@haus-tech/haus-workflow 6.4.0 → 6.5.0

package/dist/cli.js

@@ -509,9 +509,12 @@ async function writeJson(file, value, opts = {}) {
 }
 async function pruneEmptyDir(dir) {
   try {
-    const entries = await fs2.readdir(dir);
-    if (entries.length === 0) await fs2.remove(dir);
+    if (!(await fs2.lstat(dir)).isDirectory()) return false;
+    if ((await fs2.readdir(dir)).length > 0) return false;
+    await fs2.remove(dir);
+    return true;
   } catch {
+    return false;
   }
 }
 async function readText(file) {
@@ -715,7 +718,7 @@ function checkManifestFormat(value, sourceLabel) {
     return {
       ok: false,
       kind: "invalid",
-      error: `${sourceLabel} declares an invalid manifestFormat (${JSON.stringify(value)}) \u2014 expected a positive integer.`
+      error: `${sourceLabel} declares an invalid manifestFormat (${JSON.stringify(value)}): expected a positive integer.`
     };
   }
   if (value > MAX_SUPPORTED_MANIFEST_FORMAT) {
@@ -941,7 +944,7 @@ function formatGithubRateLimitMessage(info) {
     "Fix:  export GITHUB_TOKEN=$(gh auth token)   # or HAUS_GITHUB_TOKEN=<pat>",
     "      # also: gh auth login   if gh isn't logged in",
     "Then: retry the command (e.g. haus update)",
-    `Or wait until ${when} and retry once (token still recommended \u2014 wait alone can re-hit the limit).`
+    `Or wait until ${when} and retry once (token still recommended: waiting alone can re-hit the limit).`
   ].join("\n");
 }
 var hit;
@@ -980,7 +983,7 @@ function formatPrivateCatalogMessage(info) {
   return [
     `The catalog could not be read (HTTP ${info.status}) because haus is not signed in to GitHub.`,
     "The catalog lives in a private repository, and GitHub answers a signed-out read of",
-    "a private repository with 404 \u2014 so this is an access problem, not a missing file.",
+    "a private repository with 404, so this is an access problem, not a missing file.",
     "Fix:  gh auth login                        # sign in once, then retry",
     "      export GITHUB_TOKEN=$(gh auth token) # or HAUS_GITHUB_TOKEN=<pat>",
     "Then: retry the command (e.g. haus update)"
@@ -1084,15 +1087,15 @@ function describeCatalogPin(pin, latestTag) {
   if (pin.kind === "invalid") {
     return {
       level: "advisory",
-      line: `- CATALOG PIN: ${PROJECT_CONFIG_REL} ${pin.reason} \u2014 the pin is ignored`,
+      line: `- CATALOG PIN: ${PROJECT_CONFIG_REL} ${pin.reason}, the pin is ignored`,
       sentence: `${PROJECT_CONFIG_REL} cannot be read as a catalog pin`,
-      fix: 'fix or remove it \u2014 it must be JSON shaped { "catalogRef": "v3.2.0" }'
+      fix: 'fix or remove it: it must be JSON shaped { "catalogRef": "v3.2.0" }'
     };
   }
   const behind = latestTag !== null && isCatalogRefOlderThan(pin.ref, latestTag);
   return {
     level: "advisory",
-    line: behind ? `- CATALOG PIN: ${pin.ref} (from ${PROJECT_CONFIG_REL}) \u2014 latest release is ${latestTag}` : `- CATALOG PIN: ${pin.ref} (from ${PROJECT_CONFIG_REL})`,
+    line: behind ? `- CATALOG PIN: ${pin.ref} (from ${PROJECT_CONFIG_REL}), latest release is ${latestTag}` : `- CATALOG PIN: ${pin.ref} (from ${PROJECT_CONFIG_REL})`,
     sentence: behind ? `The catalog is pinned to ${pin.ref}; ${latestTag} is available` : `The catalog is pinned to ${pin.ref}`,
     fix: `remove "catalogRef" from ${PROJECT_CONFIG_REL} to track the latest release`
   };
@@ -1142,7 +1145,7 @@ function getResolvedCatalogRef() {
   const resolved = cachedCatalogRef?.ref ?? process.env["HAUS_CATALOG_REF"] ?? getBundledCatalogRef();
   if (!resolved) {
     warn(
-      "Could not determine catalog ref from cache, env, or bundled snapshot \u2014 falling back to main (moving target)."
+      "Could not determine catalog ref from cache, env, or bundled snapshot, falling back to main (moving target)."
     );
     return "main";
   }
@@ -1196,7 +1199,7 @@ async function resolveCatalogRefWithSource(opts) {
   if (env["HAUS_CATALOG_REF"]) {
     if (env["HAUS_CATALOG_REF"] === "main") {
       warn(
-        "HAUS_CATALOG_REF=main is set \u2014 fetching from the moving main branch. Pin to a release tag for reproducible installs."
+        "HAUS_CATALOG_REF=main is set, fetching from the moving main branch. Pin to a release tag for reproducible installs."
       );
     }
     return { ref: env["HAUS_CATALOG_REF"], source: "env" };
@@ -1205,7 +1208,7 @@ async function resolveCatalogRefWithSource(opts) {
     const pin = readProjectCatalogPin(opts.projectRoot);
     if (pin.kind === "pinned") return { ref: pin.ref, source: "pin" };
     if (pin.kind === "invalid") {
-      warn(`${PROJECT_CONFIG_REL} ${pin.reason} \u2014 ignoring the pin and resolving normally.`);
+      warn(`${PROJECT_CONFIG_REL} ${pin.reason}, ignoring the pin and resolving normally.`);
     }
   }
   const fetchLatest = opts?.fetchLatestTag ?? fetchLatestCatalogTag;
@@ -1352,7 +1355,7 @@ async function fetchGitHubRecursiveBlobPaths(ref) {
     }
     const tree = await treeRes.json();
     if (tree.truncated) {
-      warn("Catalog GitHub tree listing was truncated \u2014 refusing partial cache sync");
+      warn("Catalog GitHub tree listing was truncated, refusing partial cache sync");
       return null;
     }
     return tree.tree.filter((e) => e.type === "blob").map((e) => e.path);
@@ -1619,7 +1622,7 @@ function parseManifest(json) {
           kept.push(clause);
         } else {
           warnings.push(
-            `${item.id}: dropping unrecognized requiresAny clause (catalog schema evolved ahead of this CLI version) \u2014 ${JSON.stringify(clause)}`
+            `${item.id}: dropping unrecognized requiresAny clause (catalog schema evolved ahead of this CLI version): ${JSON.stringify(clause)}`
           );
         }
       }
@@ -1921,7 +1924,7 @@ async function syncSuperpowersShared(base) {
 async function syncOneItem(item, base) {
   if (!KNOWN_ITEM_TYPES.has(item.type)) {
     warn(
-      `Skipping ${item.id}: type "${item.type}" is unknown to this haus version \u2014 upgrade to use it`
+      `Skipping ${item.id}: type "${item.type}" is unknown to this haus version. Upgrade to use it`
     );
     return "failed";
   }
@@ -1971,7 +1974,7 @@ function buildCacheManifest(input2) {
 }
 async function syncRemoteCatalog(projectRoot) {
   if (isOffline()) {
-    warn("Offline \u2014 skipping catalog sync; using cached or bundled content.");
+    warn("Offline: skipping catalog sync; using cached or bundled content.");
     return { newItems: [], refreshed: [], unchanged: 0, failed: [], skipped: true };
   }
   _resetBlobPathCacheForNewSync();
@@ -1989,7 +1992,7 @@ async function syncRemoteCatalog(projectRoot) {
         ...getPrivateCatalogDenial() ? { accessDenied: getPrivateCatalogDenial() } : {}
       };
     }
-    warn("Remote catalog fetch failed \u2014 using bundled catalog");
+    warn("Remote catalog fetch failed, using bundled catalog");
     return {
       newItems: [],
       refreshed: [],
@@ -2013,7 +2016,7 @@ async function syncRemoteCatalog(projectRoot) {
       // the tier `apply` actually loads from, and `loadCatalogContext` reads a missing
       // field as format 1. Dropping it here would mean a synced cache always claims
       // format 1 whatever the catalog declared, so the cache-tier half of the format
-      // gate could never fire — the remote fetch would be the only thing standing
+      // gate could never fire, the remote fetch would be the only thing standing
       // between a too-new catalog and an install.
       //
       // catalogRef binds this cache to the ref that populated it. The cache directory is
@@ -2030,7 +2033,7 @@ async function syncRemoteCatalog(projectRoot) {
     );
   } catch (err) {
     warn(
-      `Catalog cache not writable (${cacheDir}) \u2014 skipping cache sync: ${err instanceof Error ? err.message : String(err)}`
+      `Catalog cache not writable (${cacheDir}), skipping cache sync: ${err instanceof Error ? err.message : String(err)}`
     );
     return { newItems: [], refreshed: [], unchanged: 0, failed: [] };
   }
@@ -2115,15 +2118,46 @@ init_paths();
 import path4 from "node:path";
 
