@harness-engineering/cli 2.7.0 → 2.8.0

package/dist/{chunk-IY2TZLY5.js → chunk-GOHWCHCS.js}

@@ -22,8 +22,8 @@ import {
   getDefaultRegistry,
   getOutline,
   getParser,
-  init_chunk_BTUDWWB4,
   init_chunk_MUWJHO2S,
+  init_chunk_S4DTDJ6J,
   parseFile,
   parseSize,
   readFileContent,
@@ -31,7 +31,7 @@ import {
   resetParserCache,
   resolveFileToLayer,
   validateDependencies
-} from "./chunk-W3PDVZ4I.js";
+} from "./chunk-N55WOGN3.js";
 import {
   AuthAuditEntrySchema,
   AuthTokenPublicSchema,
@@ -51,6 +51,7 @@ import {
   NotificationSinkConfigSchema,
   NotificationSinkKindSchema,
   NotificationsConfigSchema,
+  OPTIONAL_STRATEGY_SECTIONS,
   OTLPKeyValueSchema,
   OTLPSpanSchema,
   Ok,
@@ -62,6 +63,7 @@ import {
   ProposalKindSchema,
   ProposalSourceSchema,
   ProposalStatusSchema,
+  REQUIRED_STRATEGY_SECTIONS,
   SESSIONS_DEFAULTS,
   SESSION_SECTION_NAMES,
   STANDARD_COGNITIVE_MODES,
@@ -77,7 +79,7 @@ import {
   init_dist,
   isErr,
   isOk
-} from "./chunk-OH3NXXUY.js";
+} from "./chunk-BDGTZRZ6.js";
 import {
   DEFAULT_SKIP_DIRS,
   GraphStore,
@@ -85,7 +87,7 @@ import {
   init_dist as init_dist2,
   queryTraceability,
   skipDirGlobs
-} from "./chunk-H2ZJOJ7A.js";
+} from "./chunk-PP6ZRL5T.js";
 import {
   ArchBaselineSchema,
   ArchConfigSchema,
@@ -1244,6 +1246,7 @@ var init_chunk_FYTJQ2ZY = __esm({
 // ../core/dist/index.mjs
 var dist_exports = {};
 __export(dist_exports, {
+  ADVERSARIAL_DESCRIPTOR: () => ADVERSARIAL_DESCRIPTOR,
   AGENT_DESCRIPTORS: () => AGENT_DESCRIPTORS,
   AGREEMENT_LINE_GAP: () => AGREEMENT_LINE_GAP,
   ALLOWED_FIELD_KEYS: () => ALLOWED_FIELD_KEYS,
@@ -1271,6 +1274,7 @@ __export(dist_exports, {
   CACHE_TTL_MS: () => CACHE_TTL_MS,
   CINotifier: () => CINotifier,
   COMPLIANCE_DESCRIPTOR: () => COMPLIANCE_DESCRIPTOR,
+  CONDITIONAL_SUBAGENT_DESCRIPTORS: () => CONDITIONAL_SUBAGENT_DESCRIPTORS,
   CORROBORATED_AGREEMENT: () => CORROBORATED_AGREEMENT,
   CacheMetricsRecorder: () => CacheMetricsRecorder,
   CategoryBaselineSchema: () => CategoryBaselineSchema,
@@ -1318,6 +1322,7 @@ __export(dist_exports, {
   Err: () => Err,
   ExclusionSet: () => ExclusionSet,
   FACTOR_WEIGHTS: () => FACTOR_WEIGHTS,
+  FRONTEND_RACES_DESCRIPTOR: () => FRONTEND_RACES_DESCRIPTOR,
   FailureEntrySchema: () => FailureEntrySchema,
   FileSink: () => FileSink,
   FindingLifecycleSchema: () => FindingLifecycleSchema,
@@ -1351,6 +1356,7 @@ __export(dist_exports, {
   NotificationSinkConfigSchema: () => NotificationSinkConfigSchema,
   NotificationSinkKindSchema: () => NotificationSinkKindSchema,
   NotificationsConfigSchema: () => NotificationsConfigSchema,
+  OPTIONAL_STRATEGY_SECTIONS: () => OPTIONAL_STRATEGY_SECTIONS,
   OTLPExporter: () => OTLPExporter,
   OTLPKeyValueSchema: () => OTLPKeyValueSchema,
   OTLPSpanSchema: () => OTLPSpanSchema,
@@ -1382,6 +1388,8 @@ __export(dist_exports, {
   PulseSourcesSchema: () => PulseSourcesSchema,
   QuestionSchema: () => QuestionSchema,
   REQUIRED_SECTIONS: () => REQUIRED_SECTIONS,
+  REQUIRED_STRATEGY_SECTIONS: () => REQUIRED_STRATEGY_SECTIONS,
+  RISK_KEYWORDS: () => RISK_KEYWORDS,
   RegressionDetector: () => RegressionDetector,
   RuleRegistry: () => RuleRegistry,
   SECURITY_DESCRIPTOR: () => SECURITY_DESCRIPTOR,
@@ -1391,6 +1399,7 @@ __export(dist_exports, {
   STANDALONE_AGREEMENT: () => STANDALONE_AGREEMENT,
   STANDARD_COGNITIVE_MODES: () => STANDARD_COGNITIVE_MODES,
   STATUS_RANK: () => STATUS_RANK,
+  SUBAGENT_ORDER: () => SUBAGENT_ORDER,
   SecurityCategorySnapshotSchema: () => SecurityCategorySnapshotSchema,
   SecurityConfigSchema: () => SecurityConfigSchema,
   SecurityDirectionSchema: () => DirectionSchema2,
@@ -1414,10 +1423,13 @@ __export(dist_exports, {
   SpecImpactEstimator: () => SpecImpactEstimator,
   SpecImpactSignalsSchema: () => SpecImpactSignalsSchema,
   StabilityForecastSchema: () => StabilityForecastSchema,
+  StrategyDocSchema: () => StrategyDocSchema,
+  StrategyFrontmatterSchema: () => StrategyFrontmatterSchema,
   StreamIndexSchema: () => StreamIndexSchema,
   StreamInfoSchema: () => StreamInfoSchema,
   StructuralStrategy: () => StructuralStrategy,
   SupplyChainSnapshotSchema: () => SupplyChainSnapshotSchema,
+  TYPESCRIPT_STRICT_DESCRIPTOR: () => TYPESCRIPT_STRICT_DESCRIPTOR,
   ThresholdConfigSchema: () => ThresholdConfigSchema,
   TimeToFixResultSchema: () => TimeToFixResultSchema,
   TimeToFixStatsSchema: () => TimeToFixStatsSchema,
@@ -1467,6 +1479,7 @@ __export(dist_exports, {
   archiveLearnings: () => archiveLearnings,
   archiveSession: () => archiveSession,
   archiveStream: () => archiveStream,
+  asStrategyDoc: () => asStrategyDoc,
   assembleCandidateReport: () => assembleCandidateReport,
   assembleReport: () => assembleReport,
   assertPortUsable: () => assertPortUsable,
@@ -1477,6 +1490,7 @@ __export(dist_exports, {
   buildSnapshot: () => buildSnapshot,
   calculateCacheSavings: () => calculateCacheSavings,
   calculateCost: () => calculateCost,
+  calibrateDepth: () => calibrateDepth,
   checkDocCoverage: () => checkDocCoverage,
   checkEligibility: () => checkEligibility,
   checkEvidenceCoverage: () => checkEvidenceCoverage,
@@ -1492,7 +1506,9 @@ __export(dist_exports, {
   clusterViolations: () => clusterViolations,
   collectEvents: () => collectEvents,
   composeInsights: () => composeInsights,
+  computeActivations: () => computeActivations,
   computeContentHash: () => computeContentHash,
+  computeDepth: () => computeDepth,
   computeHotspots: () => computeHotspots,
   computeLexicalSimilarity: () => computeLexicalSimilarity,
   computeLoadPlan: () => computeLoadPlan,
@@ -1504,6 +1520,7 @@ __export(dist_exports, {
   constraintRuleId: () => constraintRuleId,
   contextBudget: () => contextBudget,
   contextFilter: () => contextFilter,
+  countChangedLines: () => countChangedLines,
   countLearningEntries: () => countLearningEntries,
   createBoundaryValidator: () => createBoundaryValidator,
   createCommentedCodeFixes: () => createCommentedCodeFixes,
@@ -1537,6 +1554,7 @@ __export(dist_exports, {
   detectEmergentConstraints: () => detectEmergentConstraints,
   detectLanguage: () => detectLanguage,
   detectPatternViolations: () => detectPatternViolations,
+  detectRiskKeywords: () => detectRiskKeywords,
   detectSizeBudgetViolations: () => detectSizeBudgetViolations,
   detectStack: () => detectStack,
   detectStaleConstraints: () => detectStaleConstraints,
@@ -1555,6 +1573,7 @@ __export(dist_exports, {
   extractLevel: () => extractLevel,
   extractMarkdownLinks: () => extractMarkdownLinks,
   extractSections: () => extractSections,
+  fanOutConditionalSubagents: () => fanOutConditionalSubagents,
   fanOutReview: () => fanOutReview,
   findParallelGroups: () => findParallelGroups,
   formatCIReportAsMarkdown: () => formatCIReportAsMarkdown,
@@ -1647,6 +1666,7 @@ __export(dist_exports, {
   parseSections: () => parseSections,
   parseSecurityConfig: () => parseSecurityConfig,
   parseSize: () => parseSize,
+  parseStrategyDoc: () => parseStrategyDoc,
   pathTraversalRules: () => pathTraversalRules,
   previewFix: () => previewFix,
   projectValue: () => projectValue,
@@ -1679,12 +1699,14 @@ __export(dist_exports, {
   resolveStability: () => resolveStability,
   resolveStreamPath: () => resolveStreamPath,
   resolveThresholds: () => resolveThresholds,
+  runAdversarialAgent: () => runAdversarialAgent,
   runAgentConfigFallbackRules: () => runFallbackRules,
   runAll: () => runAll,
   runArchitectureAgent: () => runArchitectureAgent,
   runBugDetectionAgent: () => runBugDetectionAgent,
   runCIChecks: () => runCIChecks,
   runComplianceAgent: () => runComplianceAgent,
+  runFrontendRacesAgent: () => runFrontendRacesAgent,
   runMechanicalChecks: () => runMechanicalChecks,
   runMechanicalGate: () => runMechanicalGate,
   runMultiTurnPipeline: () => runMultiTurnPipeline,
@@ -1692,6 +1714,7 @@ __export(dist_exports, {
   runPulse: () => runPulse,
   runReviewPipeline: () => runReviewPipeline,
   runSecurityAgent: () => runSecurityAgent,
+  runTypescriptStrictAgent: () => runTypescriptStrictAgent,
   saveHandoff: () => saveHandoff,
   saveState: () => saveState,
   saveStreamIndex: () => saveStreamIndex,
@@ -1707,6 +1730,7 @@ __export(dist_exports, {
   send: () => send,
   serializeEnvelope: () => serializeEnvelope,
   serializeRoadmap: () => serializeRoadmap,
+  serializeStrategyDoc: () => serializeStrategyDoc,
   setActiveStream: () => setActiveStream,
   sharpEdgesRules: () => sharpEdgesRules,
   shouldRunCheck: () => shouldRunCheck,
@@ -1741,6 +1765,7 @@ __export(dist_exports, {
   validatePulseConfig: () => validatePulseConfig,
   validateRoadmapMode: () => validateRoadmapMode,
   validateSolutionsDir: () => validateSolutionsDir,
+  validateStrategy: () => validateStrategy,
   violationId: () => violationId,
   weeksUntilThreshold: () => weeksUntilThreshold,
   weightedLinearRegression: () => weightedLinearRegression,
@@ -1748,6 +1773,7 @@ __export(dist_exports, {
   writeLockfile: () => writeLockfile,
   writePulseConfig: () => writePulseConfig,
   writeSessionSummary: () => writeSessionSummary,
+  writeStrategyDoc: () => writeStrategyDoc,
   writeTaint: () => writeTaint,
   xssRules: () => xssRules
 });
@@ -1758,84 +1784,86 @@ import * as fs2 from "fs/promises";
 import * as path2 from "path";
 import matter from "gray-matter";
 import { z as z2 } from "zod";
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+import matter2 from "gray-matter";
+import { z as z3 } from "zod";
 import { spawn } from "child_process";
 import { existsSync as existsSync2 } from "fs";
-import { join as join32, isAbsolute } from "path";
+import { join as join42, isAbsolute } from "path";
 import { existsSync as existsSync22 } from "fs";
-import { join as join42 } from "path";
+import { join as join52 } from "path";
 import { readFileSync as readFileSync2, statSync } from "fs";
 import { glob } from "glob";
 import { existsSync as existsSync3 } from "fs";
-import { isAbsolute as isAbsolute2, resolve as resolve2, join as join52 } from "path";
+import { isAbsolute as isAbsolute2, resolve as resolve2, join as join62 } from "path";
 import { glob as glob2 } from "glob";
 import { existsSync as existsSync4 } from "fs";
-import { basename, dirname as dirname3, join as join6 } from "path";
+import { basename, dirname as dirname3, join as join7 } from "path";
 import { existsSync as existsSync5 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import { existsSync as existsSync6 } from "fs";
-import { join as join9 } from "path";
-import { join as join8, dirname as dirname22 } from "path";
+import { join as join10 } from "path";
+import { join as join9, dirname as dirname22 } from "path";
 import { glob as glob3 } from "glob";
 import { existsSync as existsSync7 } from "fs";
 import { dirname as dirname32, resolve as resolve22, isAbsolute as isAbsolute3 } from "path";
 import { existsSync as existsSync8 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { glob as glob4 } from "glob";
 import { existsSync as existsSync9 } from "fs";
-import { join as join11 } from "path";
-import { existsSync as existsSync10 } from "fs";
 import { join as join12 } from "path";
-import * as fs3 from "fs";
-import * as path3 from "path";
+import { existsSync as existsSync10 } from "fs";
+import { join as join13 } from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 import { minimatch } from "minimatch";
 import { minimatch as minimatch2 } from "minimatch";
 import { basename as basename2 } from "path";
-import { join as join14, basename as basename3 } from "path";
+import { join as join15, basename as basename3 } from "path";
 import { basename as basename4, dirname as dirname4 } from "path";
-import { z as z3 } from "zod";
-import * as fs4 from "fs/promises";
-import * as fs5 from "fs/promises";
-import * as fs6 from "fs";
-import { promisify } from "util";
-import { dirname as dirname5, basename as basename5, join as join15 } from "path";
 import { z as z4 } from "zod";
+import * as fs5 from "fs/promises";
+import * as fs6 from "fs/promises";
 import * as fs7 from "fs";
-import * as path4 from "path";
-import { readFileSync as readFileSync32, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync13 } from "fs";
-import { join as join17, dirname as dirname6 } from "path";
-import { execFileSync } from "child_process";
+import { promisify } from "util";
+import { dirname as dirname5, basename as basename5, join as join16 } from "path";
+import { z as z5 } from "zod";
 import * as fs8 from "fs";
 import * as path5 from "path";
-import { appendFileSync, writeFileSync as writeFileSync22, existsSync as existsSync14, mkdirSync as mkdirSync22 } from "fs";
-import { dirname as dirname7 } from "path";
-import { z as z5 } from "zod";
+import { readFileSync as readFileSync32, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync13 } from "fs";
+import { join as join18, dirname as dirname6 } from "path";
+import { execFileSync } from "child_process";
 import * as fs9 from "fs";
 import * as path6 from "path";
+import { appendFileSync, writeFileSync as writeFileSync22, existsSync as existsSync14, mkdirSync as mkdirSync22 } from "fs";
+import { dirname as dirname7 } from "path";
+import { z as z6 } from "zod";
 import * as fs10 from "fs";
 import * as path7 from "path";
 import * as fs11 from "fs";
 import * as path8 from "path";
-import { z as z6 } from "zod";
-import * as fs15 from "fs";
-import * as path12 from "path";
-import * as fs14 from "fs";
-import * as path11 from "path";
 import * as fs12 from "fs";
 import * as path9 from "path";
-import { execSync } from "child_process";
 import { z as z7 } from "zod";
-import * as fs13 from "fs";
-import * as path10 from "path";
 import * as fs16 from "fs";
 import * as path13 from "path";
-import * as crypto2 from "crypto";
+import * as fs15 from "fs";
+import * as path12 from "path";
+import * as fs13 from "fs";
+import * as path10 from "path";
+import { execSync } from "child_process";
+import { z as z8 } from "zod";
+import * as fs14 from "fs";
+import * as path11 from "path";
 import * as fs17 from "fs";
 import * as path14 from "path";
+import * as crypto2 from "crypto";
 import * as fs18 from "fs";
 import * as path15 from "path";
-import * as crypto3 from "crypto";
 import * as fs19 from "fs";
 import * as path16 from "path";
+import * as crypto3 from "crypto";
 import * as fs20 from "fs";
 import * as path17 from "path";
 import * as fs21 from "fs";
@@ -1844,90 +1872,94 @@ import * as fs22 from "fs";
 import * as path19 from "path";
 import * as fs23 from "fs";
 import * as path20 from "path";
-import { execSync as execSync2 } from "child_process";
 import * as fs24 from "fs";
 import * as path21 from "path";
+import { execSync as execSync2 } from "child_process";
 import * as fs25 from "fs";
 import * as path22 from "path";
 import * as fs26 from "fs";
 import * as path23 from "path";
 import * as fs27 from "fs";
 import * as path24 from "path";
-import { z as z8 } from "zod";
-import * as fs29 from "fs/promises";
-import { minimatch as minimatch3 } from "minimatch";
-import { z as z9 } from "zod";
 import * as fs28 from "fs";
 import * as path25 from "path";
-import * as fs30 from "fs";
+import { z as z9 } from "zod";
+import * as fs30 from "fs/promises";
+import { minimatch as minimatch3 } from "minimatch";
+import { z as z10 } from "zod";
+import * as fs29 from "fs";
 import * as path26 from "path";
+import * as fs31 from "fs";
+import * as path27 from "path";
 import { readFileSync as readFileSync22, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2, mkdirSync as mkdirSync13, readdirSync as readdirSync3 } from "fs";
-import { join as join382, dirname as dirname10 } from "path";
+import { join as join39, dirname as dirname10 } from "path";
 import { createHash as createHash32 } from "crypto";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync15, renameSync as renameSync72, mkdirSync as mkdirSync14, existsSync as existsSync342 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { isAbsolute as isAbsolute4, join as join39, relative as relative3, dirname as dirname11 } from "path";
-import * as path27 from "path";
+import { isAbsolute as isAbsolute4, join as join40, relative as relative3, dirname as dirname11 } from "path";
 import * as path28 from "path";
 import * as path29 from "path";
 import * as path30 from "path";
-import * as fs31 from "fs";
 import * as path31 from "path";
 import * as fs32 from "fs";
 import * as path32 from "path";
 import * as fs33 from "fs";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-import * as fs34 from "fs";
 import * as path33 from "path";
+import * as fs34 from "fs";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import * as fs35 from "fs";
 import * as path34 from "path";
-import { createHash as createHash4 } from "crypto";
+import * as fs36 from "fs";
 import * as path35 from "path";
-import { z as z11 } from "zod";
-import * as fs36 from "fs/promises";
+import { createHash as createHash4 } from "crypto";
 import * as path36 from "path";
+import { z as z12 } from "zod";
 import * as fs37 from "fs/promises";
 import * as path37 from "path";
-import * as ejs from "ejs";
-import * as fs38 from "fs";
+import * as fs38 from "fs/promises";
 import * as path38 from "path";
+import * as ejs from "ejs";
+import * as fs39 from "fs";
+import * as path39 from "path";
 import * as os from "os";
 import { spawn as spawn2 } from "child_process";
-import * as fs39 from "fs/promises";
-import * as path39 from "path";
-import * as fs40 from "fs";
+import * as fs40 from "fs/promises";
 import * as path40 from "path";
 import * as fs41 from "fs";
 import * as path41 from "path";
-import * as os2 from "os";
 import * as fs42 from "fs";
 import * as path42 from "path";
+import * as os2 from "os";
 import * as fs43 from "fs";
 import * as path43 from "path";
-import * as fs45 from "fs";
-import * as path45 from "path";
-import { execFileSync as execFileSync2 } from "child_process";
 import * as fs44 from "fs";
 import * as path44 from "path";
-import * as crypto4 from "crypto";
 import * as fs46 from "fs";
 import * as path46 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+import * as fs45 from "fs";
+import * as path45 from "path";
+import * as crypto4 from "crypto";
 import * as fs47 from "fs";
-import * as fs48 from "fs";
 import * as path47 from "path";
+import * as fs48 from "fs";
+import * as fs49 from "fs";
+import * as path48 from "path";
 import { readFileSync as readFileSync392 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname16, join as join612 } from "path";
+import { dirname as dirname16, join as join622 } from "path";
 import { execFile } from "child_process";
 import { promisify as promisify2 } from "util";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify3 } from "util";
-import * as fs49 from "fs/promises";
-import * as path48 from "path";
-import * as fs50 from "fs";
+import * as fs50 from "fs/promises";
 import * as path49 from "path";
+import * as fs51 from "fs";
+import * as path50 from "path";
+import * as fs52 from "fs";
+import * as path51 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function isBadPort(port) {
   return BAD_PORT_SET.has(port);
@@ -1974,15 +2006,15 @@ function validateConfig(data, schema) {
   let message = "Configuration validation failed";
   const suggestions = [];
   if (firstError) {
-    const path50 = firstError.path.join(".");
-    const pathDisplay = path50 ? ` at "${path50}"` : "";
+    const path52 = firstError.path.join(".");
+    const pathDisplay = path52 ? ` at "${path52}"` : "";
     if (firstError.code === "invalid_type") {
       const received = firstError.received;
       const expected = firstError.expected;
       if (received === "undefined") {
         code = "MISSING_FIELD";
         message = `Missing required field${pathDisplay}: ${firstError.message}`;
-        suggestions.push(`Field "${path50}" is required and must be of type "${expected}"`);
+        suggestions.push(`Field "${path52}" is required and must be of type "${expected}"`);
       } else {
         code = "INVALID_TYPE";
         message = `Invalid type${pathDisplay}: ${firstError.message}`;
@@ -2118,23 +2150,127 @@ async function validatePulseConfig(cwd) {
   if (!result.ok) return Err(result.error);
   return Ok({ present: true, valid: true });
 }
+function coerceFrontmatter(raw) {
+  if (raw === null || typeof raw !== "object") return raw;
+  const out = { ...raw };
+  const lu = out.last_updated;
+  if (lu instanceof Date && !Number.isNaN(lu.getTime())) {
+    const iso = lu.toISOString();
+    out.last_updated = iso.slice(0, 10);
+  }
+  return out;
+}
+function findH2Matches(body) {
+  const h2Re = /^##[ \t]+(.+?)[ \t]*$/gm;
+  const matches = [];
+  let m;
+  while ((m = h2Re.exec(body)) !== null) {
+    matches.push({
+      name: (m[1] ?? "").trim(),
+      headingStart: m.index,
+      bodyStart: m.index + m[0].length
+    });
+  }
+  return matches;
+}
+function accumulateSection(acc, name, body) {
+  if (KNOWN_SECTION_NAMES.has(name)) {
+    acc.sections.push({ name, body });
+  } else {
+    acc.unknownSectionNames.push(name);
+  }
+}
+function buildSections(body, matches) {
+  const acc = { sections: [], unknownSectionNames: [] };
+  for (let i = 0; i < matches.length; i++) {
+    const current = matches[i];
+    if (current === void 0) continue;
+    const sliceEnd = matches[i + 1]?.headingStart ?? body.length;
+    const sectionBody = body.slice(current.bodyStart, sliceEnd).trim();
+    accumulateSection(acc, current.name, sectionBody);
+  }
+  return acc;
+}
+function parseStrategyDoc(raw) {
+  const parsed = matter(raw);
+  const body = parsed.content;
+  const frontmatter = coerceFrontmatter(parsed.data);
+  const matches = findH2Matches(body);
+  const { sections, unknownSectionNames } = buildSections(body, matches);
+  return { frontmatter, sections, unknownSectionNames };
+}
+function asStrategyDoc(parsed) {
+  const fm = parsed.frontmatter;
+  if (fm === null || typeof fm !== "object" || typeof fm.name !== "string" || typeof fm.last_updated !== "string" || typeof fm.version !== "number") {
+    return null;
+  }
+  return {
+    frontmatter: {
+      name: fm.name,
+      last_updated: fm.last_updated,
+      version: fm.version
+    },
+    sections: parsed.sections
+  };
+}
+function nonBlankLines(body) {
+  return body.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+function bodyContentIssue(body) {
+  const lines = nonBlankLines(body);
+  if (lines.length === 0) {
+    return "section is empty";
+  }
+  for (const line of lines) {
+    if (PLACEHOLDER_INLINE.test(line)) {
+      return `unfilled template placeholder detected (${line})`;
+    }
+  }
+  return null;
+}
+async function validateStrategy(cwd) {
+  const strategyPath = path2.join(cwd, "STRATEGY.md");
+  let raw;
+  try {
+    raw = await fs2.readFile(strategyPath, "utf-8");
+  } catch {
+    return Ok({ present: false, valid: true });
+  }
+  const parsed = parseStrategyDoc(raw);
+  const doc = asStrategyDoc(parsed);
+  if (doc === null) {
+    return Err(
+      createError(
+        "VALIDATION_FAILED",
+        "STRATEGY.md frontmatter is missing required fields (name, last_updated, version)",
+        {},
+        [
+          "Add YAML frontmatter at the top of STRATEGY.md with name (string), last_updated (YYYY-MM-DD), and version (positive integer)"
+        ]
+      )
+    );
+  }
+  const result = validateConfig(doc, StrategyDocSchema);
+  if (!result.ok) return Err(result.error);
+  return Ok({ present: true, valid: true });
+}
 async function* walk(dir) {
   let entries;
   try {
-    entries = await fs2.readdir(dir, { withFileTypes: true });
+    entries = await fs3.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const e of entries) {