 // src/catalog/install-mapping.ts
-init_paths();
-init_path_safety();
 import path3 from "node:path";
+
+// src/claude/install-root.ts
+import { posix } from "node:path";
 var FLATTEN_DIR_BY_TYPE = {
   skill: "skills",
   agent: "agents",
   template: "templates",
   command: "commands"
 };
+var INSTALL_ROOT_PREFIXES = [".claude/"];
+var NEVER_INSTALLED = {
+  files: [
+    ".claude/settings.json",
+    ".claude/settings.local.json",
+    ".claude/CLAUDE.md",
+    ".claude/rules/haus.md"
+  ],
+  subtrees: [".claude/worktrees", ".claude/rules/project", ".claude/agent-memory"]
+};
+function installTypeFolders() {
+  return [.../* @__PURE__ */ new Set([...Object.values(FLATTEN_DIR_BY_TYPE), "rules"])].map(
+    (folder) => `.claude/${folder}`
+  );
+}
+function holdsPosix(a, b) {
+  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+}
+function insideInstallRoot(recorded) {
+  const rel = posix.normalize(recorded).replace(/\/+$/, "");
+  if (!INSTALL_ROOT_PREFIXES.some((prefix) => rel.startsWith(prefix))) return false;
+  const lower = rel.toLowerCase();
+  const equalsAny = (entries) => entries.some((entry) => entry.toLowerCase() === lower);
+  if (equalsAny(NEVER_INSTALLED.files) || equalsAny(installTypeFolders())) return false;
+  return !NEVER_INSTALLED.subtrees.some((tree) => holdsPosix(lower, tree.toLowerCase()));
+}
+
+// src/catalog/install-mapping.ts
+init_paths();
+init_path_safety();
 var MIRRORED_TYPES = /* @__PURE__ */ new Set(["rule", "asset"]);
 function upstreamRelative(itemPath) {
   const match = itemPath.replace(/\\/g, "/").match(/^sources\/[^/]+\/(.+)$/);
@@ -2144,7 +2178,7 @@ function installTargetFor(item) {
     return {
       ok: false,
       code: "unknown-type",
-      reason: `type "${type}" is unknown to this haus version \u2014 upgrade the CLI to use it`
+      reason: `type "${type}" is unknown to this haus version. Upgrade the CLI to use it`
     };
   }
   const itemPath = typeof item.path === "string" ? item.path : "";
@@ -2156,11 +2190,7 @@ function installTargetFor(item) {
     };
   }
   if (flattenDir) {
-    return {
-      ok: true,
-      layout: "flatten",
-      relPath: `${flattenDir}/${path3.posix.basename(itemPath)}`
-    };
+    return admitted("flatten", `${flattenDir}/${path3.posix.basename(itemPath)}`);
   }
   const rel = upstreamRelative(itemPath);
   if (rel === null) {
@@ -2177,7 +2207,18 @@ function installTargetFor(item) {
       reason: `path "${itemPath}" escapes its own sources/<source>/ prefix`
     };
   }
-  return { ok: true, layout: "mirror", relPath: rel };
+  return admitted("mirror", rel);
+}
+function admitted(layout, relPath) {
+  const target = path3.posix.normalize(`.claude/${relPath}`);
+  if (!insideInstallRoot(target)) {
+    return {
+      ok: false,
+      code: "never-installed",
+      reason: `install path "${target}" is one haus never installs to (only into an item's own path below .claude/), so haus leaves the item out; the catalog has to move the item`
+    };
+  }
+  return { ok: true, layout, relPath };
 }
 function installDestinationFor(root, item) {
   const target = installTargetFor(item);
@@ -2587,9 +2628,22 @@ var EDITED_REASON = {
   "no-hash": "has no lock hash",
   modified: "was modified locally"
 };
-async function unsafeTrackedPath(root, rel) {
+var REPLACE_LINK_RULES = { installRoot: false, linkedParent: false };
+async function realPathInsideRoot(root, abs) {
+  const [realAbs, realRoot] = await Promise.all([fs4.realpath(abs), fs4.realpath(root)]);
+  return insideReal(realAbs, realRoot);
+}
+function insideReal(realAbs, realRoot) {
+  const prefix = realRoot.endsWith(path8.sep) ? realRoot : realRoot + path8.sep;
+  return realAbs === realRoot || realAbs.startsWith(prefix);
+}
+async function unsafeTrackedPath(root, rel, rules = {}) {
   const abs = resolveContainedPath(root, recordedRel(rel));
   if (abs === null) return "escapes-root";
+  if (rules.installRoot !== false) {
+    const normalised = path8.relative(path8.resolve(root), abs).split(path8.sep).join("/");
+    if (!insideInstallRoot(normalised)) return "outside-install-root";
+  }
   if (!await fs4.pathExists(abs)) {
     try {
       if ((await fs4.lstat(abs)).isSymbolicLink()) return "symlink";
@@ -2599,9 +2653,16 @@ async function unsafeTrackedPath(root, rel) {
     return null;
   }
   if ((await fs4.lstat(abs)).isSymbolicLink()) return "symlink";
-  const [realAbs, realRoot] = await Promise.all([fs4.realpath(abs), fs4.realpath(root)]);
-  const prefix = realRoot.endsWith(path8.sep) ? realRoot : realRoot + path8.sep;
-  if (realAbs !== realRoot && !realAbs.startsWith(prefix)) return "symlink";
+  const [realAbs, realRoot, realParent] = await Promise.all([
+    fs4.realpath(abs),
+    fs4.realpath(root),
+    fs4.realpath(path8.dirname(abs))
+  ]);
+  if (!insideReal(realAbs, realRoot)) return "symlink";
+  if (rules.linkedParent !== false) {
+    const lexicalParent = path8.relative(path8.resolve(root), path8.dirname(abs));
+    if (realParent !== path8.join(realRoot, lexicalParent)) return "symlink";
+  }
   return null;
 }
 async function hasProtectedUnsafePath(root, relPaths, unsafeByRel) {
@@ -2609,14 +2670,39 @@ async function hasProtectedUnsafePath(root, relPaths, unsafeByRel) {
     const unsafe = unsafeByRel.get(rel) ?? null;
     if (unsafe === "symlink") return true;
     if (unsafe === "escapes-root" && await fs4.pathExists(path8.resolve(root, rel))) return true;
+    if (unsafe === "outside-install-root" && await lstatExists(path8.resolve(root, rel))) {
+      return true;
+    }
   }
   return false;
 }
-async function unsafeReasonsFor(root, relPaths) {
+async function lstatExists(abs) {
+  try {
+    await fs4.lstat(abs);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function unsafePathLine(id, rel, reason) {
+  if (reason === "escapes-root") {
+    return `Refusing to touch ${id}'s recorded path outside the project root: ${rel}`;
+  }
+  if (reason === "symlink")
+    return `Refusing to touch ${id}'s recorded path through a symlink: ${rel}`;
+  return `Refusing to touch ${id}'s recorded path ${rel}: haus never installs there (only into an item's own path below .claude/), so it leaves it. Delete the row from .haus-workflow/haus.lock.json by hand.`;
+}
+function holdsPath(target, held) {
+  const a = path8.resolve(target);
+  const b = path8.resolve(held);
+  const below = (folder) => folder.endsWith(path8.sep) ? folder : `${folder}${path8.sep}`;
+  return a === b || b.startsWith(below(a)) || a.startsWith(below(b));
+}
+async function unsafeReasonsFor(root, relPaths, rules = {}) {
   const reasons = /* @__PURE__ */ new Map();
   for (const rel of relPaths.map(recordedRel)) {
     if (reasons.has(rel)) continue;
-    reasons.set(rel, await unsafeTrackedPath(root, rel));
+    reasons.set(rel, await unsafeTrackedPath(root, rel, rules));
   }
   return reasons;
 }
@@ -2624,12 +2710,8 @@ async function resolveExistingTrackedPaths(root, itemId, relPaths, warnFn, unsaf
   const existing = [];
   for (const rel of new Set(relPaths.map(recordedRel))) {
     const unsafe = unsafeByRel?.has(rel) ? unsafeByRel.get(rel) ?? null : await unsafeTrackedPath(root, rel);
-    if (unsafe === "escapes-root") {
-      warnFn(`Refusing to touch ${itemId}'s recorded path outside the project root: ${rel}`);
-      continue;
-    }
-    if (unsafe === "symlink") {
-      warnFn(`Refusing to touch ${itemId}'s recorded path through a symlink: ${rel}`);
+    if (unsafe !== null) {
+      warnFn(unsafePathLine(itemId, rel, unsafe));
       continue;
     }
     const abs = path8.resolve(root, rel);
@@ -2790,7 +2872,7 @@ function recordedPathSet(rows2) {
 }
 async function recordedPathsOnDisk(root, relPaths) {
   const rels = [...new Set(relPaths.map(recordedRel))];
-  const unsafeByRel = await unsafeReasonsFor(root, rels);
+  const unsafeByRel = await unsafeReasonsFor(root, rels, REPLACE_LINK_RULES);
   let anyPresent = false;
   const refused = [];
   for (const rel of rels) {
@@ -2809,7 +2891,8 @@ async function recordedPathsOnDisk(root, relPaths) {
 }
 var UNSAFE_ON_DISK = {
   symlink: "is a symlink (or resolves through one), which haus does not copy or replace",
-  "escapes-root": "is outside the project root, which haus does not touch"
+  "escapes-root": "is outside the project root, which haus does not touch",
+  "outside-install-root": "is where haus never installs (only into an item's own path below .claude/), which haus does not copy or replace"
 };
 function unsafeOnDiskReason(rel, reason) {
   return `${recordedRel(rel)} ${UNSAFE_ON_DISK[reason]}`;
@@ -3013,6 +3096,10 @@ function inUseLine(rel, id, holder, dryRun = false) {
   const verb = dryRun ? "[dry-run] would keep (in use)" : "kept (in use)";
   return `${verb} ${recordedRel(rel)} ${bracketedId(id)}: ${holder} also records it, so haus leaves it on disk.`;
 }
+function excludedLine(rel, id, dryRun = false) {
+  const verb = dryRun ? "[dry-run] would exclude" : "excluded";
+  return `${verb} ${recordedRel(rel)} ${bracketedId(id)}: haus leaves the file as it is and reports nothing about it. Take ${id} out of excludedIds in .haus-workflow/haus.config.json to hand it back to haus.`;
+}
 function underFileLine(paths, id, blocking, dryRun = false) {
   const verb = dryRun ? "[dry-run] would refuse" : "refused";
   return `${verb} ${posixPathsOnce(paths).join(", ")} ${bracketedId(id)}: ${recordedRel(blocking)} is a file where a folder belongs. haus left both as they were; move the file aside by hand and run again.`;
@@ -3381,7 +3468,7 @@ async function loadCatalogContext(root) {
     const wantedRef = expectedCatalogRef(root);
     if (!cacheRefMatches(cacheData.catalogRef, wantedRef)) {
       warn(
-        `Catalog cache was populated from ${String(cacheData.catalogRef)} but this project resolves to ${wantedRef} \u2014 ignoring the cache. Run \`haus update\` to re-sync it.`
+        `Catalog cache was populated from ${String(cacheData.catalogRef)} but this project resolves to ${wantedRef}, ignoring the cache. Run \`haus update\` to re-sync it.`
       );
     } else {
       return {
@@ -3530,7 +3617,7 @@ async function reconcileIndex(root, move, dryRun, notify) {
   if (tracked.length === 0) return;
   if (dryRun) {
     notify(
-      move.keepTracked ? `Would stage the move of ${move.from} to ${move.to} in git (${tracked.length} tracked file(s)).` : `Would untrack ${tracked.length} committed file(s) under ${move.from} from git \u2014 request pricing material should never have been committed.`
+      move.keepTracked ? `Would stage the move of ${move.from} to ${move.to} in git (${tracked.length} tracked file(s)).` : `Would untrack ${tracked.length} committed file(s) under ${move.from} from git: request pricing material should never have been committed.`
     );
     return;
   }
@@ -3543,12 +3630,12 @@ async function reconcileIndex(root, move, dryRun, notify) {
   if (move.keepTracked) {
     await runGitStep(root, ["add", "--", move.to], notify);
     notify(
-      `Staged the move of ${move.from} to ${move.to} in git \u2014 it is board configuration and stays tracked. Run \`git status\` to review before committing this change.`
+      `Staged the move of ${move.from} to ${move.to} in git: it is board configuration and stays tracked. Run \`git status\` to review before committing this change.`
     );
     return;
   }
   notify(
-    `Untracked ${tracked.length} file(s) under ${move.from} from git \u2014 request pricing material should never have been committed, and \`${move.to}\` is gitignored from here on. Run \`git status\` to review before committing this change.`
+    `Untracked ${tracked.length} file(s) under ${move.from} from git: request pricing material should never have been committed, and \`${move.to}\` is gitignored from here on. Run \`git status\` to review before committing this change.`
   );
 }
 async function removeEmptyLegacyDir(root, previewedMoves, dryRun, notify) {
@@ -3568,7 +3655,7 @@ async function removeEmptyLegacyDir(root, previewedMoves, dryRun, notify) {
     notify(`Removed the now-empty ${LEGACY_REQUEST_DIR}/ directory.`);
   } catch (error2) {
     notify(
-      `Could not remove the empty ${LEGACY_REQUEST_DIR}/ directory: ${error2 instanceof Error ? error2.message : String(error2)}. The request state was migrated successfully \u2014 delete ${LEGACY_REQUEST_DIR}/ by hand.`
+      `Could not remove the empty ${LEGACY_REQUEST_DIR}/ directory: ${error2 instanceof Error ? error2.message : String(error2)}. The request state was migrated successfully. Delete ${LEGACY_REQUEST_DIR}/ by hand.`
     );
   }
 }
@@ -3601,7 +3688,7 @@ async function migrateRequestState(root, dryRun, notify) {
     if (await exists2(toAbs)) {
       conflicts.push({ ...move, reason: "destination-exists" });
       notify(
-        `Refused to migrate ${move.from} to ${move.to}: ${move.to} already exists. Two locations hold request state \u2014 reconcile them by hand, then remove ${move.from} so this migration can finish.`
+        `Refused to migrate ${move.from} to ${move.to}: ${move.to} already exists. Two locations hold request state. Reconcile them by hand, then remove ${move.from} so this migration can finish.`
       );
       continue;
     }
@@ -3619,13 +3706,13 @@ async function migrateRequestState(root, dryRun, notify) {
       const message2 = error2 instanceof Error ? error2.message : String(error2);
       failures.push({ ...move, message: message2 });
       notify(
-        `Could not migrate ${move.from} to ${move.to}: ${message2}. ${move.from} was left in place \u2014 fix the cause and re-run \`haus apply --write\`.`
+        `Could not migrate ${move.from} to ${move.to}: ${message2}. ${move.from} was left in place. Fix the cause and re-run \`haus apply --write\`.`
       );
       continue;
     }
     moved.push(move);
     notify(
-      `Moved ${move.from} to ${move.to} \u2014 request state now lives under \`${HAUS_DIR}/\`, where haus's gitignore rules cover it (ADR-0103).`
+      `Moved ${move.from} to ${move.to}: request state now lives under \`${HAUS_DIR}/\`, where haus's gitignore rules cover it (ADR-0103).`
     );
     if (trackedBefore.length > 0) await reconcileIndex(root, move, false, notify);
   }
@@ -3716,7 +3803,7 @@ function resolveGlobalPlugins(manifest, deps = {}) {
   const declared = manifest?.globalPlugins;
   if (declared === void 0) return [...DEFAULT_GLOBAL_PLUGINS];
   if (!Array.isArray(declared)) {
-    warn2("Catalog `globalPlugins` is not an array \u2014 falling back to the bundled pin.");
+    warn2("Catalog `globalPlugins` is not an array, falling back to the bundled pin.");
     return [...DEFAULT_GLOBAL_PLUGINS];
   }
   const pins = [];
@@ -3729,13 +3816,13 @@ function resolveGlobalPlugins(manifest, deps = {}) {
     const activation = entry.activation ?? "always";
     if (entry.ref !== void 0 && !isImmutableRef(entry.ref)) {
       warn2(
-        `Refusing catalog pin ${entry.id}: ref "${entry.ref}" is not a release tag \u2014 haus only installs immutable, reviewed plugin content.`
+        `Refusing catalog pin ${entry.id}: ref "${entry.ref}" is not a release tag: haus only installs immutable, reviewed plugin content.`
       );
       continue;
     }
     if (activation === "project" && !(entry.requiresAny && entry.requiresAny.length > 0)) {
       warn2(
-        `Refusing catalog pin ${entry.id}: activation "project" needs a non-empty requiresAny \u2014 without a signal no project could ever enable it.`
+        `Refusing catalog pin ${entry.id}: activation "project" needs a non-empty requiresAny: without a signal no project could ever enable it.`
       );
       continue;
     }
@@ -3825,7 +3912,7 @@ function planBuiltin(pin, state) {
       pin,
       kind: "marketplace-missing",
       steps: [],
-      reason: `built-in marketplace ${pin.marketplace} is not listed by this Claude Code \u2014 haus does not add it`
+      reason: `built-in marketplace ${pin.marketplace} is not listed by this Claude Code, and haus does not add it`
     };
   }
   const installed = findManagedInstall(state, pin);
@@ -3845,7 +3932,7 @@ function planBuiltin(pin, state) {
       pin,
       kind: "re-enable",
       steps: ["plugin-enable"],
-      reason: `plugin ${id} is disabled \u2014 haus workflows depend on it`
+      reason: `plugin ${id} is disabled, and haus workflows depend on it`
     };
   }
   if (!wantEnabled && enabled) {
@@ -3853,7 +3940,7 @@ function planBuiltin(pin, state) {
       pin,
       kind: "disable-at-user-scope",
       steps: ["plugin-disable"],
-      reason: `plugin ${id} is enabled at ${MANAGED_SCOPE} scope \u2014 it loads into every session instead of only the projects that use it`
+      reason: `plugin ${id} is enabled at ${MANAGED_SCOPE} scope, so it loads into every session instead of only the projects that use it`
     };
   }
   return {
@@ -3905,7 +3992,7 @@ function planPinned(pin, state) {
       pin,
       kind: "re-enable",
       steps: ["plugin-enable"],
-      reason: `plugin ${pluginId(pin)} is disabled \u2014 haus workflows depend on it`
+      reason: `plugin ${pluginId(pin)} is disabled, and haus workflows depend on it`
     };
   }
   return { pin, kind: "up-to-date", steps: [], reason: `pinned to ${ref}` };
@@ -4574,7 +4661,7 @@ async function readProjectConfigObject(root) {
   } catch (err) {
     if (err.code === "ENOENT") return null;
     warn(
-      `${PROJECT_CONFIG_REL} could not be read (${err instanceof Error ? err.message : String(err)}) \u2014 treating project intent as unset`
+      `${PROJECT_CONFIG_REL} could not be read (${err instanceof Error ? err.message : String(err)}), treating project intent as unset`
     );
     return null;
   }
@@ -4713,7 +4800,7 @@ async function readProjectProfile(root) {
   const { profile, malformed } = parseProfile(data?.profile);
   if (malformed) {
     warn(
-      `${PROJECT_CONFIG_REL}: unknown profile ${JSON.stringify(data?.profile)} \u2014 expected one of ${PROFILE_IDS.join(", ")}; treating as ${DEFAULT_PROFILE}`
+      `${PROJECT_CONFIG_REL}: unknown profile ${JSON.stringify(data?.profile)}: expected one of ${PROFILE_IDS.join(", ")}; treating as ${DEFAULT_PROFILE}`
     );
   }
   return profile;
@@ -4740,7 +4827,7 @@ function warnOnce(message2) {
 function stringList(value, label) {
   if (value === void 0) return [];
   if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) {
-    warnOnce(`${label} is not a string array \u2014 ignoring it`);
+    warnOnce(`${label} is not a string array, ignoring it`);
     return [];
   }
   return value;
@@ -4755,7 +4842,7 @@ function parseProfileRules(raw, profile, knownIds) {
   for (const key of Object.keys(clauses)) {
     if (!KNOWN_CLAUSES.includes(key)) {
       warnOnce(
-        `profiles.${profile}.exclude.${key}: unknown clause (catalog schema evolved ahead of this CLI version) \u2014 ignoring it`
+        `profiles.${profile}.exclude.${key}: unknown clause (catalog schema evolved ahead of this CLI version), ignoring it`
       );
     }
   }
@@ -4765,7 +4852,7 @@ function parseProfileRules(raw, profile, knownIds) {
   ).filter((id) => {
     if (knownIds !== void 0 && !knownIds.has(id)) {
       warnOnce(
-        `profiles.${profile}.keepIds names an id the catalog does not have (${id}) \u2014 ignoring it`
+        `profiles.${profile}.keepIds names an id the catalog does not have (${id}), ignoring it`
       );
       return false;
     }
@@ -5451,8 +5538,8 @@ function computeDetectionStatus(roles, stacks, unsupportedSignals) {
 }
 function describeUnknownDetection(unsupportedSignals, isLinkedWorktree) {
   const markers = unsupportedSignals.join(", ");
-  const base = markers ? `Stack not recognised \u2014 detected ${markers}, which haus does not support.` : "Stack not recognised \u2014 no supported framework detected.";
-  const worktreeNote = isLinkedWorktree ? "You're running from inside a git worktree \u2014 sibling repos may not be on disk here, so this could be a false zero-signal reading rather than truly no stack." : "";
+  const base = markers ? `Stack not recognised: detected ${markers}, which haus does not support.` : "Stack not recognised: no supported framework detected.";
+  const worktreeNote = isLinkedWorktree ? "You're running from inside a git worktree: sibling repos may not be on disk here, so this could be a false zero-signal reading rather than truly no stack." : "";
   return [base, worktreeNote, "Only stack-agnostic workflow and security guidance is applied."].filter(Boolean).join(" ");
 }
 function blocked(rel) {
@@ -6018,17 +6105,13 @@ function describeRequiresAny(clauses) {
 function mergeRecommendationWarnings(context, isLinkedWorktree = false) {
   const markers = context.unsupportedSignals?.join(", ");
   const statusLines = context.detectionStatus === "unknown" ? [describeUnknownDetection(context.unsupportedSignals ?? [], isLinkedWorktree)] : context.detectionStatus === "partial" && markers ? [
-    `Partially supported \u2014 found unsupported ${markers} alongside recognised stacks; guidance covers the supported parts only.`
+    `Partially supported: found unsupported ${markers} alongside recognised stacks; guidance covers the supported parts only.`
   ] : [];
   const riskLines = (context.securityRisks?.length ?? 0) > 0 ? [`Scan reported security signals: ${context.securityRisks.join("; ")}`] : [];
   return [.../* @__PURE__ */ new Set([...statusLines, ...context.warnings, ...riskLines])];
 }
 
 // src/claude/item-admission.ts
-var CORE_MANAGED_CLAUDE_PATHS = /* @__PURE__ */ new Set(["settings.json", "rules/haus.md"]);
-function isCoreManagedClaudePath(relPath) {
-  return CORE_MANAGED_CLAUDE_PATHS.has(relPath.toLowerCase());
-}
 var RETIREMENT_REFUSALS = /* @__PURE__ */ new Set([
   "deprecated",
   "plugin-superseded"
@@ -6106,19 +6189,12 @@ async function computeAdmission({ root, contentRoot, manifestById, installPlugin
       warning: `Skipping ${item.id}: ${placement.reason}`
     };
   }
-  if (isCoreManagedClaudePath(placement.relPath)) {
-    return {
-      ok: false,
-      refusal: "core-managed-path",
-      warning: `Skipping ${item.id}: .claude/${placement.relPath} is written and owned by haus itself`
-    };
-  }
   const sourcePath = catalogItemContentPath(contentRoot, manifestItem);
   if (!await fs19.pathExists(sourcePath)) {
     return {
       ok: false,
       refusal: "source-missing",
-      warning: `Skipping ${item.id}: source not found at ${sourcePath} \u2014 run \`haus update\` to populate catalog cache`
+      warning: `Skipping ${item.id}: source not found at ${sourcePath}. Run \`haus update\` to populate catalog cache`
     };
   }
   return { ok: true, manifestItem, destination: placement.destination, sourcePath };
@@ -6140,7 +6216,7 @@ async function sourceValidationFailure(item, manifestItem, sourcePath) {
         mdContent
       );
       if (!mdValidation.ok) {
-        return `Skipping ${item.id}: pre-copy validation failed (${relFile}) \u2014 ${mdValidation.reason}`;
+        return `Skipping ${item.id}: pre-copy validation failed (${relFile}): ${mdValidation.reason}`;
       }
     }
     return void 0;
@@ -6154,7 +6230,7 @@ async function sourceValidationFailure(item, manifestItem, sourcePath) {
     },
     await fs19.readFile(sourcePath, "utf8")
   );
-  return validation.ok ? void 0 : `Skipping ${item.id}: pre-copy validation failed \u2014 ${validation.reason}`;
+  return validation.ok ? void 0 : `Skipping ${item.id}: pre-copy validation failed: ${validation.reason}`;
 }
 function assertNeverRenameVerdict(verdict) {
   throw new Error(`Unhandled RenameTargetVerdict: ${JSON.stringify(verdict)}`);
@@ -6194,8 +6270,6 @@ function describeAdmissionRefusal(refusal2) {
       return "config items are not written into .claude/";
     case "placement-refused":
       return "haus cannot place it under .claude/";
-    case "core-managed-path":
-      return "its destination is a file haus writes itself";
     case "source-missing":
       return "its content is missing from the catalog cache";
   }
@@ -6247,17 +6321,13 @@ async function holdsKnownStub(abs, stub) {
 `, `${stub}\r
 `].some((known) => found.equals(Buffer.from(known)));
 }
-async function throughLinkedFolder(root, rel) {
-  let dir = root;
-  for (const part of path32.posix.dirname(rel).split("/")) {
-    dir = path32.join(dir, part);
-    try {
-      if ((await fs20.lstat(dir)).isSymbolicLink()) return true;
-    } catch {
-      return true;
-    }
+async function keptForLinkedFolder(root, rel, unsafeByRel) {
+  if (unsafeByRel.get(rel) !== "symlink") return false;
+  try {
+    return await realPathInsideRoot(root, path32.join(root, rel));
+  } catch {
+    return false;
   }
-  return false;
 }
 function legacyKeptLine(rel, kind) {
   if (kind === "linked") {
@@ -6270,20 +6340,27 @@ function legacyKeptLine(rel, kind) {
 }
 var CI_GATE_COMMIT_HINT = 'Commit this with an [adr-skip] line in the commit body (e.g. "[adr-skip] haus moved its gate from CI to Lefthook, ADR-0161"): removing a workflow is a decision trigger.';
 var CI_GATE_REL = CI_GATE_WORKFLOW_REL.split(path32.sep).join("/");
+var CI_GATE_RULES = { installRoot: false };
 async function findCiGateWorkflow(root) {
   if (await legacyFileState(path32.join(root, CI_GATE_REL)) !== "file") return void 0;
-  const [tracked] = await resolveExistingTrackedPaths(root, "haus-gate", [CI_GATE_REL], () => {
-  });
-  if (tracked === void 0) return void 0;
+  const unsafeByRel = await unsafeReasonsFor(root, [CI_GATE_REL], CI_GATE_RULES);
+  const [tracked] = await resolveExistingTrackedPaths(
+    root,
+    "haus-gate",
+    [CI_GATE_REL],
+    () => {
+    },
+    unsafeByRel
+  );
+  const linked = tracked === void 0 && await keptForLinkedFolder(root, CI_GATE_REL, unsafeByRel);
+  if (tracked === void 0 && !linked) return void 0;
   let content2;
   try {
-    content2 = await fs20.readFile(tracked.abs);
+    content2 = await fs20.readFile(tracked?.abs ?? path32.join(root, CI_GATE_REL));
   } catch {
     return void 0;
   }
-  if (isKnownHausCiGate(content2)) {
-    return await throughLinkedFolder(root, CI_GATE_REL) ? { kind: "linked" } : { kind: "known" };
-  }
+  if (isKnownHausCiGate(content2)) return linked ? { kind: "linked" } : { kind: "known" };
   return isHausWrittenCiGate(content2.toString("utf8")) ? { kind: "edited" } : void 0;
 }
 async function findLegacyStubPaths(root) {
@@ -6291,10 +6368,13 @@ async function findLegacyStubPaths(root) {
   for (const stub of LEGACY_STUBS) {
     const state = await legacyFileState(path32.join(root, stub.rel));
     if (state === "absent") continue;
+    const unsafeByRel = state === "file" ? await unsafeReasonsFor(root, [stub.rel]) : /* @__PURE__ */ new Map();
     const existing = state === "file" ? await resolveExistingTrackedPaths(root, stub.id, [stub.rel], () => {
-    }) : [];
+    }, unsafeByRel) : [];
     const tracked = existing[0];
-    const kind = tracked === void 0 || !await holdsKnownStub(tracked.abs, stub.text) ? "other" : await throughLinkedFolder(root, stub.rel) ? "linked" : "stub";
+    const linked = tracked === void 0 && await keptForLinkedFolder(root, stub.rel, unsafeByRel);
+    const readAt = tracked?.abs ?? (linked ? path32.join(root, stub.rel) : void 0);
+    const kind = readAt === void 0 || !await holdsKnownStub(readAt, stub.text) ? "other" : linked ? "linked" : "stub";
     found.push({ id: stub.id, rel: stub.rel, kind });
   }
   return found;
@@ -6315,8 +6395,14 @@ async function removeLegacyHausFiles(root, dryRun, say, opts = {}) {
     if (found.kind === "linked") warn(legacyKeptLine(found.rel, "linked"));
   }
   const ciGate = opts.ciGateReplaced ? await findCiGateWorkflow(root) : void 0;
-  const [ciGateTracked] = ciGate?.kind === "known" ? await resolveExistingTrackedPaths(root, "haus-gate", [CI_GATE_REL], () => {
-  }) : [];
+  const [ciGateTracked] = ciGate?.kind === "known" ? await resolveExistingTrackedPaths(
+    root,
+    "haus-gate",
+    [CI_GATE_REL],
+    () => {
+    },
+    await unsafeReasonsFor(root, [CI_GATE_REL], CI_GATE_RULES)
+  ) : [];
   if (ciGateTracked !== void 0) {
     matched.push({
       id: "haus-gate",
@@ -6382,6 +6468,10 @@ async function removeLegacyHausFiles(root, dryRun, say, opts = {}) {
 init_paths();
 var PROJECT_MANAGED_CLAUDE_REL = ["rules/haus.md"];
 var RULES_HAUS_ID = "core.rules-haus";
+var HEADER_FILE_RELS = {
+  "template.workflow": ".haus-workflow/WORKFLOW.md",
+  [RULES_HAUS_ID]: ".claude/rules/haus.md"
+};
 var PROJECT_MANAGED_HAUS_REL = [];
 function coreManagedAbsolutePaths(root) {
   const claude = PROJECT_MANAGED_CLAUDE_REL.map((rel) => claudePath(root, rel));
@@ -6797,7 +6887,7 @@ async function readProjectExcludedIds(root) {
   } catch (err) {
     if (err.code === "ENOENT") return [];
     warn(
-      `${PROJECT_CONFIG_REL} could not be read for excludedIds (${err instanceof Error ? err.message : String(err)}) \u2014 treating as none`
+      `${PROJECT_CONFIG_REL} could not be read for excludedIds (${err instanceof Error ? err.message : String(err)}), treating as none`
     );
     return [];
   }
@@ -6979,7 +7069,7 @@ function skillDepInstallCommand(manager) {
     case "yarn":
       return {
         ok: false,
-        reason: "yarn resolves installs from the nearest lockfile up the tree, so it cannot install a standalone skill directory without reaching the project root \u2014 install it manually if the skill scripts are needed"
+        reason: "yarn resolves installs from the nearest lockfile up the tree, so it cannot install a standalone skill directory without reaching the project root. Install it manually if the skill scripts are needed"
       };
     default:
       return { ok: false, reason: "no package manager detected for this project" };
@@ -7039,7 +7129,7 @@ async function installSkillDependencies(opts, deps = {}) {
     case "inconclusive":
       return {
         status: "skipped",
-        reason: `could not determine whether ${command} is on PATH (${probe.reason}) \u2014 dependency install skipped`
+        reason: `could not determine whether ${command} is on PATH (${probe.reason}), dependency install skipped`
       };
     default:
       return assertNeverCommandProbe(probe);
@@ -7076,10 +7166,10 @@ async function findStrayFiles(root, items, contentRoot, lockRows, excludedIds, i
     if (reported.has(relPath) || recorded.has(relPath)) continue;
     if (isItemExcluded(item, excludedIds) || trackedIds.has(item.id)) continue;
     if (!await anyRecordedPathOnDisk(root, [relPath])) continue;
-    const admitted = await admission(item).catch(() => void 0);
-    if (admitted === void 0 || !admitted.ok) continue;
-    if (await sourceIsInvalid(item, admitted.manifestItem, admitted.sourcePath)) continue;
-    const verdict = await verdictFor(root, admitted.manifestItem, contentRoot, relPath);
+    const admitted2 = await admission(item).catch(() => void 0);
+    if (admitted2 === void 0 || !admitted2.ok) continue;
+    if (await sourceIsInvalid(item, admitted2.manifestItem, admitted2.sourcePath)) continue;
+    const verdict = await verdictFor(root, admitted2.manifestItem, contentRoot, relPath);
     if (verdict.kind === "absent") continue;
     reported.add(relPath);
     strays.push(
@@ -7390,7 +7480,7 @@ async function writeManagedText(root, filePath, nextText, dryRun, quiet = false,
 // src/claude/write-decisions-seed.ts
 var SEED_README = `# Architecture Decision Records (ADRs)
 