-    const p = path2.join(dir, e.name);
+    const p = path3.join(dir, e.name);
     if (e.isDirectory()) yield* walk(p);
     else if (e.isFile() && e.name.endsWith(".md")) yield p;
   }
 }
 async function validateSolutionsDir(cwd) {
-  const root = path2.join(cwd, "docs", "solutions");
+  const root = path3.join(cwd, "docs", "solutions");
   try {
-    await fs2.stat(root);
+    await fs3.stat(root);
   } catch {
     return Ok({ filesChecked: 0, issues: [] });
   }
@@ -2142,15 +2278,15 @@ async function validateSolutionsDir(cwd) {
   let count = 0;
   for (const [track, categories] of TRACK_CATEGORIES) {
     for (const category of categories) {
-      const categoryDir = path2.join(root, track, category);
+      const categoryDir = path3.join(root, track, category);
       for await (const file of walk(categoryDir)) {
         count++;
-        const raw = await fs2.readFile(file, "utf-8");
-        const parsed = matter(raw);
+        const raw = await fs3.readFile(file, "utf-8");
+        const parsed = matter2(raw);
         const result = validateConfig(parsed.data, SolutionDocFrontmatterSchema);
         if (!result.ok)
           issues.push({
-            file: path2.relative(cwd, file).replaceAll("\\", "/"),
+            file: path3.relative(cwd, file).replaceAll("\\", "/"),
             message: result.error.message
           });
       }
@@ -2188,7 +2324,7 @@ function lookupOnPath() {
 function firstExistingIn(dir, candidates) {
   if (!dir) return null;
   for (const name of candidates) {
-    const candidate = isAbsolute(dir) ? join32(dir, name) : join32(process.cwd(), dir, name);
+    const candidate = isAbsolute(dir) ? join42(dir, name) : join42(process.cwd(), dir, name);
     if (existsSync2(candidate)) return candidate;
   }
   return null;
@@ -2265,7 +2401,7 @@ function extractDiagnostics(parsed) {
 }
 function normalizeDiagnostic(diag, cwd) {
   const finding = {
-    file: normalizeFilePath(readFile32(diag), cwd),
+    file: normalizeFilePath(readFile42(diag), cwd),
     ruleId: readRuleId(diag),
     severity: normalizeSeverity(readSeverity(diag)),
     message: diag.message ?? "agnix diagnostic"
@@ -2273,7 +2409,7 @@ function normalizeDiagnostic(diag, cwd) {
   attachOptionalFields(finding, diag);
   return finding;
 }
-function readFile32(diag) {
+function readFile42(diag) {
   return diag.file ?? diag.path ?? "";
 }
 function readRuleId(diag) {
@@ -2316,16 +2452,16 @@ function makeFinding(input) {
   if (input.suggestion) finding.suggestion = input.suggestion;
   return finding;
 }
-function readTextSafe(path50) {
+function readTextSafe(path52) {
   try {
-    return readFileSync2(path50, "utf-8");
+    return readFileSync2(path52, "utf-8");
   } catch {
     return null;
   }
 }
-function safeFileSize(path50) {
+function safeFileSize(path52) {
   try {
-    return statSync(path50).size;
+    return statSync(path52).size;
   } catch {
     return null;
   }
@@ -2362,7 +2498,7 @@ function stripQuotes(value) {
 function runClaudeMdRules(cwd) {
   const findings = [];
   for (const name of CONTEXT_FILES) {
-    const abs = join42(cwd, name);
+    const abs = join52(cwd, name);
     if (!existsSync22(abs)) continue;
     findings.push(...inspectContextFile(abs, name));
   }
@@ -2509,7 +2645,7 @@ function appendDescriptionFindings(out, rel, description) {
 function runHookRules(cwd) {
   const findings = [];
   for (const rel of SETTINGS_PATHS) {
-    const abs = join52(cwd, rel);
+    const abs = join62(cwd, rel);
     if (!existsSync3(abs)) continue;
     const content = readTextSafe(abs);
     if (content === null) continue;
@@ -2625,7 +2761,7 @@ async function runSkillRules(cwd) {
   for (const abs of skillFiles) {
     const rel = relPath(cwd, abs);
     const dirName = basename(dirname3(abs));
-    const siblingYaml = join6(dirname3(abs), "skill.yaml");
+    const siblingYaml = join7(dirname3(abs), "skill.yaml");
     if (existsSync4(siblingYaml)) {
       const yamlFields = parseFrontmatterFields(readTextSafe(siblingYaml) ?? "");
       findings.push(...checkSkillMetadata(relPath(cwd, siblingYaml), dirName, yamlFields));
@@ -2731,7 +2867,7 @@ function runMcpRules(cwd) {
   return findings;
 }
 function loadMcpServers(cwd, rel) {
-  const abs = join7(cwd, rel);
+  const abs = join8(cwd, rel);
   if (!existsSync5(abs)) return null;
   const content = readTextSafe(abs);
   if (content === null) return null;
@@ -2870,27 +3006,27 @@ function extractSections(content) {
   }
   return sections.map((section) => buildAgentMapSection(section, lines));
 }
-function isExternalLink(path50) {
-  return path50.startsWith("http://") || path50.startsWith("https://") || path50.startsWith("#") || path50.startsWith("mailto:");
+function isExternalLink(path52) {
+  return path52.startsWith("http://") || path52.startsWith("https://") || path52.startsWith("#") || path52.startsWith("mailto:");
 }
 function resolveLinkPath(linkPath, baseDir) {
-  return linkPath.startsWith(".") ? join8(baseDir, linkPath) : linkPath;
+  return linkPath.startsWith(".") ? join9(baseDir, linkPath) : linkPath;
 }
-async function validateAgentsMap(path50 = "./AGENTS.md") {
-  const contentResult = await readFileContent(path50);
+async function validateAgentsMap(path52 = "./AGENTS.md") {
+  const contentResult = await readFileContent(path52);
   if (!contentResult.ok) {
     return Err(
       createError(
         "PARSE_ERROR",
         `Failed to read AGENTS.md: ${contentResult.error.message}`,
-        { path: path50 },
+        { path: path52 },
         ["Ensure the file exists", "Check file permissions"]
       )
     );
   }
   const content = contentResult.value;
   const sections = extractSections(content);
-  const baseDir = dirname22(path50);
+  const baseDir = dirname22(path52);
   const sectionTitles = sections.map((s) => s.title);
   const missingSections = REQUIRED_SECTIONS.filter(
     (required) => !sectionTitles.some((title) => title.toLowerCase().includes(required.toLowerCase()))
@@ -2929,7 +3065,7 @@ async function validateAgentsMap(path50 = "./AGENTS.md") {
   });
 }
 async function runAgentsMdRules(cwd) {
-  const abs = join9(cwd, "AGENTS.md");
+  const abs = join10(cwd, "AGENTS.md");
   if (!existsSync6(abs)) return [];
   const result = await validateAgentsMap(abs);
   if (result.ok) return [];
@@ -2986,7 +3122,7 @@ function extractLinkTargets(content) {
 function runSettingsJsonRules(cwd) {
   const findings = [];
   for (const rel of SETTINGS_FILES) {
-    const abs = join10(cwd, rel);
+    const abs = join11(cwd, rel);
     if (!existsSync8(abs)) continue;
     const content = readTextSafe(abs);
     if (content === null) continue;
@@ -3062,15 +3198,15 @@ function stripQuotes2(value) {
   return value;
 }
 function skillExists(cwd, slug) {
-  if (existsSync9(join11(cwd, "agents", "skills", slug, "SKILL.md"))) return true;
+  if (existsSync9(join12(cwd, "agents", "skills", slug, "SKILL.md"))) return true;
   for (const platform of ["claude-code", "gemini-cli", "codex", "cursor", "shared"]) {
-    if (existsSync9(join11(cwd, "agents", "skills", platform, slug, "SKILL.md"))) return true;
+    if (existsSync9(join12(cwd, "agents", "skills", platform, slug, "SKILL.md"))) return true;
   }
   return false;
 }
 function runAgnixTomlRules(cwd) {
   const rel = ".agnix.toml";
-  const abs = join12(cwd, rel);
+  const abs = join13(cwd, rel);
   if (!existsSync10(abs)) return [];
   const content = readTextSafe(abs);
   if (content === null) return [];
@@ -3240,7 +3376,7 @@ function getRoadmapMode(config) {
   return mode === "file-less" ? "file-less" : "file-backed";
 }
 function validateRoadmapMode(config, projectRoot) {
-  const root = path3.resolve(projectRoot);
+  const root = path4.resolve(projectRoot);
   const mode = getRoadmapMode(config);
   if (mode === "file-backed") return Ok(void 0);
   const tracker = config.roadmap?.tracker;
@@ -3257,8 +3393,8 @@ function validateRoadmapMode(config, projectRoot) {
       )
     );
   }
-  const roadmapPath = path3.join(root, "docs", "roadmap.md");
-  if (fs3.existsSync(roadmapPath)) {
+  const roadmapPath = path4.join(root, "docs", "roadmap.md");
+  if (fs4.existsSync(roadmapPath)) {
     return Err(
       createError(
         "ROADMAP_MODE_FILE_PRESENT",
@@ -3441,8 +3577,8 @@ async function checkDocCoverage(domain, options = {}) {
     );
   }
 }
-function suggestFix(path50, existingFiles) {
-  const targetName = basename3(path50).toLowerCase();
+function suggestFix(path52, existingFiles) {
+  const targetName = basename3(path52).toLowerCase();
   const similar = existingFiles.find((file) => {
     const fileName = basename3(file).toLowerCase();
     return fileName.includes(targetName) || targetName.includes(fileName);
@@ -3450,10 +3586,10 @@ function suggestFix(path50, existingFiles) {
   if (similar) {
     return `Did you mean "${similar}"?`;
   }
-  return `Create the file "${path50}" or remove the link`;
+  return `Create the file "${path52}" or remove the link`;
 }
 async function validateKnowledgeMap(rootDir = process.cwd()) {
-  const agentsPath = join14(rootDir, "AGENTS.md");
+  const agentsPath = join15(rootDir, "AGENTS.md");
   const agentsResult = await validateAgentsMap(agentsPath);
   if (!agentsResult.ok) {
     return Err(agentsResult.error);
@@ -3808,8 +3944,8 @@ function createBoundaryValidator(schema, name) {
         return Ok(result.data);
       }
       const suggestions = result.error.issues.map((issue) => {
-        const path50 = issue.path.join(".");
-        return path50 ? `${path50}: ${issue.message}` : issue.message;
+        const path52 = issue.path.join(".");
+        return path52 ? `${path52}: ${issue.message}` : issue.message;
       });
       return Err(
         createError(
@@ -3855,7 +3991,7 @@ function validateBoundaries(boundaries, data) {
 async function writeConfig(filePath, content) {
   try {
     const json = JSON.stringify(content, null, 2) + "\n";
-    await fs4.writeFile(filePath, json, "utf-8");
+    await fs5.writeFile(filePath, json, "utf-8");
     return Ok(void 0);
   } catch (error) {
     return Err(error instanceof Error ? error : new Error(String(error)));
@@ -4129,7 +4265,7 @@ function deepMergeConstraints(localConfig, bundleConstraints, _existingContribut
 async function readLockfile(lockfilePath) {
   let raw;
   try {
-    raw = await fs5.readFile(lockfilePath, "utf-8");
+    raw = await fs6.readFile(lockfilePath, "utf-8");
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT") {
       return { ok: true, value: null };
@@ -4507,7 +4643,7 @@ function previewFix(fix) {
   }
 }
 async function createBackup(filePath, backupDir) {
-  const backupPath = join15(backupDir, `${Date.now()}-${basename5(filePath)}`);
+  const backupPath = join16(backupDir, `${Date.now()}-${basename5(filePath)}`);
   try {
     await mkdir22(dirname5(backupPath), { recursive: true });
     await copyFile2(filePath, backupPath);
@@ -4533,7 +4669,7 @@ async function applyDeleteFile(fix, config) {
 }
 async function applyDeleteLines(fix) {
   if (fix.line !== void 0) {
-    const content = await readFile62(fix.file, "utf-8");
+    const content = await readFile72(fix.file, "utf-8");
     const lines = content.split("\n");
     lines.splice(fix.line - 1, 1);
     await writeFile32(fix.file, lines.join("\n"));
@@ -4541,13 +4677,13 @@ async function applyDeleteLines(fix) {
 }
 async function applyReplace(fix) {
   if (fix.oldContent && fix.newContent !== void 0) {
-    const content = await readFile62(fix.file, "utf-8");
+    const content = await readFile72(fix.file, "utf-8");
     await writeFile32(fix.file, content.replace(fix.oldContent, fix.newContent));
   }
 }
 async function applyInsert(fix) {
   if (fix.line !== void 0 && fix.newContent) {
-    const content = await readFile62(fix.file, "utf-8");
+    const content = await readFile72(fix.file, "utf-8");
     const lines = content.split("\n");
     lines.splice(fix.line - 1, 0, fix.newContent);
     await writeFile32(fix.file, lines.join("\n"));
@@ -4814,7 +4950,7 @@ function arrayLen(arr) {
   return Array.isArray(arr) ? arr.length : 0;
 }
 async function gatherEntropyBlock(projectPath) {
-  const { EntropyAnalyzer: EntropyAnalyzer2 } = await import("./analyzer-VY6DJVOU-WYKV3TTW.js");
+  const { EntropyAnalyzer: EntropyAnalyzer2 } = await import("./analyzer-V633GUHY-MBCQWKDU.js");
   const analyzer = new EntropyAnalyzer2({
     rootDir: projectPath,
     include: ["src/**/*.ts", "src/**/*.tsx", "packages/*/src/**/*.ts"],
@@ -4851,18 +4987,18 @@ function collectTopAffectedLabels(affected) {
   return out;
 }
 async function gatherAttentionBlock(projectPath) {
-  const sessionsDir = path4.join(projectPath, ".harness", "sessions");
-  if (!fs7.existsSync(sessionsDir)) return { activeThreadCount: 0, staleThreadCount: 0 };
+  const sessionsDir = path5.join(projectPath, ".harness", "sessions");
+  if (!fs8.existsSync(sessionsDir)) return { activeThreadCount: 0, staleThreadCount: 0 };
   const now = Date.now();
   const STALE_MS = 7 * 24 * 60 * 60 * 1e3;
   let active = 0;
   let stale = 0;
-  const entries = fs7.readdirSync(sessionsDir, { withFileTypes: true });
+  const entries = fs8.readdirSync(sessionsDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dirPath = path4.join(sessionsDir, entry.name);
+    const dirPath = path5.join(sessionsDir, entry.name);
     try {
-      const stat2 = fs7.statSync(dirPath);
+      const stat2 = fs8.statSync(dirPath);
       if (now - stat2.mtimeMs > STALE_MS) {
         stale++;
       } else {
@@ -4874,10 +5010,10 @@ async function gatherAttentionBlock(projectPath) {
   return { activeThreadCount: active, staleThreadCount: stale };
 }
 async function gatherImpactBlock(projectPath) {
-  const cachePath = path4.join(projectPath, ".harness", "cache", "impact.json");
-  if (!fs7.existsSync(cachePath)) return { recentBlastRadius: [] };
+  const cachePath = path5.join(projectPath, ".harness", "cache", "impact.json");
+  if (!fs8.existsSync(cachePath)) return { recentBlastRadius: [] };
   try {
-    const raw = JSON.parse(fs7.readFileSync(cachePath, "utf8"));
+    const raw = JSON.parse(fs8.readFileSync(cachePath, "utf8"));
     const radii = raw.blastRadius ?? [];
     return {
       recentBlastRadius: radii.slice(0, 5).map((r) => ({
@@ -4927,9 +5063,9 @@ async function composeInsights(projectPath, opts = {}) {
 }
 function pickProjectName(projectPath) {
   try {
-    const pkgPath = path4.join(projectPath, "package.json");
-    if (!fs7.existsSync(pkgPath)) return void 0;
-    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path5.join(projectPath, "package.json");
+    if (!fs8.existsSync(pkgPath)) return void 0;
+    const pkg = JSON.parse(fs8.readFileSync(pkgPath, "utf8"));
     return pkg.name;
   } catch {
     return void 0;
@@ -5015,12 +5151,12 @@ function parseDiffHeader(part) {
   return headerMatch[2];
 }
 function parseDiffPart(part) {
-  const path50 = parseDiffHeader(part);
-  if (!path50) return null;
+  const path52 = parseDiffHeader(part);
+  if (!path52) return null;
   const additionRegex = /^\+(?!\+\+)/gm;
   const deletionRegex = /^-(?!--)/gm;
   return {
-    path: path50,
+    path: path52,
     status: detectFileStatus(part),
     additions: (part.match(additionRegex) || []).length,
     deletions: (part.match(deletionRegex) || []).length
@@ -5805,10 +5941,10 @@ function detectEmergentConstraints(history, options) {
   return { suggestions, totalViolationsAnalyzed, windowWeeks, minOccurrences };
 }
 function streamsDir(projectPath) {
-  return path9.join(projectPath, HARNESS_DIR, STREAMS_DIR);
+  return path10.join(projectPath, HARNESS_DIR, STREAMS_DIR);
 }
 function indexPath(projectPath) {
-  return path9.join(streamsDir(projectPath), INDEX_FILE);
+  return path10.join(streamsDir(projectPath), INDEX_FILE);
 }
 function validateStreamName(name) {
   if (!STREAM_NAME_REGEX.test(name)) {
@@ -5822,11 +5958,11 @@ function validateStreamName(name) {
 }
 async function loadStreamIndex(projectPath) {
   const idxPath = indexPath(projectPath);
-  if (!fs12.existsSync(idxPath)) {
+  if (!fs13.existsSync(idxPath)) {
     return Ok({ ...DEFAULT_STREAM_INDEX, streams: {} });
   }
   try {
-    const raw = fs12.readFileSync(idxPath, "utf-8");
+    const raw = fs13.readFileSync(idxPath, "utf-8");
     const parsed = JSON.parse(raw);
     const result = StreamIndexSchema.safeParse(parsed);
     if (!result.success) {
@@ -5844,8 +5980,8 @@ async function loadStreamIndex(projectPath) {
 async function saveStreamIndex(projectPath, index) {
   const dir = streamsDir(projectPath);
   try {
-    fs12.mkdirSync(dir, { recursive: true });
-    fs12.writeFileSync(indexPath(projectPath), JSON.stringify(index, null, 2));
+    fs13.mkdirSync(dir, { recursive: true });
+    fs13.writeFileSync(indexPath(projectPath), JSON.stringify(index, null, 2));
     return Ok(void 0);
   } catch (error) {
     return Err(
@@ -5884,18 +6020,18 @@ async function resolveStreamPath(projectPath, options) {
         )
       );
     }
-    return Ok(path9.join(streamsDir(projectPath), options.stream));
+    return Ok(path10.join(streamsDir(projectPath), options.stream));
   }
   const branch = getCurrentBranch(projectPath);
   if (branch && branch !== "main" && branch !== "master") {
     for (const [name, info] of Object.entries(index.streams)) {
       if (info.branch === branch) {
-        return Ok(path9.join(streamsDir(projectPath), name));
+        return Ok(path10.join(streamsDir(projectPath), name));
       }
     }
   }
   if (index.activeStream && index.streams[index.activeStream]) {
-    return Ok(path9.join(streamsDir(projectPath), index.activeStream));
+    return Ok(path10.join(streamsDir(projectPath), index.activeStream));
   }
   return Err(
     new Error(
@@ -5923,9 +6059,9 @@ async function createStream(projectPath, name, branch) {
   if (index.streams[name]) {
     return Err(new Error(`Stream '${name}' already exists`));
   }
-  const streamPath = path9.join(streamsDir(projectPath), name);
+  const streamPath = path10.join(streamsDir(projectPath), name);
   try {
-    fs12.mkdirSync(streamPath, { recursive: true });
+    fs13.mkdirSync(streamPath, { recursive: true });
   } catch (error) {
     return Err(
       new Error(
@@ -5966,12 +6102,12 @@ async function archiveStream(projectPath, name) {
   if (!index.streams[name]) {
     return Err(new Error(`Stream '${name}' not found`));
   }
-  const streamPath = path9.join(streamsDir(projectPath), name);
-  const archiveDir = path9.join(projectPath, HARNESS_DIR, "archive", "streams");
+  const streamPath = path10.join(streamsDir(projectPath), name);
+  const archiveDir = path10.join(projectPath, HARNESS_DIR, "archive", "streams");
   try {
-    fs12.mkdirSync(archiveDir, { recursive: true });
+    fs13.mkdirSync(archiveDir, { recursive: true });
     const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-    fs12.renameSync(streamPath, path9.join(archiveDir, `${name}-${date}`));
+    fs13.renameSync(streamPath, path10.join(archiveDir, `${name}-${date}`));
   } catch (error) {
     return Err(
       new Error(
@@ -5992,19 +6128,19 @@ function getStreamForBranch(index, branch) {
   return null;
 }
 async function migrateToStreams(projectPath) {
-  const harnessDir = path9.join(projectPath, HARNESS_DIR);
-  if (fs12.existsSync(indexPath(projectPath))) {
+  const harnessDir = path10.join(projectPath, HARNESS_DIR);
+  if (fs13.existsSync(indexPath(projectPath))) {
     return Ok(void 0);
   }
-  const filesToMove = STATE_FILES.filter((f) => fs12.existsSync(path9.join(harnessDir, f)));
+  const filesToMove = STATE_FILES.filter((f) => fs13.existsSync(path10.join(harnessDir, f)));
   if (filesToMove.length === 0) {
     return Ok(void 0);
   }
-  const defaultDir = path9.join(streamsDir(projectPath), "default");
+  const defaultDir = path10.join(streamsDir(projectPath), "default");
   try {
-    fs12.mkdirSync(defaultDir, { recursive: true });
+    fs13.mkdirSync(defaultDir, { recursive: true });
     for (const file of filesToMove) {
-      fs12.renameSync(path9.join(harnessDir, file), path9.join(defaultDir, file));
+      fs13.renameSync(path10.join(harnessDir, file), path10.join(defaultDir, file));
     }
   } catch (error) {
     return Err(
@@ -6034,26 +6170,26 @@ function resolveSessionDir(projectPath, sessionSlug, options) {
       new Error(`Invalid session slug '${sessionSlug}': must not contain path traversal characters`)
     );
   }
-  const sessionDir = path10.join(projectPath, HARNESS_DIR, SESSIONS_DIR, sessionSlug);
+  const sessionDir = path11.join(projectPath, HARNESS_DIR, SESSIONS_DIR, sessionSlug);
   if (options?.create) {
-    fs13.mkdirSync(sessionDir, { recursive: true });
+    fs14.mkdirSync(sessionDir, { recursive: true });
   }
   return Ok(sessionDir);
 }
 function updateSessionIndex(projectPath, sessionSlug, description) {
-  const sessionsDir = path10.join(projectPath, HARNESS_DIR, SESSIONS_DIR);
-  fs13.mkdirSync(sessionsDir, { recursive: true });
-  const indexPath2 = path10.join(sessionsDir, SESSION_INDEX_FILE);
+  const sessionsDir = path11.join(projectPath, HARNESS_DIR, SESSIONS_DIR);
+  fs14.mkdirSync(sessionsDir, { recursive: true });
+  const indexPath2 = path11.join(sessionsDir, SESSION_INDEX_FILE);
   const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const newLine = `- [${sessionSlug}](${sessionSlug}/summary.md) \u2014 ${description} (${date})`;
-  if (!fs13.existsSync(indexPath2)) {
-    fs13.writeFileSync(indexPath2, `## Active Sessions
+  if (!fs14.existsSync(indexPath2)) {
+    fs14.writeFileSync(indexPath2, `## Active Sessions
 
 ${newLine}
 `);
     return;
   }
-  const content = fs13.readFileSync(indexPath2, "utf-8");
+  const content = fs14.readFileSync(indexPath2, "utf-8");
   const lines = content.split("\n");
   const slugPattern = `- [${sessionSlug}]`;
   const existingIdx = lines.findIndex((l) => l.startsWith(slugPattern));
@@ -6063,7 +6199,7 @@ ${newLine}
     const lastNonEmpty = lines.reduce((last, line, i) => line.trim() !== "" ? i : last, 0);
     lines.splice(lastNonEmpty + 1, 0, newLine);
   }
-  fs13.writeFileSync(indexPath2, lines.join("\n"));
+  fs14.writeFileSync(indexPath2, lines.join("\n"));
 }
 function evictIfNeeded(map) {
   if (map.size > MAX_CACHE_ENTRIES) {
@@ -6076,8 +6212,8 @@ async function getStateDir(projectPath, stream, session) {
     const sessionResult = resolveSessionDir(projectPath, session, { create: true });
     return sessionResult;
   }
-  const streamsIndexPath = path11.join(projectPath, HARNESS_DIR, "streams", INDEX_FILE);
-  const hasStreams = fs14.existsSync(streamsIndexPath);
+  const streamsIndexPath = path12.join(projectPath, HARNESS_DIR, "streams", INDEX_FILE);
+  const hasStreams = fs15.existsSync(streamsIndexPath);
   if (stream || hasStreams) {
     const result = await resolveStreamPath(projectPath, stream ? { stream } : void 0);
     if (result.ok) {
@@ -6087,18 +6223,18 @@ async function getStateDir(projectPath, stream, session) {
       return result;
     }
   }
-  return Ok(path11.join(projectPath, HARNESS_DIR));
+  return Ok(path12.join(projectPath, HARNESS_DIR));
 }
 async function loadState(projectPath, stream, session) {
   try {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const statePath = path12.join(stateDir, STATE_FILE);
-    if (!fs15.existsSync(statePath)) {
+    const statePath = path13.join(stateDir, STATE_FILE);
+    if (!fs16.existsSync(statePath)) {
       return Ok({ ...DEFAULT_STATE });
     }
-    const raw = fs15.readFileSync(statePath, "utf-8");
+    const raw = fs16.readFileSync(statePath, "utf-8");
     const parsed = JSON.parse(raw);
     const result = HarnessStateSchema.safeParse(parsed);
     if (!result.success) {
@@ -6116,11 +6252,11 @@ async function saveState(projectPath, state, stream, session) {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const statePath = path12.join(stateDir, STATE_FILE);