-Why we chose X \u2014 short, dated, write-once decision log for humans and agents.
+Why we chose X: a short, dated, write-once decision log for humans and agents.
 
 | ADR | Title | Why (one line) | Status |
 | --- | ----- | -------------- | ------ |
@@ -7706,13 +7796,53 @@ var DEPLOY_SIGNALS = [
   /\bscp\b/,
   /\bssh-agent\b/
 ];
-function classifyEnvironmentName(name) {
+function environmentNameClass(name) {
   const lowered = name.toLowerCase();
   if (/\bpreview\b/.test(lowered)) return "preview";
   if (/github-pages|\bdocs?\b|docusaurus|github\.io/.test(lowered)) return "customer-visible";
   if (/\bprod|\bproduction\b|\blive\b/.test(lowered)) return "production";
-  if (/\bstag(?:e|ing)\b|\btest\b|\bqa\b|\buat\b|\bdev\b|\bdevelop/.test(lowered)) return "staging";
-  return "production";
+  if (/\bstag(?:e|ing)\b|\btest(?:ing)?\b|\bqa\b|\buat\b|\bdev\b|\bdevelop/.test(lowered)) {
+    return "staging";
+  }
+  return void 0;
+}
+function classifyEnvironmentName(name) {
+  return environmentNameClass(name) ?? "production";
+}
+var TARGET_WORD = "(?:prod(?:uction)?|live|staging)";
+var STAGE_WORD = "(?:test(?:ing)?|dev(?:elop(?:ment)?)?|stage|qa|uat)";
+var DEPLOY_WORD = "(?:deploy(?:ment)?|rollout)";
+var SEP = "[-_ ./]";
+var NAMED_TARGET = [
+  new RegExp(`\\b${DEPLOY_WORD}${SEP}*(?:to${SEP}+)?${TARGET_WORD}\\b`),
+  new RegExp(`\\b${TARGET_WORD}${SEP}+${DEPLOY_WORD}`),
+  new RegExp(`\\b${DEPLOY_WORD}${SEP}*(?:to${SEP}+)?${STAGE_WORD}$`)
+];
+var ENVIRONMENT_WORD = new RegExp(`\\b(?:${TARGET_WORD}|${STAGE_WORD})\\b`, "g");
+function namedTargetClass(doc, file) {
+  const groupOf = (value) => typeof value === "string" ? value : isPlainObject(value) && typeof value.group === "string" ? value.group : "";
+  const names4 = [file.replace(/\.ya?ml$/, ""), textOf(doc.name), groupOf(doc.concurrency)];
+  const jobs = isPlainObject(doc.jobs) ? doc.jobs : {};
+  for (const job of Object.values(jobs)) {
+    if (isPlainObject(job)) names4.push(groupOf(job.concurrency));
+  }
+  let found;
+  for (const name of names4) {
+    if (!name || name.length > MAX_TARGET_NAME || name.includes("${{")) continue;
+    const lowered = withoutTrailingSeparators(name.toLowerCase());
+    if (!NAMED_TARGET.some((pattern) => pattern.test(lowered))) continue;
+    for (const [word] of lowered.matchAll(ENVIRONMENT_WORD)) {
+      const value = environmentNameClass(word);
+      if (value && value !== "preview") found = found ? maxClass(found, value) : value;
+    }
+  }
+  return found;
+}
+var MAX_TARGET_NAME = 200;
+function withoutTrailingSeparators(name) {
+  let end = name.length;
+  while (end > 0 && "-_ ./".includes(name[end - 1])) end -= 1;
+  return name.slice(0, end);
 }
 function toList(value) {
   if (typeof value === "string") return [value];
@@ -7730,26 +7860,54 @@ function triggers(doc) {
   }
   return isPlainObject(on) ? on : {};
 }
+function staticEnvironment(job) {
+  const env = job.environment;
+  const name = typeof env === "string" ? env : isPlainObject(env) && typeof env.name === "string" ? env.name : void 0;
+  return name && !name.includes("${{") ? name : void 0;
+}
+function isPagesDeploy(doc, text, file) {
+  const named = `${file} ${typeof doc.name === "string" ? doc.name : ""}`.toLowerCase();
+  return /github\.io|docusaurus|gh-pages|deploy-pages|\bdocs?\b/.test(named) || /github\.io|deploy-pages|gh-pages/.test(text);
+}
 function workflowClass(doc, text, file) {
-  let found;
+  let declared;
+  const raise = (value) => {
+    declared = declared ? maxClass(declared, value) : value;
+  };
+  const unnamed = [];
+  const deploying = [];
+  let anyJobDeploys = false;
   const jobs = isPlainObject(doc.jobs) ? doc.jobs : {};
-  for (const job of Object.values(jobs)) {
+  for (const [id, job] of Object.entries(jobs)) {
     if (!isPlainObject(job)) continue;
-    const env = job.environment;
-    const name = typeof env === "string" ? env : isPlainObject(env) && typeof env.name === "string" ? env.name : void 0;
-    if (!name || name.includes("${{")) continue;
-    const value = classifyEnvironmentName(name);
-    if (value !== "preview") found = found ? maxClass(found, value) : value;
+    const deploys = DEPLOY_SIGNALS.some((signal) => signal.test(jobText(id, job)));
+    anyJobDeploys ||= deploys;
+    const name = staticEnvironment(job);
+    if (name !== void 0) {
+      const value = classifyEnvironmentName(name);
+      if (value !== "preview") raise(value);
+    } else {
+      unnamed.push([id, job]);
+      if (deploys) deploying.push([id, job]);
+    }
   }
-  if (found) return found;
-  const named = `${file} ${typeof doc.name === "string" ? doc.name : ""}`.toLowerCase();
-  if (/github\.io|docusaurus|gh-pages|deploy-pages|\bdocs?\b/.test(named) || /github\.io|deploy-pages|gh-pages/.test(text)) {
-    return "customer-visible";
+  if (!anyJobDeploys) {
+    deploying.push(
+      ...unnamed.filter(
+        ([id, job]) => !SUPPORT_JOB.test(`${id} ${textOf(job.name)}`.toLowerCase())
+      )
+    );
   }
-  if (/\bprod|production/.test(text)) return "production";
-  if (/\bstag(?:e|ing)\b/.test(text)) return "staging";
-  return "production";
+  const target = namedTargetClass(doc, file);
+  if (target) raise(target);
+  const pages = isPagesDeploy(doc, text, file);
+  if (pages) raise("customer-visible");
+  if (declared && (deploying.length === 0 || target || pages)) return declared;
+  const words = declared ? JSON.stringify(Object.fromEntries(deploying)).toLowerCase() : text;
+  const guessed = /\bprod|production/.test(words) ? "production" : /\bstag(?:e|ing)\b/.test(words) ? "staging" : "production";
+  return declared ? maxClass(declared, guessed) : guessed;
 }
+var SUPPORT_JOB = /^(?:build|test|tests|unit|e2e|lint|check|checks|ci|typecheck|types|format|audit|scan|coverage|report|notify|notification|setup|install|cache|verify)(?:[-_ ]|$)/;
 function textOf(value) {
   if (typeof value === "string") return value;
   if (isPlainObject(value) && typeof value.name === "string") return value.name;
@@ -7759,19 +7917,71 @@ var REPORTING_ACTION = /test|coverage|report|lint|codecov|sonar/;
 function deployText(doc, file) {
   const parts = [file, textOf(doc.name)];
   const jobs = isPlainObject(doc.jobs) ? doc.jobs : {};
+  for (const [id, job] of Object.entries(jobs)) {
+    if (isPlainObject(job)) parts.push(jobText(id, job));
+  }
+  return parts.join("\n").toLowerCase();
+}
+function jobText(id, job) {
+  const parts = [id, textOf(job.name), textOf(job.environment), textOf(job.uses)];
+  if (isPlainObject(job.with)) {
+    for (const value of Object.values(job.with)) {
+      if (typeof value === "string") parts.push(value);
+    }
+  }
+  for (const step of Array.isArray(job.steps) ? job.steps : []) {
+    if (!isPlainObject(step)) continue;
+    const uses = textOf(step.uses);
+    if (REPORTING_ACTION.test(uses.toLowerCase())) continue;
+    parts.push(uses, textOf(step.run), textOf(step.name));
+  }
+  return parts.join("\n").toLowerCase();
+}
+var SCRIPT_PATH = /(?:^|[\s"'=(;&|])((?:\.\/)?[\w.][\w./-]*\.(?:sh|bash|zsh|mjs|cjs|js|ts|py|rb))(?=$|[\s"';)&|])/gm;
+var MAX_SCRIPTS = 10;
+var MAX_SCRIPT_BYTES = 256 * 1024;
+async function commandText(root, doc) {
+  const texts = [];
+  const rels = /* @__PURE__ */ new Set();
+  const jobs = isPlainObject(doc.jobs) ? doc.jobs : {};
   for (const [id, job] of Object.entries(jobs)) {
     if (!isPlainObject(job)) continue;
-    parts.push(id, textOf(job.name), textOf(job.environment), textOf(job.uses));
+    if (isPlainObject(job.with) && DEPLOY_SIGNALS.some((signal) => signal.test(jobText(id, job)))) {
+      for (const value of Object.values(job.with)) {
+        if (typeof value === "string") texts.push(value.toLowerCase());
+      }
+    }
     for (const step of Array.isArray(job.steps) ? job.steps : []) {
-      if (!isPlainObject(step)) continue;
-      const uses = textOf(step.uses);
-      if (REPORTING_ACTION.test(uses.toLowerCase())) continue;
-      parts.push(uses, textOf(step.run), textOf(step.name));
+      if (!isPlainObject(step) || typeof step.run !== "string") continue;
+      const run = step.run.toLowerCase();
+      if (!DEPLOY_SIGNALS.some((signal) => signal.test(run))) continue;
+      texts.push(run);
+      for (const match of step.run.matchAll(SCRIPT_PATH)) {
+        const rel = path35.posix.normalize(match[1]);
+        if (!rel.startsWith("..") && !path35.isAbsolute(rel)) rels.add(rel);
+      }
     }
   }
-  return parts.join("\n").toLowerCase();
+  let realRoot;
+  try {
+    realRoot = await fs24.realpath(root);
+  } catch {
+    return texts.join("\n");
+  }
+  for (const rel of [...rels].slice(0, MAX_SCRIPTS)) {
+    try {
+      const real = await fs24.realpath(path35.join(root, rel));
+      if (!real.startsWith(`${realRoot}${path35.sep}`)) continue;
+      const stat2 = await fs24.stat(real);
+      if (!stat2.isFile() || stat2.size > MAX_SCRIPT_BYTES) continue;
+      const lines = (await fs24.readFile(real, "utf8")).toLowerCase().split("\n");
+      texts.push(lines.filter((line2) => !/^\s*(?:#|\/\/)/.test(line2)).join("\n"));
+    } catch {
+    }
+  }
+  return texts.join("\n");
 }
-async function workflowEvidence(root, defaultBranch2) {
+async function workflowEvidence(root, defaultBranch2, mentions) {
   const dir = path35.join(root, ".github", "workflows");
   let names4;
   try {
@@ -7793,6 +8003,7 @@ async function workflowEvidence(root, defaultBranch2) {
     const signals = deployText(doc, name);
     if (!DEPLOY_SIGNALS.some((signal) => signal.test(signals))) continue;
     const deploys = workflowClass(doc, text, name);
+    let mention;
     const on = triggers(doc);
     const sources = [];
     if ("push" in on) sources.push({ event: "push", filter: isPlainObject(on.push) ? on.push : {} });
@@ -7822,7 +8033,7 @@ async function workflowEvidence(root, defaultBranch2) {
     if ("workflow_dispatch" in on) {
       evidence.push({
         source: "workflow",
-        deploys: "production",
+        deploys,
         dispatch: rel,
         detail: `${rel}: deploys on workflow_dispatch`
       });
@@ -7845,6 +8056,10 @@ async function workflowEvidence(root, defaultBranch2) {
           ...pathsIgnore.length > 0 ? { ignorePaths: pathsIgnore } : {},
           detail: `${rel}: ${event} to ${branch}${pathNote} deploys ${deploys}`
         });
+        if (paths.length === 0) {
+          mention ??= await commandText(root, doc);
+          mentions.set(branch, [...mentions.get(branch) ?? [], mention]);
+        }
       }
       for (const tag of tags) {
         evidence.push({
@@ -7858,31 +8073,96 @@ async function workflowEvidence(root, defaultBranch2) {
   }
   return evidence;
 }
-async function vercelEvidence(root, defaultBranch2) {
-  const configFile = path35.join(root, "vercel.json");
-  const linked = await fs24.pathExists(path35.join(root, ".vercel", "project.json"));
+async function gitIgnores(root, rel, git) {
+  if (!git) return false;
+  try {
+    const result = await git(["check-ignore", "-q", "--", rel], { cwd: root, timeoutMs: 5e3 });
+    return result.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+async function vercelFileEvidence(root, rel, defaultBranch2) {
   let config;
-  if (await fs24.pathExists(configFile)) {
+  try {
+    config = JSON.parse(await fs24.readFile(path35.join(root, rel), "utf8"));
+  } catch {
+    config = {};
+  }
+  const git = isPlainObject(config) && isPlainObject(config.git) ? config.git : void 0;
+  const enabled = git?.deploymentEnabled;
+  if (enabled === false) return void 0;
+  if (isPlainObject(enabled) && enabled[defaultBranch2] === false) return void 0;
+  return {
+    source: "vercel",
+    deploys: "production",
+    branch: defaultBranch2,
+    detail: `${rel}: Vercel deploys ${defaultBranch2} to production`
+  };
+}
+var NOT_AN_APP = /^(?:node_modules|examples?|samples?|fixtures?|tests?|__tests__|templates?)$/;
+var skippedFolder = (name) => name.startsWith(".") || name === "node_modules";
+function isNestedVercelFile(rel) {
+  const parts = rel.split("/");
+  if (parts.length < 2 || parts.length > 3 || parts[parts.length - 1] !== "vercel.json")
+    return false;
+  const folders = parts.slice(0, -1);
+  return !NOT_AN_APP.test(folders[0]) && !folders.some(skippedFolder);
+}
+async function nestedVercelFiles(root, git) {
+  if (git) {
     try {
-      config = JSON.parse(await fs24.readFile(configFile, "utf8"));
+      const listed = await git(["ls-files", "-z", "--", "*/vercel.json"], {
+        cwd: root,
+        timeoutMs: 5e3
+      });
+      if (listed.exitCode === 0) {
+        return listed.stdout.split("\0").filter(isNestedVercelFile).sort();
+      }
     } catch {
-      config = {};
     }
-  } else if (!linked) {
-    return [];
   }
-  const git = isPlainObject(config) && isPlainObject(config.git) ? config.git : void 0;
-  const enabled = git?.deploymentEnabled;
-  if (enabled === false) return [];
-  if (isPlainObject(enabled) && enabled[defaultBranch2] === false) return [];
-  return [
-    {
-      source: "vercel",
-      deploys: "production",
-      branch: defaultBranch2,
-      detail: `${linked ? ".vercel/project.json" : "vercel.json"}: Vercel deploys ${defaultBranch2} to production`
+  const children = async (rel) => {
+    try {
+      const entries = await fs24.readdir(path35.join(root, rel), { withFileTypes: true });
+      return entries.filter((entry) => entry.isDirectory() && !skippedFolder(entry.name)).map((entry) => rel ? `${rel}/${entry.name}` : entry.name).sort();
+    } catch {
+      return [];
     }
-  ];
+  };
+  const found = [];
+  for (const first of await children("")) {
+    if (NOT_AN_APP.test(first)) continue;
+    for (const dir of [first, ...await children(first)]) {
+      const rel = `${dir}/vercel.json`;
+      if (isNestedVercelFile(rel) && await fs24.pathExists(path35.join(root, rel))) found.push(rel);
+    }
+  }
+  return found;
+}
+async function vercelEvidence(root, defaultBranch2, git) {
+  const evidence = [];
+  if (await fs24.pathExists(path35.join(root, "vercel.json"))) {
+    const item = await vercelFileEvidence(root, "vercel.json", defaultBranch2);
+    if (item) evidence.push(item);
+  } else {
+    const link = ".vercel/project.json";
+    if (await fs24.pathExists(path35.join(root, link))) {
+      const ignored = await gitIgnores(root, link, git);
+      evidence.push({
+        source: "vercel",
+        deploys: "production",
+        branch: defaultBranch2,
+        ...ignored ? { tracedTo: "vercel" } : {},
+        detail: `${link}${ignored ? " (git-ignored)" : ""}: Vercel deploys ${defaultBranch2} to production`
+      });
+    }
+  }
+  for (const rel of await nestedVercelFiles(root, git)) {
+    const item = await vercelFileEvidence(root, rel, defaultBranch2);
+    if (item) evidence.push(item);
+  }
+  return evidence;
 }
 async function fetchDeployments(deps, errors) {
   const { gh, slug } = deps;
@@ -7943,6 +8223,7 @@ async function fetchDeployments(deps, errors) {
   }
   return rows2;
 }
+var SERVICE_NAME = /^[a-z0-9]{2,}(?:[-_][a-z0-9]{2,})+$/i;
 function deploymentEvidence(rows2, deps) {
   const now = (deps.now ?? /* @__PURE__ */ new Date()).getTime();
   const cutoff = now - DEPLOYMENT_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
@@ -7950,7 +8231,8 @@ function deploymentEvidence(rows2, deps) {
   const seen = /* @__PURE__ */ new Map();
   for (const row of rows2) {
     if (Date.parse(row.created_at) < cutoff) continue;
-    const deploys = classifyEnvironmentName(row.environment);
+    const named = environmentNameClass(row.environment);
+    const deploys = named ?? "production";
     if (deploys === "preview") continue;
     if (/^v?\d+(?:\.\d+)+/.test(row.ref)) {
       const pattern = row.ref.startsWith("v") ? "v*" : "*.*";
@@ -7974,6 +8256,9 @@ function deploymentEvidence(rows2, deps) {
       source: "deployments",
       deploys,
       branch,
+      // Only a service-shaped name (`shop-server`) is traced: a plain word (`backend`, `web`)
+      // could stand for anything in a script, so it is never explained.
+      ...named === void 0 && SERVICE_NAME.test(row.environment) ? { tracedTo: row.environment.toLowerCase() } : {},
       detail: `GitHub deployments: ${branch} deployed to ${row.environment} (last ${row.created_at.slice(0, 10)})`
     });
   }
@@ -8019,15 +8304,23 @@ function configFromEvidence(evidence) {
 async function detectDeployConfig(root, deps = {}) {
   const defaultBranch2 = deps.defaultBranch ?? "main";
   const errors = [];
-  const evidence = [];
+  const found = [];
+  const mentions = /* @__PURE__ */ new Map();
   if (root) {
-    evidence.push(...await workflowEvidence(root, defaultBranch2));
-    evidence.push(...await vercelEvidence(root, defaultBranch2));
+    found.push(...await workflowEvidence(root, defaultBranch2, mentions));
+    found.push(...await vercelEvidence(root, defaultBranch2, deps.git));
   }
   const rows2 = await fetchDeployments(deps, errors);
-  if (rows2) evidence.push(...deploymentEvidence(rows2, { ...deps, defaultBranch: defaultBranch2 }));
+  if (rows2) found.push(...deploymentEvidence(rows2, { ...deps, defaultBranch: defaultBranch2 }));
+  const evidence = found.filter((item) => !explainedBy(item, mentions));
   return { config: configFromEvidence(evidence), evidence, errors };
 }
+function explainedBy(item, mentions) {
+  if (!item.tracedTo || !item.branch) return false;
+  const escaped = item.tracedTo.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const word = new RegExp(`(?<![\\w-])${escaped}(?![\\w-])`);
+  return (mentions.get(item.branch) ?? []).some((text) => word.test(text));
+}
 
 // src/deploy/repo.ts
 init_exec();
@@ -8134,6 +8427,7 @@ async function writeDeployConfig(root, dryRun, opts = {}) {
   const gh = opts.gh ?? (deployDetectOffline() ? void 0 : realGh());
   const result = await detectDeployConfig(root, {
     gh,
+    git,
     slug: context?.slug,
     defaultBranch: branch,
     now: opts.now,
@@ -8296,7 +8590,7 @@ function prettierIgnoreProtects(lines, dir) {
 function buildPrettierIgnoreBlock() {
   return [
     PRETTIERIGNORE_BEGIN,
-    "# haus-owned files \u2014 do not reformat (keeps tamper/lock hashes stable)",
+    "# haus-owned files, do not reformat (keeps tamper/lock hashes stable)",
     ...IGNORED_PATHS,
     PRETTIERIGNORE_END
   ].join("\n");
@@ -8498,7 +8792,7 @@ function line(f) {
 function buildWorkflowConfig(v) {
   const f = productionFields(v);
   const byPrefix = (p) => line(f.find((x) => x.prefix === p));
-  return "# How this project works (workflow methodology bindings)\n\n> The few project-specific values the workflow standard (WORKFLOW.md) binds to:\n> where the source-of-truth docs live, the test commands the TDD/verification gate\n> runs, the highest-stakes logic, and the pre-commit tool. This file is yours to\n> edit and haus will not overwrite it.\n>\n> Everyday commands (dev, build, lint, typecheck, format) and project documentation\n> live in `CLAUDE.md` + `docs/` \u2014 run **`/docs`** to generate/refresh them.\n\n## Source-of-truth documents\n" + byPrefix("- Spec: ") + "\n" + byPrefix("- Design: ") + "\n" + byPrefix("- UX flows: ") + "\n\n## Test commands (TDD / verification gate)\n" + byPrefix("- Test (unit + integration): ") + "\n" + byPrefix("- Test (E2E): ") + "\n\n## Highest-stakes logic\n<!-- fill in domain areas requiring TDD-only treatment, e.g. payment flows, auth, medical data -->\n\n## Pre-commit tool\n" + byPrefix("- Tool: ") + "\n";
+  return "# How this project works (workflow methodology bindings)\n\n> The few project-specific values the workflow standard (WORKFLOW.md) binds to:\n> where the source-of-truth docs live, the test commands the TDD/verification gate\n> runs, the highest-stakes logic, and the pre-commit tool. This file is yours to\n> edit and haus will not overwrite it.\n>\n> Everyday commands (dev, build, lint, typecheck, format) and project documentation\n> live in `CLAUDE.md` + `docs/`. Run **`/docs`** to generate/refresh them.\n\n## Source-of-truth documents\n" + byPrefix("- Spec: ") + "\n" + byPrefix("- Design: ") + "\n" + byPrefix("- UX flows: ") + "\n\n## Test commands (TDD / verification gate)\n" + byPrefix("- Test (unit + integration): ") + "\n" + byPrefix("- Test (E2E): ") + "\n\n## Highest-stakes logic\n<!-- fill in domain areas requiring TDD-only treatment, e.g. payment flows, auth, medical data -->\n\n## Pre-commit tool\n" + byPrefix("- Tool: ") + "\n";
 }
 function buildPocWorkflowConfig(v) {
   const f = pocFields(v);
@@ -8693,6 +8987,10 @@ var APPLY_FORCE = "haus apply --write --force";
 var APPLY_WRITE = "haus apply --write";
 async function writeWorkflowReport(root, pkgVersion, opts) {
   const { dryRun } = opts;
+  if (opts.marked === true) {
+    const left = await leaveMarkedFile(root, WORKFLOW_REL, STABLE_ID, opts.force === true);
+    if (left !== null) return left;
+  }
   const templateContent = await readWorkflowTemplate({
     dryRun,
     projectRoot: root,
@@ -8700,7 +8998,7 @@ async function writeWorkflowReport(root, pkgVersion, opts) {
   });
   if (templateContent === null) {
     warn(
-      isOffline() ? `Workflow template is not in the local catalog cache and this run is offline \u2014 run \`haus catalog bundle import <file>\` (or drop \`--offline\`), then re-run \`haus apply --write\`` : `Workflow template could not be fetched from the catalog \u2014 check your network, then re-run \`haus apply --write\` (or \`haus update\`)`
+      isOffline() ? `Workflow template is not in the local catalog cache and this run is offline. Run \`haus catalog bundle import <file>\` (or drop \`--offline\`), then re-run \`haus apply --write\`` : `Workflow template could not be fetched from the catalog. Check your network, then re-run \`haus apply --write\` (or \`haus update\`)`
     );
     return null;
   }
@@ -8712,9 +9010,19 @@ async function writeWorkflowReport(root, pkgVersion, opts) {
     force: opts.force === true,
     quiet: opts.quiet === true,
     forceCommand: opts.forceCommand ?? APPLY_FORCE,
-    writeCommand: opts.writeCommand ?? APPLY_WRITE
+    writeCommand: opts.writeCommand ?? APPLY_WRITE,
+    marked: opts.marked === true
   });
 }
+var MARK_SET_ASIDE = " (excludedIds marks it as the project's own; --force replaces it anyway)";
+function leavesMarkedFile(onDisk, force) {
+  return !force || onDisk.kind === "absent" || onDisk.kind === "other";
+}
+async function leaveMarkedFile(root, relPath, id, force) {
+  const file = path43.join(root, relPath);
+  if (!leavesMarkedFile(await inspectHeaderHashedFile(file), force)) return null;
+  return { id, relPath, path: file, outcome: "kept", marked: true };
+}
 function headerFileItem(result) {
   return {
     id: result.id,
@@ -8805,6 +9113,10 @@ async function writeHeaderHashedFile(root, relPath, opts) {
   const file = path43.join(root, relPath);
   const printable = displayPath(root, file);
   const onDisk = await inspectHeaderHashedFile(file);
+  const marked = opts.marked === true;
+  if (marked && leavesMarkedFile(onDisk, opts.force)) {
+    return { id: opts.id, relPath, path: file, outcome: "kept", marked: true };
+  }
   const next = `${hausManagedHeader(opts.id, opts.pkgVersion, hashText(normaliseLF(opts.body)))}
 ${opts.body}`;
   const named = { id: opts.id, relPath, path: file };
@@ -8818,8 +9130,9 @@ ${opts.body}`;
         ...outcome === "refused" && notAFile !== void 0 ? { notAFile } : {}
       }
     );
-    if (outcomeStream(outcome) === "warn") warn(line2);
-    else say(line2);
+    const said = marked && outcome === "replaced" ? `${line2}${MARK_SET_ASIDE}` : line2;
+    if (outcomeStream(outcome) === "warn") warn(said);
+    else say(said);
     const before = onDisk.kind === "file" ? onDisk.text : onDisk.kind === "absent" ? "" : void 0;
     if (opts.dryRun && before !== void 0 && isOwnedAfter(outcome) && outcome !== "unchanged") {
       say(createUnifiedDiff(printable, before, next));
@@ -8889,7 +9202,7 @@ async function reportSkillDependencyInstall(root, itemId, sourceDir, skillDir, m
     case "none":
       return;
     case "skipped":
-      warn(`${itemId}: skipping dependency install \u2014 ${outcome.reason}`);
+      warn(`${itemId}: skipping dependency install: ${outcome.reason}`);
       return;
     case "would-install":
       say(
@@ -8903,7 +9216,7 @@ async function reportSkillDependencyInstall(root, itemId, sourceDir, skillDir, m
       return;
     case "failed":
       warn(
-        `${itemId}: dependency install failed (${outcome.command} exited ${outcome.exitCode}) \u2014 the skill is installed but its scripts may not run${outcome.stderr ? `: ${outcome.stderr.trim().split("\n").slice(-1)[0]}` : ""}`
+        `${itemId}: dependency install failed (${outcome.command} exited ${outcome.exitCode}): the skill is installed but its scripts may not run${outcome.stderr ? `: ${outcome.stderr.trim().split("\n").slice(-1)[0]}` : ""}`
       );
       return;
   }
@@ -9069,12 +9382,15 @@ async function writeClaudeFilesReport(root, dryRun, selectedIds, opts = {}) {
   }
   const rootClaudeMdPath = rootClaudeMd.status === "written" ? rootClaudeMd.path : null;
   const decisionsSeedPath = profileSpec.writesDecisionsSeed ? await writeDecisionsSeed(root, dryRun, opts.quiet) : null;
+  const excludedIds = await readProjectExcludedIdsIfReadable(root);
+  const isMarked = (id) => excludedIds?.includes(id) === true;
   const workflow = await writeWorkflowReport(root, hausVersion2, {
     dryRun,
     force: opts.force,
     quiet: opts.quiet,
     templateRel: profileSpec.workflowTemplateRel,
-    forceCommand: APPLY_FORCE2
+    forceCommand: APPLY_FORCE2,
+    marked: isMarked(WORKFLOW_ID)
   });
   if (workflow?.backupFailed) exitCode = 1;
   const workflowPath = workflow !== null && isOwnedAfter(workflow.outcome) ? workflow.path : null;
@@ -9149,10 +9465,11 @@ async function writeClaudeFilesReport(root, dryRun, selectedIds, opts = {}) {
     force: opts.force === true,
     quiet: opts.quiet === true,
     forceCommand: APPLY_FORCE2,
-    writeCommand: APPLY_WRITE2
+    writeCommand: APPLY_WRITE2,
+    marked: isMarked(RULES_HAUS_ID)
   });
   if (rulesHaus.backupFailed) exitCode = 1;
-  const headerItems = [...workflow === null ? [] : [workflow], rulesHaus].map(headerFileItem);
+  const headerItems = [...workflow === null ? [] : [workflow], rulesHaus].filter((result) => result.marked !== true).map(headerFileItem);
   const coreFiles = [
     ...settingsRefused ? [] : [claudePath(root, "settings.json")],
     ...isOwnedAfter(rulesHaus.outcome) ? [rulesHaus.path] : []
@@ -9503,11 +9820,10 @@ async function writeClaudeFilesReport(root, dryRun, selectedIds, opts = {}) {
   }
   if (curatedReviewStatusSkips > 1) {
     warn(
-      `${curatedReviewStatusSkips} curated items skipped: reviewStatus is not approved \u2014 possible catalog field rename upstream`
+      `${curatedReviewStatusSkips} curated items skipped: reviewStatus is not approved (possible catalog field rename upstream)`
     );
   }
   const adoptedStrays = [];
-  const excludedIds = await readProjectExcludedIdsIfReadable(root);
   if (excludedIds === void 0) {
     warn(
       `Not adopting stray files: ${PROJECT_CONFIG_REL} cannot be read as JSON, so haus cannot tell which ids it excludes. Fix the file and run again.`
@@ -9555,7 +9871,7 @@ async function writeClaudeFilesReport(root, dryRun, selectedIds, opts = {}) {
   if (opts.prune) {
     if (refusePruneWithoutRecommendation) {
       warn(
-        "recommendation.json is missing or unreadable \u2014 refusing --prune (every installed item would look orphaned). Run `haus recommend` first, or pass --force to override."
+        "recommendation.json is missing or unreadable, refusing --prune (every installed item would look orphaned). Run `haus recommend` first, or pass --force to override."
       );
     } else {
       const notOrphaned = new Set(rec.recommended.map((r) => r.id));
@@ -9875,7 +10191,7 @@ async function targetShapeMismatch(root, target, itemType) {
   for (const rel of target) {
     let stat2;
     try {
-      if (await unsafeTrackedPath(root, rel) !== null) continue;
+      if (await unsafeTrackedPath(root, rel, REPLACE_LINK_RULES) !== null) continue;
       stat2 = await fs28.lstat(path44.resolve(root, recordedRel(rel)));
     } catch {
       continue;
@@ -9936,18 +10252,14 @@ async function cleanupMigratedCatalogItems(root, prevLock, migrations, dryRun, q
       unsafeByRel
     );
     if (await hasProtectedUnsafePath(root, relPaths, unsafeByRel)) {
-      if (isMove) {
-        if (samePath2.force) {
-          const reasons = [...unsafeByRel].flatMap(
-            ([rel, reason]) => reason === null ? [] : [unsafeOnDiskReason(rel, reason)]
-          );
-          warn(
-            dryRun ? `[dry-run] would refuse ${posixPathsOnce(relPaths).join(", ")} (${migration.oldId}): ${reasons.join("; ")}` : backupFailedLine(relPaths, migration.oldId, reasons.join("; "))
-          );
-          containmentFailed = true;
-        } else {
-          warn(movedKeptLine(migration.oldId, relPaths, dryRun));
-        }
+      if (isMove && samePath2.force) {
+        const reasons = [...unsafeByRel].flatMap(
+          ([rel, reason]) => reason === null ? [] : [unsafeOnDiskReason(rel, reason)]
+        );
+        warn(
+          dryRun ? `[dry-run] would refuse ${posixPathsOnce(relPaths).join(", ")} (${migration.oldId}): ${reasons.join("; ")}` : backupFailedLine(relPaths, migration.oldId, reasons.join("; "))
+        );
+        containmentFailed = true;
       }
       refusedIds.add(migration.oldId);
       continue;
@@ -9995,11 +10307,11 @@ async function cleanupMigratedCatalogItems(root, prevLock, migrations, dryRun, q
     if (!gate.ok) {
       if (gate.reason === "no-hash") {
         warn(
-          `Former catalog item ${migration.oldId} has no lock hash \u2014 leaving old paths in place: ${existing.map((e) => e.rel).join(", ")}`
+          `Former catalog item ${migration.oldId} has no lock hash, leaving old paths in place: ${existing.map((e) => e.rel).join(", ")}`
         );
       } else {
         warn(
-          `Former catalog item ${migration.oldId} was modified locally \u2014 leaving old paths in place: ${existing.map((e) => e.rel).join(", ")}`
+          `Former catalog item ${migration.oldId} was modified locally, leaving old paths in place: ${existing.map((e) => e.rel).join(", ")}`
         );
       }
       refusedIds.add(migration.oldId);
@@ -10158,11 +10470,11 @@ async function cleanupStaleCatalogItems(root, prevLock, manifestById, dryRun, qu
     if (!gate.ok) {
       if (gate.reason === "no-hash") {
         warn(
-          `${label} catalog item ${entry.id} has no lock hash \u2014 leaving in place: ${existing.map((e) => e.rel).join(", ")}`
+          `${label} catalog item ${entry.id} has no lock hash, leaving in place: ${existing.map((e) => e.rel).join(", ")}`
         );
       } else {
         warn(
-          `${label} catalog item ${entry.id} was modified locally \u2014 leaving in place${superseded ? " (the global plugin provides it; delete the copy manually if you no longer want it)" : ""}: ${existing.map((e) => e.rel).join(", ")}`
+          `${label} catalog item ${entry.id} was modified locally, leaving in place${superseded ? " (the global plugin provides it; delete the copy manually if you no longer want it)" : ""}: ${existing.map((e) => e.rel).join(", ")}`
         );
       }
       refusedIds.add(entry.id);
@@ -10172,7 +10484,7 @@ async function cleanupStaleCatalogItems(root, prevLock, manifestById, dryRun, qu
       const isShared = recordedRel(rel) === LEGACY_SUPERPOWERS_SHARED_REL_PATH;
       if (isShared && keepShared) {
         say(
-          `Keeping ${displayPath(root, path44.join(root, rel))} \u2014 a locally-edited superpowers skill still uses it`
+          `Keeping ${displayPath(root, path44.join(root, rel))}: a locally-edited superpowers skill still uses it`
         );
         result.heldBack.set(entry.id, [...result.heldBack.get(entry.id) ?? [], rel]);
         return false;
@@ -10272,7 +10584,7 @@ async function pruneOrphanedCatalogItems(root, prevLock, notOrphanedIds, dryRun,
     if (!gate.ok) {
       const detail = gate.reason === "no-hash" ? "has no lock hash" : "was modified locally";
       warn(
-        `Orphaned catalog item ${entry.id} ${detail} \u2014 leaving in place: ${existing.map((e) => e.rel).join(", ")}`
+        `Orphaned catalog item ${entry.id} ${detail}, leaving in place: ${existing.map((e) => e.rel).join(", ")}`
       );
       refusedIds.add(entry.id);
       continue;
@@ -10367,8 +10679,8 @@ var GITIGNORED_ARTIFACT_PATHS = [
   // process state and machine-local diagnostics, meaningless in another checkout.
   ".haus-workflow/locks/",
   ".haus-workflow/logs/",
-  // The request pipeline's archive (#472, ADR-0103): per-request pricing material —
-  // specs, impact analyses, scores — written by the request skill, not this CLI. It
+  // The request pipeline's archive (#472, ADR-0103): per-request pricing material,
+  // specs, impact analyses, scores, written by the request skill, not this CLI. It
   // lived at `.haus/requests/` behind a hand-added ignore line OUTSIDE this block,
   // so no client repo ever received the rule; `migrate-request-state.ts` moves it
   // here precisely so this block can own it. Note `.haus-workflow/request.json`
@@ -10408,7 +10720,7 @@ function buildBlockFor(existing, beginMarker, endMarker, comment, patterns) {
   if (needed.length === 0) return null;
   return [beginMarker, comment, ...needed, endMarker].join("\n");
 }
-var ARTIFACT_BLOCK_COMMENT = "# haus machine-local artifacts \u2014 must never be committed (see ADR-0025, ADR-0058, ADR-0009)";
+var ARTIFACT_BLOCK_COMMENT = "# haus machine-local artifacts, must never be committed (see ADR-0025, ADR-0058, ADR-0009)";
 function injectBlockFor(existing, beginMarker, endMarker, comment, patterns) {
   const range = findBlockRangeFor(existing, beginMarker, endMarker);
   if (!range && findLineMarker(existing, beginMarker)) return { refused: "lone-begin" };
@@ -10436,7 +10748,7 @@ var LINKED_CONTEXT_GITIGNORE_PATTERNS = [
   ".claude/agents/*--*.md",
   ".claude/commands/*--*.md"
 ];
-var LINK_CONTEXT_BLOCK_COMMENT = "# haus workspace link-context copies \u2014 derived cross-repo skill/agent/command copies, never committed";
+var LINK_CONTEXT_BLOCK_COMMENT = "# haus workspace link-context copies: derived cross-repo skill/agent/command copies, never committed";
 function injectLinkContextGitignoreBlock(existing) {
   return injectBlockFor(
     existing,
@@ -10504,7 +10816,7 @@ async function untrackMachineLocalArtifacts(root, dryRun, notify) {
   for (const rel of tracked) {
     if (dryRun) {
       notify(
-        `Would untrack ${rel} from git \u2014 it is machine-local haus output and should never have been committed.`
+        `Would untrack ${rel} from git: it is machine-local haus output and should never have been committed.`
       );
       continue;
     }
@@ -10512,7 +10824,7 @@ async function untrackMachineLocalArtifacts(root, dryRun, notify) {
     if (result.exitCode === 0) {