-    fs15.mkdirSync(stateDir, { recursive: true });
+    const statePath = path13.join(stateDir, STATE_FILE);
+    fs16.mkdirSync(stateDir, { recursive: true });
     const tmpPath = statePath + ".tmp";
-    fs15.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs15.renameSync(tmpPath, statePath);
+    fs16.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs16.renameSync(tmpPath, statePath);
     return Ok(void 0);
   } catch (error) {
     return Err(
@@ -6206,10 +6342,10 @@ function computeContentHash(text) {
   return crypto2.createHash("sha256").update(text).digest("hex").slice(0, 16);
 }
 function loadContentHashes(stateDir) {
-  const hashesPath = path13.join(stateDir, CONTENT_HASHES_FILE);
-  if (!fs16.existsSync(hashesPath)) return {};
+  const hashesPath = path14.join(stateDir, CONTENT_HASHES_FILE);
+  if (!fs17.existsSync(hashesPath)) return {};
   try {
-    const raw = fs16.readFileSync(hashesPath, "utf-8");
+    const raw = fs17.readFileSync(hashesPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
     return parsed;
@@ -6218,15 +6354,15 @@ function loadContentHashes(stateDir) {
   }
 }
 function saveContentHashes(stateDir, index) {
-  const hashesPath = path13.join(stateDir, CONTENT_HASHES_FILE);
+  const hashesPath = path14.join(stateDir, CONTENT_HASHES_FILE);
   const tmpPath = hashesPath + ".tmp";
-  fs16.writeFileSync(tmpPath, JSON.stringify(index, null, 2) + "\n");
-  fs16.renameSync(tmpPath, hashesPath);
+  fs17.writeFileSync(tmpPath, JSON.stringify(index, null, 2) + "\n");
+  fs17.renameSync(tmpPath, hashesPath);
 }
 function rebuildContentHashes(stateDir, learningsFile) {
-  const learningsPath = path13.join(stateDir, learningsFile);
-  if (!fs16.existsSync(learningsPath)) return {};
-  const content = fs16.readFileSync(learningsPath, "utf-8");
+  const learningsPath = path14.join(stateDir, learningsFile);
+  if (!fs17.existsSync(learningsPath)) return {};
+  const content = fs17.readFileSync(learningsPath, "utf-8");
   const lines = content.split("\n");
   const index = {};
   for (let i = 0; i < lines.length; i++) {
@@ -6285,18 +6421,18 @@ async function loadRelevantLearnings(projectPath, skillName, stream, session) {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const learningsPath = path14.join(stateDir, LEARNINGS_FILE);
-    if (!fs17.existsSync(learningsPath)) {
+    const learningsPath = path15.join(stateDir, LEARNINGS_FILE);
+    if (!fs18.existsSync(learningsPath)) {
       return Ok([]);
     }
-    const stats = fs17.statSync(learningsPath);
+    const stats = fs18.statSync(learningsPath);
     const cacheKey = learningsPath;
     const cached = learningsCacheMap.get(cacheKey);
     let entries;
     if (cached && cached.mtimeMs === stats.mtimeMs) {
       entries = cached.entries;
     } else {
-      const content = fs17.readFileSync(learningsPath, "utf-8");
+      const content = fs18.readFileSync(learningsPath, "utf-8");
       const lines = content.split("\n");
       entries = [];
       let currentBlock = [];
@@ -6437,11 +6573,11 @@ function sleep(ms) {
 async function acquireFileLock(lockPath) {
   for (let attempt = 0; attempt < LOCK_RETRIES; attempt++) {
     try {
-      const fd = fs18.openSync(
+      const fd = fs19.openSync(
         lockPath,
-        fs18.constants.O_CREAT | fs18.constants.O_EXCL | fs18.constants.O_WRONLY
+        fs19.constants.O_CREAT | fs19.constants.O_EXCL | fs19.constants.O_WRONLY
       );
-      fs18.closeSync(fd);
+      fs19.closeSync(fd);
       return;
     } catch (err) {
       const isExist = err instanceof Error && "code" in err && err.code === "EEXIST";
@@ -6455,20 +6591,20 @@ async function acquireFileLock(lockPath) {
 }
 function releaseFileLock(lockPath) {
   try {
-    fs18.unlinkSync(lockPath);
+    fs19.unlinkSync(lockPath);
   } catch {
   }
 }
 function loadOrRebuildHashes(stateDir, learningsPath) {
-  const hashesPath = path15.join(stateDir, CONTENT_HASHES_FILE);
-  if (fs18.existsSync(hashesPath)) {
+  const hashesPath = path16.join(stateDir, CONTENT_HASHES_FILE);
+  if (fs19.existsSync(hashesPath)) {
     const hashes = loadContentHashes(stateDir);
-    if (Object.keys(hashes).length === 0 && fs18.existsSync(learningsPath)) {
+    if (Object.keys(hashes).length === 0 && fs19.existsSync(learningsPath)) {
       return rebuildContentHashes(stateDir, LEARNINGS_FILE);
     }
     return hashes;
   }
-  if (fs18.existsSync(learningsPath)) {
+  if (fs19.existsSync(learningsPath)) {
     return rebuildContentHashes(stateDir, LEARNINGS_FILE);
   }
   return {};
@@ -6492,8 +6628,8 @@ async function appendLearning(projectPath, learning, skillName, outcome, stream,
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const learningsPath = path15.join(stateDir, LEARNINGS_FILE);
-    fs18.mkdirSync(stateDir, { recursive: true });
+    const learningsPath = path16.join(stateDir, LEARNINGS_FILE);
+    fs19.mkdirSync(stateDir, { recursive: true });
     const lockPath = learningsPath + ".lock";
     await acquireFileLock(lockPath);
     try {
@@ -6523,17 +6659,17 @@ ${bulletLine}
 `;
       let overlapResult;
       let existingLineCount;
-      if (!fs18.existsSync(learningsPath)) {
-        fs18.writeFileSync(learningsPath, `# Learnings
+      if (!fs19.existsSync(learningsPath)) {
+        fs19.writeFileSync(learningsPath, `# Learnings
 ${entry}`);
         existingLineCount = 1;
       } else {
-        const existingContent = fs18.readFileSync(learningsPath, "utf-8");
+        const existingContent = fs19.readFileSync(learningsPath, "utf-8");
         const existingEntries = existingContent.split("\n").filter((line) => /^- \*\*\d{4}-\d{2}-\d{2}/.test(line));
         const overlap = checkOverlap(bulletLine, existingEntries);
         if (overlap.score >= 0.7) overlapResult = overlap;
         existingLineCount = existingContent.split("\n").length;
-        fs18.appendFileSync(learningsPath, entry);
+        fs19.appendFileSync(learningsPath, entry);
       }
       const bulletLineNum = existingLineCount + 2;
       contentHashes[contentHash] = { date: timestamp ?? "", line: bulletLineNum };
@@ -6638,11 +6774,11 @@ async function loadIndexEntries(projectPath, skillName, stream, session) {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const learningsPath = path15.join(stateDir, LEARNINGS_FILE);
-    if (!fs18.existsSync(learningsPath)) {
+    const learningsPath = path16.join(stateDir, LEARNINGS_FILE);
+    if (!fs19.existsSync(learningsPath)) {
       return Ok([]);
     }
-    const content = fs18.readFileSync(learningsPath, "utf-8");
+    const content = fs19.readFileSync(learningsPath, "utf-8");
     const lines = content.split("\n");
     const indexEntries = [];
     let pendingFrontmatter = null;
@@ -6684,16 +6820,16 @@ async function archiveLearnings(projectPath, entries, stream) {
     const dirResult = await getStateDir(projectPath, stream);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const archiveDir = path16.join(stateDir, "learnings-archive");
-    fs19.mkdirSync(archiveDir, { recursive: true });
+    const archiveDir = path17.join(stateDir, "learnings-archive");
+    fs20.mkdirSync(archiveDir, { recursive: true });
     const now = /* @__PURE__ */ new Date();
     const yearMonth = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
-    const archivePath = path16.join(archiveDir, `${yearMonth}.md`);
+    const archivePath = path17.join(archiveDir, `${yearMonth}.md`);
     const archiveContent = entries.join("\n\n") + "\n";
-    if (fs19.existsSync(archivePath)) {
-      fs19.appendFileSync(archivePath, "\n" + archiveContent);
+    if (fs20.existsSync(archivePath)) {
+      fs20.appendFileSync(archivePath, "\n" + archiveContent);
     } else {
-      fs19.writeFileSync(archivePath, `# Learnings Archive
+      fs20.writeFileSync(archivePath, `# Learnings Archive
 
 ${archiveContent}`);
     }
@@ -6711,8 +6847,8 @@ async function pruneLearnings(projectPath, stream) {
     const dirResult = await getStateDir(projectPath, stream);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const learningsPath = path16.join(stateDir, LEARNINGS_FILE);
-    if (!fs19.existsSync(learningsPath)) {
+    const learningsPath = path17.join(stateDir, LEARNINGS_FILE);
+    if (!fs20.existsSync(learningsPath)) {
       return Ok({ kept: 0, archived: 0, patterns: [] });
     }
     const loadResult = await loadRelevantLearnings(projectPath, void 0, stream);
@@ -6743,7 +6879,7 @@ async function pruneLearnings(projectPath, stream) {
       if (!archiveResult.ok) return archiveResult;
     }
     const newContent = "# Learnings\n\n" + toKeep.join("\n\n") + "\n";
-    fs19.writeFileSync(learningsPath, newContent);
+    fs20.writeFileSync(learningsPath, newContent);
     invalidateLearningsCacheEntry(learningsPath);
     return Ok({
       kept: toKeep.length,
@@ -6787,19 +6923,19 @@ async function promoteSessionLearnings(projectPath, sessionSlug, stream) {
     const dirResult = await getStateDir(projectPath, stream);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const globalPath = path16.join(stateDir, LEARNINGS_FILE);
-    const existingGlobal = fs19.existsSync(globalPath) ? fs19.readFileSync(globalPath, "utf-8") : "";
+    const globalPath = path17.join(stateDir, LEARNINGS_FILE);
+    const existingGlobal = fs20.existsSync(globalPath) ? fs20.readFileSync(globalPath, "utf-8") : "";
     const newEntries = toPromote.filter((entry) => !existingGlobal.includes(entry.trim()));
     if (newEntries.length === 0) {
       return Ok({ promoted: 0, skipped: skipped + toPromote.length });
     }
     const promotedContent = newEntries.join("\n\n") + "\n";
     if (!existingGlobal) {
-      fs19.writeFileSync(globalPath, `# Learnings
+      fs20.writeFileSync(globalPath, `# Learnings
 
 ${promotedContent}`);
     } else {
-      fs19.appendFileSync(globalPath, "\n\n" + promotedContent);
+      fs20.appendFileSync(globalPath, "\n\n" + promotedContent);
     }
     invalidateLearningsCacheEntry(globalPath);
     return Ok({
@@ -6835,13 +6971,13 @@ async function detectStaleLearnings(projectPath, stream, session) {
         freshCount++;
         continue;
       }
-      const resolvedRoot = path17.resolve(projectPath);
+      const resolvedRoot = path18.resolve(projectPath);
       const missing = refs.filter((ref) => {
-        const absPath = path17.resolve(projectPath, ref);
-        if (!absPath.startsWith(resolvedRoot + path17.sep) && absPath !== resolvedRoot) {
+        const absPath = path18.resolve(projectPath, ref);
+        if (!absPath.startsWith(resolvedRoot + path18.sep) && absPath !== resolvedRoot) {
           return false;
         }
-        return !fs20.existsSync(absPath);
+        return !fs21.existsSync(absPath);
       });
       if (missing.length > 0) {
         const idx = extractIndexEntry(entry);
@@ -6876,17 +7012,17 @@ async function appendFailure(projectPath, description, skillName, type, stream,
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const failuresPath = path18.join(stateDir, FAILURES_FILE);
-    fs21.mkdirSync(stateDir, { recursive: true });
+    const failuresPath = path19.join(stateDir, FAILURES_FILE);
+    fs22.mkdirSync(stateDir, { recursive: true });
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const entry = `
 - **${timestamp} [skill:${skillName}] [type:${type}]:** ${description}
 `;
-    if (!fs21.existsSync(failuresPath)) {
-      fs21.writeFileSync(failuresPath, `# Failures
+    if (!fs22.existsSync(failuresPath)) {
+      fs22.writeFileSync(failuresPath, `# Failures
 ${entry}`);
     } else {
-      fs21.appendFileSync(failuresPath, entry);
+      fs22.appendFileSync(failuresPath, entry);
     }
     failuresCacheMap.delete(failuresPath);
     return Ok(void 0);
@@ -6903,17 +7039,17 @@ async function loadFailures(projectPath, stream, session) {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const failuresPath = path18.join(stateDir, FAILURES_FILE);
-    if (!fs21.existsSync(failuresPath)) {
+    const failuresPath = path19.join(stateDir, FAILURES_FILE);
+    if (!fs22.existsSync(failuresPath)) {
       return Ok([]);
     }
-    const stats = fs21.statSync(failuresPath);
+    const stats = fs22.statSync(failuresPath);
     const cacheKey = failuresPath;
     const cached = failuresCacheMap.get(cacheKey);
     if (cached && cached.mtimeMs === stats.mtimeMs) {
       return Ok(cached.entries);
     }
-    const content = fs21.readFileSync(failuresPath, "utf-8");
+    const content = fs22.readFileSync(failuresPath, "utf-8");
     const entries = [];
     for (const line of content.split("\n")) {
       const match = line.match(FAILURE_LINE_REGEX);
@@ -6942,20 +7078,20 @@ async function archiveFailures(projectPath, stream, session) {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const failuresPath = path18.join(stateDir, FAILURES_FILE);
-    if (!fs21.existsSync(failuresPath)) {
+    const failuresPath = path19.join(stateDir, FAILURES_FILE);
+    if (!fs22.existsSync(failuresPath)) {
       return Ok(void 0);
     }
-    const archiveDir = path18.join(stateDir, "archive");
-    fs21.mkdirSync(archiveDir, { recursive: true });
+    const archiveDir = path19.join(stateDir, "archive");
+    fs22.mkdirSync(archiveDir, { recursive: true });
     const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     let archiveName = `failures-${date}.md`;
     let counter = 2;
-    while (fs21.existsSync(path18.join(archiveDir, archiveName))) {
+    while (fs22.existsSync(path19.join(archiveDir, archiveName))) {
       archiveName = `failures-${date}-${counter}.md`;
       counter++;
     }
-    fs21.renameSync(failuresPath, path18.join(archiveDir, archiveName));
+    fs22.renameSync(failuresPath, path19.join(archiveDir, archiveName));
     failuresCacheMap.delete(failuresPath);
     return Ok(void 0);
   } catch (error) {
@@ -6971,11 +7107,11 @@ async function saveHandoff(projectPath, handoff, stream, session) {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const handoffPath = path19.join(stateDir, HANDOFF_FILE);
-    fs22.mkdirSync(stateDir, { recursive: true });
+    const handoffPath = path20.join(stateDir, HANDOFF_FILE);
+    fs23.mkdirSync(stateDir, { recursive: true });
     const tmpPath = handoffPath + ".tmp";
-    fs22.writeFileSync(tmpPath, JSON.stringify(handoff, null, 2));
-    fs22.renameSync(tmpPath, handoffPath);
+    fs23.writeFileSync(tmpPath, JSON.stringify(handoff, null, 2));
+    fs23.renameSync(tmpPath, handoffPath);
     return Ok(void 0);
   } catch (error) {
     return Err(
@@ -6988,11 +7124,11 @@ async function loadHandoff(projectPath, stream, session) {
     const dirResult = await getStateDir(projectPath, stream, session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const handoffPath = path19.join(stateDir, HANDOFF_FILE);
-    if (!fs22.existsSync(handoffPath)) {
+    const handoffPath = path20.join(stateDir, HANDOFF_FILE);
+    if (!fs23.existsSync(handoffPath)) {
       return Ok(null);
     }
-    const raw = fs22.readFileSync(handoffPath, "utf-8");
+    const raw = fs23.readFileSync(handoffPath, "utf-8");
     const parsed = JSON.parse(raw);
     const result = HandoffSchema.safeParse(parsed);
     if (!result.success) {
@@ -7006,28 +7142,28 @@ async function loadHandoff(projectPath, stream, session) {
   }
 }
 function loadChecksFromConfig(gateConfigPath) {
-  if (!fs23.existsSync(gateConfigPath)) return [];
-  const raw = JSON.parse(fs23.readFileSync(gateConfigPath, "utf-8"));
+  if (!fs24.existsSync(gateConfigPath)) return [];
+  const raw = JSON.parse(fs24.readFileSync(gateConfigPath, "utf-8"));
   const config = GateConfigSchema.safeParse(raw);
   if (config.success && config.data.checks) return config.data.checks;
   return [];
 }
 function discoverChecksFromProject(projectPath) {
   const checks = [];
-  const packageJsonPath = path20.join(projectPath, "package.json");
-  if (fs23.existsSync(packageJsonPath)) {
-    const pkg = JSON.parse(fs23.readFileSync(packageJsonPath, "utf-8"));
+  const packageJsonPath = path21.join(projectPath, "package.json");
+  if (fs24.existsSync(packageJsonPath)) {
+    const pkg = JSON.parse(fs24.readFileSync(packageJsonPath, "utf-8"));
     const scripts = pkg.scripts || {};
     if (scripts.test) checks.push({ name: "test", command: "npm test" });
     if (scripts.lint) checks.push({ name: "lint", command: "npm run lint" });
     if (scripts.typecheck) checks.push({ name: "typecheck", command: "npm run typecheck" });
     if (scripts.build) checks.push({ name: "build", command: "npm run build" });
   }
-  if (fs23.existsSync(path20.join(projectPath, "go.mod"))) {
+  if (fs24.existsSync(path21.join(projectPath, "go.mod"))) {
     checks.push({ name: "test", command: "go test ./..." });
     checks.push({ name: "build", command: "go build ./..." });
   }
-  if (fs23.existsSync(path20.join(projectPath, "pyproject.toml")) || fs23.existsSync(path20.join(projectPath, "setup.py"))) {
+  if (fs24.existsSync(path21.join(projectPath, "pyproject.toml")) || fs24.existsSync(path21.join(projectPath, "setup.py"))) {
     checks.push({ name: "test", command: "python -m pytest" });
   }
   return checks;
@@ -7067,8 +7203,8 @@ function executeCheck(check, projectPath) {
   }
 }
 async function runMechanicalGate(projectPath) {
-  const harnessDir = path20.join(projectPath, HARNESS_DIR);
-  const gateConfigPath = path20.join(harnessDir, GATE_CONFIG_FILE);
+  const harnessDir = path21.join(projectPath, HARNESS_DIR);
+  const gateConfigPath = path21.join(harnessDir, GATE_CONFIG_FILE);
   try {
     let checks = loadChecksFromConfig(gateConfigPath);
     if (checks.length === 0) {
@@ -7124,9 +7260,9 @@ function writeSessionSummary(projectPath, sessionSlug, data) {
     const dirResult = resolveSessionDir(projectPath, sessionSlug, { create: true });
     if (!dirResult.ok) return dirResult;
     const sessionDir = dirResult.value;
-    const summaryPath = path21.join(sessionDir, SUMMARY_FILE);
+    const summaryPath = path22.join(sessionDir, SUMMARY_FILE);
     const content = formatSummary(data);
-    fs24.writeFileSync(summaryPath, content);
+    fs25.writeFileSync(summaryPath, content);
     const description = deriveIndexDescription(data);
     updateSessionIndex(projectPath, sessionSlug, description);
     return Ok(void 0);
@@ -7143,11 +7279,11 @@ function loadSessionSummary(projectPath, sessionSlug) {
     const dirResult = resolveSessionDir(projectPath, sessionSlug);
     if (!dirResult.ok) return dirResult;
     const sessionDir = dirResult.value;
-    const summaryPath = path21.join(sessionDir, SUMMARY_FILE);
-    if (!fs24.existsSync(summaryPath)) {
+    const summaryPath = path22.join(sessionDir, SUMMARY_FILE);
+    if (!fs25.existsSync(summaryPath)) {
       return Ok(null);
     }
-    const content = fs24.readFileSync(summaryPath, "utf-8");
+    const content = fs25.readFileSync(summaryPath, "utf-8");
     return Ok(content);
   } catch (error) {
     return Err(
@@ -7159,11 +7295,11 @@ function loadSessionSummary(projectPath, sessionSlug) {
 }
 function listActiveSessions(projectPath) {
   try {
-    const indexPath2 = path21.join(projectPath, HARNESS_DIR, SESSIONS_DIR, SESSION_INDEX_FILE);
-    if (!fs24.existsSync(indexPath2)) {
+    const indexPath2 = path22.join(projectPath, HARNESS_DIR, SESSIONS_DIR, SESSION_INDEX_FILE);
+    if (!fs25.existsSync(indexPath2)) {
       return Ok(null);
     }
-    const content = fs24.readFileSync(indexPath2, "utf-8");
+    const content = fs25.readFileSync(indexPath2, "utf-8");
     return Ok(content);
   } catch (error) {
     return Err(
@@ -7184,12 +7320,12 @@ async function loadSessionState(projectPath, sessionSlug) {
   const dirResult = resolveSessionDir(projectPath, sessionSlug);
   if (!dirResult.ok) return dirResult;
   const sessionDir = dirResult.value;
-  const filePath = path22.join(sessionDir, SESSION_STATE_FILE);
-  if (!fs25.existsSync(filePath)) {
+  const filePath = path23.join(sessionDir, SESSION_STATE_FILE);
+  if (!fs26.existsSync(filePath)) {
     return Ok(emptySections());
   }
   try {
-    const raw = fs25.readFileSync(filePath, "utf-8");
+    const raw = fs26.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     const sections = emptySections();
     for (const name of SESSION_SECTION_NAMES) {
@@ -7210,9 +7346,9 @@ async function saveSessionState(projectPath, sessionSlug, sections) {
   const dirResult = resolveSessionDir(projectPath, sessionSlug, { create: true });
   if (!dirResult.ok) return dirResult;
   const sessionDir = dirResult.value;
-  const filePath = path22.join(sessionDir, SESSION_STATE_FILE);
+  const filePath = path23.join(sessionDir, SESSION_STATE_FILE);
   try {
-    fs25.writeFileSync(filePath, JSON.stringify(sections, null, 2));
+    fs26.writeFileSync(filePath, JSON.stringify(sections, null, 2));
     return Ok(void 0);
   } catch (error) {
     return Err(
@@ -7268,26 +7404,26 @@ async function archiveSession(projectPath, sessionSlug, options = {}) {
   const dirResult = resolveSessionDir(projectPath, sessionSlug);
   if (!dirResult.ok) return dirResult;
   const sessionDir = dirResult.value;
-  if (!fs26.existsSync(sessionDir)) {
+  if (!fs27.existsSync(sessionDir)) {
     return Err(new Error(`Session '${sessionSlug}' not found at ${sessionDir}`));
   }
-  const archiveBase = path23.join(projectPath, HARNESS_DIR, ARCHIVE_DIR, "sessions");
+  const archiveBase = path24.join(projectPath, HARNESS_DIR, ARCHIVE_DIR, "sessions");
   try {
-    fs26.mkdirSync(archiveBase, { recursive: true });
+    fs27.mkdirSync(archiveBase, { recursive: true });
     const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     let archiveName = `${sessionSlug}-${date}`;
     let counter = 1;
-    while (fs26.existsSync(path23.join(archiveBase, archiveName))) {
+    while (fs27.existsSync(path24.join(archiveBase, archiveName))) {
       archiveName = `${sessionSlug}-${date}-${counter}`;
       counter++;
     }
-    const dest = path23.join(archiveBase, archiveName);
+    const dest = path24.join(archiveBase, archiveName);
     try {
-      fs26.renameSync(sessionDir, dest);
+      fs27.renameSync(sessionDir, dest);
     } catch (renameErr) {
       if (renameErr instanceof Error && "code" in renameErr && renameErr.code === "EXDEV") {
-        fs26.cpSync(sessionDir, dest, { recursive: true });
-        fs26.rmSync(sessionDir, { recursive: true });
+        fs27.cpSync(sessionDir, dest, { recursive: true });
+        fs27.rmSync(sessionDir, { recursive: true });
       } else {
         throw renameErr;
       }
@@ -7322,8 +7458,8 @@ function loadKnownHashes(eventsPath) {
   const cached = knownHashesCache.get(eventsPath);
   if (cached) return cached;
   const hashes = /* @__PURE__ */ new Set();
-  if (fs27.existsSync(eventsPath)) {
-    const content = fs27.readFileSync(eventsPath, "utf-8");
+  if (fs28.existsSync(eventsPath)) {
+    const content = fs28.readFileSync(eventsPath, "utf-8");
     const lines = content.split("\n").filter((line) => line.trim() !== "");
     for (const line of lines) {
       try {
@@ -7346,8 +7482,8 @@ async function emitEvent(projectPath, event, options) {
     const dirResult = await getStateDir(projectPath, options?.stream, options?.session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const eventsPath = path24.join(stateDir, EVENTS_FILE);
-    fs27.mkdirSync(stateDir, { recursive: true });
+    const eventsPath = path25.join(stateDir, EVENTS_FILE);
+    fs28.mkdirSync(stateDir, { recursive: true });
     const contentHash = computeEventHash(event, options?.session);
     const knownHashes = loadKnownHashes(eventsPath);
     if (knownHashes.has(contentHash)) {
@@ -7361,7 +7497,7 @@ async function emitEvent(projectPath, event, options) {
     if (options?.session) {
       fullEvent.session = options.session;
     }
-    fs27.appendFileSync(eventsPath, JSON.stringify(fullEvent) + "\n");
+    fs28.appendFileSync(eventsPath, JSON.stringify(fullEvent) + "\n");
     knownHashes.add(contentHash);
     return Ok({ written: true });
   } catch (error) {
@@ -7375,11 +7511,11 @@ async function loadEvents(projectPath, options) {
     const dirResult = await getStateDir(projectPath, options?.stream, options?.session);
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
-    const eventsPath = path24.join(stateDir, EVENTS_FILE);
-    if (!fs27.existsSync(eventsPath)) {
+    const eventsPath = path25.join(stateDir, EVENTS_FILE);
+    if (!fs28.existsSync(eventsPath)) {
       return Ok([]);
     }
-    const content = fs27.readFileSync(eventsPath, "utf-8");
+    const content = fs28.readFileSync(eventsPath, "utf-8");
     const lines = content.split("\n").filter((line) => line.trim() !== "");
     const events = [];
     for (const line of lines) {
@@ -7628,11 +7764,11 @@ function nodeSubStacks(allDeps) {
   return found;
 }
 function detectNodeStacks(projectRoot) {
-  const pkgJsonPath = path25.join(projectRoot, "package.json");
-  if (!fs28.existsSync(pkgJsonPath)) return [];
+  const pkgJsonPath = path26.join(projectRoot, "package.json");
+  if (!fs29.existsSync(pkgJsonPath)) return [];
   const stacks = ["node"];
   try {
-    const pkgJson = JSON.parse(fs28.readFileSync(pkgJsonPath, "utf-8"));
+    const pkgJson = JSON.parse(fs29.readFileSync(pkgJsonPath, "utf-8"));
     const allDeps = { ...pkgJson.dependencies, ...pkgJson.devDependencies };
     stacks.push(...nodeSubStacks(allDeps));
   } catch {
@@ -7641,10 +7777,10 @@ function detectNodeStacks(projectRoot) {
 }
 function detectStack(projectRoot) {
   const stacks = [...detectNodeStacks(projectRoot)];
-  if (fs28.existsSync(path25.join(projectRoot, "go.mod"))) {
+  if (fs29.existsSync(path26.join(projectRoot, "go.mod"))) {
     stacks.push("go");
   }
-  const hasPython = fs28.existsSync(path25.join(projectRoot, "requirements.txt")) || fs28.existsSync(path25.join(projectRoot, "pyproject.toml"));
+  const hasPython = fs29.existsSync(path26.join(projectRoot, "requirements.txt")) || fs29.existsSync(path26.join(projectRoot, "pyproject.toml"));
   if (hasPython) {
     stacks.push("python");
   }
@@ -7667,7 +7803,7 @@ function createOsvClient(options = {}) {
   return {
     async check(pkg) {
       const cacheKey = `${pkg.ecosystem}-${sanitizePkgName(pkg.name)}@${pkg.version ?? "latest"}.json`;
-      const cachePath = path26.join(cacheDir, cacheKey);
+      const cachePath = path27.join(cacheDir, cacheKey);
       const cached = await readCache(cachePath, ttlMs);
       if (cached) {
         return { ...cached, source: "cache" };
@@ -7688,7 +7824,7 @@ function createOsvClient(options = {}) {
     },
     async clearCache() {
       try {
-        await fs30.promises.rm(cacheDir, { recursive: true, force: true });
+        await fs31.promises.rm(cacheDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -7724,9 +7860,9 @@ function classify(advisories) {
 }
 async function readCache(cachePath, ttlMs) {
   try {
-    const stat2 = await fs30.promises.stat(cachePath);
+    const stat2 = await fs31.promises.stat(cachePath);
     if (Date.now() - stat2.mtimeMs > ttlMs) return null;
-    const buf = await fs30.promises.readFile(cachePath, "utf-8");
+    const buf = await fs31.promises.readFile(cachePath, "utf-8");
     const parsed = JSON.parse(buf);
     return { malicious: parsed.malicious ?? [], other: parsed.other ?? [] };
   } catch {
@@ -7735,8 +7871,8 @@ async function readCache(cachePath, ttlMs) {
 }
 async function writeCache(cachePath, payload) {
   try {
-    await fs30.promises.mkdir(path26.dirname(cachePath), { recursive: true });
-    await fs30.promises.writeFile(cachePath, JSON.stringify(payload, null, 2), "utf-8");
+    await fs31.promises.mkdir(path27.dirname(cachePath), { recursive: true });
+    await fs31.promises.writeFile(cachePath, JSON.stringify(payload, null, 2), "utf-8");
   } catch {
   }
 }
@@ -7772,7 +7908,7 @@ function getInjectionPatterns() {
 }
 function getTaintFilePath(projectRoot, sessionId) {
   const id = sessionId || DEFAULT_SESSION_ID;
-  return join382(projectRoot, ".harness", `session-taint-${id}.json`);
+  return join39(projectRoot, ".harness", `session-taint-${id}.json`);
 }
 function readTaint(projectRoot, sessionId) {
   const filePath = getTaintFilePath(projectRoot, sessionId);
@@ -7854,14 +7990,14 @@ function clearTaint(projectRoot, sessionId) {
       return 0;
     }
   }
-  const harnessDir = join382(projectRoot, ".harness");
+  const harnessDir = join39(projectRoot, ".harness");
   let count = 0;
   try {
     const files = readdirSync3(harnessDir);
     for (const file of files) {
       if (file.startsWith("session-taint-") && file.endsWith(".json")) {
         try {
-          unlinkSync2(join382(harnessDir, file));
+          unlinkSync2(join39(harnessDir, file));
           count++;
         } catch {
         }
@@ -7872,7 +8008,7 @@ function clearTaint(projectRoot, sessionId) {
   return count;
 }
 function listTaintedSessions(projectRoot) {
-  const harnessDir = join382(projectRoot, ".harness");
+  const harnessDir = join39(projectRoot, ".harness");
   const sessions = [];
   try {
     const files = readdirSync3(harnessDir);
@@ -7944,7 +8080,7 @@ function securityFindingId(finding) {
 }
 async function runValidateCheck(projectRoot, config) {
   const issues = [];
-  const agentsPath = path27.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
+  const agentsPath = path28.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
   const result = await validateAgentsMap(agentsPath);
   if (!result.ok) {
     issues.push({ severity: "error", message: result.error.message });
@@ -8001,7 +8137,7 @@ async function runDepsCheck(projectRoot, config) {
 }
 async function runDocsCheck(projectRoot, config) {
   const issues = [];
-  const docsDir = path27.join(projectRoot, config.docsDir ?? "docs");
+  const docsDir = path28.join(projectRoot, config.docsDir ?? "docs");
   const entropyConfig = config.entropy || {};
   const result = await checkDocCoverage("project", {
     docsDir,
@@ -8180,7 +8316,7 @@ async function runTraceabilityCheck(projectRoot, config) {
   const issues = [];
   const traceConfig = config.traceability || {};
   if (traceConfig.enabled === false) return issues;
-  const graphDir = path27.join(projectRoot, ".harness", "graph");
+  const graphDir = path28.join(projectRoot, ".harness", "graph");
   const store = new GraphStore();
   const loaded = await store.load(graphDir);
   if (!loaded) {
@@ -8358,7 +8494,7 @@ async function runMechanicalChecks(options) {
   };
   if (!skip.includes("validate")) {
     try {
-      const agentsPath = path28.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
+      const agentsPath = path29.join(projectRoot, config.agentsMapPath ?? "AGENTS.md");
       const result = await validateAgentsMap(agentsPath);
       if (!result.ok) {
         statuses.validate = "fail";
@@ -8395,7 +8531,7 @@ async function runMechanicalChecks(options) {
       statuses.validate = "fail";
       findings.push({
         tool: "validate",
-        file: path28.join(projectRoot, "AGENTS.md"),
+        file: path29.join(projectRoot, "AGENTS.md"),
         message: err instanceof Error ? err.message : String(err),
         severity: "error"
       });
@@ -8459,7 +8595,7 @@ async function runMechanicalChecks(options) {
       (async () => {
         const localFindings = [];
         try {
-          const docsDir = path28.join(projectRoot, config.docsDir ?? "docs");
+          const docsDir = path29.join(projectRoot, config.docsDir ?? "docs");
           const result = await checkDocCoverage("project", { docsDir });
           if (!result.ok) {
             statuses["check-docs"] = "warn";
@@ -8486,7 +8622,7 @@ async function runMechanicalChecks(options) {
           statuses["check-docs"] = "warn";
           localFindings.push({
             tool: "check-docs",
-            file: path28.join(projectRoot, "docs"),
+            file: path29.join(projectRoot, "docs"),
             message: err instanceof Error ? err.message : String(err),
             severity: "warning"
           });
@@ -8583,18 +8719,18 @@ function computeContextBudget(diffLines) {
   return diffLines;
 }
 function isWithinProject(absPath, projectRoot) {
-  const resolvedRoot = path29.resolve(projectRoot) + path29.sep;
-  const resolvedPath = path29.resolve(absPath);
-  return resolvedPath.startsWith(resolvedRoot) || resolvedPath === path29.resolve(projectRoot);
+  const resolvedRoot = path30.resolve(projectRoot) + path30.sep;
+  const resolvedPath = path30.resolve(absPath);
+  return resolvedPath.startsWith(resolvedRoot) || resolvedPath === path30.resolve(projectRoot);
 }
 async function readContextFile(projectRoot, filePath, reason) {
-  const absPath = path29.isAbsolute(filePath) ? filePath : path29.join(projectRoot, filePath);
+  const absPath = path30.isAbsolute(filePath) ? filePath : path30.join(projectRoot, filePath);
   if (!isWithinProject(absPath, projectRoot)) return null;
   const result = await readFileContent(absPath);
   if (!result.ok) return null;
   const content = result.value;
   const lines = content.split("\n").length;
-  const relPath2 = path29.isAbsolute(filePath) ? relativePosix(projectRoot, filePath) : filePath;
+  const relPath2 = path30.isAbsolute(filePath) ? relativePosix(projectRoot, filePath) : filePath;
   return { path: relPath2, content, reason, lines };
 }
 function extractImportSources2(content) {
@@ -8609,24 +8745,24 @@ function extractImportSources2(content) {
 }
 async function resolveImportPath(projectRoot, fromFile, importSource) {
   if (!importSource.startsWith(".")) return null;
-  const fromDir = path29.dirname(path29.join(projectRoot, fromFile));
-  const basePath = path29.resolve(fromDir, importSource);
+  const fromDir = path30.dirname(path30.join(projectRoot, fromFile));
+  const basePath = path30.resolve(fromDir, importSource);
   if (!isWithinProject(basePath, projectRoot)) return null;
   const relBase = relativePosix(projectRoot, basePath);
-  const sourceExt = path29.extname(relBase);
+  const sourceExt = path30.extname(relBase);
   const candidates = [];
   const fallbacks = JS_EXT_FALLBACKS[sourceExt];
   if (fallbacks) {
     const stripped = relBase.slice(0, -sourceExt.length);
     for (const ext of fallbacks) candidates.push(stripped + ext);
-    candidates.push(path29.join(stripped, "index.ts"));
-    candidates.push(path29.join(stripped, "index.tsx"));
-    candidates.push(path29.join(stripped, "index.jsx"));
+    candidates.push(path30.join(stripped, "index.ts"));
+    candidates.push(path30.join(stripped, "index.tsx"));
+    candidates.push(path30.join(stripped, "index.jsx"));
   }
   candidates.push(relBase + ".ts", relBase + ".tsx", relBase + ".mts");
-  candidates.push(path29.join(relBase, "index.ts"));
+  candidates.push(path30.join(relBase, "index.ts"));
   for (const candidate of candidates) {
-    const absCandidate = path29.join(projectRoot, candidate);
+    const absCandidate = path30.join(projectRoot, candidate);
     if (await fileExists(absCandidate)) {
       return candidate;
     }
@@ -8634,7 +8770,7 @@ async function resolveImportPath(projectRoot, fromFile, importSource) {
   return null;
 }
 async function findTestFiles(projectRoot, sourceFile) {
-  const baseName = path29.basename(sourceFile, path29.extname(sourceFile));
+  const baseName = path30.basename(sourceFile, path30.extname(sourceFile));
   const pattern = `**/${baseName}.{test,spec}.{ts,tsx,mts}`;
   const results = await findFiles(pattern, projectRoot);
   return results.map((f) => relativePosix(projectRoot, f));
@@ -9370,6 +9506,383 @@ function runLearningsAgent(bundle) {
   const allEntries = learningsContextFiles.flatMap((lcf) => parseLearningEntries(lcf.content));
   return allEntries.map((entry) => matchEntryToFiles(entry, changedPaths)).filter((f) => f !== null);
 }
+function scan(bundle, predicate) {
+  const matches = [];
+  for (const cf of bundle.changedFiles) {
+    const lines = cf.content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (predicate(line)) matches.push({ file: cf.path, line: i + 1, snippet: line.trim() });
+    }
+  }
+  return matches;
+}
+function makeFinding2(category, match, title, rationale, suggestion, confidence) {
+  return {
+    id: makeFindingId("adversarial", match.file, match.line, `${category} ${title}`),
+    file: match.file,
+    lineRange: [match.line, match.line],
+    domain: "bug",
+    severity: confidence >= 75 ? "important" : "suggestion",
+    title,
+    rationale,
+    suggestion,
+    evidence: [`Line ${match.line}: ${match.snippet}`],
+    validatedBy: "heuristic",
+    subagent: "adversarial",
+    confidence
+  };
+}
+function detectAssumptionViolations(bundle) {
+  return scan(bundle, (line) => UNVERIFIED_INPUT_PATTERN.test(line)).map(
+    (m) => makeFinding2(
+      "assumption",
+      m,
+      "JSON.parse on untrusted input without shape validation",
+      "The diff assumes the parsed value matches an expected schema. Malformed JSON throws synchronously; structurally-valid-but-semantically-wrong JSON propagates downstream as a malformed object.",
+      "Validate the parsed value against a schema (zod, valibot) or guard each access with a narrow type predicate before use.",
+      75
+    )
+  );
+}
+function detectCompositionFailures(bundle) {
+  const findings = [];
+  findings.push(
+    ...scan(bundle, (line) => COMPOSE_NO_AWAIT.test(line) && !line.includes("await ")).map(
+      (m) => makeFinding2(
+        "composition",
+        m,
+        "Floating Promise chain without await or .catch",
+        "A `.then(...)` chain without `await` or `.catch(...)` produces an unhandled rejection if any link rejects. Composing two such chains lets a failure in one silently delay or stall the other.",
+        "Await the chain or attach `.catch(handler)` and verify the handler is observable.",
+        75
+      )
+    )
+  );
+  findings.push(
+    ...scan(bundle, (line) => UNGUARDED_OPTIONAL_CALL.test(line)).map(
+      (m) => makeFinding2(
+        "composition",
+        m,
+        "Optional chain over a callable masks composition failure",
+        "Calling `foo?.foo(...)` silently becomes `undefined` when the receiver is nil. When composed with downstream code that expects a value, this propagates as a confusing `undefined` rather than a clear error.",
+        "Decide explicitly: either guard up front and throw a meaningful error, or rename the variable so the optionality is visible at the call site.",
+        50
+      )
+    )
+  );
+  return findings;
+}
+function detectAbuseCases(bundle) {
+  return scan(
+    bundle,
+    (line) => FETCH_NO_TIMEOUT.test(line) && !line.includes("AbortController")
+  ).map(
+    (m) => makeFinding2(
+      "abuse",
+      m,
+      "fetch() without timeout or AbortController",
+      "A `fetch` with no timeout allows a slow or malicious upstream to hold a request open indefinitely. Multiple such calls can exhaust the calling pool.",
+      "Pass `signal: AbortSignal.timeout(ms)` (Node 18+) or wire an `AbortController` with an explicit timeout.",
+      100
+    )
+  );
+}
+function detectCascades(bundle) {
+  return scan(bundle, (line) => PROMISE_NO_REJECT_PATTERN.test(line)).map(
+    (m) => makeFinding2(
+      "cascade",
+      m,
+      "new Promise constructor without a reject parameter",
+      "A Promise that only captures `resolve` cannot signal failure. Errors thrown inside the executor become unhandled, and downstream chains await indefinitely if no `resolve` path is reached.",
+      "Add a `reject` parameter and forward thrown errors, or refactor to an `async` function that returns the value or throws.",
+      100
+    )
+  );
+}
+function runAdversarialAgent(bundle, options = {}) {
+  const { runCascades = true } = options;
+  const findings = [];
+  findings.push(...detectAssumptionViolations(bundle));
+  findings.push(...detectCompositionFailures(bundle));
+  findings.push(...detectAbuseCases(bundle));
+  if (runCascades) findings.push(...detectCascades(bundle));
+  return findings;
+}
+function isProductionTsFile(path52) {
+  if (!/\.(ts|tsx)$/.test(path52)) return false;
+  if (/\.d\.ts$/.test(path52)) return false;
+  if (/\.(test|spec)\.(ts|tsx)$/.test(path52)) return false;
+  if (/__tests__\//.test(path52)) return false;
+  return true;
+}
+function isProductionFile(path52) {
+  return isProductionTsFile(path52);
+}
+function scan2(bundle, predicate) {
+  const matches = [];
+  for (const cf of bundle.changedFiles) {
+    if (!isProductionFile(cf.path)) continue;
+    const lines = cf.content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const codePart = stripLineComment(line);
+      if (predicate(codePart) || predicate(line)) {
+        matches.push({ file: cf.path, line: i + 1, snippet: line.trim() });
+      }
+    }
+  }
+  return matches;
+}
+function stripLineComment(line) {
+  const idx = line.indexOf("//");
+  if (idx === -1) return line;
+  if (TS_IGNORE_PATTERN.test(line)) return line;
+  return line.slice(0, idx);
+}
+function detectExplicitAny(bundle) {
+  return scan2(bundle, (codeLine) => {
+    const cleaned = codeLine.replace(/(['"`])[^'"`]*\1/g, '""');
+    return /:\s*any(?![A-Za-z0-9_$])/.test(cleaned) || /\bas\s+any(?![A-Za-z0-9_$])/.test(cleaned);
+  }).map((m) => ({
+    id: makeFindingId("ts-strict", m.file, m.line, "explicit any"),
+    file: m.file,
+    lineRange: [m.line, m.line],
+    domain: "bug",
+    severity: "important",
+    title: "Explicit `any` disables the type checker",
+    rationale: "An `any`-typed value bypasses every downstream check. Future callers receive no help from the compiler when they pass the wrong shape.",
+    suggestion: "Replace `any` with the narrowest type that compiles \u2014 a union, `unknown` with a type predicate, or a generic. If the shape is truly external, parse it with a schema (zod, valibot) at the boundary.",
+    evidence: [`Line ${m.line}: ${m.snippet}`],
+    validatedBy: "heuristic",
+    subagent: "typescript-strict",
+    confidence: 100
+  })).filter((f) => EXPLICIT_ANY_PATTERN.test(f.evidence[0]));
+}
+function detectTsIgnore(bundle) {
+  return scan2(bundle, (line) => TS_IGNORE_PATTERN.test(line)).map((m) => ({
+    id: makeFindingId("ts-strict", m.file, m.line, "ts ignore"),
+    file: m.file,
+    lineRange: [m.line, m.line],
+    domain: "bug",
+    severity: "important",
+    title: "ts-ignore / ts-expect-error suppresses a type error",
+    rationale: "Suppressing a type error hides a real signal from the compiler. The reason for the suppression is rarely captured, and the original error is invisible at the call site.",
+    suggestion: "Either remove the directive and fix the underlying type, or replace it with a typed assertion accompanied by a comment that names the invariant being asserted.",
+    evidence: [`Line ${m.line}: ${m.snippet}`],
+    validatedBy: "heuristic",
+    subagent: "typescript-strict",
+    confidence: 100
+  }));
+}
+function detectUnsafeAsUnknown(bundle) {
+  return scan2(bundle, (line) => UNSAFE_AS_UNKNOWN.test(line)).map((m) => ({
+    id: makeFindingId("ts-strict", m.file, m.line, "as unknown as"),
+    file: m.file,
+    lineRange: [m.line, m.line],
+    domain: "bug",
+    severity: "important",
+    title: "`as unknown as X` is a double-cast escape hatch",
+    rationale: "The pattern bypasses the type system entirely. If the runtime shape diverges from X, downstream code crashes with a type-confusion error that points at the wrong line.",
+    suggestion: "Parse the value at the boundary with a schema, or refine via a narrowing predicate so the cast becomes unnecessary.",
+    evidence: [`Line ${m.line}: ${m.snippet}`],
+    validatedBy: "heuristic",
+    subagent: "typescript-strict",
+    confidence: 100
+  }));
+}
+function detectNonNullAssertion(bundle) {
+  return scan2(bundle, (line) => NON_NULL_ASSERTION.test(line)).filter((m) => !/process\.env\./.test(m.snippet)).map((m) => ({
+    id: makeFindingId("ts-strict", m.file, m.line, "non null assertion"),
+    file: m.file,
+    lineRange: [m.line, m.line],
+    domain: "bug",
+    severity: "suggestion",
+    title: "Non-null assertion (`!`) bypasses the null check",
+    rationale: "The `!` operator promises the compiler that the value is not nullish. If that promise is wrong, the failure shows up as a `Cannot read properties of undefined` at runtime far from the assertion.",
+    suggestion: "Guard with an explicit `if (value == null) throw new Error(...)` so the assertion is verified at runtime, or refactor the producer to return a non-nullable type.",
+    evidence: [`Line ${m.line}: ${m.snippet}`],
+    validatedBy: "heuristic",
+    subagent: "typescript-strict",
+    confidence: 75
+  }));
+}
+function detectLargeFileGrowth(bundle) {
+  return bundle.changedFiles.filter((cf) => isProductionFile(cf.path) && cf.lines > 400).map((cf) => ({
+    id: makeFindingId("ts-strict", cf.path, 1, "file growth"),
+    file: cf.path,
+    lineRange: [1, cf.lines],
+    domain: "architecture",
+    severity: "suggestion",
+    title: `File grew to ${cf.lines} lines \u2014 Single Responsibility risk`,
+    rationale: "Past 400 lines a single TypeScript file typically encodes more than one responsibility. Adding to it compounds the burden on future readers and reviewers.",
+    suggestion: "Identify two responsibilities and split the larger one into a new module. A new file with a clear name reads better than a longer file with vague boundaries.",
+    evidence: [`File length: ${cf.lines} lines`],
+    validatedBy: "heuristic",
+    subagent: "typescript-strict",
+    confidence: 50
+  }));
+}
+function detectVagueNames(bundle) {
+  return scan2(bundle, (line) => VAGUE_HELPER_NAME.test(line)).map((m) => ({
+    id: makeFindingId("ts-strict", m.file, m.line, "vague name"),
+    file: m.file,
+    lineRange: [m.line, m.line],
+    domain: "bug",
+    severity: "suggestion",
+    title: "Vague function name \u2014 fails the five-second rule",
+    rationale: "A name like `handle*` or `process*` or `doStuff` does not let a reader predict what the function does from a call site. Future maintainers must read the body to know \u2014 every time.",
+    suggestion: "Rename to a verb-object phrase that says what changes (e.g., `applyDiscount`, `serializeOrder`). If you cannot name it, the function probably does more than one thing.",
+    evidence: [`Line ${m.line}: ${m.snippet}`],
+    validatedBy: "heuristic",
+    subagent: "typescript-strict",
+    confidence: 50
+  }));
+}
+function runTypescriptStrictAgent(bundle) {
+  const findings = [];
+  findings.push(...detectExplicitAny(bundle));
+  findings.push(...detectTsIgnore(bundle));
+  findings.push(...detectUnsafeAsUnknown(bundle));
+  findings.push(...detectNonNullAssertion(bundle));
+  findings.push(...detectLargeFileGrowth(bundle));
+  findings.push(...detectVagueNames(bundle));
+  return findings;
+}
+function frontendFiles(bundle) {
+  return bundle.changedFiles.filter((cf) => /\.(ts|tsx|jsx|js)$/.test(cf.path)).filter((cf) => !/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(cf.path)).filter((cf) => !/__tests__\//.test(cf.path)).filter((cf) => !/\.d\.ts$/.test(cf.path)).map((cf) => ({ path: cf.path, content: cf.content, lines: cf.content.split("\n") }));
+}
+function detectUnclearedTimers(bundle) {
+  const findings = [];
+  for (const file of frontendFiles(bundle)) {
+    const hasClearInterval = /\bclearInterval\s*\(/.test(file.content);
+    const hasClearTimeout = /\bclearTimeout\s*\(/.test(file.content);
+    for (let i = 0; i < file.lines.length; i++) {