       untracked.push(rel);
       notify(
-        `Untracked ${rel} from git \u2014 it is machine-local haus output and should never have been committed. Run \`git status\` to review before committing this change.`
+        `Untracked ${rel} from git: it is machine-local haus output and should never have been committed. Run \`git status\` to review before committing this change.`
       );
     } else {
       notify(`Could not untrack ${rel} from git: ${result.stderr.trim() || result.stdout.trim()}`);
@@ -10669,7 +10981,7 @@ async function probePluginEnv(deps = {}) {
         return { status: "absent" };
       case "inconclusive":
         warn2(
-          `Could not determine whether the \`claude\` CLI is on PATH (${probe.reason}) \u2014 leaving global plugins untouched this run.`
+          `Could not determine whether the \`claude\` CLI is on PATH (${probe.reason}), leaving global plugins untouched this run.`
         );
         return { status: "inconclusive", reason: probe.reason };
       default:
@@ -10698,7 +11010,7 @@ async function probePluginEnv(deps = {}) {
   ]);
   if (listed.exitCode !== 0 || markets.exitCode !== 0) {
     warn2(
-      `Could not read Claude Code plugin state (${listed.exitCode !== 0 ? "plugin list" : "marketplace list"} exited ${listed.exitCode !== 0 ? listed.exitCode : markets.exitCode}) \u2014 leaving global plugins untouched.`
+      `Could not read Claude Code plugin state (${listed.exitCode !== 0 ? "plugin list" : "marketplace list"} exited ${listed.exitCode !== 0 ? listed.exitCode : markets.exitCode}), leaving global plugins untouched.`
     );
     return unread(
       "query-failed",
@@ -10709,7 +11021,7 @@ async function probePluginEnv(deps = {}) {
   const installed = parseInstalled(listed.stdout);
   const marketplaces = await parseMarketplaces(markets.stdout, configDir);
   if (installed === null || marketplaces === null) {
-    warn2("Claude Code returned unreadable plugin state \u2014 leaving global plugins untouched.");
+    warn2("Claude Code returned unreadable plugin state, leaving global plugins untouched.");
     return unread("unreadable");
   }
   const userEnabledPlugins = await readUserEnabledPlugins(configDir);
@@ -10783,7 +11095,7 @@ async function ensureGlobalPlugins(pins, deps = {}) {
   for (const action of actions) {
     if (action.kind === "unavailable") {
       warn2(
-        `Claude Code CLI not found \u2014 cannot manage the ${action.pin.id} plugin. Install it manually:`
+        `Claude Code CLI not found, cannot manage the ${action.pin.id} plugin. Install it manually:`
       );
       manualCommands(action.pin).forEach((cmd) => warn2(`  ${cmd}`));
       continue;
@@ -10801,7 +11113,7 @@ async function ensureGlobalPlugins(pins, deps = {}) {
     }
     if (action.overriddenRef !== void 0 && action.overriddenRef !== action.pin.ref) {
       warn2(
-        `Re-pointing marketplace ${action.pin.marketplace} from ${action.overriddenRef} to the haus-pinned ${action.pin.ref} \u2014 haus manages this plugin's version.`
+        `Re-pointing marketplace ${action.pin.marketplace} from ${action.overriddenRef} to the haus-pinned ${action.pin.ref}: haus manages this plugin's version.`
       );
     }
     if (dryRun) {
@@ -10849,7 +11161,7 @@ async function removeGlobalPlugins(plugins, deps = {}) {
   const state = await probePluginEnv(deps);
   if (!state.available) {
     result.unavailable = true;
-    warn2("Claude Code CLI not found \u2014 leaving the haus-managed global plugin(s) in place.");
+    warn2("Claude Code CLI not found, leaving the haus-managed global plugin(s) in place.");
     return result;
   }
   const scopeKey = (id, scope) => `${id}@@${scope ?? "user"}`;
@@ -11110,7 +11422,7 @@ async function resolveWorkspaceForWorktree(start) {
   if (!hasYaml && !hasManifest) {
     return {
       ok: false,
-      reason: `No workspace found at ${workspaceRoot} \u2014 expected ${WORKSPACE_FILE} or ${REPOS_MANIFEST_FILE}. Run \`haus workspace discover --write\` or \`haus workspace init\` first.`
+      reason: `No workspace found at ${workspaceRoot}: expected ${WORKSPACE_FILE} or ${REPOS_MANIFEST_FILE}. Run \`haus workspace discover --write\` or \`haus workspace init\` first.`
     };
   }
   return { ok: true, rootInfo, workspaceRoot };
@@ -11131,7 +11443,7 @@ function isValidWorktreeSlug(slug) {
 function worktreePath(mainRoot, slug) {
   if (!isValidWorktreeSlug(slug)) {
     throw new Error(
-      `Invalid worktree slug ${JSON.stringify(slug)} \u2014 slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
+      `Invalid worktree slug ${JSON.stringify(slug)}: slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
     );
   }
   return path50.join(worktreesDir(mainRoot), slug);
@@ -12531,14 +12843,14 @@ async function applyRun(options) {
     const skippedIds = new Set((rec2?.skipped ?? []).map((s) => s.id));
     for (const id of explicitIds.filter((id2) => !installableIds.has(id2))) {
       if (configIds.has(id)) {
-        warn(`--ids: "${id}" is a config item \u2014 install it with \`haus configs ${id}\`. Ignoring.`);
+        warn(`--ids: "${id}" is a config item. Install it with \`haus configs ${id}\`. Ignoring.`);
       } else if (skippedIds.has(id)) {
         warn(
-          `--ids: "${id}" is not currently recommended (skipped) \u2014 add it with \`haus recommend --include ${id}\` first. Ignoring.`
+          `--ids: "${id}" is not currently recommended (skipped). Add it with \`haus recommend --include ${id}\` first. Ignoring.`
         );
       } else {
         warn(
-          `--ids: "${id}" is not in recommendation.json \u2014 run \`haus recommend\` (or \`--include ${id}\`) first. Ignoring.`
+          `--ids: "${id}" is not in recommendation.json. Run \`haus recommend\` (or \`--include ${id}\`) first. Ignoring.`
         );
       }
     }
@@ -12553,7 +12865,7 @@ async function applyRun(options) {
     }
     const rec2 = await readJson(hausPath(root, "recommendation.json"));
     if (!rec2) {
-      log("No recommendation.json found \u2014 run `haus recommend` first. Writing core files only.");
+      log("No recommendation.json found. Run `haus recommend` first. Writing core files only.");
       selectedIds = [];
     } else {
       const items = installableRecommendedItems(rec2.recommended);
@@ -12562,7 +12874,7 @@ async function applyRun(options) {
         selectedIds = [];
       } else {
         const choices = items.map((item) => ({
-          name: `${item.id}  [${item.selectionMode}] \u2014 ${item.reason}`,
+          name: `${item.id}  [${item.selectionMode}]: ${item.reason}`,
           value: item.id,
           checked: true
         }));
@@ -12608,7 +12920,7 @@ async function applyRun(options) {
       const message2 = "No catalog content found. Run `haus update` first.";
       if (!options.allowEmptyCache) {
         if (isDryRun) {
-          warn(`Catalog cache is empty \u2014 dry-run will skip catalog items. ${message2}`);
+          warn(`Catalog cache is empty: dry-run will skip catalog items. ${message2}`);
         } else {
           error(message2);
           process.exitCode = 1;
@@ -12630,7 +12942,7 @@ async function applyRun(options) {
         const cacheAgeDays = Math.floor(cacheAgeMs / (1e3 * 60 * 60 * 24));
         if (cacheAgeDays >= STALE_CACHE_THRESHOLD_DAYS) {
           warn(
-            `Catalog cache is ${cacheAgeDays} days old \u2014 run \`haus update\` for the latest content.`
+            `Catalog cache is ${cacheAgeDays} days old. Run \`haus update\` for the latest content.`
           );
         }
       }
@@ -12667,7 +12979,7 @@ async function applyRun(options) {
       if (isOffline()) {
         const refCount = collectLlmsTxtUrls(installedItems).length;
         if (refCount > 0)
-          log(`Offline \u2014 skipping ${refCount} llms.txt reference fetch(es); using the cache as-is.`);
+          log(`Offline: skipping ${refCount} llms.txt reference fetch(es); using the cache as-is.`);
       } else {
         const summary = await fetchRefsForItems(installedItems, cacheDir);
         if (summary.fetched > 0)
@@ -12694,11 +13006,11 @@ async function applyRun(options) {
     const dirList = dirs.join(" and ");
     const verb = dirs.length === 1 ? "is" : "are";
     warn(
-      `${dirList} ${verb} gitignored \u2014 installed skills/agents/commands will not be visible to anything relying on git-tracked state. Remove the covering .gitignore rule (only settings.json, settings.local.json, and worktrees/ under .claude/ should ever be ignored).`
+      `${dirList} ${verb} gitignored: installed skills/agents/commands will not be visible to anything relying on git-tracked state. Remove the covering .gitignore rule (only settings.json, settings.local.json, and worktrees/ under .claude/ should ever be ignored).`
     );
   }
   if (isDryRun) {
-    log(`Dry-run complete \u2014 ${files.length} file(s) planned, none written. Run --write to apply.`);
+    log(`Dry-run complete: ${files.length} file(s) planned, none written. Run --write to apply.`);
     return { report: report2, dryRun: isDryRun };
   }
   log("Applied files:");
@@ -12712,7 +13024,7 @@ async function applyRun(options) {
       log(`${installedWantedCount} of ${countedIds.length} catalog items installed (${tier} tier).`);
       if (installedWantedCount === 0) {
         error(
-          "No catalog items were installed \u2014 only core files were written. Run `haus update` with network access, or import a catalog bundle."
+          "No catalog items were installed, only core files were written. Run `haus update` with network access, or import a catalog bundle."
         );
         process.exitCode = 1;
       }
@@ -12760,7 +13072,7 @@ async function confirm(question, io) {
 async function input(question, io = defaultIO()) {
   if (!io.isTTY) {
     throw new Error(
-      `Cannot prompt for "${question}" without a TTY \u2014 pass the value as a flag/argument.`
+      `Cannot prompt for "${question}" without a TTY. Pass the value as a flag/argument.`
     );
   }
   for (let i = 0; i < MAX_PROMPT_RETRIES; i++) {
@@ -12772,7 +13084,7 @@ async function input(question, io = defaultIO()) {
 async function select(question, choices, io = defaultIO()) {
   if (!io.isTTY) {
     throw new Error(
-      `Cannot prompt for "${question}" without a TTY \u2014 pass the value as a flag/argument.`
+      `Cannot prompt for "${question}" without a TTY. Pass the value as a flag/argument.`
     );
   }
   const menu = choices.map((c, i) => `  ${i + 1}. ${c.label}`).join("\n");
@@ -13133,7 +13445,7 @@ async function restoreDirBackup(root, entry, yes, json, dryRun) {
   const { files, skippedLinks, skippedOther } = await collectFilesRecursive(entry.absPath);
   if (skippedLinks.length > 0) {
     warn(
-      `Skipped ${skippedLinks.length} symlink(s) inside backup ${entry.id} \u2014 never followed: ${skippedLinks.map((abs) => path57.relative(entry.absPath, abs)).join(", ")}`
+      `Skipped ${skippedLinks.length} symlink(s) inside backup ${entry.id}, never followed: ${skippedLinks.map((abs) => path57.relative(entry.absPath, abs)).join(", ")}`
     );
   }
   if (skippedOther.length > 0) {
@@ -13164,7 +13476,7 @@ async function restoreDirBackup(root, entry, yes, json, dryRun) {
   }
   if (unsafeTargets.length > 0) {
     warn(
-      `Skipped ${unsafeTargets.length} restore target(s) that are a symlink (or under one) rather than a plain path \u2014 never written through: ${unsafeTargets.join(", ")}`
+      `Skipped ${unsafeTargets.length} restore target(s) that are a symlink (or under one) rather than a plain path, never written through: ${unsafeTargets.join(", ")}`
     );
   }
   if (safeFiles.length === 0 && lockInBackup === null) {
@@ -13482,7 +13794,7 @@ async function runBackups(action, opts = {}) {
     return;
   }
   if (opts.olderThan === void 0 && opts.keep === void 0) {
-    const message2 = "Specify --older-than <days> or --keep <n> \u2014 refusing to prune with no bound.";
+    const message2 = "Specify --older-than <days> or --keep <n>. Refusing to prune with no bound.";
     if (json) log(JSON.stringify({ ok: false, error: message2 }));
     error(message2);
     process.exitCode = 1;
@@ -13492,7 +13804,7 @@ async function runBackups(action, opts = {}) {
   if (opts.olderThan !== void 0) {
     const n = Number(opts.olderThan);
     if (!Number.isFinite(n) || n < 0) {
-      const message2 = `Invalid --older-than value "${opts.olderThan}" \u2014 expected a non-negative number of days.`;
+      const message2 = `Invalid --older-than value "${opts.olderThan}": expected a non-negative number of days.`;
       if (json) log(JSON.stringify({ ok: false, error: message2 }));
       error(message2);
       process.exitCode = 1;
@@ -13504,7 +13816,7 @@ async function runBackups(action, opts = {}) {
   if (opts.keep !== void 0) {
     const n = Number(opts.keep);
     if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n)) {
-      const message2 = `Invalid --keep value "${opts.keep}" \u2014 expected a non-negative integer.`;
+      const message2 = `Invalid --keep value "${opts.keep}": expected a non-negative integer.`;
       if (json) log(JSON.stringify({ ok: false, error: message2 }));
       error(message2);
       process.exitCode = 1;
@@ -13578,7 +13890,7 @@ async function runBundleExport(options) {
   const cacheDir = getCacheDir();
   const manifest = await readJson(path58.join(cacheDir, MANIFEST_FILE));
   if (!manifest?.items?.length) {
-    error("Catalog cache is empty \u2014 run `haus update` on a connected machine first.");
+    error("Catalog cache is empty. Run `haus update` on a connected machine first.");
     process.exitCode = 1;
     return;
   }
@@ -13724,9 +14036,9 @@ async function runBundleImport(file, options = {}) {
       cwd: staging,
       // Refuse anything that would land outside the staging dir. node-tar's own
       // extraction already refuses `..`, absolute paths, and symlink escapes by
-      // default (preservePaths is left unset) — this filter is a second, independent
+      // default (preservePaths is left unset), this filter is a second, independent
       // check using the same path-safety module the network sync uses. Both this
-      // filter's refusals and node-tar's own built-in ones are logged — a tampered
+      // filter's refusals and node-tar's own built-in ones are logged, a tampered
       // bundle's dropped entries must be visible, not silently absorbed.
       filter: (entryPath) => {
         const safe = isSafeCatalogPath(entryPath);
@@ -13741,7 +14053,7 @@ async function runBundleImport(file, options = {}) {
     }
     const manifest = await readJson(path58.join(staging, MANIFEST_FILE));
     if (!manifest?.items?.length) {
-      error("Bundle contains no catalog manifest \u2014 refusing to import.");
+      error("Bundle contains no catalog manifest, refusing to import.");
       process.exitCode = 1;
       return;
     }
@@ -14811,7 +15123,7 @@ async function runDecisionsCheck(root, opts = {}) {
     return {
       triggered: false,
       satisfied: true,
-      reasons: ["catalog-sync branch \u2014 exempt"],
+      reasons: ["catalog-sync branch, exempt"],
       securityTriggered: false,
       ...noRecordFailure()
     };
@@ -14895,7 +15207,7 @@ async function auditDecisionsLayout(root, profile) {
     if (PROFILES[profile].writesDecisionsSeed) {
       findings.push({
         level: "advisory",
-        line: `- DECISIONS: legacy ${DECISIONS_TRIGGERS.legacyDecisionsDir}/ present \u2014 migrate to docs/decisions/`,
+        line: `- DECISIONS: legacy ${DECISIONS_TRIGGERS.legacyDecisionsDir}/ present, migrate to docs/decisions/`,
         sentence: "Decision records still live under the legacy docs/adr/ path",
         fix: `git mv ${DECISIONS_TRIGGERS.legacyDecisionsDir} ${DECISIONS_TRIGGERS.decisionsDir}`
       });
@@ -15219,7 +15531,7 @@ function printConfigDirMigration(result) {
     if (!result.planned) log("Rewrote the install manifest to the new location.");
   }
   for (const conflict of result.conflicts) {
-    warn(`Left in place \u2014 a different file already exists at the destination: ${conflict}`);
+    warn(`Left in place: a different file already exists at the destination: ${conflict}`);
   }
   for (const failure2 of result.failures) {
     warn(`Could not move ${failure2.path}: ${failure2.reason}`);
@@ -15304,12 +15616,12 @@ async function checkPrereqs(deps = {}) {
 function formatPrereqReport(report2) {
   const lines = report2.checks.map((check) => {
     const label = check.status === "ok" ? "OK     " : check.status === "missing" ? "MISSING" : "UNKNOWN";
-    const head = `- ${label} ${check.name} \u2014 ${check.detail}`;
+    const head = `- ${label} ${check.name}: ${check.detail}`;
     return check.fix ? `${head}
            fix: ${check.fix}` : head;
   });
   const unknown = report2.checks.filter((check) => check.status === "unknown");
-  const verdict = report2.ok ? unknown.length > 0 ? `This machine looks ready, though ${unknown.length} check(s) could not complete.` : "This machine is ready to run haus." : "Some prerequisites are missing \u2014 the fixes are listed above.";
+  const verdict = report2.ok ? unknown.length > 0 ? `This machine looks ready, though ${unknown.length} check(s) could not complete.` : "This machine is ready to run haus." : "Some prerequisites are missing. The fixes are listed above.";
   return [...lines, "", verdict].join("\n");
 }
 