+      const line = file.lines[i];
+      if (/\bsetInterval\s*\(/.test(line) && !hasClearInterval) {
+        findings.push({
+          id: makeFindingId("frontend-races", file.path, i + 1, "setInterval no clear"),
+          file: file.path,
+          lineRange: [i + 1, i + 1],
+          domain: "bug",
+          severity: "important",
+          title: "setInterval without matching clearInterval in the same module",
+          rationale: "An interval that is never cleared keeps firing after the owning component, controller, or scope is gone. Each render creates a new timer; old timers continue mutating state that no longer exists.",
+          suggestion: "Capture the handle and clear it in the matching teardown path (useEffect return, controller `disconnect`, or explicit `dispose`). For one-shot work, prefer setTimeout with a clearTimeout in the cleanup path.",
+          evidence: [`Line ${i + 1}: ${line.trim()}`],
+          validatedBy: "heuristic",
+          subagent: "frontend-races",
+          confidence: 100
+        });
+      }
+      if (/\bsetTimeout\s*\(/.test(line) && !hasClearTimeout && // ignore intentional fire-and-forget where the callback is a single bound function with no closure access
+      !/setTimeout\s*\(\s*[A-Za-z_$][\w$]*\s*(?:,|\))/.test(line)) {
+        findings.push({
+          id: makeFindingId("frontend-races", file.path, i + 1, "setTimeout no clear"),
+          file: file.path,
+          lineRange: [i + 1, i + 1],
+          domain: "bug",
+          severity: "suggestion",
+          title: "setTimeout with closure access but no clearTimeout in the same module",
+          rationale: 'A timeout that closes over mutable state can fire after the owner is gone, updating stale references and triggering "set state on unmounted component" warnings.',
+          suggestion: "Capture the timeout id and clear it in the teardown path, or extract a pure function and bind explicit arguments.",
+          evidence: [`Line ${i + 1}: ${line.trim()}`],
+          validatedBy: "heuristic",
+          subagent: "frontend-races",
+          confidence: 75
+        });
+      }
+    }
+  }
+  return findings;
+}
+function detectDanglingListeners(bundle) {
+  const findings = [];
+  for (const file of frontendFiles(bundle)) {
+    const hasRemove = /\bremoveEventListener\s*\(/.test(file.content);
+    for (let i = 0; i < file.lines.length; i++) {
+      const line = file.lines[i];
+      if (/\baddEventListener\s*\(/.test(line) && !hasRemove) {
+        findings.push({
+          id: makeFindingId("frontend-races", file.path, i + 1, "listener no remove"),
+          file: file.path,
+          lineRange: [i + 1, i + 1],
+          domain: "bug",
+          severity: "important",
+          title: "addEventListener without removeEventListener in the same module",
+          rationale: "Event listeners that are not removed accumulate across mounts. Each mount adds another callback, and old callbacks fire against stale state.",
+          suggestion: "Pair every `addEventListener` with a `removeEventListener` in the teardown path. In React, return the cleanup from `useEffect`; in Stimulus, remove in `disconnect()`.",
+          evidence: [`Line ${i + 1}: ${line.trim()}`],
+          validatedBy: "heuristic",
+          subagent: "frontend-races",
+          confidence: 100
+        });
+      }
+    }
+  }
+  return findings;
+}
+function detectMisplacedStateUpdate(bundle) {
+  const findings = [];
+  const useEffectStateRe = /useEffect\s*\(\s*\(\)\s*=>\s*\{\s*set[A-Z]\w*\s*\(/;
+  for (const file of frontendFiles(bundle)) {
+    for (let i = 0; i < file.lines.length; i++) {
+      const window = file.lines.slice(i, Math.min(i + 3, file.lines.length)).join("\n");
+      if (useEffectStateRe.test(window)) {
+        findings.push({
+          id: makeFindingId("frontend-races", file.path, i + 1, "state in useEffect"),
+          file: file.path,
+          lineRange: [i + 1, Math.min(i + 3, file.lines.length)],
+          domain: "bug",
+          severity: "suggestion",
+          title: "useEffect immediately calling setState may indicate derived state",
+          rationale: "When an effect runs only to set state from props or render-time values, the same value can be derived inline. The effect adds a render, a stale-closure risk, and a window where the state and its source disagree.",
+          suggestion: "Compute the value inline from props. Reserve `useEffect` for true side effects (subscriptions, IO).",
+          evidence: [`Line ${i + 1}: ${file.lines[i].trim()}`],
+          validatedBy: "heuristic",
+          subagent: "frontend-races",
+          confidence: 50
+        });
+      }
+    }
+  }
+  return findings;
+}
+function detectStaleResponseRace(bundle) {
+  const findings = [];
+  for (const file of frontendFiles(bundle)) {
+    for (let i = 0; i < file.lines.length - 4; i++) {
+      const window = file.lines.slice(i, i + 5).join("\n");
+      if (!/\bawait\s+(?:fetch|axios|api)/.test(window)) continue;
+      if (!/\bset[A-Z]\w*\s*\(/.test(window)) continue;
+      if (/AbortController|AbortSignal\.timeout|signal:/.test(window)) continue;
+      findings.push({
+        id: makeFindingId("frontend-races", file.path, i + 1, "stale response race"),
+        file: file.path,
+        lineRange: [i + 1, i + 5],
+        domain: "bug",
+        severity: "important",
+        title: "await fetch followed by setState without an abort signal",
+        rationale: "When the component unmounts (or re-renders with new inputs) before the response resolves, the late-arriving setState writes stale data onto a now-replaced component, causing flashes of wrong content or warnings about unmounted components.",
+        suggestion: "Pass `signal: AbortSignal.timeout(ms)` or an `AbortController` and abort it in the cleanup path. Alternatively, ignore the response when a request-generation counter has advanced.",
+        evidence: [`Lines ${i + 1}-${i + 5}`],
+        validatedBy: "heuristic",
+        subagent: "frontend-races",
+        confidence: 75
+      });
+      i += 4;
+    }
+  }
+  return findings;
+}
+function runFrontendRacesAgent(bundle) {
+  const findings = [];
+  findings.push(...detectUnclearedTimers(bundle));
+  findings.push(...detectDanglingListeners(bundle));
+  findings.push(...detectMisplacedStateUpdate(bundle));
+  findings.push(...detectStaleResponseRace(bundle));
+  return findings;
+}
 async function runAgent(bundle) {
   const start = Date.now();
   const runner = AGENT_RUNNERS[bundle.domain];
@@ -9387,6 +9900,160 @@ async function fanOutReview(options) {
   const results = await Promise.all(bundles.map((bundle) => runAgent(bundle)));
   return results;
 }
+async function fanOutConditionalSubagents(options) {
+  const { bundles, activations, depth } = options;
+  if (activations.size === 0 || bundles.length === 0) return [];
+  const bugBundle = bundles.find((b) => b.domain === "bug") ?? bundles[0];
+  const tasks = [];
+  if (activations.has("adversarial")) {
+    tasks.push(
+      Promise.resolve().then(() => {
+        const start = Date.now();
+        const findings = runAdversarialAgent(bugBundle, { runCascades: depth === "deep" });
+        return {
+          subagent: "adversarial",
+          findings,
+          durationMs: Date.now() - start
+        };
+      })
+    );
+  }
+  if (activations.has("typescript-strict")) {
+    tasks.push(
+      Promise.resolve().then(() => {
+        const start = Date.now();
+        const findings = runTypescriptStrictAgent(bugBundle);
+        return {
+          subagent: "typescript-strict",
+          findings,
+          durationMs: Date.now() - start
+        };
+      })
+    );
+  }
+  if (activations.has("frontend-races")) {
+    tasks.push(
+      Promise.resolve().then(() => {
+        const start = Date.now();
+        const findings = runFrontendRacesAgent(bugBundle);
+        return {
+          subagent: "frontend-races",
+          findings,
+          durationMs: Date.now() - start
+        };
+      })
+    );
+  }
+  return Promise.all(tasks);
+}
+function isExcludedPath(path52) {
+  return EXCLUDED_PATH_PATTERNS.some((re) => re.test(path52));
+}
+function isProductionTsFile2(path52) {
+  if (!/\.(ts|tsx)$/.test(path52)) return false;
+  if (/\.d\.ts$/.test(path52)) return false;
+  return !isExcludedPath(path52);
+}
+function countDiffLines(diffContent) {
+  let count = 0;
+  for (const line of diffContent.split("\n")) {
+    if (line.length === 0) continue;
+    const first = line[0];
+    if (first === "+" && !line.startsWith("+++")) count++;
+    else if (first === "-" && !line.startsWith("---")) count++;
+  }
+  return count;
+}
+function countChangedLines(diff2) {
+  let total = 0;
+  let counted = false;
+  for (const [path52, content] of diff2.fileDiffs) {
+    if (isExcludedPath(path52)) continue;
+    total += countDiffLines(content);
+    counted = true;
+  }
+  if (counted) return total;
+  if (diff2.changedFiles.length === 0) return 0;
+  const includedFiles = diff2.changedFiles.filter((p) => !isExcludedPath(p)).length;
+  if (includedFiles === 0) return 0;
+  const ratio = includedFiles / diff2.changedFiles.length;
+  return Math.round(diff2.totalDiffLines * ratio);
+}
+function buildHaystack(diff2, commitMessage) {
+  const parts = [commitMessage];
+  for (const [path52, content] of diff2.fileDiffs) {
+    parts.push(path52);
+    parts.push(content);
+  }
+  if (diff2.fileDiffs.size === 0) {
+    parts.push(...diff2.changedFiles);
+  }
+  return parts.join("\n");
+}
+function keywordMatches(keyword, haystack) {
+  const lowerKey = keyword.toLowerCase();
+  const lowerHay = haystack.toLowerCase();
+  if (keyword.includes(" ")) {
+    return lowerHay.includes(lowerKey);
+  }
+  let idx = lowerHay.indexOf(lowerKey);
+  while (idx !== -1) {
+    const before = idx === 0 ? "" : lowerHay[idx - 1];
+    const after = lowerHay[idx + lowerKey.length] ?? "";
+    const leftOk = before === "" || !WORD_BOUNDARY.test(before);
+    const rightOk = after === "" || !WORD_BOUNDARY.test(after);
+    if (leftOk && rightOk) return true;
+    idx = lowerHay.indexOf(lowerKey, idx + 1);
+  }
+  return false;
+}
+function detectRiskKeywords(diff2, commitMessage) {
+  const haystack = buildHaystack(diff2, commitMessage);
+  const matched = [];
+  for (const keyword of RISK_KEYWORDS) {
+    if (keywordMatches(keyword, haystack)) matched.push(keyword);
+  }
+  return matched;
+}
+function computeDepth(changedLines, riskKeywordCount) {
+  if (changedLines >= 200 || riskKeywordCount >= 2) return "deep";
+  if (changedLines < 50 && riskKeywordCount === 0) return "quick";
+  return "standard";
+}
+function computeActivations(depth, diff2, overridden) {
+  if (overridden && depth === "deep") {
+    return /* @__PURE__ */ new Set(["adversarial", "typescript-strict", "frontend-races"]);
+  }
+  const activations = /* @__PURE__ */ new Set();
+  if (depth !== "quick") activations.add("adversarial");
+  const hasTsFile = diff2.changedFiles.some(isProductionTsFile2);
+  if (hasTsFile) activations.add("typescript-strict");
+  if (activations.has("typescript-strict") && hasAsyncUiSignal(diff2)) {
+    activations.add("frontend-races");
+  }
+  return activations;
+}
+function hasAsyncUiSignal(diff2) {
+  const tsxInDiff = diff2.changedFiles.some((p) => /\.tsx$/.test(p) && !isExcludedPath(p));
+  if (tsxInDiff) return true;
+  for (const [, content] of diff2.fileDiffs) {
+    for (const signal of ASYNC_UI_SIGNALS) {
+      if (signal === ".tsx") continue;
+      if (content.includes(signal)) return true;
+    }
+  }
+  return false;
+}
+function calibrateDepth(options) {
+  const { diff: diff2, commitMessage, override } = options;
+  const changedLines = countChangedLines(diff2);
+  const riskSignals = detectRiskKeywords(diff2, commitMessage);
+  const computed = computeDepth(changedLines, riskSignals.length);
+  const depth = override ?? computed;
+  const overridden = override !== void 0;
+  const activations = computeActivations(depth, diff2, overridden);
+  return { depth, changedLines, riskSignals, activations, overridden };
+}
 function extractCrossFileRefs(finding) {
   const refs = [];
   const crossFilePattern = /([^\s]+\.(?:ts|tsx|js|jsx))\s+affects\s+([^\s]+\.(?:ts|tsx|js|jsx))/i;
@@ -9402,7 +10069,7 @@ function normalizePath(filePath, projectRoot) {
   let normalized = filePath;
   normalized = normalized.replace(/\\/g, "/");
   const normalizedRoot = projectRoot.replace(/\\/g, "/");
-  if (path30.isAbsolute(normalized)) {
+  if (path31.isAbsolute(normalized)) {
     const root = normalizedRoot.endsWith("/") ? normalizedRoot : normalizedRoot + "/";
     if (normalized.startsWith(root)) {
       normalized = normalized.slice(root.length);
@@ -9414,12 +10081,12 @@ function normalizePath(filePath, projectRoot) {
   return normalized;
 }
 function resolveImportPath2(currentFile, importPath) {
-  const dir = path30.dirname(currentFile);
-  let resolved = path30.join(dir, importPath).replace(/\\/g, "/");
+  const dir = path31.dirname(currentFile);
+  let resolved = path31.join(dir, importPath).replace(/\\/g, "/");
   if (!resolved.match(/\.(ts|tsx|js|jsx)$/)) {
     resolved += ".ts";
   }
-  return path30.normalize(resolved).replace(/\\/g, "/");
+  return path31.normalize(resolved).replace(/\\/g, "/");
 }
 function enqueueImports(content, current, visited, queue, maxDepth) {
   const importRegex = /import\s+.*?from\s+['"]([^'"]+)['"]/g;
@@ -9451,7 +10118,7 @@ function isMechanicallyExcluded(finding, exclusionSet, projectRoot) {
   const normalizedFile = normalizePath(finding.file, projectRoot);
   if (exclusionSet.isExcluded(normalizedFile, finding.lineRange)) return true;
   if (exclusionSet.isExcluded(finding.file, finding.lineRange)) return true;
-  const absoluteFile = path30.isAbsolute(finding.file) ? finding.file : path30.join(projectRoot, finding.file).replace(/\\/g, "/");
+  const absoluteFile = path31.isAbsolute(finding.file) ? finding.file : path31.join(projectRoot, finding.file).replace(/\\/g, "/");
   return exclusionSet.isExcluded(absoluteFile, finding.lineRange);
 }
 async function validateWithGraph(crossFileRefs, graph) {
@@ -9509,8 +10176,22 @@ function pickLongest(a, b) {
   if (a && b) return a.length >= b.length ? a : b;
   return a ?? b;
 }
+function confidenceStrength(f) {
+  if (typeof f.confidence === "number") return f.confidence;
+  if (f.confidence === "high") return 75;
+  if (f.confidence === "medium") return 50;
+  if (f.confidence === "low") return 25;
+  return 0;
+}
+function pickPrimary(a, b) {
+  const sevDiff = SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
+  if (sevDiff !== 0) return sevDiff > 0 ? a : b;
+  const confDiff = confidenceStrength(a) - confidenceStrength(b);
+  if (confDiff !== 0) return confDiff > 0 ? a : b;
+  return a;
+}
 function buildMergedTitle(a, b, domains) {
-  const primaryFinding = SEVERITY_RANK[a.severity] >= SEVERITY_RANK[b.severity] ? a : b;
+  const primaryFinding = pickPrimary(a, b);
   const domainList = [...domains].sort().join(", ");
   const cleanTitle = primaryFinding.title.replace(/^\[.*?\]\s*/, "");
   return { title: `[${domainList}] ${cleanTitle}`, primaryFinding };
@@ -9556,6 +10237,7 @@ function mergeFindings(a, b) {
   };
   setIfDefined(merged, "suggestion", pickLongest(a.suggestion, b.suggestion));
   setIfDefined(merged, "trustScore", mergeTrustScore(a, b));
+  setIfDefined(merged, "subagent", primaryFinding.subagent ?? a.subagent ?? b.subagent);
   mergeSecurityFields(merged, primaryFinding, a, b);
   return merged;
 }
@@ -9646,11 +10328,19 @@ function determineAssessment(findings) {
 function getExitCode(assessment) {
   return assessment === "request-changes" ? 1 : 0;
 }
+function formatConfidence(c) {
+  if (c === void 0) return "";
+  if (typeof c === "number") return ` (conf ${c})`;
+  return ` (conf ${c})`;
+}
 function formatFindingBlock(finding) {
   const lines = [];
   const location = `${finding.file}:L${finding.lineRange[0]}-${finding.lineRange[1]}`;
   const trustBadge = finding.trustScore != null ? ` [${finding.trustScore}%]` : "";
-  lines.push(`  [${finding.domain}] ${finding.title}${trustBadge}`);
+  const subagentBadge = finding.subagent && finding.subagent !== finding.domain ? `:${finding.subagent}` : "";
+  lines.push(
+    `  [${finding.domain}${subagentBadge}] ${finding.title}${formatConfidence(finding.confidence)}${trustBadge}`
+  );
   lines.push(`    Location: ${location}`);
   lines.push(`    Rationale: ${finding.rationale}`);
   if (finding.suggestion) {
@@ -9658,9 +10348,28 @@ function formatFindingBlock(finding) {
   }
   return lines.join("\n");
 }
+function titleCase(s) {
+  if (s.length === 0) return s;
+  return s[0].toUpperCase() + s.slice(1);
+}
+function formatDepthHeader(calibration) {
+  const overrideTag = calibration.overridden ? " (override)" : "";
+  const signals = calibration.riskSignals.length === 0 ? "none" : calibration.riskSignals.join(", ");
+  const activations = calibration.activations.size === 0 ? "none" : [...calibration.activations].join(", ");
+  return [
+    `## Review Depth: ${titleCase(calibration.depth)}${overrideTag}`,
+    `  Changed lines: ${calibration.changedLines}`,
+    `  Risk signals: ${signals}`,
+    `  Conditional subagents: ${activations}`,
+    ""
+  ].join("\n");
+}
 function formatTerminalOutput(options) {
   const { findings, strengths } = options;
   const sections = [];
+  if (options.depthCalibration) {
+    sections.push(formatDepthHeader(options.depthCalibration));
+  }
   sections.push("## Strengths\n");
   if (strengths.length === 0) {
     sections.push("  No specific strengths noted.\n");
@@ -10252,6 +10961,22 @@ async function runReviewPipeline(options) {
   if (rubric) {
     contextBundles = contextBundles.map((b) => ({ ...b, rubric }));
   }
+  let depthCalibration;
+  try {
+    depthCalibration = calibrateDepth({
+      diff: diff2,
+      commitMessage,
+      ...flags.depth != null ? { override: flags.depth } : {}
+    });
+  } catch {
+    depthCalibration = {
+      depth: "standard",
+      changedLines: diff2.totalDiffLines,
+      riskSignals: [],
+      activations: /* @__PURE__ */ new Set(),
+      overridden: false
+    };
+  }
   let agentResults;
   if (flags.isolated) {
     const specBundles = splitBundlesByStage(contextBundles, "spec-compliance");
@@ -10264,7 +10989,15 @@ async function runReviewPipeline(options) {
   } else {
     agentResults = await fanOutReview({ bundles: contextBundles });
   }
-  const rawFindings = agentResults.flatMap((r) => r.findings);
+  const conditionalResults = await fanOutConditionalSubagents({
+    bundles: contextBundles,
+    activations: depthCalibration.activations,
+    depth: depthCalibration.depth
+  });
+  const rawFindings = [
+    ...agentResults.flatMap((r) => r.findings),
+    ...conditionalResults.flatMap((r) => r.findings)
+  ];
   const fileContents = /* @__PURE__ */ new Map();
   for (const [file, content] of diff2.fileDiffs) {
     fileContents.set(file, content);
@@ -10298,7 +11031,8 @@ async function runReviewPipeline(options) {
   const terminalOutput = formatTerminalOutput({
     findings: dedupedFindings,
     strengths,
-    ...evidenceCoverage != null ? { evidenceCoverage } : {}
+    ...evidenceCoverage != null ? { evidenceCoverage } : {},
+    depthCalibration
   });
   let githubComments = [];
   if (flags.comment) {
@@ -10313,6 +11047,7 @@ async function runReviewPipeline(options) {
     terminalOutput,
     githubComments,
     exitCode,
+    depthCalibration,
     ...mechanicalResult != null ? { mechanicalResult } : {},
     ...evidenceCoverage != null ? { evidenceCoverage } : {}
   };
@@ -10459,7 +11194,7 @@ function isRegression(from, to) {
 }
 function collectAutopilotStatuses(autopilotPath, featurePlans, allTaskStatuses) {
   try {
-    const raw = fs31.readFileSync(autopilotPath, "utf-8");
+    const raw = fs32.readFileSync(autopilotPath, "utf-8");
     const autopilot = JSON.parse(raw);
     if (!autopilot.phases) return;
     const linkedPhases = autopilot.phases.filter(
@@ -10491,10 +11226,10 @@ function inferStatus(feature, projectPath, allFeatures) {
   const featuresWithPlans = allFeatures.filter((f) => f.plans.length > 0);
   const useRootState = featuresWithPlans.length <= 1;
   if (useRootState) {
-    const rootStatePath = path31.join(projectPath, ".harness", "state.json");
-    if (fs31.existsSync(rootStatePath)) {
+    const rootStatePath = path32.join(projectPath, ".harness", "state.json");
+    if (fs32.existsSync(rootStatePath)) {
       try {
-        const raw = fs31.readFileSync(rootStatePath, "utf-8");
+        const raw = fs32.readFileSync(rootStatePath, "utf-8");
         const state = JSON.parse(raw);
         if (state.progress) {
           for (const status of Object.values(state.progress)) {
@@ -10505,14 +11240,14 @@ function inferStatus(feature, projectPath, allFeatures) {
       }
     }
   }
-  const sessionsDir = path31.join(projectPath, ".harness", "sessions");
-  if (fs31.existsSync(sessionsDir)) {
+  const sessionsDir = path32.join(projectPath, ".harness", "sessions");
+  if (fs32.existsSync(sessionsDir)) {
     try {
-      const sessionDirs = fs31.readdirSync(sessionsDir, { withFileTypes: true });
+      const sessionDirs = fs32.readdirSync(sessionsDir, { withFileTypes: true });
       for (const entry of sessionDirs) {
         if (!entry.isDirectory()) continue;
-        const autopilotPath = path31.join(sessionsDir, entry.name, "autopilot-state.json");
-        if (!fs31.existsSync(autopilotPath)) continue;
+        const autopilotPath = path32.join(sessionsDir, entry.name, "autopilot-state.json");
+        if (!fs32.existsSync(autopilotPath)) continue;
         collectAutopilotStatuses(autopilotPath, feature.plans, allTaskStatuses);
       }
     } catch {
@@ -10627,9 +11362,9 @@ function isValidTrackerShape(tracker) {
 }
 function loadTrackerSyncConfig(projectRoot) {
   try {
-    const configPath = path32.join(projectRoot, "harness.config.json");
-    if (!fs32.existsSync(configPath)) return null;
-    const raw = fs32.readFileSync(configPath, "utf-8");
+    const configPath = path33.join(projectRoot, "harness.config.json");
+    if (!fs33.existsSync(configPath)) return null;
+    const raw = fs33.readFileSync(configPath, "utf-8");
     const config = JSON.parse(raw);
     const tracker = config.roadmap?.tracker;
     if (!isValidTrackerShape(tracker)) return null;
@@ -10749,7 +11484,7 @@ async function fullSync(roadmapPath, adapter2, config, options) {
   });
   await previousSync;
   try {
-    const raw = fs33.readFileSync(roadmapPath, "utf-8");
+    const raw = fs34.readFileSync(roadmapPath, "utf-8");
     const parseResult = parseRoadmap(raw);
     if (!parseResult.ok) {
       return {
@@ -10762,7 +11497,7 @@ async function fullSync(roadmapPath, adapter2, config, options) {
     const tickets = fetchResult.ok ? fetchResult.value : void 0;
     const pushResult = await syncToExternal(roadmap, adapter2, config, tickets);
     const pullResult = await syncFromExternal(roadmap, adapter2, config, options);
-    fs33.writeFileSync(roadmapPath, serializeRoadmap(roadmap), "utf-8");
+    fs34.writeFileSync(roadmapPath, serializeRoadmap(roadmap), "utf-8");
     return {
       created: pushResult.created,
       updated: pushResult.updated,
@@ -11122,9 +11857,9 @@ function makeTrackerConflictBody(err, opts = {}) {
 }
 function loadProjectRoadmapMode(projectRoot) {
   try {
-    const configPath = path33.join(projectRoot, "harness.config.json");
-    if (!fs34.existsSync(configPath)) return getRoadmapMode(null);
-    const raw = fs34.readFileSync(configPath, "utf-8");
+    const configPath = path34.join(projectRoot, "harness.config.json");
+    if (!fs35.existsSync(configPath)) return getRoadmapMode(null);