@@ -15350,6 +15662,11 @@ async function fetchNpmVersionStatus(currentVersion) {
 init_fs();
 init_logger();
 init_paths();
+function joinFix(sentence, label, fix) {
+  const trimmed = sentence.replace(/[:;]+$/, "");
+  const closed = /[.!?]$/.test(trimmed) ? trimmed : `${trimmed}.`;
+  return `${closed} ${label}: ${fix}`;
+}
 async function runDoctor(options, deps = {}) {
   const root = process.cwd();
   if (options?.prereqs) {
@@ -15397,7 +15714,7 @@ async function runDoctor(options, deps = {}) {
   };
   const SETTINGS_HAND_FIX = "fix .claude/settings.json by hand, then run haus apply --write";
   const UNCLOSED_BLOCK_FIX = "close the block by hand (put the HAUS:END line back, or delete the HAUS:BEGIN line), then run haus apply --write";
-  const notOwnedHeaderFile = (rel, refusal2) => {
+  const notOwnedHeaderFile = (rel, id, refusal2) => {
     if (refusal2.kind === "not-a-file") {
       const what = notAFileDescription(refusal2.what);
       suggest(
@@ -15410,9 +15727,15 @@ async function runDoctor(options, deps = {}) {
     suggest(
       `- ${rel}: not owned (no haus header). haus refuses it; haus apply --write --force replaces it after a backup`,
       `${rel} has no haus header and is not a version haus wrote`,
-      "keep it as your own (apply keeps refusing it), or replace it with haus apply --write --force (backed up first)"
+      `keep it as your own (haus remove ${id} marks it, so apply and doctor stop naming it), or replace it with haus apply --write --force (backed up first)`
     );
   };
+  const headerMarks = await readProjectExcludedIdsIfReadable(root) ?? [];
+  const markedHeaderRels = new Set(
+    headerMarks.flatMap(
+      (id) => Object.hasOwn(HEADER_FILE_RELS, id) ? [HEADER_FILE_RELS[id]] : []
+    )
+  );
   ok2(`Repo: ${context.repoName}`);
   ok2(`Roles: ${context.repoRoles.join(", ") || "unknown"}`);
   if (context.detectionStatus === "unknown") {
@@ -15427,7 +15750,7 @@ async function runDoctor(options, deps = {}) {
   } else {
     ok2("Recommended items: none recorded yet (run `haus recommend`)");
     suggest(
-      "- CATALOG ITEMS: no recommendation.json \u2014 the missing-item drift and orphaned-item checks did not run",
+      "- CATALOG ITEMS: no recommendation.json, so the missing-item drift and orphaned-item checks did not run",
       "No recommendation has been computed for this project yet, so two of the checks were skipped",
       "haus recommend (or `haus apply --write` to set the project up)"
     );
@@ -15440,7 +15763,7 @@ async function runDoctor(options, deps = {}) {
   if (hooks.skipped) {
     flag(
       `- HOOKS: (skipped) ${hooks.message}`,
-      "No Claude Code settings.json \u2014 haus security hooks are not installed",
+      "No Claude Code settings.json, so the haus security hooks are not installed",
       "haus apply --write"
     );
   } else if (!hooks.ok) {
@@ -15520,6 +15843,7 @@ async function runDoctor(options, deps = {}) {
         const resolved = path67.resolve(root, target);
         const relFromRoot = path67.relative(root, resolved);
         const escapesRoot = relFromRoot === ".." || relFromRoot.startsWith(`..${path67.sep}`) || path67.isAbsolute(relFromRoot);
+        if (!escapesRoot && markedHeaderRels.has(relFromRoot.split(path67.sep).join("/"))) continue;
         if (escapesRoot || !await fs45.pathExists(resolved)) {
           flag(
             `- CLAUDE.md import: @${target} does not resolve (run \`haus apply --write\`)`,
@@ -15539,7 +15863,8 @@ async function runDoctor(options, deps = {}) {
   }
   const workflowPath = hausPath(root, "WORKFLOW.md");
   const workflowOnDisk = await inspectHeaderHashedFile(workflowPath);
-  if (workflowOnDisk.kind === "absent") {
+  if (headerMarks.includes(WORKFLOW_ID)) {
+  } else if (workflowOnDisk.kind === "absent") {
     flag(
       "- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)",
       "The workflow standard file is missing",
@@ -15549,7 +15874,7 @@ async function runDoctor(options, deps = {}) {
     const onDisk = workflowOnDisk;
     const workflowContent = onDisk.kind === "unreadable" ? null : verdictText(onDisk);
     if (workflowContent !== null && typeof workflowContent !== "string") {
-      notOwnedHeaderFile(".haus-workflow/WORKFLOW.md", workflowContent);
+      notOwnedHeaderFile(".haus-workflow/WORKFLOW.md", WORKFLOW_ID, workflowContent);
     } else if (workflowContent !== null) {
       const firstLine3 = workflowContent.split("\n")[0] ?? "";
       const bodyContent = parseHausManagedHeader(firstLine3) === null ? workflowContent : workflowContent.slice(firstLine3.length + 1);
@@ -15583,7 +15908,7 @@ async function runDoctor(options, deps = {}) {
         );
       } else if (verdict.outcome === "installed") {
         suggest(
-          "- .haus-workflow/WORKFLOW.md: stale (template updated \u2014 run `haus apply --write`)",
+          "- .haus-workflow/WORKFLOW.md: stale (template updated, run `haus apply --write`)",
           "The workflow standard is out of date",
           "haus apply --write"
         );
@@ -15592,14 +15917,14 @@ async function runDoctor(options, deps = {}) {
       } else if (verdict.refusal?.kind === "another-id") {
         ok2("- .haus-workflow/WORKFLOW.md: OK (user-owned)");
       } else if (verdict.refusal?.kind === "not-owned") {
-        notOwnedHeaderFile(".haus-workflow/WORKFLOW.md", verdict.refusal);
+        notOwnedHeaderFile(".haus-workflow/WORKFLOW.md", WORKFLOW_ID, verdict.refusal);
       } else {
         ok2("- .haus-workflow/WORKFLOW.md: OK");
       }
     }
   }
   const rulesOnDisk = await inspectHeaderHashedFile(claudePath(root, "rules", "haus.md"));
-  const rulesHaus = rulesOnDisk.kind === "unreadable" ? void 0 : headerFileVerdict(verdictText(rulesOnDisk), {
+  const rulesHaus = rulesOnDisk.kind === "unreadable" || headerMarks.includes(RULES_HAUS_ID) ? void 0 : headerFileVerdict(verdictText(rulesOnDisk), {
     id: RULES_HAUS_ID,
     body: RULES_HAUS_BODY,
     knownBodies: KNOWN_RULES_HAUS_BODIES,
@@ -15609,10 +15934,10 @@ async function runDoctor(options, deps = {}) {
     suggest(
       "- .claude/rules/haus.md: edited (header hash does not match). haus keeps it; haus apply --write --force replaces it after a backup",
       "The haus rule (.claude/rules/haus.md) was edited after haus wrote it, so haus keeps it as it is",
-      "keep it, or replace it with haus apply --write --force (backed up first)"
+      `keep it (haus remove ${RULES_HAUS_ID} marks it as your own, so this stops), or replace it with haus apply --write --force (backed up first)`
     );
   } else if (rulesHaus?.refusal?.kind === "not-owned" || rulesHaus?.refusal?.kind === "not-a-file") {
-    notOwnedHeaderFile(".claude/rules/haus.md", rulesHaus.refusal);
+    notOwnedHeaderFile(".claude/rules/haus.md", RULES_HAUS_ID, rulesHaus.refusal);
   }
   const workflowConfigPath = hausPath(root, "workflow-config.md");
   const workflowConfigExists = await fs45.pathExists(workflowConfigPath);
@@ -15640,6 +15965,10 @@ async function runDoctor(options, deps = {}) {
       ok2(finding.line);
       continue;
     }
+    if (finding.level === "attention") {
+      flag(finding.line, finding.sentence, finding.fix);
+      continue;
+    }
     suggest(finding.line, finding.sentence, finding.fix);
     for (const line2 of finding.details ?? []) detail.push({ stream: "warn", text: `    ${line2}` });
   }
@@ -15651,7 +15980,7 @@ async function runDoctor(options, deps = {}) {
       ok2("- PROJECT DOCS: OK (docs/SUMMARY.md present)");
     } else if (PROFILES[profile].runsDocsPass) {
       suggest(
-        "- PROJECT DOCS: docs/SUMMARY.md missing \u2014 run the writing-documentation skill (`/docs` in Claude Code) to generate the project docs",
+        "- PROJECT DOCS: docs/SUMMARY.md missing. Run the writing-documentation skill (`/docs` in Claude Code) to generate the project docs",
         "The project docs index (docs/SUMMARY.md) has not been generated yet",
         "run `/docs` in Claude Code (the writing-documentation skill)"
       );
@@ -15741,7 +16070,7 @@ async function runDoctor(options, deps = {}) {
     const dirList = dirs.join(" and ");
     const verb = dirs.length === 1 ? "is" : "are";
     flag(
-      `- GITIGNORE (haus content): ${dirList} ${verb} gitignored \u2014 installed skills/agents/commands will not be visible to anything relying on git-tracked state`,
+      `- GITIGNORE (haus content): ${dirList} ${verb} gitignored: installed skills/agents/commands will not be visible to anything relying on git-tracked state`,
       `${dirList} ${verb} gitignored, so haus-installed content isn't visible to git-tracked state`,
       "remove the covering .gitignore rule (only settings.json, settings.local.json, and worktrees/ under .claude/ should ever be ignored)"
     );
@@ -15762,7 +16091,7 @@ async function runDoctor(options, deps = {}) {
     flag(
       `- CATALOG: ${err.message}`,
       err.kind === "too-new" ? "The catalog this project uses needs a newer haus than the one installed" : "The catalog this project uses declares a manifestFormat that is not a valid format number",
-      err.kind === "too-new" ? "npm install -g @haus-tech/haus-workflow@latest" : "fix `manifestFormat` in the catalog manifest \u2014 it must be a positive integer (upgrading haus will not help)"
+      err.kind === "too-new" ? "npm install -g @haus-tech/haus-workflow@latest" : "fix `manifestFormat` in the catalog manifest: it must be a positive integer (upgrading haus will not help)"
     );
   }
   const profileRules = catalogCtx ? parseProfileRules(
@@ -15772,7 +16101,7 @@ async function runDoctor(options, deps = {}) {
   ) : null;
   if (catalogCtx && profileRules === null) {
     flag(
-      `- PROFILE: the ${describeCatalogTier(catalogCtx)} catalog defines no "${profile}" profile \u2014 \`haus apply\` refuses until it does`,
+      `- PROFILE: the ${describeCatalogTier(catalogCtx)} catalog defines no "${profile}" profile, so \`haus apply\` refuses until it does`,
       `This project is set to the ${profile} profile, but the catalog it uses defines no such profile (needs haus-workflow-catalog >= 6.5.0)`,
       'haus update (or set "profile" back to "production" in .haus-workflow/haus.config.json)'
     );
@@ -15805,7 +16134,7 @@ async function runDoctor(options, deps = {}) {
       suggest(
         `- GLOBAL PLUGINS: ${marketplaceMissing.length} built-in marketplace not listed (${marketplaceMissing.map((a) => `${a.pin.id}: ${a.reason}`).join("; ")})`,
         `${marketplaceMissing.length} haus-managed plugin(s) sit on a built-in marketplace this Claude Code does not list`,
-        "update Claude Code (the claude-plugins-official marketplace is built in) \u2014 or: claude plugin marketplace add anthropics/claude-plugins-official"
+        "update Claude Code (the claude-plugins-official marketplace is built in), or: claude plugin marketplace add anthropics/claude-plugins-official"
       );
     }
     if (otherPending.length > 0) {
@@ -15911,7 +16240,7 @@ async function runDoctor(options, deps = {}) {
       suggest(
         `- GLOBAL PLUGINS: ${untrackedDuplicates.length} project skill folder(s) duplicate the global plugin but are not lock-tracked (${untrackedDuplicates.slice(0, 3).join(", ")}${untrackedDuplicates.length > 3 ? ", \u2026" : ""})`,
         `${untrackedDuplicates.length} skill folder(s) load twice in every session; haus does not track them, so no command will remove them`,
-        `delete .claude/skills/{${untrackedDuplicates.join(",")}} \u2014 the global plugin already provides them`
+        `delete .claude/skills/{${untrackedDuplicates.join(",")}} (the global plugin already provides them)`
       );
     }
   }
@@ -16037,8 +16366,8 @@ async function runDoctor(options, deps = {}) {
       }).join("; ");
       suggest(
         `- AGENT REFS: ${gatedOut.length} reference(s) name ${referent(gatedOut)} the catalog gates out of this project's stack (${unmet}) (${gatedOut.slice(0, 3).map(describeAgent).join("; ")}${gatedOut.length > 3 ? "; \u2026" : ""})`,
-        `${gatedOut.length} rule/agent reference(s) ${routedTo(gatedOut, names4)}, which the catalog does not offer a project with this stack (${unmet}) \u2014 the reference is upstream prose, not a missing install`,
-        `nothing to install here: correct or drop the reference upstream (catalog-owned prose) \u2014 the catalog gates ${names4.join(", ")} out of this stack on purpose`
+        `${gatedOut.length} rule/agent reference(s) ${routedTo(gatedOut, names4)}, which the catalog does not offer a project with this stack (${unmet}): the reference is upstream prose, not a missing install`,
+        `nothing to install here: correct or drop the reference upstream (catalog-owned prose); the catalog gates ${names4.join(", ")} out of this stack on purpose`
       );
     }
     if (unknown.length > 0) {
@@ -16079,7 +16408,7 @@ async function runDoctor(options, deps = {}) {
     if (drifted.length > 0) {
       suggest(
         `- ELIGIBILITY DRIFT: ${drifted.length} installed item(s) are no longer recommended by the current signals (${drifted.slice(0, 3).join(", ")}${drifted.length > 3 ? ", \u2026" : ""})`,
-        `${drifted.length} installed item(s) no longer match anything haus can detect in this repo \u2014 often a role that only \`deep-context.json\` knew about, which is not tracked in git`,
+        `${drifted.length} installed item(s) no longer match anything haus can detect in this repo, often a role that only \`deep-context.json\` knew about, which is not tracked in git`,
         "declare the role with `haus recommend --declare-role <role>` or the stack in .haus-workflow/haus.config.json (declaredStacks), re-run the docs pass to regenerate deep-context.json, or `haus remove <id>` if the item is genuinely no longer wanted"
       );
     }
@@ -16089,7 +16418,7 @@ async function runDoctor(options, deps = {}) {
     ok2(`- CLAUDE CONFIG DIR: ${configMigration.to} (CLAUDE_CONFIG_DIR)`);
     if (configMigration.status === "pending") {
       suggest(
-        `- CLAUDE CONFIG DIR: ${configMigration.moved.length} haus file(s) still under ${configMigration.from} \u2014 \`haus install\` moves them`,
+        `- CLAUDE CONFIG DIR: ${configMigration.moved.length} haus file(s) still under ${configMigration.from}; \`haus install\` moves them`,
         "Your haus global install predates CLAUDE_CONFIG_DIR and still sits in ~/.claude",
         "haus install"
       );
@@ -16113,18 +16442,18 @@ async function runDoctor(options, deps = {}) {
     const tierLabel = `${catalogTier}${catalogVersion ? ` (v${catalogVersion})` : ""}`;
     if (catalogTier === "bundled") {
       suggest(
-        `- CATALOG TIER: ${tierLabel} \u2014 frozen at publish time, metadata only (${installableItems} installable item(s))`,
-        `Catalog is being served from the snapshot bundled with this CLI (${tierLabel}), frozen at publish time and carrying metadata only \u2014 ${installableItems} of its items have installable content, so \`haus apply\` will write core files only`,
+        `- CATALOG TIER: ${tierLabel}: frozen at publish time, metadata only (${installableItems} installable item(s))`,
+        `Catalog is being served from the snapshot bundled with this CLI (${tierLabel}), frozen at publish time and carrying metadata only: ${installableItems} of its items have installable content, so \`haus apply\` will write core files only`,
         "haus update (with network access), or `haus catalog bundle import` on a disconnected machine"
       );
     } else if (installableItems === 0) {
       suggest(
-        `- CATALOG TIER: ${tierLabel} \u2014 0 installable items (\`haus apply\` will write core files only)`,
+        `- CATALOG TIER: ${tierLabel}: 0 installable items (\`haus apply\` will write core files only)`,
         `The ${catalogTier} catalog tier has 0 installable items`,
         "haus update (or `haus catalog bundle import` on a disconnected machine)"
       );
     } else {
-      ok2(`- CATALOG TIER: ${tierLabel} \u2014 ${installableItems} installable item(s)`);
+      ok2(`- CATALOG TIER: ${tierLabel}: ${installableItems} installable item(s)`);
     }
   }
   const cacheAgeMs = await getCacheManifestAge();
@@ -16138,7 +16467,7 @@ async function runDoctor(options, deps = {}) {
     const cacheAgeDays = Math.floor(cacheAgeMs / (1e3 * 60 * 60 * 24));
     if (cacheAgeDays >= 7) {
       suggest(
-        `- CATALOG CACHE: stale (${cacheAgeDays}d old \u2014 run \`haus update\`)`,
+        `- CATALOG CACHE: stale (${cacheAgeDays}d old, run \`haus update\`)`,
         `The catalog cache is ${cacheAgeDays} days old`,
         "haus update"
       );
@@ -16155,7 +16484,7 @@ async function runDoctor(options, deps = {}) {
   if (recommendation) {
     if (!Array.isArray(recommendation.recommended)) {
       suggest(
-        `- CATALOG ITEMS: recommendation.json's "recommended" field is not an array \u2014 skipping orphaned-item check`,
+        `- CATALOG ITEMS: recommendation.json's "recommended" field is not an array, skipping orphaned-item check`,
         'recommendation.json looks malformed (its "recommended" field is not an array)',
         "run `haus recommend` to regenerate it"
       );
@@ -16282,9 +16611,9 @@ async function runDoctor(options, deps = {}) {
       if (orphans.length > 0) {
         const paths = orphans.map((orphan) => orphan.relPath);
         suggest(
-          `- CATALOG RENAMES: ${orphans.length} directory/file left by a rename is not tracked in haus.lock.json (${orphans.map((orphan) => `${orphan.relPath} \u2014 renamed to ${orphan.currentId}`).join("; ")})`,
+          `- CATALOG RENAMES: ${orphans.length} directory/file left by a rename is not tracked in haus.lock.json (${orphans.map((orphan) => `${orphan.relPath}, renamed to ${orphan.currentId}`).join("; ")})`,
           `${orphans.length} leftover item(s) from a catalog rename are still in .claude/ and haus cannot remove them`,
-          `nothing in haus.lock.json records them, so haus leaves them alone \u2014 delete them by hand once you have checked for local edits: rm -rf ${paths.join(" ")}`
+          `nothing in haus.lock.json records them, so haus leaves them alone. Delete them by hand once you have checked for local edits: rm -rf ${paths.join(" ")}`
         );
       }
     } catch (err) {
@@ -16377,7 +16706,7 @@ async function runDoctor(options, deps = {}) {
     if (lingering.length > 0) {
       const idList = `${lingering.slice(0, 3).join(", ")}${lingering.length > 3 ? ", \u2026" : ""}`;
       suggest(
-        `- CATALOG ITEMS: ${lingering.length} installed item(s) are removed or deprecated in the current catalog (${idList}) \u2014 pre-0.30.0 CLIs never pruned these`,
+        `- CATALOG ITEMS: ${lingering.length} installed item(s) are removed or deprecated in the current catalog (${idList}); pre-0.30.0 CLIs never pruned these`,
         `${lingering.length} installed item(s) no longer exist in the catalog (removed or deprecated)`,
         "haus update (prunes them when unmodified; see docs/runbook.md for locally-edited copies)"
       );
@@ -16454,11 +16783,11 @@ async function runDoctor(options, deps = {}) {
     log("\u2705 Your project is set up and healthy.");
   } else {
     log(`\u26A0\uFE0F ${attention.length} thing(s) need attention:`);
-    for (const a of attention) log(`  \u2022 ${a.sentence} \u2014 fix: ${a.fix}`);
+    for (const a of attention) log(`  \u2022 ${joinFix(a.sentence, "Fix", a.fix)}`);
   }
   if (suggestions.length > 0) {
     log(`\u{1F4A1} ${suggestions.length} suggestion(s):`);
-    for (const s of suggestions) log(`  \u2022 ${s.sentence} \u2014 try: ${s.fix}`);
+    for (const s of suggestions) log(`  \u2022 ${joinFix(s.sentence, "Try", s.fix)}`);
   }
   log("Haus Doctor");
   for (const line2 of detail) {
@@ -16488,6 +16817,7 @@ function deployDisagreements(config, evidence) {
     groups.set(key, group);
   };
   for (const item of evidence) {
+    if (item.dispatch && !needsHumanClass(item.deploys)) continue;
     if (item.dispatch) {
       const listed = config.dispatchDeploys.includes(item.dispatch);
       add(
@@ -16531,16 +16861,57 @@ function deployDisagreements(config, evidence) {
       subject: group.subject,
       detected,
       fileSays: group.file === void 0 ? group.noRow : `says ${group.file}`,
+      ...group.file === void 0 ? {} : { file: group.file },
       details: [...new Set(higher.map((item) => item.detail))]
     });
   }
   return out;
 }
+function topDetected(result) {
+  let top;
+  const consider = (subject, deploys) => {
+    if (!top || classRank(deploys) > classRank(top.deploys)) top = { subject, deploys };
+  };
+  for (const [branch, row] of Object.entries(result.config.branches)) {
+    consider(branch, row.deploys);
+    for (const [glob, value] of Object.entries(row.pathDeploys ?? {})) {
+      consider(`a change to ${glob} on ${branch}`, value);
+    }
+  }
+  for (const [tag, value] of Object.entries(result.config.tags)) consider(`tag ${tag}`, value);
+  for (const item of result.evidence) {
+    if (item.dispatch) consider(`${item.dispatch}, when dispatched,`, item.deploys);
+  }
+  return top;
+}
 async function auditDeployConfig(root, workflowConfigPath, deps) {
   const rel = DEPLOY_CONFIG_REL;
   const fallback2 = `the deploy gate guesses from detection on every merge, push and deploy until it is fixed`;
+  const git = realGit();
+  const detect = async () => {
+    const context = await repoContext(root, git);
+    const branch = context ? await defaultBranch(git, context.root) : void 0;
+    return detectDeployConfig(root, {
+      gh: deps.deployGh ?? (deployDetectOffline() ? void 0 : realGh()),
+      git,
+      slug: context?.slug,
+      defaultBranch: branch,
+      cache: true
+    });
+  };
   const found = await readTextDetailed(path67.join(root, rel));
   if (found.status === "missing") {
+    const top = topDetected(await detect());
+    if (top && isGatedClass(top.deploys)) {
+      return [
+        {
+          level: "attention",
+          line: `- DEPLOY TARGETS: ${rel} missing while detection says ${top.subject} deploys ${top.deploys} (run \`haus apply --write\`, then set confirmedBy); ${fallback2}`,
+          sentence: `${rel} is missing while detection says ${top.subject} deploys ${top.deploys}, so the deploy gate guesses on every merge, push and deploy`,
+          fix: "run haus apply --write to write it, then check what each branch deploys and set confirmedBy"
+        }
+      ];
+    }
     return [
       {
         level: "suggest",
@@ -16613,15 +16984,7 @@ async function auditDeployConfig(root, workflowConfigPath, deps) {
       fix: `set branches.<branch>.localCheck in ${rel} to the command that runs the change locally (the app, a dev server, a build or a docs preview)`
     });
   }
-  const git = realGit();
-  const context = await repoContext(root, git);
-  const branch = context ? await defaultBranch(git, context.root) : void 0;
-  const detection = await detectDeployConfig(root, {
-    gh: deps.deployGh ?? (deployDetectOffline() ? void 0 : realGh()),
-    slug: context?.slug,
-    defaultBranch: branch,
-    cache: true
-  });
+  const detection = await detect();
   for (const message2 of detection.errors) {
     findings.push({
       level: "ok",
@@ -16630,11 +16993,12 @@ async function auditDeployConfig(root, workflowConfigPath, deps) {
   }
   const disagreements = deployDisagreements(config, detection.evidence);
   for (const d of disagreements) {
+    const nameIt = d.file === void 0 ? "" : "; if the file is right, name the target in the workflow (a job environment:, or a concurrency group or file name such as deploy-test) so detection agrees";
     findings.push({
       level: "suggest",
       line: `- DEPLOY TARGETS: detection says ${d.subject} deploys ${d.detected}, but ${rel} ${d.fileSays} (${d.details.join("; ")})`,
       sentence: `Detection says ${d.subject} deploys ${d.detected} (${d.details.join("; ")}), but ${rel} ${d.fileSays}`,
-      fix: `check it, and raise the class in ${rel} if detection is right (a higher class than detection's is fine)`
+      fix: `check it, and raise the class in ${rel} if detection is right (a higher class than detection's is fine)${nameIt}`
     });
   }
   const configText = await readText(workflowConfigPath);
@@ -16914,12 +17278,7 @@ async function pruneEmptyDirsUpward(dirs, stopAt) {
   for (const start of ordered) {
     let dir = start;
     while (dir.startsWith(stopAt) && dir !== stopAt) {
-      try {
-        if ((await fs48.readdir(dir)).length > 0) break;
-        await fs48.remove(dir);
-      } catch {
-        break;
-      }
+      if (!await pruneEmptyDir(dir)) break;
       dir = path70.dirname(dir);
     }
   }
@@ -17036,7 +17395,7 @@ async function applyInstall(options = {}) {
     }
     if (stampableMarkerForm(entry.destPath) === void 0)
       throw new Error(
-        `No safe ownership-marker form for ${entry.srcRelPath} \u2014 only .md and .js/.mjs/.cjs aux files can ship in library/global (see ADR-0072)`
+        `No safe ownership-marker form for ${entry.srcRelPath}: only .md and .js/.mjs/.cjs aux files can ship in library/global (see ADR-0072)`
       );
     const stamped = stampMarkdown(
       rawContent,
@@ -17069,7 +17428,7 @@ async function applyInstall(options = {}) {
           continue;
         }
         if (existing && hashContent(currentContent) !== existing.hash && !force) {
-          warn(`User edited haus file (skipping): ${entry.destPath} \u2014 use --force to overwrite`);
+          warn(`User edited haus file (skipping): ${entry.destPath}. Use --force to overwrite`);
           result.skipped.push(entry.destPath);
           result.userEdited.push(entry.destPath);
           manifestFiles.push(existing);
@@ -17136,7 +17495,7 @@ async function applyInstall(options = {}) {
         emptiedDirs.add(path70.dirname(entry.destPath));
         result.deleted.push(entry.destPath);
       } else {
-        warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
+        warn(`Orphaned file ${entry.destPath} was user-modified, leaving in place`);
         result.skipped.push(entry.destPath);
       }
     }
@@ -17168,7 +17527,7 @@ function printInternalChannel(result, prefix) {
   }
   if (!enabled && result.deleted.some((p) => p.includes("request") || p.includes("slack-cowork"))) {
     log(
-      `${prefix}Internal channel is off \u2014 the request skills and slack-cowork were removed. Bring them back with \`haus install --internal\`.`
+      `${prefix}Internal channel is off: the request skills and slack-cowork were removed. Bring them back with \`haus install --internal\`.`
     );
   }
 }
@@ -17197,7 +17556,7 @@ function printApplyResult(result, dryRun) {
   }
   printInternalChannel(result, prefix);
   if (result.drift) {
-    warn("Install drift detected \u2014 run `haus install` to sync.");
+    warn("Install drift detected. Run `haus install` to sync.");
   }
 }
 
@@ -17328,7 +17687,7 @@ What changed in ${npmStatus.latest}:`);
   const notAProject = await projectSkipReason(root);
   if (notAProject !== null) warn(`Skipped the project refresh: ${root} ${notAProject}.`);
   if (notAProject === null && await hasLocalOverrides(root)) {
-    log("Existing .claude/settings.json \u2014 haus rules will be merged, not replaced.");
+    log("Existing .claude/settings.json: haus rules will be merged, not replaced.");
   }
   const lockBefore = await readLockRaw(root);
   log("Syncing remote catalog...");
@@ -17423,7 +17782,7 @@ async function refreshProjectFiles(root) {
   try {
     const result = await refreshProjectApply(root);
     if (!result.setUp) {
-      warn("No prior haus project setup detected \u2014 skipped project re-apply.");
+      warn("No prior haus project setup detected, skipped project re-apply.");
       return null;
     }
     if (result.report.refusedFiles.includes(LOCK_FILE)) return result.report;
@@ -17731,10 +18090,10 @@ async function runClone(url, opts = {}) {
   if (existsSync4(target) && !await isEmptyDirectory(target)) {
     const check = await checkExistingTarget(target, url);
     if (check.kind === "matches") {
-      log(`\u2022 ${path72.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
+      log(`\u2022 ${path72.basename(target)} already cloned here, matches ${url}, skipped`);
       return;
     }
-    const message2 = check.kind === "not-a-repo" ? `${target} already exists and is not a git repository \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].` : `${target} already exists as a different repository (origin: ${check.origin ?? "(no origin remote)"}) \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].`;
+    const message2 = check.kind === "not-a-repo" ? `${target} already exists and is not a git repository, refusing to clone ${url} there. Remove or rename it, or pass a different [dir].` : `${target} already exists as a different repository (origin: ${check.origin ?? "(no origin remote)"}), refusing to clone ${url} there. Remove or rename it, or pass a different [dir].`;
     if (opts.dryRun) {
       warn(`[dry-run] ${message2}`);
       return;
@@ -18505,9 +18864,143 @@ var INERT_COMMANDS = /* @__PURE__ */ new Set([
   "wc"
 ]);
 var INERT_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set(["add", "diff", "log", "status"]);
-var GIT_CONTROL_FILE = /(?:^|\/)(?:\.git(?:\/|$)|\.git(?:attributes|config|modules)$|git\/[^/]+$|config$|hooks\/|info\/attributes$)/;
-function runsNothing(segment, callTargets) {
-  if (segment.some((token) => !token.quoted && ENV_ASSIGNMENT.test(token.value))) return false;
+var GIT_CONTROL_FILE = /(?:^|\/)(?:\.git(?:\/|$)|\.git(?:attributes|config|modules)$|git\/[^/]+$|config$|hooks\/|info\/attributes$)/i;
+var GH_BODY_FILE_FLAGS = /* @__PURE__ */ new Map([
+  [
+    "pr",
+    /* @__PURE__ */ new Map([
+      ["create", ["--body-file", "-F"]],
+      ["edit", ["--body-file", "-F"]],
+      ["comment", ["--body-file", "-F"]]
+    ])
+  ],
+  [
+    "issue",
+    /* @__PURE__ */ new Map([
+      ["create", ["--body-file", "-F"]],
+      ["edit", ["--body-file", "-F"]],
+      ["comment", ["--body-file", "-F"]]
+    ])
+  ],
+  [
+    "release",
+    /* @__PURE__ */ new Map([
+      ["create", ["--notes-file", "-F"]],
+      ["edit", ["--notes-file", "-F"]]
+    ])
+  ]
+]);
+var GH_CONTROL_FILE = /(?:^|\/)gh\/|(?:^|\/)(?:config|hosts)\.ya?ml$/i;
+var BARE_GH_PREFIXES = /* @__PURE__ */ new Set(["command", "exec"]);
+var SUBSTITUTION = /\$\(|`|<\(|>\(/;
+var UNREAD_PATH = /[*?[\]$`~{}]/;
+var WRITES_ONLY_WHERE_SENT = /* @__PURE__ */ new Set([
+  "cat",
+  "echo",
+  "grep",
+  "head",
+  "jq",
+  "printf",
+  "tail",
+  "tee",
+  "wc"
+]);
+function plainPath(path137) {
+  return path137.replace(/^(?:\.\/+)+/, "");
+}
+function folded(path137) {
+  return path137.normalize("NFKC").toLowerCase();
+}
+var NOT_PRINTABLE_ASCII = /[^ -~]/;
+function mayBeControlFile(path137) {
+  const plain2 = folded(path137);
+  return NOT_PRINTABLE_ASCII.test(path137) || GIT_CONTROL_FILE.test(plain2) || GH_CONTROL_FILE.test(plain2);
+}
+var NOTE_EXTENSION = /\.(?:md|markdown|txt)$/;
+function everyWrittenFile(segment) {
+  const embedded = segment.filter((token) => !token.quoted && token.value.includes(">")).filter((token) => !OUTPUT_REDIRECTION.test(token.value)).map((token) => token.value);
+  const values = withoutRedirections(segment).map((token) => token.value);
+  const tee = values.findIndex((value) => commandBaseName(value) === "tee");
+  const teeOperands = tee === -1 ? [] : values.slice(tee + 1).filter((value) => !value.startsWith("-"));
+  const git = trustedName(commandWords(withoutRedirections(segment))[0] ?? "") === "git";
+  const gitOutput = git ? values.filter((value) => value.startsWith("--out")) : [];
+  return [...writtenFiles(segment), ...embedded, ...teeOperands, ...gitOutput];
+}
+function safeNotePath(file) {
+  const plain2 = plainPath(file);
+  if (UNREAD_PATH.test(plain2) || mayBeControlFile(plain2)) return false;
+  if (!NOTE_EXTENSION.test(folded(plain2))) return false;
+  const directories = folded(plain2).split("/").slice(0, -1);
+  return !directories.some((part) => part.startsWith(".") && part !== ".");
+}
+function writesOnlyWhereSent(segment) {
+  const bare = withoutRedirections(segment);
+  if (bare.length === 0) return true;
+  const name = trustedName(commandWords(bare)[0] ?? "");
+  return name !== void 0 && WRITES_ONLY_WHERE_SENT.has(name);
+}
+function callWrites(commands, written) {
+  return {
+    targets: written.flatMap((body) => body.targets),
+    files: commands.flatMap(({ segment }) => everyWrittenFile(segment)),
+    hiddenWriter: written.some((body) => !body.writers.every(writesOnlyWhereSent))
+  };
+}
+function attachedBodyFile(word, flags) {
+  for (const flag of flags) {
+    if (flag.startsWith("--")) {
+      if (word.startsWith(`${flag}=`)) return word.slice(flag.length + 1);
+    } else if (word.startsWith(flag) && word.length > flag.length) {
+      return word.slice(flag.length).replace(/^=/, "");
+    }
+  }
+  return void 0;
+}
+function ghSendsOnlyAsBody(segment, words, call, bodyTargets) {
+  const flags = GH_BODY_FILE_FLAGS.get(words[1] ?? "")?.get(words[2] ?? "");
+  if (flags === void 0 || bodyTargets.length === 0 || call.hiddenWriter) return false;
+  if (segment.some((token) => SUBSTITUTION.test(token.value))) return false;
+  const values = withoutRedirections(segment).map((token) => token.value);
+  if (values.some((value) => commandBaseName(value) === "xargs")) return false;
+  const writes = [...call.targets, ...call.files];
+  if (writes.some(mayBeControlFile)) {
+    return false;
+  }
+  let at = 0;
+  while (at < values.length && BARE_GH_PREFIXES.has(values[at])) at += 1;
+  if (values[at] !== words[0] || values[at + 1] !== words[1] || values[at + 2] !== words[2]) {
+    return false;
+  }
+  const names4 = writes.filter((file) => plainPath(file) !== "/dev/null").map((file) => commandBaseName(file)).filter(Boolean);
+  const bodyFiles = [];
+  let bodyFlags = 0;
+  for (let i = 0; i < values.length; i += 1) {
+    const value = values[i];
+    if (i > at + 2 && flags.includes(value)) {
+      bodyFlags += 1;
+      if (i + 1 < values.length) bodyFiles.push(values[i + 1]);
+      i += 1;
+      continue;
+    }
+    const attached = i > at + 2 ? attachedBodyFile(value, flags) : void 0;
+    if (attached !== void 0) {
+      bodyFlags += 1;
+      bodyFiles.push(attached);
+      continue;
+    }
+    if (names4.some((name) => value.toLowerCase().includes(name))) return false;
+  }
+  if (bodyFlags !== 1 || bodyFiles.length !== 1 || !safeNotePath(bodyFiles[0])) return false;
+  const note = plainPath(bodyFiles[0]);
+  const isNote = (file) => !UNREAD_PATH.test(file) && plainPath(file) === note;
+  return bodyTargets.every(isNote) && writes.every((file) => plainPath(file) === "/dev/null" || isNote(file));
+}
+function runsNothing(segment, call, bodyTargets) {
+  const viaEnv = segment.some((token) => commandBaseName(token.value) === "env");
+  const assigns = segment.some(
+    (token) => (!token.quoted || viaEnv) && ENV_ASSIGNMENT.test(token.value)
+  );
+  if (assigns) return false;
   const bare = withoutRedirections(segment);
   if (bare.length === 0) return true;
   const words = commandWords(bare);
@@ -18515,19 +19008,20 @@ function runsNothing(segment, callTargets) {
   const name = trustedName(words[0]);
   if (name === void 0) return false;
   if (name === "git") {
-    return INERT_GIT_SUBCOMMANDS.has(words[1] ?? "") && !callTargets.some((target) => GIT_CONTROL_FILE.test(target));
+    return INERT_GIT_SUBCOMMANDS.has(words[1] ?? "") && !call.targets.some((target) => GIT_CONTROL_FILE.test(folded(target)));
   }
+  if (name === "gh") return ghSendsOnlyAsBody(segment, words, call, bodyTargets);
   return INERT_COMMANDS.has(name);
 }
 function writtenBodiesThatRun(commands, written, sawGrouping) {
   const writers = written.flatMap((body) => body.writers);
-  const allTargets = written.flatMap((body) => body.targets);
+  const call = callWrites(commands, written);
   return written.filter(({ targets }) => {
     const names4 = targets.map((target) => commandBaseName(target)).filter(Boolean);
     const mentionsFile = (value) => names4.some((name) => value.toLowerCase().includes(name));
     return commands.some(({ segment }) => {
       if (writers.includes(segment)) return false;
-      if (!runsNothing(segment, allTargets)) return true;
+      if (!runsNothing(segment, call, targets)) return true;
       const words = commandWords(withoutRedirections(segment));
       if (words.length > 0 && names4.includes(commandBaseName(words[0]))) return true;
       const copies = segment.some(
@@ -18913,7 +19407,7 @@ async function guardRepository(root) {
   if (result.triggered && !result.satisfied) {
     const rel = relativeDecisionPath(await resolveDecisionsDir(root), root);
     emitPreToolUseDeny(
-      result.securityTriggered ? `I didn't run that: this change touches a security path, so an ADR is required before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under ${rel}/, then retry.` : `I didn't run that \u2014 this change needs an ADR before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under ${rel}/, then retry, or put [adr-skip] on its own line in a commit body for non-security changes.`
+      result.securityTriggered ? `I didn't run that: this change touches a security path, so an ADR is required before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under ${rel}/, then retry.` : `I didn't run that: this change needs an ADR before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under ${rel}/, then retry, or put [adr-skip] on its own line in a commit body for non-security changes.`
     );
     return true;
   }
@@ -18960,11 +19454,11 @@ _(One clear sentence: what we chose.)_
 