+    const raw = fs35.readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return getRoadmapMode(parsed);
   } catch {
@@ -11133,11 +11868,11 @@ function loadProjectRoadmapMode(projectRoot) {
 }
 function loadTrackerClientConfigFromProject(projectRoot) {
   try {
-    const configPath = path34.join(projectRoot, "harness.config.json");
-    if (!fs35.existsSync(configPath)) {
+    const configPath = path35.join(projectRoot, "harness.config.json");
+    if (!fs36.existsSync(configPath)) {
       return Err(new Error("harness.config.json not found"));
     }
-    const cfg = JSON.parse(fs35.readFileSync(configPath, "utf-8"));
+    const cfg = JSON.parse(fs36.readFileSync(configPath, "utf-8"));
     const tracker = cfg.roadmap?.tracker;
     if (!tracker) {
       return Err(
@@ -11352,10 +12087,10 @@ function mapAction(action) {
 }
 async function runMigrationPlan(plan, deps, opts) {
   const projectRoot = opts.projectRoot;
-  const roadmapPath = path35.join(projectRoot, "docs", "roadmap.md");
-  const archivedPath = path35.join(projectRoot, "docs", "roadmap.md.archived");
-  const configPath = path35.join(projectRoot, "harness.config.json");
-  const configBackupPath = path35.join(projectRoot, "harness.config.json.pre-migration");
+  const roadmapPath = path36.join(projectRoot, "docs", "roadmap.md");
+  const archivedPath = path36.join(projectRoot, "docs", "roadmap.md.archived");
+  const configPath = path36.join(projectRoot, "harness.config.json");
+  const configBackupPath = path36.join(projectRoot, "harness.config.json.pre-migration");
   const createdSoFar = [];
   const report = {
     created: 0,
@@ -11467,7 +12202,7 @@ async function runMigrationPlan(plan, deps, opts) {
 }
 function getStatePath() {
   const home = process.env["HOME"] || os.homedir();
-  return path38.join(home, ".harness", "update-check.json");
+  return path39.join(home, ".harness", "update-check.json");
 }
 function isUpdateCheckEnabled(configInterval) {
   if (process.env["HARNESS_NO_UPDATE_CHECK"] === "1") return false;
@@ -11480,13 +12215,13 @@ function shouldRunCheck(state, intervalMs) {
 }
 function invalidateCheckState() {
   try {
-    fs38.unlinkSync(getStatePath());
+    fs39.unlinkSync(getStatePath());
   } catch {
   }
 }
 function readCheckState() {
   try {
-    const raw = fs38.readFileSync(getStatePath(), "utf-8");
+    const raw = fs39.readFileSync(getStatePath(), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && "lastCheckTime" in parsed && typeof parsed.lastCheckTime === "number" && "currentVersion" in parsed && typeof parsed.currentVersion === "string") {
       const state = parsed;
@@ -11503,7 +12238,7 @@ function readCheckState() {
 }
 function spawnBackgroundCheck(currentVersion) {
   const statePath = getStatePath();
-  const stateDir = path38.dirname(statePath);
+  const stateDir = path39.dirname(statePath);
   const script = `
 const { execSync } = require('child_process');
 const fs = require('fs');
@@ -11746,14 +12481,14 @@ function getModelPrice(model, dataset) {
   return pricing;
 }
 function getCachePath(projectRoot) {
-  return path39.join(projectRoot, ".harness", "cache", "pricing.json");
+  return path40.join(projectRoot, ".harness", "cache", "pricing.json");
 }
 function getStalenessMarkerPath(projectRoot) {
-  return path39.join(projectRoot, ".harness", "cache", "staleness-marker.json");
+  return path40.join(projectRoot, ".harness", "cache", "staleness-marker.json");
 }
 async function readDiskCache(projectRoot) {
   try {
-    const raw = await fs39.readFile(getCachePath(projectRoot), "utf-8");
+    const raw = await fs40.readFile(getCachePath(projectRoot), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -11761,8 +12496,8 @@ async function readDiskCache(projectRoot) {
 }
 async function writeDiskCache(projectRoot, data) {
   const cachePath = getCachePath(projectRoot);
-  await fs39.mkdir(path39.dirname(cachePath), { recursive: true });
-  await fs39.writeFile(cachePath, JSON.stringify(data, null, 2));
+  await fs40.mkdir(path40.dirname(cachePath), { recursive: true });
+  await fs40.writeFile(cachePath, JSON.stringify(data, null, 2));
 }
 async function fetchFromNetwork() {
   try {
@@ -11789,7 +12524,7 @@ function loadFallbackDataset() {
 async function checkAndWarnStaleness(projectRoot) {
   const markerPath = getStalenessMarkerPath(projectRoot);
   try {
-    const raw = await fs39.readFile(markerPath, "utf-8");
+    const raw = await fs40.readFile(markerPath, "utf-8");
     const marker = JSON.parse(raw);
     const firstUse = new Date(marker.firstFallbackUse).getTime();
     const now = Date.now();
@@ -11801,8 +12536,8 @@ async function checkAndWarnStaleness(projectRoot) {
     }
   } catch {
     try {
-      await fs39.mkdir(path39.dirname(markerPath), { recursive: true });
-      await fs39.writeFile(
+      await fs40.mkdir(path40.dirname(markerPath), { recursive: true });
+      await fs40.writeFile(
         markerPath,
         JSON.stringify({ firstFallbackUse: (/* @__PURE__ */ new Date()).toISOString() })
       );
@@ -11812,7 +12547,7 @@ async function checkAndWarnStaleness(projectRoot) {
 }
 async function clearStalenessMarker(projectRoot) {
   try {
-    await fs39.unlink(getStalenessMarkerPath(projectRoot));
+    await fs40.unlink(getStalenessMarkerPath(projectRoot));
   } catch {
   }
 }
@@ -12049,10 +12784,10 @@ function parseLine(line, lineNumber) {
   return record;
 }
 function readCostRecords(projectRoot) {
-  const costsFile = path40.join(projectRoot, ".harness", "metrics", "costs.jsonl");
+  const costsFile = path41.join(projectRoot, ".harness", "metrics", "costs.jsonl");
   let raw;
   try {
-    raw = fs40.readFileSync(costsFile, "utf-8");
+    raw = fs41.readFileSync(costsFile, "utf-8");
   } catch {
     return [];
   }
@@ -12102,7 +12837,7 @@ function parseCCLine(line, filePath, lineNumber) {
     entry = JSON.parse(line);
   } catch {
     console.warn(
-      `[harness usage] Skipping malformed CC JSONL line ${lineNumber} in ${path41.basename(filePath)}`
+      `[harness usage] Skipping malformed CC JSONL line ${lineNumber} in ${path42.basename(filePath)}`
     );
     return null;
   }
@@ -12116,7 +12851,7 @@ function parseCCLine(line, filePath, lineNumber) {
 function readCCFile(filePath) {
   let raw;
   try {
-    raw = fs41.readFileSync(filePath, "utf-8");
+    raw = fs42.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -12138,10 +12873,10 @@ function readCCFile(filePath) {
 }
 function parseCCRecords() {
   const homeDir = process.env.HOME ?? os2.homedir();
-  const projectsDir = path41.join(homeDir, ".claude", "projects");
+  const projectsDir = path42.join(homeDir, ".claude", "projects");
   let projectDirs;
   try {
-    projectDirs = fs41.readdirSync(projectsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path41.join(projectsDir, d.name));
+    projectDirs = fs42.readdirSync(projectsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path42.join(projectsDir, d.name));
   } catch {
     return [];
   }
@@ -12149,7 +12884,7 @@ function parseCCRecords() {
   for (const dir of projectDirs) {
     let files;
     try {
-      files = fs41.readdirSync(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path41.join(dir, f));
+      files = fs42.readdirSync(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path42.join(dir, f));
     } catch {
       continue;
     }
@@ -12177,10 +12912,10 @@ function parseLine2(line, lineNumber) {
   }
 }
 function readAdoptionRecords(projectRoot) {
-  const adoptionFile = path42.join(projectRoot, ".harness", "metrics", "adoption.jsonl");
+  const adoptionFile = path43.join(projectRoot, ".harness", "metrics", "adoption.jsonl");
   let raw;
   try {
-    raw = fs42.readFileSync(adoptionFile, "utf-8");
+    raw = fs43.readFileSync(adoptionFile, "utf-8");
   } catch {
     return [];
   }
@@ -12253,13 +12988,13 @@ function topSkills(records, n) {
   return aggregateBySkill(records).slice(0, n);
 }
 function loadNotificationsConfig(projectRoot) {
-  const configPath = path43.join(projectRoot, "harness.config.json");
-  if (!fs43.existsSync(configPath)) {
+  const configPath = path44.join(projectRoot, "harness.config.json");
+  if (!fs44.existsSync(configPath)) {
     return Ok({ sinks: [] });
   }
   let raw;
   try {
-    raw = fs43.readFileSync(configPath, "utf-8");
+    raw = fs44.readFileSync(configPath, "utf-8");
   } catch (err) {
     return Err(err instanceof Error ? err : new Error(String(err)));
   }
@@ -12360,25 +13095,25 @@ function resolveStability(contentType) {
   return STABILITY_LOOKUP[contentType] ?? "ephemeral";
 }
 function getOrCreateInstallId(projectRoot) {
-  const harnessDir = path44.join(projectRoot, ".harness");
-  const installIdFile = path44.join(harnessDir, ".install-id");
+  const harnessDir = path45.join(projectRoot, ".harness");
+  const installIdFile = path45.join(harnessDir, ".install-id");
   const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
   try {
-    const existing = fs44.readFileSync(installIdFile, "utf-8").trim();
+    const existing = fs45.readFileSync(installIdFile, "utf-8").trim();
     if (UUID_V4_RE.test(existing)) {
       return existing;
     }
   } catch {
   }
   const id = crypto4.randomUUID();
-  fs44.mkdirSync(harnessDir, { recursive: true });
-  fs44.writeFileSync(installIdFile, id, { encoding: "utf-8", mode: 384 });
+  fs45.mkdirSync(harnessDir, { recursive: true });
+  fs45.writeFileSync(installIdFile, id, { encoding: "utf-8", mode: 384 });
   return id;
 }
 function parseIdentityFromTelemetryFile(filePath) {
   const identity = {};
   try {
-    const raw = fs45.readFileSync(filePath, "utf-8");
+    const raw = fs46.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     const src = parsed?.identity;
     if (!src || typeof src !== "object") return identity;
@@ -12391,7 +13126,7 @@ function parseIdentityFromTelemetryFile(filePath) {
 }
 function readProjectNameFallback(configPath) {
   try {
-    const raw = fs45.readFileSync(configPath, "utf-8");
+    const raw = fs46.readFileSync(configPath, "utf-8");
     const config = JSON.parse(raw);
     return typeof config?.name === "string" ? config.name : void 0;
   } catch {
@@ -12412,10 +13147,10 @@ function readGitAliasFallback(cwd) {
   }
 }
 function readIdentity(projectRoot) {
-  const filePath = path45.join(projectRoot, ".harness", "telemetry.json");
+  const filePath = path46.join(projectRoot, ".harness", "telemetry.json");
   const identity = parseIdentityFromTelemetryFile(filePath);
   if (!identity.project) {
-    const fallbackProject = readProjectNameFallback(path45.join(projectRoot, "harness.config.json"));
+    const fallbackProject = readProjectNameFallback(path46.join(projectRoot, "harness.config.json"));
     if (fallbackProject) identity.project = fallbackProject;
   }
   if (!identity.alias) {
@@ -12545,12 +13280,12 @@ function acquireCompoundLock(category, opts = {}) {
     );
   }
   const cwd = opts.cwd ?? process.cwd();
-  const lockDir = path46.join(cwd, ".harness", "locks");
-  fs46.mkdirSync(lockDir, { recursive: true });
-  const lockPath = path46.join(lockDir, `compound-${category}.lock`);
+  const lockDir = path47.join(cwd, ".harness", "locks");
+  fs47.mkdirSync(lockDir, { recursive: true });
+  const lockPath = path47.join(lockDir, `compound-${category}.lock`);
   let fd;
   try {
-    fd = fs46.openSync(lockPath, "wx");
+    fd = fs47.openSync(lockPath, "wx");
   } catch (e) {
     const err = e;
     if (err.code === "EEXIST") {
@@ -12559,14 +13294,14 @@ function acquireCompoundLock(category, opts = {}) {
     }
     throw err;
   }
-  fs46.writeSync(fd, String(process.pid));
-  fs46.closeSync(fd);
+  fs47.writeSync(fd, String(process.pid));
+  fs47.closeSync(fd);
   let released = false;
   const release = () => {
     if (released) return;
     released = true;
     try {
-      fs46.unlinkSync(lockPath);
+      fs47.unlinkSync(lockPath);
     } catch {
     }
     process.removeListener("exit", onExit);
@@ -12592,7 +13327,7 @@ function acquireCompoundLock(category, opts = {}) {
 }
 function readHolderPid(lockPath) {
   try {
-    const raw = fs46.readFileSync(lockPath, "utf-8").trim();
+    const raw = fs47.readFileSync(lockPath, "utf-8").trim();
     const n = Number.parseInt(raw, 10);
     return Number.isFinite(n) ? n : -1;
   } catch {
@@ -12624,10 +13359,10 @@ function assertSanitized(value) {
 }
 function writePulseConfig(config, opts) {
   PulseConfigSchema.parse(config);
-  if (!fs47.existsSync(opts.configPath)) {
+  if (!fs48.existsSync(opts.configPath)) {
     throw new Error(`harness.config.json not found at ${opts.configPath}`);
   }
-  const raw = fs47.readFileSync(opts.configPath, "utf-8");
+  const raw = fs48.readFileSync(opts.configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -12635,18 +13370,18 @@ function writePulseConfig(config, opts) {
     throw new Error(`Invalid JSON in ${opts.configPath}: ${e.message}`, { cause: e });
   }
   const bakPath = `${opts.configPath}.bak`;
-  if (!opts.skipBackup && !fs47.existsSync(bakPath)) {
-    fs47.writeFileSync(bakPath, raw, "utf-8");
+  if (!opts.skipBackup && !fs48.existsSync(bakPath)) {
+    fs48.writeFileSync(bakPath, raw, "utf-8");
   }
   parsed.pulse = config;
   const serialized = JSON.stringify(parsed, null, 2) + "\n";
   const tmpPath = `${opts.configPath}.tmp-${process.pid}`;
-  fs47.writeFileSync(tmpPath, serialized, "utf-8");
+  fs48.writeFileSync(tmpPath, serialized, "utf-8");
   try {
-    fs47.renameSync(tmpPath, opts.configPath);
+    fs48.renameSync(tmpPath, opts.configPath);
   } catch (e) {
     try {
-      fs47.unlinkSync(tmpPath);
+      fs48.unlinkSync(tmpPath);
     } catch {
     }
     throw e;
@@ -12654,12 +13389,12 @@ function writePulseConfig(config, opts) {
 }
 function seedFromStrategy(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const strategyPath = path47.join(cwd, "STRATEGY.md");
+  const strategyPath = path48.join(cwd, "STRATEGY.md");
   const warnings = [];
-  if (!fs48.existsSync(strategyPath)) {
+  if (!fs49.existsSync(strategyPath)) {
     return { name: null, keyMetrics: [], warnings: ["STRATEGY.md not found"] };
   }
-  const raw = fs48.readFileSync(strategyPath, "utf-8");
+  const raw = fs49.readFileSync(strategyPath, "utf-8");
   let name = null;
   const fmMatch = /^---\s*\n([\s\S]*?)\n---\s*\n/.exec(raw);
   const fm = fmMatch?.[1];
@@ -12811,7 +13546,7 @@ function loadTemplate() {
     const url = import.meta?.url;
     if (!url) return INLINE_TEMPLATE;
     const here = dirname16(fileURLToPath(url));
-    return readFileSync392(join612(here, "template.md"), "utf-8");
+    return readFileSync392(join622(here, "template.md"), "utf-8");
   } catch {
     return INLINE_TEMPLATE;
   }
@@ -13000,11 +13735,11 @@ async function computeHotspots(opts) {
   }
   const counts = /* @__PURE__ */ new Map();
   for (const line of stdout.split("\n")) {
-    const path50 = line.trim();
-    if (path50.length === 0) continue;
-    counts.set(path50, (counts.get(path50) ?? 0) + 1);
+    const path52 = line.trim();
+    if (path52.length === 0) continue;
+    counts.set(path52, (counts.get(path52) ?? 0) + 1);
   }
-  return [...counts.entries()].filter(([, c]) => c > opts.threshold).map(([path50, churn]) => ({ path: path50, churn })).sort((a, b) => b.churn - a.churn);
+  return [...counts.entries()].filter(([, c]) => c > opts.threshold).map(([path52, churn]) => ({ path: path52, churn })).sort((a, b) => b.churn - a.churn);
 }
 function tokenize(text) {
   return new Set(
@@ -13014,12 +13749,12 @@ function tokenize(text) {
 async function* walk2(dir) {
   let entries;
   try {
-    entries = await fs49.readdir(dir, { withFileTypes: true });
+    entries = await fs50.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const e of entries) {
-    const p = path48.join(dir, e.name);
+    const p = path49.join(dir, e.name);
     if (e.isDirectory()) yield* walk2(p);
     else if (e.isFile() && e.name.endsWith(".md")) yield p;
   }
@@ -13028,11 +13763,11 @@ async function readDocumentedTokens(solutionsDir) {
   const docs = [];
   for (const [track, categories] of TRACK_CATEGORIES2) {
     for (const category of categories) {
-      const dir = path48.join(solutionsDir, track, category);
+      const dir = path49.join(solutionsDir, track, category);
       for await (const file of walk2(dir)) {
-        const raw = await fs49.readFile(file, "utf-8");
+        const raw = await fs50.readFile(file, "utf-8");
         const m = /^#\s+(.+)$/m.exec(raw);
-        const title = m?.[1] ?? path48.basename(file, ".md");
+        const title = m?.[1] ?? path49.basename(file, ".md");
         docs.push(tokenize(title));
       }
     }
@@ -13095,19 +13830,89 @@ function assembleCandidateReport(input) {
   }
   return lines.join("\n");
 }
+function emitFrontmatter(doc) {
+  const lines = [
+    "---",
+    `name: ${doc.frontmatter.name}`,
+    `last_updated: "${doc.frontmatter.last_updated}"`,
+    `version: ${doc.frontmatter.version}`,
+    "---"
+  ];
+  return lines.join("\n");
+}
+function emitH1(doc, opts) {
+  if (typeof opts.h1 === "string" && opts.h1.trim().length > 0) {
+    return opts.h1.trimEnd();
+  }
+  return `# ${doc.frontmatter.name} Strategy`;
+}
+function emitSection(name, body) {
+  const trimmed = body.trim();
+  return trimmed.length === 0 ? `## ${name}
+` : `## ${name}
+
+${trimmed}
+`;
+}
+function serializeStrategyDoc(doc, opts = {}) {
+  const sectionByName = new Map(doc.sections.map((s) => [s.name, s.body]));
+  const sectionBlocks = [];
+  for (const name of SECTION_ORDER) {
+    const body = sectionByName.get(name);
+    if (body === void 0) continue;
+    sectionBlocks.push(emitSection(name, body));
+  }
+  const blocks = [emitFrontmatter(doc), "", emitH1(doc, opts), "", sectionBlocks.join("\n")];
+  const out = blocks.join("\n");
+  return out.endsWith("\n") ? out : out + "\n";
+}
+function readExistingH1(filePath) {
+  if (!fs51.existsSync(filePath)) return void 0;
+  const raw = fs51.readFileSync(filePath, "utf-8");
+  const lines = raw.split("\n").slice(0, 50);
+  for (const line of lines) {
+    if (line.startsWith("# ")) return line.trimEnd();
+  }
+  return void 0;
+}
+function writeStrategyDoc(doc, opts) {
+  StrategyDocSchema.parse(doc);
+  const targetPath = path50.join(opts.cwd, FILENAME);
+  const bakPath = `${targetPath}.bak`;
+  const tmpPath = `${targetPath}.tmp-${process.pid}`;
+  const preservedH1 = readExistingH1(targetPath);
+  if (fs51.existsSync(targetPath) && !opts.skipBackup && !fs51.existsSync(bakPath)) {
+    const raw = fs51.readFileSync(targetPath, "utf-8");
+    fs51.writeFileSync(bakPath, raw, "utf-8");
+  }
+  const serialized = serializeStrategyDoc(
+    doc,
+    preservedH1 !== void 0 ? { h1: preservedH1 } : {}
+  );
+  fs51.writeFileSync(tmpPath, serialized, "utf-8");
+  try {
+    fs51.renameSync(tmpPath, targetPath);
+  } catch (e) {
+    try {
+      fs51.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw e;
+  }
+}
 function proposalsDir(projectPath) {
-  return path49.join(projectPath, ".harness", "proposals");
+  return path51.join(projectPath, ".harness", "proposals");
 }
 function proposalPath(projectPath, id) {
-  return path49.join(proposalsDir(projectPath), `${id}.json`);
+  return path51.join(proposalsDir(projectPath), `${id}.json`);
 }
 function ensureDir(dir) {
-  fs50.mkdirSync(dir, { recursive: true });
+  fs52.mkdirSync(dir, { recursive: true });
 }
 function writeAtomic(filePath, content) {
   const tmpPath = `${filePath}.tmp`;
-  fs50.writeFileSync(tmpPath, content);
-  fs50.renameSync(tmpPath, filePath);
+  fs52.writeFileSync(tmpPath, content);
+  fs52.renameSync(tmpPath, filePath);
 }
 async function createProposal(projectPath, input) {
   const validated = EmitSkillProposalInputSchema.parse(input);
@@ -13145,7 +13950,7 @@ async function createProposal(projectPath, input) {
 async function getProposal(projectPath, id) {
   const file = proposalPath(projectPath, id);
   try {
-    const raw = fs50.readFileSync(file, "utf-8");
+    const raw = fs52.readFileSync(file, "utf-8");
     const parsed = SkillProposalSchema.safeParse(JSON.parse(raw));
     return parsed.success ? parsed.data : null;
   } catch {
@@ -13156,7 +13961,7 @@ async function listProposals(projectPath, opts = {}) {
   const dir = proposalsDir(projectPath);
   let files;
   try {
-    files = fs50.readdirSync(dir);
+    files = fs52.readdirSync(dir);
   } catch {
     return [];
   }
@@ -13201,17 +14006,19 @@ function deriveSkillUsage(projectRoot, skillName, windowDays = 30) {
   if (lastUsed) stats.lastUsed = lastUsed;
   return stats;
 }
-var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, KEBAB_CASE, TICKET_ID, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, MAX_TOP_AFFECTED, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, OSV_ENDPOINT, DEFAULT_CACHE_DIR, DEFAULT_TTL_HOURS, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, DEFAULT_CAPACITY, CacheMetricsRecorder, RETRY_BACKOFFS_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_BATCH_SIZE, defaultFetch, defaultWarn, OTLPExporter, SERVICE_NAME_ATTR, SpanKind, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY, ProposalNotFoundError, ProposalConflictError;
+var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, KNOWN_SECTION_NAMES, ISO_DATE, PLACEHOLDER_INLINE, REQUIRED, ALLOWED, StrategyFrontmatterSchema, StrategySectionSchema, StrategyDocSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE2, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, KEBAB_CASE, TICKET_ID, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, readFile72, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, MAX_TOP_AFFECTED, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, OSV_ENDPOINT, DEFAULT_CACHE_DIR, DEFAULT_TTL_HOURS, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, ADVERSARIAL_DESCRIPTOR, UNVERIFIED_INPUT_PATTERN, PROMISE_NO_REJECT_PATTERN, UNGUARDED_OPTIONAL_CALL, COMPOSE_NO_AWAIT, FETCH_NO_TIMEOUT, TYPESCRIPT_STRICT_DESCRIPTOR, EXPLICIT_ANY_PATTERN, TS_IGNORE_PATTERN, UNSAFE_AS_UNKNOWN, NON_NULL_ASSERTION, VAGUE_HELPER_NAME, FRONTEND_RACES_DESCRIPTOR, AGENT_DESCRIPTORS, CONDITIONAL_SUBAGENT_DESCRIPTORS, AGENT_RUNNERS, SUBAGENT_ORDER, RISK_KEYWORDS, EXCLUDED_PATH_PATTERNS, ASYNC_UI_SIGNALS, WORD_BOUNDARY, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, DEFAULT_CAPACITY, CacheMetricsRecorder, RETRY_BACKOFFS_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_BATCH_SIZE, defaultFetch, defaultWarn, OTLPExporter, SERVICE_NAME_ATTR, SpanKind, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY, SECTION_ORDER, FILENAME, ProposalNotFoundError, ProposalConflictError;
 var init_dist3 = __esm({
   "../core/dist/index.mjs"() {
     init_chunk_FYTJQ2ZY();
-    init_chunk_BTUDWWB4();
+    init_chunk_S4DTDJ6J();
     init_chunk_MUWJHO2S();
     init_chunk_XKLVJIPL();
     init_chunk_IIEDD47I();
     init_chunk_7P6ASYW6();
     init_dist();
     init_dist();
+    init_dist();
+    init_dist();
     init_dist2();
     init_dist();
     init_dist();
@@ -13228,6 +14035,8 @@ var init_dist3 = __esm({
     init_dist();
     init_dist2();
     init_dist();
+    init_dist();
+    init_dist();
     WHATWG_BAD_PORTS = Object.freeze([
       1,
       7,
@@ -13351,6 +14160,67 @@ var init_dist3 = __esm({
       pendingMetrics: z.array(z.string()),
       excludedMetrics: z.array(z.string())
     });
+    KNOWN_SECTION_NAMES = /* @__PURE__ */ new Set([
+      ...REQUIRED_STRATEGY_SECTIONS,
+      ...OPTIONAL_STRATEGY_SECTIONS
+    ]);
+    ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+    PLACEHOLDER_INLINE = /<[^<>\n]*\s[^<>\n]*>/;
+    REQUIRED = new Set(REQUIRED_STRATEGY_SECTIONS);
+    ALLOWED = /* @__PURE__ */ new Set([
+      ...REQUIRED_STRATEGY_SECTIONS,
+      ...OPTIONAL_STRATEGY_SECTIONS
+    ]);
+    StrategyFrontmatterSchema = z2.object({
+      name: z2.string().min(1, "frontmatter.name must be a non-empty string"),
+      last_updated: z2.string().regex(ISO_DATE, "frontmatter.last_updated must be ISO date YYYY-MM-DD"),
+      version: z2.number().int("frontmatter.version must be an integer").positive("frontmatter.version must be \u2265 1")
+    });
+    StrategySectionSchema = z2.object({
+      name: z2.enum([...REQUIRED_STRATEGY_SECTIONS, ...OPTIONAL_STRATEGY_SECTIONS]),
+      body: z2.string()
+    });
+    StrategyDocSchema = z2.object({
+      frontmatter: StrategyFrontmatterSchema,
+      sections: z2.array(StrategySectionSchema)
+    }).superRefine((doc, ctx) => {
+      const seen = /* @__PURE__ */ new Set();
+      for (const section of doc.sections) {
+        if (!ALLOWED.has(section.name)) {
+          ctx.addIssue({
+            code: z2.ZodIssueCode.custom,
+            message: `unknown section "${section.name}" \u2014 only documented sections are allowed`,
+            path: ["sections"]
+          });
+          continue;
+        }
+        if (seen.has(section.name)) {
+          ctx.addIssue({
+            code: z2.ZodIssueCode.custom,
+            message: `section "${section.name}" appears more than once`,
+            path: ["sections"]
+          });
+        }
+        seen.add(section.name);
+        const issue = bodyContentIssue(section.body);
+        if (issue !== null) {
+          ctx.addIssue({
+            code: z2.ZodIssueCode.custom,
+            message: `section "${section.name}": ${issue}`,
+            path: ["sections", section.name]
+          });
+        }
+      }
+      for (const required of REQUIRED) {
+        if (!seen.has(required)) {
+          ctx.addIssue({
+            code: z2.ZodIssueCode.custom,
+            message: `required section "${required}" is missing`,
+            path: ["sections", required]
+          });
+        }
+      }
+    });
     BUG_TRACK_CATEGORIES = [
       "build-errors",
       "test-failures",
@@ -13374,22 +14244,22 @@ var init_dist3 = __esm({
       ...BUG_TRACK_CATEGORIES,
       ...KNOWLEDGE_TRACK_CATEGORIES
     ];
-    ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
-    BugTrackSchema = z2.object({
-      track: z2.literal("bug-track"),
-      category: z2.enum(BUG_TRACK_CATEGORIES)
+    ISO_DATE2 = /^\d{4}-\d{2}-\d{2}$/;
+    BugTrackSchema = z3.object({
+      track: z3.literal("bug-track"),
+      category: z3.enum(BUG_TRACK_CATEGORIES)
     });
-    KnowledgeTrackSchema = z2.object({
-      track: z2.literal("knowledge-track"),
-      category: z2.enum(KNOWLEDGE_TRACK_CATEGORIES)
+    KnowledgeTrackSchema = z3.object({
+      track: z3.literal("knowledge-track"),
+      category: z3.enum(KNOWLEDGE_TRACK_CATEGORIES)
     });
-    BaseFrontmatter = z2.object({
-      module: z2.string().min(1),
-      tags: z2.array(z2.string()),
-      problem_type: z2.string().min(1),
-      last_updated: z2.string().regex(ISO_DATE, "last_updated must be ISO date YYYY-MM-DD")
+    BaseFrontmatter = z3.object({
+      module: z3.string().min(1),
+      tags: z3.array(z3.string()),
+      problem_type: z3.string().min(1),
+      last_updated: z3.string().regex(ISO_DATE2, "last_updated must be ISO date YYYY-MM-DD")
     });
-    SolutionDocFrontmatterSchema = z2.discriminatedUnion("track", [
+    SolutionDocFrontmatterSchema = z3.discriminatedUnion("track", [
       BaseFrontmatter.merge(BugTrackSchema),
       BaseFrontmatter.merge(KnowledgeTrackSchema)
     ]);
@@ -13545,81 +14415,81 @@ var init_dist3 = __esm({
         { category: "config", patterns: ["harness.config.json", "package.json"], priority: 5 }
       ]
     };
-    ManifestSchema = z3.object({
-      name: z3.string(),
-      version: z3.string(),
-      description: z3.string().optional(),
-      include: z3.array(z3.string()).min(1),
-      minHarnessVersion: z3.string().optional(),
-      keywords: z3.array(z3.string()).optional().default([]),
-      layers: z3.record(z3.array(z3.string())).optional(),
-      boundaries: z3.array(
-        z3.object({
-          name: z3.string(),
-          layer: z3.string(),
-          direction: z3.enum(["input", "output"]),
-          schema: z3.string()
+    ManifestSchema = z4.object({
+      name: z4.string(),
+      version: z4.string(),
+      description: z4.string().optional(),
+      include: z4.array(z4.string()).min(1),
+      minHarnessVersion: z4.string().optional(),
+      keywords: z4.array(z4.string()).optional().default([]),
+      layers: z4.record(z4.array(z4.string())).optional(),
+      boundaries: z4.array(
+        z4.object({
+          name: z4.string(),
+          layer: z4.string(),
+          direction: z4.enum(["input", "output"]),
+          schema: z4.string()
         })
       ).optional()
     });
-    BundleConstraintsSchema = z3.object({
-      layers: z3.array(
-        z3.object({
-          name: z3.string(),
-          pattern: z3.string(),
-          allowedDependencies: z3.array(z3.string())
+    BundleConstraintsSchema = z4.object({
+      layers: z4.array(
+        z4.object({
+          name: z4.string(),
+          pattern: z4.string(),
+          allowedDependencies: z4.array(z4.string())
         })
       ).optional(),
-      forbiddenImports: z3.array(
-        z3.object({
-          from: z3.string(),
-          disallow: z3.array(z3.string()),
-          message: z3.string().optional()
+      forbiddenImports: z4.array(
+        z4.object({
+          from: z4.string(),
+          disallow: z4.array(z4.string()),
+          message: z4.string().optional()
         })
       ).optional(),
-      boundaries: z3.object({
-        requireSchema: z3.array(z3.string()).optional()
+      boundaries: z4.object({
+        requireSchema: z4.array(z4.string()).optional()
       }).optional(),
-      architecture: z3.object({
-        thresholds: z3.record(z3.unknown()).optional(),
-        modules: z3.record(z3.record(z3.unknown())).optional()
+      architecture: z4.object({
+        thresholds: z4.record(z4.unknown()).optional(),
+        modules: z4.record(z4.record(z4.unknown())).optional()
       }).optional(),
-      security: z3.object({
-        rules: z3.record(z3.string()).optional()
+      security: z4.object({
+        rules: z4.record(z4.string()).optional()
       }).optional()
     });
-    BundleSchema = z3.object({
-      name: z3.string(),
-      version: z3.string(),
-      description: z3.string().optional(),
-      minHarnessVersion: z3.string().optional(),
+    BundleSchema = z4.object({
+      name: z4.string(),
+      version: z4.string(),
+      description: z4.string().optional(),
+      minHarnessVersion: z4.string().optional(),
       manifest: ManifestSchema,
       constraints: BundleConstraintsSchema,
-      contributions: z3.record(z3.unknown()).optional()
+      contributions: z4.record(z4.unknown()).optional()
     });
-    ContributionsSchema = z3.record(z3.unknown());
-    LockfilePackageSchema = z3.object({
-      version: z3.string(),
-      source: z3.string(),
-      installedAt: z3.string(),
-      contributions: z3.record(z3.unknown()).optional().nullable(),
-      resolved: z3.string().optional(),
-      integrity: z3.string().optional(),
-      provenance: z3.array(z3.string()).optional()
+    ContributionsSchema = z4.record(z4.unknown());
+    LockfilePackageSchema = z4.object({
+      version: z4.string(),
+      source: z4.string(),
+      installedAt: z4.string(),
+      contributions: z4.record(z4.unknown()).optional().nullable(),
+      resolved: z4.string().optional(),
+      integrity: z4.string().optional(),
+      provenance: z4.array(z4.string()).optional()
     });
-    LockfileSchema = z3.object({
-      version: z3.literal(1).optional(),
+    LockfileSchema = z4.object({
+      version: z4.literal(1).optional(),
       // Used by some tests
-      lockfileVersion: z3.literal(1).optional(),
+      lockfileVersion: z4.literal(1).optional(),
       // Standard field
-      packages: z3.record(LockfilePackageSchema)
+      packages: z4.record(LockfilePackageSchema)
     }).refine((data) => data.version !== void 0 || data.lockfileVersion !== void 0, {
       message: "Either 'version' or 'lockfileVersion' must be present and equal to 1"
     });
-    SharableLayerSchema = z3.unknown();
-    SharableForbiddenImportSchema = z3.unknown();
-    SharableBoundaryConfigSchema = z3.unknown();
-    SharableSecurityRulesSchema = z3.unknown();
+    SharableLayerSchema = z4.unknown();
+    SharableForbiddenImportSchema = z4.unknown();
+    SharableBoundaryConfigSchema = z4.unknown();
+    SharableSecurityRulesSchema = z4.unknown();
     VALID_SCOPES = /* @__PURE__ */ new Set([
       "entropy",
       "architecture",
@@ -13629,11 +14499,11 @@ var init_dist3 = __esm({
     LINE_PATTERN = /^[ \t]*(?:\/\/|#)\s*harness-ignore(?!\s*(?:SEC-|-start|-end))(?:\s+([\w,]+))?(?::\s*(.+))?$/;
     START_PATTERN = /^[ \t]*(?:\/\/|#)\s*harness-ignore-start(?:\s+([\w,]+))?(?::\s*(.+))?$/;
     END_PATTERN = /^[ \t]*(?:\/\/|#)\s*harness-ignore-end\s*$/;
-    readFile62 = promisify(fs6.readFile);
-    writeFile32 = promisify(fs6.writeFile);
-    unlink22 = promisify(fs6.unlink);
-    mkdir22 = promisify(fs6.mkdir);
-    copyFile2 = promisify(fs6.copyFile);
+    readFile72 = promisify(fs7.readFile);
+    writeFile32 = promisify(fs7.writeFile);
+    unlink22 = promisify(fs7.unlink);
+    mkdir22 = promisify(fs7.mkdir);
+    copyFile2 = promisify(fs7.copyFile);
     DEFAULT_FIX_CONFIG = {
       dryRun: false,
       fixTypes: ["unused-imports", "dead-files"],
@@ -13661,45 +14531,45 @@ var init_dist3 = __esm({
       "commented-code": "Delete commented block",
       "unused-import": "Remove import"
     };
-    MustExportRuleSchema = z4.object({
-      type: z4.literal("must-export"),
-      names: z4.array(z4.string())
+    MustExportRuleSchema = z5.object({
+      type: z5.literal("must-export"),
+      names: z5.array(z5.string())
     });
-    MustExportDefaultRuleSchema = z4.object({
-      type: z4.literal("must-export-default"),
-      kind: z4.enum(["class", "function", "object"]).optional()
+    MustExportDefaultRuleSchema = z5.object({
+      type: z5.literal("must-export-default"),
+      kind: z5.enum(["class", "function", "object"]).optional()
     });
-    NoExportRuleSchema = z4.object({
-      type: z4.literal("no-export"),
-      names: z4.array(z4.string())
+    NoExportRuleSchema = z5.object({
+      type: z5.literal("no-export"),
+      names: z5.array(z5.string())
     });
-    MustImportRuleSchema = z4.object({
-      type: z4.literal("must-import"),
-      from: z4.string(),
-      names: z4.array(z4.string()).optional()
+    MustImportRuleSchema = z5.object({
+      type: z5.literal("must-import"),
+      from: z5.string(),
+      names: z5.array(z5.string()).optional()
     });
-    NoImportRuleSchema = z4.object({
-      type: z4.literal("no-import"),
-      from: z4.string()
+    NoImportRuleSchema = z5.object({
+      type: z5.literal("no-import"),
+      from: z5.string()
     });
-    NamingRuleSchema = z4.object({
-      type: z4.literal("naming"),
-      match: z4.string(),
-      convention: z4.enum(["camelCase", "PascalCase", "UPPER_SNAKE", "kebab-case"])
+    NamingRuleSchema = z5.object({
+      type: z5.literal("naming"),
+      match: z5.string(),
+      convention: z5.enum(["camelCase", "PascalCase", "UPPER_SNAKE", "kebab-case"])
     });
-    MaxExportsRuleSchema = z4.object({
-      type: z4.literal("max-exports"),
-      count: z4.number().positive()
+    MaxExportsRuleSchema = z5.object({
+      type: z5.literal("max-exports"),
+      count: z5.number().positive()
     });
-    MaxLinesRuleSchema = z4.object({
-      type: z4.literal("max-lines"),
-      count: z4.number().positive()
+    MaxLinesRuleSchema = z5.object({
+      type: z5.literal("max-lines"),
+      count: z5.number().positive()
     });
-    RequireJSDocRuleSchema = z4.object({
-      type: z4.literal("require-jsdoc"),
-      for: z4.array(z4.enum(["function", "class", "export"]))
+    RequireJSDocRuleSchema = z5.object({
+      type: z5.literal("require-jsdoc"),
+      for: z5.array(z5.enum(["function", "class", "export"]))
     });
-    RuleSchema = z4.discriminatedUnion("type", [
+    RuleSchema = z5.discriminatedUnion("type", [
       MustExportRuleSchema,
       MustExportDefaultRuleSchema,
       NoExportRuleSchema,
@@ -13710,53 +14580,54 @@ var init_dist3 = __esm({
       MaxLinesRuleSchema,
       RequireJSDocRuleSchema
     ]);
-    ConfigPatternSchema = z4.object({
-      name: z4.string().min(1),
-      description: z4.string(),
-      severity: z4.enum(["error", "warning"]),
-      files: z4.array(z4.string()),
+    ConfigPatternSchema = z5.object({
+      name: z5.string().min(1),
+      description: z5.string(),
+      severity: z5.enum(["error", "warning"]),
+      files: z5.array(z5.string()),
       rule: RuleSchema,
-      message: z4.string().optional()
+      message: z5.string().optional()
     });
-    PatternConfigSchema = z4.object({
-      patterns: z4.array(ConfigPatternSchema),
-      customPatterns: z4.array(z4.any()).optional(),
+    PatternConfigSchema = z5.object({
+      patterns: z5.array(ConfigPatternSchema),
+      customPatterns: z5.array(z5.any()).optional(),
       // Code patterns are functions, can't validate
-      ignoreFiles: z4.array(z4.string()).optional()
+      ignoreFiles: z5.array(z5.string()).optional()
     });
-    DriftConfigSchema = z4.object({
-      docPaths: z4.array(z4.string()).optional(),
-      checkApiSignatures: z4.boolean().optional(),
-      checkExamples: z4.boolean().optional(),
-      checkStructure: z4.boolean().optional(),
-      ignorePatterns: z4.array(z4.string()).optional()
+    DriftConfigSchema = z5.object({
+      docPaths: z5.array(z5.string()).optional(),
+      checkApiSignatures: z5.boolean().optional(),
+      checkExamples: z5.boolean().optional(),
+      checkStructure: z5.boolean().optional(),
+      ignorePatterns: z5.array(z5.string()).optional(),
+      forwardLookingPaths: z5.array(z5.string()).optional()
     });
-    DeadCodeConfigSchema = z4.object({
-      entryPoints: z4.array(z4.string()).optional(),
-      includeTypes: z4.boolean().optional(),
-      includeInternals: z4.boolean().optional(),
-      ignorePatterns: z4.array(z4.string()).optional(),
-      treatDynamicImportsAs: z4.enum(["used", "unknown"]).optional()
+    DeadCodeConfigSchema = z5.object({
+      entryPoints: z5.array(z5.string()).optional(),
+      includeTypes: z5.boolean().optional(),
+      includeInternals: z5.boolean().optional(),
+      ignorePatterns: z5.array(z5.string()).optional(),
+      treatDynamicImportsAs: z5.enum(["used", "unknown"]).optional()
     });
-    EntropyConfigSchema = z4.object({
-      rootDir: z4.string(),
-      parser: z4.any().optional(),
+    EntropyConfigSchema = z5.object({
+      rootDir: z5.string(),
+      parser: z5.any().optional(),
       // LanguageParser instance, can't validate
-      entryPoints: z4.array(z4.string()).optional(),
-      analyze: z4.object({
-        drift: z4.union([z4.boolean(), DriftConfigSchema]).optional(),
-        deadCode: z4.union([z4.boolean(), DeadCodeConfigSchema]).optional(),
-        patterns: z4.union([z4.boolean(), PatternConfigSchema]).optional()
+      entryPoints: z5.array(z5.string()).optional(),
+      analyze: z5.object({
+        drift: z5.union([z5.boolean(), DriftConfigSchema]).optional(),
+        deadCode: z5.union([z5.boolean(), DeadCodeConfigSchema]).optional(),
+        patterns: z5.union([z5.boolean(), PatternConfigSchema]).optional()
       }),
-      include: z4.array(z4.string()).optional(),
-      exclude: z4.array(z4.string()).optional(),
-      docPaths: z4.array(z4.string()).optional()
+      include: z5.array(z5.string()).optional(),
+      exclude: z5.array(z5.string()).optional(),
+      docPaths: z5.array(z5.string()).optional()
     });
     MAX_TOP_AFFECTED = 5;
     BaselineManager = class {
       baselinesPath;
       constructor(projectRoot) {
-        this.baselinesPath = join17(projectRoot, ".harness", "perf", "baselines.json");
+        this.baselinesPath = join18(projectRoot, ".harness", "perf", "baselines.json");
       }
       /**
        * Load the baselines file from disk.
@@ -14030,16 +14901,16 @@ var init_dist3 = __esm({
       walkDir(dir, entries) {
         let items;
         try {
-          items = fs8.readdirSync(dir, { withFileTypes: true });
+          items = fs9.readdirSync(dir, { withFileTypes: true });
         } catch {
           return;
         }
         for (const item of items) {
           if (item.isDirectory()) {
             if (DEFAULT_SKIP_DIRS.has(item.name)) continue;
-            this.walkDir(path5.join(dir, item.name), entries);
-          } else if (item.isFile() && SOURCE_EXTENSIONS.has(path5.extname(item.name))) {
-            this.scanFile(path5.join(dir, item.name), entries);
+            this.walkDir(path6.join(dir, item.name), entries);
+          } else if (item.isFile() && SOURCE_EXTENSIONS.has(path6.extname(item.name))) {
+            this.scanFile(path6.join(dir, item.name), entries);
           }
         }
       }
@@ -14054,12 +14925,12 @@ var init_dist3 = __esm({
       scanFile(filePath, entries) {
         let content;
         try {
-          content = fs8.readFileSync(filePath, "utf-8");
+          content = fs9.readFileSync(filePath, "utf-8");
         } catch {
           return;
         }
         const lines = content.split("\n");
-        const relativePath = path5.relative(this.projectRoot, filePath).replace(/\\/g, "/");
+        const relativePath = path6.relative(this.projectRoot, filePath).replace(/\\/g, "/");
         for (let i = 0; i < lines.length; i++) {
           if (!lines[i].includes("@perf-critical")) continue;
           const fnName = this.resolveFunctionName(lines, i + 1);
@@ -14458,80 +15329,80 @@ var init_dist3 = __esm({
         return Ok(void 0);
       }
     };
-    ConfidenceTierSchema = z5.enum(["high", "medium", "low"]);
-    RegressionResultSchema = z5.object({
-      slope: z5.number(),
-      intercept: z5.number(),
-      rSquared: z5.number().min(0).max(1),
-      dataPoints: z5.number().int().min(0)
+    ConfidenceTierSchema = z6.enum(["high", "medium", "low"]);
+    RegressionResultSchema = z6.object({
+      slope: z6.number(),
+      intercept: z6.number(),
+      rSquared: z6.number().min(0).max(1),
+      dataPoints: z6.number().int().min(0)
     });
-    DirectionSchema = z5.enum(["improving", "stable", "declining"]);
-    CategoryForecastSchema = z5.object({
+    DirectionSchema = z6.enum(["improving", "stable", "declining"]);
+    CategoryForecastSchema = z6.object({
       category: ArchMetricCategorySchema,
-      current: z5.number(),
-      threshold: z5.number(),
-      projectedValue4w: z5.number(),
-      projectedValue8w: z5.number(),
-      projectedValue12w: z5.number(),
-      thresholdCrossingWeeks: z5.number().nullable(),
+      current: z6.number(),
+      threshold: z6.number(),
+      projectedValue4w: z6.number(),
+      projectedValue8w: z6.number(),
+      projectedValue12w: z6.number(),
+      thresholdCrossingWeeks: z6.number().nullable(),
       confidence: ConfidenceTierSchema,
       regression: RegressionResultSchema,
       direction: DirectionSchema
     });
-    SpecImpactSignalsSchema = z5.object({
-      newFileCount: z5.number().int().min(0),
-      affectedLayers: z5.array(z5.string()),
-      newDependencies: z5.number().int().min(0),
-      phaseCount: z5.number().int().min(0)
+    SpecImpactSignalsSchema = z6.object({
+      newFileCount: z6.number().int().min(0),
+      affectedLayers: z6.array(z6.string()),
+      newDependencies: z6.number().int().min(0),
+      phaseCount: z6.number().int().min(0)
     });
-    SpecImpactEstimateSchema = z5.object({
-      specPath: z5.string(),
-      featureName: z5.string(),
+    SpecImpactEstimateSchema = z6.object({
+      specPath: z6.string(),
+      featureName: z6.string(),
       signals: SpecImpactSignalsSchema,
-      deltas: z5.record(ArchMetricCategorySchema, z5.number()).optional()
+      deltas: z6.record(ArchMetricCategorySchema, z6.number()).optional()
     });
-    ContributingFeatureSchema = z5.object({
-      name: z5.string(),
-      specPath: z5.string(),
-      delta: z5.number()
+    ContributingFeatureSchema = z6.object({
+      name: z6.string(),
+      specPath: z6.string(),
+      delta: z6.number()
     });
-    AdjustedForecastSchema = z5.object({
+    AdjustedForecastSchema = z6.object({
       baseline: CategoryForecastSchema,
       adjusted: CategoryForecastSchema,
-      contributingFeatures: z5.array(ContributingFeatureSchema)
+      contributingFeatures: z6.array(ContributingFeatureSchema)
     });
-    PredictionWarningSchema = z5.object({
-      severity: z5.enum(["critical", "warning", "info"]),
+    PredictionWarningSchema = z6.object({
+      severity: z6.enum(["critical", "warning", "info"]),
       category: ArchMetricCategorySchema,
-      message: z5.string(),
-      weeksUntil: z5.number(),
+      message: z6.string(),
+      weeksUntil: z6.number(),
       confidence: ConfidenceTierSchema,
-      contributingFeatures: z5.array(z5.string())
+      contributingFeatures: z6.array(z6.string())
     });
-    StabilityForecastSchema = z5.object({
-      current: z5.number(),
-      projected4w: z5.number(),
-      projected8w: z5.number(),
-      projected12w: z5.number(),
+    StabilityForecastSchema = z6.object({
+      current: z6.number(),
+      projected4w: z6.number(),
+      projected8w: z6.number(),
+      projected12w: z6.number(),
       confidence: ConfidenceTierSchema,
       direction: DirectionSchema
     });
-    PredictionResultSchema = z5.object({
-      generatedAt: z5.string(),
-      snapshotsUsed: z5.number().int().min(0),
-      timelineRange: z5.object({
-        from: z5.string(),
-        to: z5.string()
+    PredictionResultSchema = z6.object({
+      generatedAt: z6.string(),
+      snapshotsUsed: z6.number().int().min(0),
+      timelineRange: z6.object({
+        from: z6.string(),
+        to: z6.string()
       }),
       stabilityForecast: StabilityForecastSchema,
-      categories: z5.record(ArchMetricCategorySchema, AdjustedForecastSchema),
-      warnings: z5.array(PredictionWarningSchema)
+      categories: z6.record(ArchMetricCategorySchema, AdjustedForecastSchema),
+      warnings: z6.array(PredictionWarningSchema)
     });
-    PredictionOptionsSchema = z5.object({
-      horizon: z5.number().int().min(1).default(12),
-      includeRoadmap: z5.boolean().default(true),
-      categories: z5.array(ArchMetricCategorySchema).optional(),
-      thresholds: z5.record(ArchMetricCategorySchema, z5.number()).optional()
+    PredictionOptionsSchema = z6.object({
+      horizon: z6.number().int().min(1).default(12),
+      includeRoadmap: z6.boolean().default(true),
+      categories: z6.array(ArchMetricCategorySchema).optional(),
+      thresholds: z6.record(ArchMetricCategorySchema, z6.number()).optional()
     });
     VALID_STATUSES = /* @__PURE__ */ new Set([
       "backlog",
@@ -14864,8 +15735,8 @@ var init_dist3 = __esm({
           return null;
         }
         try {
-          const roadmapPath = path6.join(this.rootDir, "roadmap.md");
-          const raw = fs9.readFileSync(roadmapPath, "utf-8");
+          const roadmapPath = path7.join(this.rootDir, "roadmap.md");
+          const raw = fs10.readFileSync(roadmapPath, "utf-8");
           const parseResult = parseRoadmap(raw);
           if (!parseResult.ok) return null;
           const features = parseResult.value.milestones.flatMap(
@@ -14900,8 +15771,8 @@ var init_dist3 = __esm({
        * @param specPath - Relative path from rootDir to the spec file.
        */
       estimate(specPath) {
-        const absolutePath = path7.join(this.rootDir, specPath);
-        const content = fs10.readFileSync(absolutePath, "utf-8");
+        const absolutePath = path8.join(this.rootDir, specPath);
+        const content = fs11.readFileSync(absolutePath, "utf-8");
         const newFileCount = this.extractNewFileCount(content);
         const affectedLayers = this.extractAffectedLayers(content);
         const newDependencies = this.extractNewDependencies(content);
@@ -14913,7 +15784,7 @@ var init_dist3 = __esm({
           phaseCount
         );
         const h1Match = content.match(/^#\s+(.+)$/m);
-        const featureName = h1Match ? h1Match[1].trim() : path7.basename(specPath, ".md");
+        const featureName = h1Match ? h1Match[1].trim() : path8.basename(specPath, ".md");
         return {
           specPath,
           featureName,
@@ -14934,8 +15805,8 @@ var init_dist3 = __esm({
         const results = [];
         for (const feature of features) {
           if (!feature.spec) continue;
-          const absolutePath = path7.join(this.rootDir, feature.spec);
-          if (!fs10.existsSync(absolutePath)) continue;
+          const absolutePath = path8.join(this.rootDir, feature.spec);
+          if (!fs11.existsSync(absolutePath)) continue;
           const estimate = this.estimate(feature.spec);
           results.push({ ...estimate, featureName: feature.name });
         }
@@ -14963,8 +15834,8 @@ var init_dist3 = __esm({
         }
         let count = 0;
         for (const fp of filePaths) {
-          const absolute = path7.join(this.rootDir, fp);
-          if (!fs10.existsSync(absolute)) {
+          const absolute = path8.join(this.rootDir, fp);
+          if (!fs11.existsSync(absolute)) {
             count++;
           }
         }
@@ -15034,8 +15905,8 @@ var init_dist3 = __esm({
       // --- Private: Config Loading ---
       loadLayerNames() {
         try {
-          const configPath = path7.join(this.rootDir, "harness.config.json");
-          const raw = fs10.readFileSync(configPath, "utf-8");
+          const configPath = path8.join(this.rootDir, "harness.config.json");
+          const raw = fs11.readFileSync(configPath, "utf-8");
           const config = JSON.parse(raw);
           return (config.layers ?? []).map((l) => l.name);
         } catch {
@@ -15054,8 +15925,8 @@ var init_dist3 = __esm({
       historyPath;
       /** Load history from disk, returning empty history if file doesn't exist. */
       load() {
-        if (!fs11.existsSync(this.historyPath)) return { ...EMPTY_HISTORY, snapshots: [] };
-        const raw = fs11.readFileSync(this.historyPath, "utf-8");
+        if (!fs12.existsSync(this.historyPath)) return { ...EMPTY_HISTORY, snapshots: [] };
+        const raw = fs12.readFileSync(this.historyPath, "utf-8");
         return JSON.parse(raw);
       }
       /** Append a timestamped snapshot of current violations. */
@@ -15069,18 +15940,18 @@ var init_dist3 = __esm({
       }
       /** Prune snapshots older than retentionDays. */
       prune(retentionDays) {
-        if (!fs11.existsSync(this.historyPath)) return;
+        if (!fs12.existsSync(this.historyPath)) return;
         const history = this.load();
         const cutoff = Date.now() - retentionDays * 24 * 60 * 60 * 1e3;
         history.snapshots = history.snapshots.filter((s) => new Date(s.timestamp).getTime() >= cutoff);
         this.write(history);
       }
       write(history) {
-        const dir = path8.dirname(this.historyPath);
-        if (!fs11.existsSync(dir)) {
-          fs11.mkdirSync(dir, { recursive: true });
+        const dir = path9.dirname(this.historyPath);
+        if (!fs12.existsSync(dir)) {
+          fs12.mkdirSync(dir, { recursive: true });
         }
-        fs11.writeFileSync(this.historyPath, JSON.stringify(history, null, 2), "utf-8");
+        fs12.writeFileSync(this.historyPath, JSON.stringify(history, null, 2), "utf-8");
       }
     };
     NORMALIZERS = {
@@ -15095,81 +15966,81 @@ var init_dist3 = __esm({
     MAX_SAMPLES = 5;
     DEFAULT_WINDOW_WEEKS = 4;
     DEFAULT_MIN_OCCURRENCES = 3;
-    FailureEntrySchema = z6.object({
-      date: z6.string(),
-      skill: z6.string(),
-      type: z6.string(),
-      description: z6.string()
+    FailureEntrySchema = z7.object({
+      date: z7.string(),
+      skill: z7.string(),
+      type: z7.string(),
+      description: z7.string()
     });
-    HandoffSchema = z6.object({
-      timestamp: z6.string(),
-      fromSkill: z6.string(),
-      phase: z6.string(),
-      summary: z6.string(),
-      completed: z6.array(z6.string()).default([]),
-      pending: z6.array(z6.string()).default([]),
-      concerns: z6.array(z6.string()).default([]),
-      decisions: z6.array(
-        z6.object({
-          what: z6.string(),
-          why: z6.string()
+    HandoffSchema = z7.object({
+      timestamp: z7.string(),
+      fromSkill: z7.string(),
+      phase: z7.string(),
+      summary: z7.string(),
+      completed: z7.array(z7.string()).default([]),
+      pending: z7.array(z7.string()).default([]),
+      concerns: z7.array(z7.string()).default([]),
+      decisions: z7.array(
+        z7.object({
+          what: z7.string(),
+          why: z7.string()
         })
       ).default([]),
-      blockers: z6.array(z6.string()).default([]),
-      contextKeywords: z6.array(z6.string()).default([]),
-      recommendedSkills: z6.object({
-        apply: z6.array(z6.string()),
-        reference: z6.array(z6.string()),
-        consider: z6.array(z6.string()),
-        skillsPath: z6.string()
+      blockers: z7.array(z7.string()).default([]),
+      contextKeywords: z7.array(z7.string()).default([]),
+      recommendedSkills: z7.object({
+        apply: z7.array(z7.string()),
+        reference: z7.array(z7.string()),
+        consider: z7.array(z7.string()),
+        skillsPath: z7.string()
       }).optional()
     });
-    GateCheckSchema = z6.object({
-      name: z6.string(),
-      passed: z6.boolean(),
-      command: z6.string(),
-      output: z6.string().optional(),
-      duration: z6.number().optional()
+    GateCheckSchema = z7.object({
+      name: z7.string(),
+      passed: z7.boolean(),
+      command: z7.string(),
+      output: z7.string().optional(),
+      duration: z7.number().optional()
     });
-    GateResultSchema = z6.object({
-      passed: z6.boolean(),
-      checks: z6.array(GateCheckSchema)
+    GateResultSchema = z7.object({
+      passed: z7.boolean(),
+      checks: z7.array(GateCheckSchema)
     });
-    GateConfigSchema = z6.object({
-      checks: z6.array(
-        z6.object({
-          name: z6.string(),
-          command: z6.string()
+    GateConfigSchema = z7.object({
+      checks: z7.array(
+        z7.object({
+          name: z7.string(),
+          command: z7.string()
         })
       ).optional(),
-      trace: z6.boolean().optional()
+      trace: z7.boolean().optional()
     });
-    HarnessStateSchema = z6.object({
-      schemaVersion: z6.literal(1),
-      position: z6.object({
-        phase: z6.string().optional(),
-        task: z6.string().optional()
+    HarnessStateSchema = z7.object({
+      schemaVersion: z7.literal(1),
+      position: z7.object({
+        phase: z7.string().optional(),
+        task: z7.string().optional()
       }).default({}),
-      decisions: z6.array(
-        z6.object({
-          date: z6.string(),
-          decision: z6.string(),
-          context: z6.string()
+      decisions: z7.array(
+        z7.object({
+          date: z7.string(),
+          decision: z7.string(),
+          context: z7.string()
         })
       ).default([]),
-      blockers: z6.array(
-        z6.object({
-          id: z6.string(),
-          description: z6.string(),
-          status: z6.enum(["open", "resolved"])
+      blockers: z7.array(
+        z7.object({
+          id: z7.string(),
+          description: z7.string(),
+          status: z7.enum(["open", "resolved"])
         })
       ).default([]),
-      progress: z6.record(z6.enum(["pending", "in_progress", "complete"])).default({}),
-      lastSession: z6.object({
-        date: z6.string(),
-        summary: z6.string(),
-        lastSkill: z6.string().optional(),
-        pendingTasks: z6.array(z6.string()).optional()
+      progress: z7.record(z7.enum(["pending", "in_progress", "complete"])).default({}),
+      lastSession: z7.object({
+        date: z7.string(),
+        summary: z7.string(),
+        lastSkill: z7.string().optional(),
+        pendingTasks: z7.array(z7.string()).optional()
       }).optional()
     });
     DEFAULT_STATE = {
@@ -15179,16 +16050,16 @@ var init_dist3 = __esm({
       blockers: [],
       progress: {}
     };
-    StreamInfoSchema = z7.object({
-      name: z7.string(),
-      branch: z7.string().optional(),
-      createdAt: z7.string(),
-      lastActiveAt: z7.string()
+    StreamInfoSchema = z8.object({
+      name: z8.string(),
+      branch: z8.string().optional(),
+      createdAt: z8.string(),
+      lastActiveAt: z8.string()
     });
-    StreamIndexSchema = z7.object({
-      schemaVersion: z7.literal(1),
-      activeStream: z7.string().nullable(),
-      streams: z7.record(StreamInfoSchema)
+    StreamIndexSchema = z8.object({
+      schemaVersion: z8.literal(1),
+      activeStream: z8.string().nullable(),
+      streams: z8.record(StreamInfoSchema)
     });
     DEFAULT_STREAM_INDEX = {
       schemaVersion: 1,
@@ -15229,15 +16100,15 @@ var init_dist3 = __esm({
     failuresCacheMap = /* @__PURE__ */ new Map();
     FAILURE_LINE_REGEX = /^- \*\*(\d{4}-\d{2}-\d{2}) \[skill:([^\]]+)\] \[type:([^\]]+)\]:\*\* (.+)$/;
     SAFE_GATE_COMMAND = /^(?:npm|pnpm|yarn)\s+(?:test|run\s+[\w.-]+|run-script\s+[\w.-]+)$|^go\s+(?:test|build|vet|fmt)\s+[\w./ -]+$|^(?:python|python3)\s+-m\s+[\w.-]+$|^make\s+[\w.-]+$|^cargo\s+(?:test|build|check|clippy)(?:\s+[\w./ -]+)?$|^(?:gradle|mvn)\s+[\w:.-]+$/;
-    SkillEventSchema = z8.object({
-      timestamp: z8.string(),
-      skill: z8.string(),
-      session: z8.string().optional(),
-      type: z8.enum(["phase_transition", "decision", "gate_result", "handoff", "error", "checkpoint"]),
-      summary: z8.string(),
-      data: z8.record(z8.unknown()).optional(),
-      refs: z8.array(z8.string()).optional(),
-      contentHash: z8.string().optional()
+    SkillEventSchema = z9.object({
+      timestamp: z9.string(),
+      skill: z9.string(),
+      session: z9.string().optional(),
+      type: z9.enum(["phase_transition", "decision", "gate_result", "handoff", "error", "checkpoint"]),
+      summary: z9.string(),
+      data: z9.record(z9.unknown()).optional(),
+      refs: z9.array(z9.string()).optional(),
+      contentHash: z9.string().optional()
     });
     knownHashesCache = /* @__PURE__ */ new Map();
     EVENT_FORMATTERS = {
@@ -15280,19 +16151,19 @@ var init_dist3 = __esm({
       rules: {},
       exclude: [...skipDirGlobs(), "**/*.test.ts", "**/fixtures/**"]
     };
-    RuleOverrideSchema = z9.enum(["off", "error", "warning", "info"]);
-    SecurityConfigSchema = z9.object({
-      enabled: z9.boolean().default(true),
-      strict: z9.boolean().default(false),
-      rules: z9.record(z9.string(), RuleOverrideSchema).optional().default({}),
-      exclude: z9.array(z9.string()).optional().default([...skipDirGlobs(), "**/*.test.ts", "**/fixtures/**"]),
-      external: z9.object({
-        semgrep: z9.object({
-          enabled: z9.union([z9.literal("auto"), z9.boolean()]).default("auto"),
-          rulesets: z9.array(z9.string()).optional()
+    RuleOverrideSchema = z10.enum(["off", "error", "warning", "info"]);
+    SecurityConfigSchema = z10.object({
+      enabled: z10.boolean().default(true),
+      strict: z10.boolean().default(false),
+      rules: z10.record(z10.string(), RuleOverrideSchema).optional().default({}),
+      exclude: z10.array(z10.string()).optional().default([...skipDirGlobs(), "**/*.test.ts", "**/fixtures/**"]),
+      external: z10.object({
+        semgrep: z10.object({
+          enabled: z10.union([z10.literal("auto"), z10.boolean()]).default("auto"),
+          rulesets: z10.array(z10.string()).optional()
         }).optional(),
-        gitleaks: z9.object({
-          enabled: z9.union([z9.literal("auto"), z9.boolean()]).default("auto")
+        gitleaks: z10.object({
+          enabled: z10.union([z10.literal("auto"), z10.boolean()]).default("auto")
         }).optional()
       }).optional()
     });
@@ -16082,7 +16953,7 @@ var init_dist3 = __esm({
       }
       async scanFile(filePath) {
         if (!this.config.enabled) return [];
-        const content = await fs29.readFile(filePath, "utf-8");
+        const content = await fs30.readFile(filePath, "utf-8");
         return this.scanContentForFile(content, filePath, 1);
       }
       scanContentForFile(content, filePath, startLine = 1) {
@@ -16204,7 +17075,7 @@ var init_dist3 = __esm({
       }
     };
     OSV_ENDPOINT = "https://api.osv.dev/v1/query";
-    DEFAULT_CACHE_DIR = path26.join(".harness", "cache", "osv");
+    DEFAULT_CACHE_DIR = path27.join(".harness", "cache", "osv");
     DEFAULT_TTL_HOURS = 24;
     hiddenUnicodePatterns = [
       {
@@ -16415,88 +17286,88 @@ var init_dist3 = __esm({
     ];
     TAINT_DURATION_MS = 30 * 60 * 1e3;
     DEFAULT_SESSION_ID = "default";
-    SecurityCategorySnapshotSchema = z10.object({
-      findingCount: z10.number(),
-      errorCount: z10.number(),
-      warningCount: z10.number(),
-      infoCount: z10.number()
+    SecurityCategorySnapshotSchema = z11.object({
+      findingCount: z11.number(),
+      errorCount: z11.number(),
+      warningCount: z11.number(),
+      infoCount: z11.number()
     });
-    SupplyChainSnapshotSchema = z10.object({
-      critical: z10.number(),
-      high: z10.number(),
-      moderate: z10.number(),
-      low: z10.number(),
-      info: z10.number(),
-      total: z10.number()
+    SupplyChainSnapshotSchema = z11.object({
+      critical: z11.number(),
+      high: z11.number(),
+      moderate: z11.number(),
+      low: z11.number(),
+      info: z11.number(),
+      total: z11.number()
     });
-    SecurityTimelineSnapshotSchema = z10.object({
-      capturedAt: z10.string().datetime(),
-      commitHash: z10.string(),
-      securityScore: z10.number().min(0).max(100),
-      totalFindings: z10.number(),
-      bySeverity: z10.object({
-        error: z10.number(),
-        warning: z10.number(),
-        info: z10.number()
+    SecurityTimelineSnapshotSchema = z11.object({
+      capturedAt: z11.string().datetime(),
+      commitHash: z11.string(),
+      securityScore: z11.number().min(0).max(100),
+      totalFindings: z11.number(),
+      bySeverity: z11.object({
+        error: z11.number(),
+        warning: z11.number(),
+        info: z11.number()
       }),
-      byCategory: z10.record(z10.string(), SecurityCategorySnapshotSchema),
+      byCategory: z11.record(z11.string(), SecurityCategorySnapshotSchema),
       supplyChain: SupplyChainSnapshotSchema,
-      suppressionCount: z10.number(),
-      findingIds: z10.array(z10.string())
+      suppressionCount: z11.number(),
+      findingIds: z11.array(z11.string())
     });
-    FindingLifecycleSchema = z10.object({
-      findingId: z10.string(),
-      ruleId: z10.string(),
-      category: z10.string(),
-      severity: z10.string(),
-      file: z10.string(),
-      firstSeenAt: z10.string().datetime(),
-      firstSeenCommit: z10.string(),
-      resolvedAt: z10.string().datetime().nullable(),
-      resolvedCommit: z10.string().nullable()
+    FindingLifecycleSchema = z11.object({
+      findingId: z11.string(),
+      ruleId: z11.string(),
+      category: z11.string(),
+      severity: z11.string(),
+      file: z11.string(),
+      firstSeenAt: z11.string().datetime(),
+      firstSeenCommit: z11.string(),
+      resolvedAt: z11.string().datetime().nullable(),
+      resolvedCommit: z11.string().nullable()
     });
-    SecurityTimelineFileSchema = z10.object({
-      version: z10.literal(1),
-      snapshots: z10.array(SecurityTimelineSnapshotSchema),
-      findingLifecycles: z10.array(FindingLifecycleSchema)
+    SecurityTimelineFileSchema = z11.object({
+      version: z11.literal(1),
+      snapshots: z11.array(SecurityTimelineSnapshotSchema),
+      findingLifecycles: z11.array(FindingLifecycleSchema)
     });
-    DirectionSchema2 = z10.enum(["improving", "stable", "declining"]);
-    SecurityTrendLineSchema = z10.object({
-      current: z10.number(),
-      previous: z10.number(),
-      delta: z10.number(),
+    DirectionSchema2 = z11.enum(["improving", "stable", "declining"]);
+    SecurityTrendLineSchema = z11.object({
+      current: z11.number(),
+      previous: z11.number(),
+      delta: z11.number(),
       direction: DirectionSchema2
     });
-    TrendAttributionSchema = z10.object({
-      category: z10.string(),
-      delta: z10.number(),
+    TrendAttributionSchema = z11.object({
+      category: z11.string(),
+      delta: z11.number(),
       direction: DirectionSchema2,
-      description: z10.string()
+      description: z11.string()
     });
-    SecurityTrendResultSchema = z10.object({
+    SecurityTrendResultSchema = z11.object({
       score: SecurityTrendLineSchema,
       totalFindings: SecurityTrendLineSchema,
-      bySeverity: z10.object({
+      bySeverity: z11.object({
         error: SecurityTrendLineSchema,
         warning: SecurityTrendLineSchema,
         info: SecurityTrendLineSchema
       }),
       supplyChain: SecurityTrendLineSchema,
-      snapshotCount: z10.number(),
-      from: z10.string(),
-      to: z10.string(),
-      attribution: z10.array(TrendAttributionSchema)
+      snapshotCount: z11.number(),
+      from: z11.string(),
+      to: z11.string(),
+      attribution: z11.array(TrendAttributionSchema)
     });
-    TimeToFixStatsSchema = z10.object({
-      mean: z10.number(),
-      median: z10.number(),
-      count: z10.number()
+    TimeToFixStatsSchema = z11.object({
+      mean: z11.number(),
+      median: z11.number(),
+      count: z11.number()
     });
-    TimeToFixResultSchema = z10.object({
+    TimeToFixResultSchema = z11.object({
       overall: TimeToFixStatsSchema,
-      byCategory: z10.record(z10.string(), TimeToFixStatsSchema),
-      openFindings: z10.number(),
-      oldestOpenDays: z10.number().nullable()
+      byCategory: z11.record(z11.string(), TimeToFixStatsSchema),
+      openFindings: z11.number(),
+      oldestOpenDays: z11.number().nullable()
     });
     EMPTY_SUPPLY_CHAIN = {
       critical: 0,
@@ -16511,7 +17382,7 @@ var init_dist3 = __esm({
       timelinePath;
       constructor(rootDir) {
         this.rootDir = rootDir;
-        this.timelinePath = join39(rootDir, ".harness", "security", "timeline.json");
+        this.timelinePath = join40(rootDir, ".harness", "security", "timeline.json");
       }
       /**
        * Load timeline from disk.
@@ -17133,6 +18004,49 @@ var init_dist3 = __esm({
       ]
     };
     RELEVANCE_THRESHOLD = 0.3;
+    ADVERSARIAL_DESCRIPTOR = {
+      domain: "bug",
+      tier: "strong",
+      displayName: "Adversarial",
+      focusAreas: [
+        "Assumption violation \u2014 hidden invariants the diff assumes but does not enforce",
+        "Composition failures \u2014 two correct pieces that misbehave together",
+        "Abuse cases \u2014 adversarial input shapes the diff does not anticipate",
+        "Cascade chains (Deep only) \u2014 a single failure propagating through downstream callers"
+      ]
+    };
+    UNVERIFIED_INPUT_PATTERN = /\bJSON\.parse\s*\(\s*(?:req\.|request\.|body\.|input\.|params\.|query\.)/;
+    PROMISE_NO_REJECT_PATTERN = /\bnew\s+Promise\s*\(\s*\(?\s*(?:resolve|res)\b\s*(?:\)|,\s*\))/;
+    UNGUARDED_OPTIONAL_CALL = /\b([A-Za-z_$][\w$]*)\?\.\1\s*\(/;
+    COMPOSE_NO_AWAIT = /^\s*[A-Za-z_$][\w$]*\s*\(.*\)\s*\.\s*then\s*\(/;
+    FETCH_NO_TIMEOUT = /\bfetch\s*\(\s*[^,)]+\)/;
+    TYPESCRIPT_STRICT_DESCRIPTOR = {
+      domain: "bug",
+      tier: "standard",
+      displayName: "TypeScript-strict",
+      focusAreas: [
+        "Type holes that disable the checker (any, unknown-as-X assertions, ts-ignore/ts-expect-error)",
+        "Existing-file complexity (large file growth as a Single-Responsibility risk)",
+        "Refactor regression risk \u2014 changed exports without companion test updates",
+        "Five-second rule \u2014 names a reader cannot guess from the call site"
+      ]
+    };
+    EXPLICIT_ANY_PATTERN = /(?<![A-Za-z0-9_$])(?:any|Array\s*<\s*any\s*>)(?![A-Za-z0-9_$])/;
+    TS_IGNORE_PATTERN = /\/\/\s*@?ts-(ignore|expect-error)\b/;
+    UNSAFE_AS_UNKNOWN = /\bas\s+unknown\s+as\s+\w+/;
+    NON_NULL_ASSERTION = /\)!|\]\s*!|[\w$]+!\.(?:[\w$])/;
+    VAGUE_HELPER_NAME = /^\s*(?:export\s+)?(?:async\s+)?function\s+(handle|process|do|stuff|util|helper)\w*\s*\(/i;
+    FRONTEND_RACES_DESCRIPTOR = {
+      domain: "bug",
+      tier: "standard",
+      displayName: "Frontend-races",
+      focusAreas: [
+        "Lifecycle cleanup gaps \u2014 listeners or timers outliving the owner",
+        "Hook timing mistakes \u2014 state set in the wrong hook, async after unmount",
+        "Concurrent interactions \u2014 overlapping clicks/requests, impossible-state booleans",
+        "Stale work \u2014 promises and timers whose callbacks fire after teardown"
+      ]
+    };
     AGENT_DESCRIPTORS = {
       compliance: COMPLIANCE_DESCRIPTOR,
       bug: BUG_DETECTION_DESCRIPTOR,
@@ -17140,6 +18054,11 @@ var init_dist3 = __esm({
       architecture: ARCHITECTURE_DESCRIPTOR,
       learnings: LEARNINGS_DESCRIPTOR
     };
+    CONDITIONAL_SUBAGENT_DESCRIPTORS = {
+      adversarial: ADVERSARIAL_DESCRIPTOR,
+      "typescript-strict": TYPESCRIPT_STRICT_DESCRIPTOR,
+      "frontend-races": FRONTEND_RACES_DESCRIPTOR
+    };
     AGENT_RUNNERS = {
       compliance: runComplianceAgent,
       bug: runBugDetectionAgent,
@@ -17147,6 +18066,57 @@ var init_dist3 = __esm({
       architecture: runArchitectureAgent,
       learnings: runLearningsAgent
     };
+    SUBAGENT_ORDER = [
+      "compliance",
+      "bug",
+      "security",
+      "architecture",
+      "learnings",
+      "adversarial",
+      "typescript-strict",
+      "frontend-races"
+    ];
+    RISK_KEYWORDS = Object.freeze([
+      "auth",
+      "authn",
+      "authz",
+      "password",
+      "token",
+      "payment",
+      "billing",
+      "migration",
+      "migrate",
+      "external API",
+      "webhook",
+      "cryptography",
+      "crypto",
+      "session",
+      "cookie",
+      "personally identifiable",
+      "PII",
+      "compliance"
+    ]);
+    EXCLUDED_PATH_PATTERNS = [
+      /\.test\.(ts|tsx|js|jsx|mjs|cjs)$/,
+      /\.spec\.(ts|tsx|js|jsx|mjs|cjs)$/,
+      /__tests__\//,
+      /(^|\/)dist\//,
+      /(^|\/)build\//,
+      /\.generated\.(ts|tsx|js|jsx)$/,
+      /(^|\/)pnpm-lock\.yaml$/,
+      /(^|\/)package-lock\.json$/,
+      /(^|\/)yarn\.lock$/
+    ];
+    ASYNC_UI_SIGNALS = Object.freeze([
+      ".tsx",
+      "useEffect",
+      "useState",
+      "setTimeout",
+      "setInterval",
+      "addEventListener",
+      "data-controller="
+    ]);
+    WORD_BOUNDARY = /[A-Za-z0-9_]/;
     DOWNGRADE_MAP = {
       critical: "important",
       important: "suggestion",
@@ -18160,28 +19130,28 @@ ${JSON.stringify(event)}`;
       runMigrationPlan: () => runMigrationPlan
     });
     HASH_RE = /<!--\s*harness-history\s+hash:([0-9a-f]{8})\s*-->/i;
-    InteractionTypeSchema = z11.enum(["question", "confirmation", "transition"]);
-    QuestionSchema = z11.object({
-      text: z11.string(),
-      options: z11.array(z11.string()).optional(),
-      default: z11.string().optional()
+    InteractionTypeSchema = z12.enum(["question", "confirmation", "transition"]);
+    QuestionSchema = z12.object({
+      text: z12.string(),
+      options: z12.array(z12.string()).optional(),
+      default: z12.string().optional()
     });
-    ConfirmationSchema = z11.object({
-      text: z11.string(),
-      context: z11.string()
+    ConfirmationSchema = z12.object({
+      text: z12.string(),
+      context: z12.string()
     });
-    TransitionSchema = z11.object({
-      completedPhase: z11.string(),
-      suggestedNext: z11.string(),
-      reason: z11.string(),
-      artifacts: z11.array(z11.string()),
-      requiresConfirmation: z11.boolean(),
-      summary: z11.string()
+    TransitionSchema = z12.object({
+      completedPhase: z12.string(),
+      suggestedNext: z12.string(),
+      reason: z12.string(),
+      artifacts: z12.array(z12.string()),
+      requiresConfirmation: z12.boolean(),
+      summary: z12.string()
     });
-    EmitInteractionInputSchema = z11.object({
-      path: z11.string(),
+    EmitInteractionInputSchema = z12.object({
+      path: z12.string(),
       type: InteractionTypeSchema,
-      stream: z11.string().optional(),
+      stream: z12.string().optional(),
       question: QuestionSchema.optional(),
       confirmation: ConfirmationSchema.optional(),
       transition: TransitionSchema.optional()
@@ -18192,10 +19162,10 @@ ${JSON.stringify(event)}`;
       }
       rootDir;
       async scan() {
-        let projectName = path36.basename(this.rootDir);
+        let projectName = path37.basename(this.rootDir);
         try {
-          const pkgPath = path36.join(this.rootDir, "package.json");
-          const pkgRaw = await fs36.readFile(pkgPath, "utf-8");
+          const pkgPath = path37.join(this.rootDir, "package.json");
+          const pkgRaw = await fs37.readFile(pkgPath, "utf-8");
           const pkg = JSON.parse(pkgRaw);
           if (pkg.name) projectName = pkg.name;
         } catch {
@@ -18308,8 +19278,8 @@ console.log('Blueprint player initialized.');
           styles: STYLES,
           scripts: SCRIPTS
         });
-        await fs37.mkdir(options.outputDir, { recursive: true });
-        await fs37.writeFile(path37.join(options.outputDir, "index.html"), html);
+        await fs38.mkdir(options.outputDir, { recursive: true });
+        await fs38.writeFile(path38.join(options.outputDir, "index.html"), html);
       }
     };
     TOKENS_PER_MILLION = 1e6;
@@ -18847,6 +19817,11 @@ console.log('Blueprint player initialized.');
       [/\b(runtime|crash|exception|panic)\b/i, "bug-track/runtime-errors"],
       [/\(orchestrator\)|\bintegrat|\blease\b|\brace\b|\bconcurren/i, "bug-track/integration-issues"]
     ];
+    SECTION_ORDER = [
+      ...REQUIRED_STRATEGY_SECTIONS,
+      ...OPTIONAL_STRATEGY_SECTIONS
+    ];
+    FILENAME = "STRATEGY.md";
     ProposalNotFoundError = class extends Error {
       constructor(id) {
         super(`proposal not found: ${id}`);
@@ -18891,6 +19866,11 @@ export {
   PulseSourcesSchema,
   PulseConfigSchema,
   validatePulseConfig,
+  parseStrategyDoc,
+  asStrategyDoc,
+  StrategyFrontmatterSchema,
+  StrategyDocSchema,
+  validateStrategy,
   BUG_TRACK_CATEGORIES,
   KNOWLEDGE_TRACK_CATEGORIES,
   ALL_SOLUTION_CATEGORIES,
@@ -19147,8 +20127,23 @@ export {
   runSecurityAgent,
   ARCHITECTURE_DESCRIPTOR,
   runArchitectureAgent,
+  ADVERSARIAL_DESCRIPTOR,
+  runAdversarialAgent,
+  TYPESCRIPT_STRICT_DESCRIPTOR,
+  runTypescriptStrictAgent,
+  FRONTEND_RACES_DESCRIPTOR,
+  runFrontendRacesAgent,
   AGENT_DESCRIPTORS,
+  CONDITIONAL_SUBAGENT_DESCRIPTORS,
   fanOutReview,
+  fanOutConditionalSubagents,
+  SUBAGENT_ORDER,
+  RISK_KEYWORDS,
+  countChangedLines,
+  detectRiskKeywords,
+  computeDepth,
+  computeActivations,
+  calibrateDepth,
   validateFindings,
   deduplicateFindings,
   checkEligibility,
@@ -19272,6 +20267,8 @@ export {
   crossReferenceUndocumentedFixes,
   suggestCategory,
   assembleCandidateReport,
+  serializeStrategyDoc,
+  writeStrategyDoc,
   proposalsDir,
   ProposalNotFoundError,
   ProposalConflictError,