 ## Motivation (why)
 
-_(Why this over alternatives \u2014 the line agents read for "why".)_
+_(Why this over alternatives: the line agents read for "why".)_
 
 ## Alternatives considered
 
-- _(Alternative)_ \u2014 rejected because _(reason)_.
+- _(Alternative)_: rejected because _(reason)_.
 
 ## Consequences
 
@@ -20358,6 +20852,7 @@ async function loadDeployConfig(context, options) {
   const detected = await detectDeployConfig(context.root, {
     // `HAUS_DEPLOY_DETECT_OFFLINE=1` keeps detection off the network (the test runner sets it).
     gh: process.env.HAUS_DEPLOY_DETECT_OFFLINE === "1" || options.detectOnline === false ? void 0 : options.gh,
+    git: options.git,
     slug: context.slug,
     defaultBranch: await defaultName(),
     cache: options.cacheDetection ?? true,
@@ -20367,13 +20862,15 @@ async function loadDeployConfig(context, options) {
     return {
       config: strictestOf(detected.config, local.config),
       source: `${local.where} (no copy on ${remoteRef} yet, so read with detection)`,
-      errors: [...errors, ...detected.errors]
+      errors: [...errors, ...detected.errors],
+      detected: true
     };
   }
   return {
     config: detected.config,
     source: "detection (no deploy.json yet)",
-    errors: [...errors, ...detected.errors]
+    errors: [...errors, ...detected.errors],
+    detected: true
   };
 }
 async function loadRemoteDeployConfig(slug, branch, options) {
@@ -20404,6 +20901,7 @@ async function loadRemoteDeployConfig(slug, branch, options) {
     config: detected.config,
     source: `detection for ${slug} (no deploy.json)`,
     errors: [...errors, ...detected.errors],
+    detected: true,
     ...unreadable2 ? { unreadable: unreadable2 } : {}
   };
 }
@@ -20433,9 +20931,15 @@ var Freezes = class {
     }
   }
 };
+function detectionHint(change) {
+  if (!change.branch || !needsHumanClass(change.deploys) || !change.detected) return "";
+  const branch = change.branch;
+  return ` If ${branch} deploys a test or staging environment, ask the human: only they may set branches.${branch}.deploys and confirmedBy in ${DEPLOY_CONFIG_REL} (haus apply --write creates it), and the gate reads it once it is on origin/${branch}.`;
+}
 async function verdictFor2(change, freezes) {
   const where = change.surface ? ` (${change.surface})` : "";
   const summary = `${change.what} deploys ${change.deploys}${where}: ${change.why}; read from ${change.source}`;
+  const hint = detectionHint(change);
   const known = await freezes.get();
   if (known instanceof Error) {
     return deny(
@@ -20451,19 +20955,19 @@ async function verdictFor2(change, freezes) {
   }
   if (needsHumanClass(change.deploys) && change.auto) {
     return deny(
-      `haus: ${summary}. Auto-merge would land it later with no one confirming the deploy. Wait for the checks yourself, then merge without auto so the human confirms.`
+      `haus: ${summary}. Auto-merge would land it later with no one confirming the deploy. Wait for the checks yourself, then merge without auto so the human confirms.${hint}`
     );
   }
   if (!change.hasRecord) {
     return deny(
-      `haus: ${summary}. No local-verification record. ${HOW_TO_RECORD} ${change.recordHint}`
+      `haus: ${summary}. No local-verification record. ${HOW_TO_RECORD} ${change.recordHint}${hint}`
     );
   }
   if (needsHumanClass(change.deploys)) {
     return {
       decision: "ask",
       gated: true,
-      reason: `haus: ${summary}. A local run is recorded. This is a ${change.deploys} deploy: confirm only if you want it live now.`
+      reason: `haus: ${summary}. A local run is recorded. This is a ${change.deploys} deploy: confirm only if you want it live now.${hint}`
     };
   }
   return { gated: true };
@@ -20621,7 +21125,8 @@ async function evaluateMerge(action, hookCwd, deps, freezes) {
       auto: action.auto,
       hasRecord,
       recordHint: prRecordHint(`#${pr2.number}`, pr2.baseRefName, classification.entry?.localCheck),
-      source: loaded.source
+      source: loaded.source,
+      detected: loaded.detected === true
     },
     freezes
   );
@@ -20773,6 +21278,7 @@ async function evaluatePush(action, deps, freezes) {
     let deploys = "none";
     let classification;
     let source = overview.source;
+    let detected = overview.detected === true;
     if (target.kind === "branch") {
       const loaded = await loadDeployConfig(context, {
         git: deps.git,
@@ -20782,6 +21288,7 @@ async function evaluatePush(action, deps, freezes) {
         detectOnline
       });
       source = loaded.source;
+      detected = loaded.detected === true;
       const files = await changedFilesSince(deps.git, context.root, `${remote}/${target.name}`, sha2);
       classification = classifyBranchChange(loaded.config, target.name, files);
       deploys = classification.deploys;
@@ -20808,7 +21315,8 @@ async function evaluatePush(action, deps, freezes) {
           auto: false,
           hasRecord: await hasReceipt([repo], sha2, localCheck, deps.verifyDir),
           recordHint: shaRecordHint(checkBranch, localCheck),
-          source
+          source,
+          detected
         },
         freezes
       )
@@ -20868,7 +21376,8 @@ async function evaluateRelease(action, deps, freezes) {
       auto: false,
       hasRecord: await hasReceipt([slug], sha2, localCheck, deps.verifyDir),
       recordHint: context ? shaRecordHint(branch, localCheck) : "from a checkout of that repository, by running haus verify local on the commit the tag lands on.",
-      source: loaded.source
+      source: loaded.source,
+      detected: loaded.detected === true
     },
     freezes
   );
@@ -20907,7 +21416,8 @@ async function evaluateDirectDeploy(what, cwd, ref, deploysOverride, deps, freez
       auto: false,
       hasRecord: await hasReceipt([repo], sha2, row?.localCheck, deps.verifyDir),
       recordHint: shaRecordHint(branch, row?.localCheck),
-      source: loaded.source
+      source: loaded.source,
+      detected: loaded.detected === true
     },
     freezes
   );
@@ -21287,12 +21797,11 @@ function resolveOnDisk(candidate) {
 }
 function guardFileAccess(candidate) {
   if (matchesDenyTier(candidate))
-    return `I didn't open ${candidate} \u2014 it looks like it holds secrets or sensitive data`;
+    return `I didn't open ${candidate}: it looks like it holds secrets or sensitive data`;
   const { resolved, unverifiable } = resolveOnDisk(candidate);
-  if (unverifiable)
-    return `I didn't open ${candidate} \u2014 it is a link whose target I couldn't verify`;
+  if (unverifiable) return `I didn't open ${candidate}: it is a link whose target I couldn't verify`;
   if (resolved && matchesDenyTier(resolved))
-    return `I didn't open ${candidate} \u2014 it leads to a file that looks like it holds secrets or sensitive data`;
+    return `I didn't open ${candidate}: it leads to a file that looks like it holds secrets or sensitive data`;
   return void 0;
 }
 
@@ -22212,7 +22721,7 @@ function guardBash(command) {
   if (shape === UNGATED_MERGE_CHAIN) {
     return `I didn't run that: the merge would run even if the CI wait before it fails, because they are joined by a semicolon, a newline, || or a pipe. Join the wait and the merge with && and no pipe, so a red check stops the merge: ${command.replace(/`/g, "'")}`;
   }
-  return `I didn't run that \u2014 it looks like ${shape}, which can permanently change or delete things: ${command}`;
+  return `I didn't run that: it looks like ${shape}, which can permanently change or delete things: ${command}`;
 }
 function allowBash(command, cwd, options = {}) {
   if (matchDangerousCommandShape(command)) return void 0;
@@ -23278,7 +23787,7 @@ async function runDiscover(workspaceRoot, opts = {}) {
 }
 
 // src/scanner/sibling-repos.ts
-var SIBLING_REPO_WARNING = 'Multiple sibling repos detected under this root \u2014 consider "haus workspace discover" instead of running init/scan per repo.';
+var SIBLING_REPO_WARNING = 'Multiple sibling repos detected under this root. Consider "haus workspace discover" instead of running init/scan per repo.';
 async function hasMultipleSiblingRepos(root) {
   try {
     const repoRoots = await findRepoRoots(root);
@@ -23398,7 +23907,7 @@ async function runSetupCore(root, opts) {
     const supersededCount = recommendation.skipped.filter(
       (s) => s.skipReasons?.some((r) => r.code === "superseded-by-global-plugin")
     ).length;
-    const message2 = supersededCount > 0 ? `No catalog items matched this project after ${supersededCount} item(s) were gated as already provided by an installed global plugin \u2014 refusing to write recommendation.json/haus.lock.json. Those skills are available globally; re-run with \`haus init --force\` to write anyway.` : "No catalog items matched this project at all (zero signal) \u2014 refusing to write recommendation.json/haus.lock.json. Re-run with `haus init --force` to write anyway.";
+    const message2 = supersededCount > 0 ? `No catalog items matched this project after ${supersededCount} item(s) were gated as already provided by an installed global plugin, refusing to write recommendation.json/haus.lock.json. Those skills are available globally; re-run with \`haus init --force\` to write anyway.` : "No catalog items matched this project at all (zero signal), refusing to write recommendation.json/haus.lock.json. Re-run with `haus init --force` to write anyway.";
     warn(message2);
     process.exitCode = 1;
     const warnings = [...warningLines2, message2];
@@ -23419,7 +23928,7 @@ async function runSetupCore(root, opts) {
       warnings,
       hooksOk: false,
       written: [],
-      // Pre-existing zero-signal guard, not the #325 catalog-install honesty check —
+      // Pre-existing zero-signal guard, not the #325 catalog-install honesty check,
       // `catalogInstallOk` stays true; `setupOk` is false so workspace setup cannot
       // record this repo as ok (issue #330).
       catalogInstallOk: true,
@@ -23526,7 +24035,7 @@ async function runSetupCore(root, opts) {
       const message2 = "No catalog content found. Run `haus update` first.";
       if (!opts.allowEmptyCache) {
         if (isPreview) {
-          warn(`Catalog cache is empty \u2014 dry-run will skip catalog items. ${message2}`);
+          warn(`Catalog cache is empty: dry-run will skip catalog items. ${message2}`);
         } else {
           error(message2);
           process.exitCode = 1;
@@ -23582,7 +24091,7 @@ async function runSetupCore(root, opts) {
       say(`${installedWantedCount} of ${countedIds.length} catalog items installed (${tier} tier).`);
       if (installedWantedCount === 0) {
         error(
-          "No catalog items were installed \u2014 only core files were written. Run `haus update` with network access, or import a catalog bundle."
+          "No catalog items were installed, only core files were written. Run `haus update` with network access, or import a catalog bundle."
         );
         process.exitCode = 1;
         catalogInstallOk = false;
@@ -23648,7 +24157,7 @@ var COMPANION_TOOLS = [
   {
     bin: "caveman",
     label: "Caveman",
-    blurb: "Ultra-compressed Claude Code responses \u2014 cuts output tokens ~75%.",
+    blurb: "Ultra-compressed Claude Code responses; cuts output tokens ~75%.",
     installCmds: [
       "curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash"
     ],
@@ -23657,13 +24166,13 @@ var COMPANION_TOOLS = [
   {
     bin: "rtk",
     label: "RTK (Rust Token Killer)",
-    blurb: "Token-optimized CLI proxy \u2014 60-90% savings on dev operations.",
+    blurb: "Token-optimized CLI proxy, 60-90% savings on dev operations.",
     installCmds: [
       "brew install rtk",
       "cargo install --git https://github.com/rtk-ai/rtk   # if Homebrew is unavailable"
     ],
     url: "https://github.com/rtk-ai/rtk",
-    note: 'Another crate named "rtk" (Rust Type Kit) exists on crates.io \u2014 use the commands above, not a bare `cargo install rtk`.'
+    note: 'Another crate named "rtk" (Rust Type Kit) exists on crates.io. Use the commands above, not a bare `cargo install rtk`.'
   }
 ];
 function buildCompanionSuggestions(tools, isInstalled) {
@@ -23671,7 +24180,7 @@ function buildCompanionSuggestions(tools, isInstalled) {
   if (missing.length === 0) return [];
   const lines = ["", "Optional token-saving tools you can add:"];
   for (const tool of missing) {
-    lines.push("", `  ${tool.label} \u2014 ${tool.blurb}`);
+    lines.push("", `  ${tool.label}: ${tool.blurb}`);
     for (const cmd of tool.installCmds) {
       lines.push(`    ${cmd}`);
     }
@@ -23751,7 +24260,7 @@ async function runInstall(options, deps = {}) {
         if (result.created.length) parts.push(`${result.created.length} file(s) added`);
         if (result.updated.length) parts.push(`${result.updated.length} file(s) updated`);
         log(
-          parts.length ? `  \u2022 ${parts.join(", ")} in ${claudeConfigDirLabel()} (skills, agents, slash commands)` : "  \u2022 already up to date \u2014 no files changed"
+          parts.length ? `  \u2022 ${parts.join(", ")} in ${claudeConfigDirLabel()} (skills, agents, slash commands)` : "  \u2022 already up to date, no files changed"
         );
         log(
           `  \u2022 ensured hooks + security rules are present in ${claudeConfigDirLabel()}/settings.json`
@@ -23797,20 +24306,20 @@ async function safeExec(exec, command, args, options) {
 function inconclusive(result, what) {
   if (!result.killed) return void 0;
   const reason = result.stderr.trim() || "the probe did not complete";
-  return `Could not confirm ${what}: ${reason}. This is usually transient load \u2014 try again, or use --no-github.`;
+  return `Could not confirm ${what}: ${reason}. This is usually transient load. Try again, or use --no-github.`;
 }
 async function checkGh(exec = runCommand) {
   const version = await safeExec(exec, "gh", ["--version"], { timeout: PROBE_TIMEOUT_MS2 });
   const versionUnknown = inconclusive(version, "the gh CLI is installed");
   if (versionUnknown) return { ok: false, reason: versionUnknown };
   if (version.exitCode !== 0) {
-    return { ok: false, reason: "gh CLI not found \u2014 install it or re-run with --no-github" };
+    return { ok: false, reason: "gh CLI not found. Install it or re-run with --no-github" };
   }
   const auth = await safeExec(exec, "gh", ["auth", "status"], { timeout: PROBE_TIMEOUT_MS2 });
   const authUnknown = inconclusive(auth, "gh is authenticated");
   if (authUnknown) return { ok: false, reason: authUnknown };
   if (auth.exitCode !== 0) {
-    return { ok: false, reason: "gh is not authenticated \u2014 run `gh auth login` or use --no-github" };
+    return { ok: false, reason: "gh is not authenticated. Run `gh auth login` or use --no-github" };
   }
   return { ok: true };
 }
@@ -23819,7 +24328,7 @@ async function checkOrg(org, exec = runCommand) {
   if (!GITHUB_LOGIN.test(org)) {
     return {
       ok: false,
-      reason: `"${org}" is not a GitHub login \u2014 expected letters, digits and hyphens (e.g. acme or octocat).`
+      reason: `"${org}" is not a GitHub login: expected letters, digits and hyphens (e.g. acme or octocat).`
     };
   }
   const res = await safeExec(exec, "gh", ["api", `users/${org}`], { timeout: PROBE_TIMEOUT_MS2 });
@@ -23843,13 +24352,13 @@ async function createRepo(opts, exec = runCommand) {
   if (result.exitCode !== 0) {
     const stderr = result.stderr.trim();
     const repoAlreadyExists = /already exists/i.test(stderr);
-    const resumeHint = result.killed ? `Repo creation timed out (${stderr || "no output before the timeout"}). It may or may not have been created \u2014 check first, then finish:
+    const resumeHint = result.killed ? `Repo creation timed out (${stderr || "no output before the timeout"}). It may or may not have been created. Check first, then finish:
   gh repo view ${slug}
   # if it exists:  git remote get-url origin || git remote add origin <url>
   #                git push -u origin main
   # if it does not: gh ${args.join(" ")}` : repoAlreadyExists ? `Repo creation failed (${stderr || "unknown error"}). GitHub reports "${slug}" already exists. If this run created it, the push is all that is left; if it existed before, check what is in it before pushing over it:
   gh repo view ${slug}
-  git push -u origin main` : `Repo creation failed (${stderr || "unknown error"}). Your project is intact \u2014 resume with:
+  git push -u origin main` : `Repo creation failed (${stderr || "unknown error"}). Your project is intact. Resume with:
   gh ${args.join(" ")}
   git push -u origin main`;
     return { ok: false, resumeHint };
@@ -23957,7 +24466,7 @@ var defaultDeps = {
   loadCatalog: loadCatalogContext,
   overlay: scaffoldConfigItems,
   setup: runSetupCore,
-  // persist:false (scan-project.ts #101): the role check is a probe — the chained
+  // persist:false (scan-project.ts #101): the role check is a probe, the chained
   // init already wrote the scan artifacts; re-persisting here would clobber them.
   scan: (root) => scanProject(root, { persist: false })
 };
@@ -23978,7 +24487,7 @@ async function recordPackageManager(projectPath, pm, deps) {
   const field = `${pm}@${version}`;
   if (detectPackageManager(projectPath, field) !== pm) {
     return {
-      note: `installed ${pm} is ${version}, which haus does not support \u2014 the package manager was not recorded, so the scanner will report it as unknown until you upgrade`
+      note: `installed ${pm} is ${version}, which haus does not support: the package manager was not recorded, so the scanner will report it as unknown until you upgrade`
     };
   }
   await fs55.writeJson(pkgPath, { ...pkg, packageManager: field }, { spaces: 2 });
@@ -24041,7 +24550,7 @@ async function createProject(opts, deps = defaultDeps) {
   if (!parentStat?.isDirectory()) {
     return fail3(
       "preflight",
-      `Parent directory ${opts.parentDir} is not an existing directory \u2014 pass an existing one to --dir.`
+      `Parent directory ${opts.parentDir} is not an existing directory. Pass an existing one to --dir.`
     );
   }
   if (!NAME_RE2.test(opts.name) || opts.name.includes("/") || opts.name.includes("\\") || path88.dirname(projectPath) !== path88.resolve(opts.parentDir)) {
@@ -24051,7 +24560,7 @@ async function createProject(opts, deps = defaultDeps) {
     );
   }
   if (await fs55.pathExists(projectPath)) {
-    return fail3("preflight", `Target ${projectPath} already exists \u2014 refusing to write into it.`);
+    return fail3("preflight", `Target ${projectPath} already exists, refusing to write into it.`);
   }
   const scaffoldArgs = stack.scaffold.args.map(
     (a) => a.replaceAll("{name}", opts.name).replaceAll("{pm}", opts.pm)
@@ -24103,7 +24612,7 @@ async function createProject(opts, deps = defaultDeps) {
   if (inconclusiveTools.length > 0) {
     return fail3(
       "preflight",
-      `Could not confirm tool availability on PATH: ${inconclusiveTools.join("; ")} \u2014 the probe did not complete (likely transient load). Try again.`
+      `Could not confirm tool availability on PATH: ${inconclusiveTools.join("; ")}: the probe did not complete (likely transient load). Try again.`
     );
   }
   if (opts.github) {
@@ -24125,8 +24634,8 @@ async function createProject(opts, deps = defaultDeps) {
       timeout: SCAFFOLD_TIMEOUT_MS
     });
     if (scaffold.exitCode !== 0) {
-      const why = scaffold.killed ? `${pinned} did not complete: ${scaffold.stderr.trim() || `timed out after ${SCAFFOLD_TIMEOUT_MS}ms`}. Scaffolders that stall this way are usually waiting on a prompt despite --yes \u2014 run it yourself to see: npx ${npxArgs.join(" ")}` : `${pinned} exited ${scaffold.exitCode}.`;
-      const leftBehind = await fs55.pathExists(projectPath) ? ` The directory was left for inspection \u2014 review it and remove it manually if unwanted (haus never auto-deletes).` : "";
+      const why = scaffold.killed ? `${pinned} did not complete: ${scaffold.stderr.trim() || `timed out after ${SCAFFOLD_TIMEOUT_MS}ms`}. Scaffolders that stall this way are usually waiting on a prompt despite --yes. Run it yourself to see: npx ${npxArgs.join(" ")}` : `${pinned} exited ${scaffold.exitCode}.`;
+      const leftBehind = await fs55.pathExists(projectPath) ? ` The directory was left for inspection. Review it and remove it manually if unwanted (haus never auto-deletes).` : "";
       return fail3("scaffold", `${why}${leftBehind}`);
     }
     steps.push({ step: "scaffold", status: "done" });
@@ -24189,7 +24698,7 @@ async function createProject(opts, deps = defaultDeps) {
       steps.push({
         step: "init",
         status: "failed",
-        detail: `haus init threw (${err instanceof Error ? err.message : String(err)}). Project and repo are intact \u2014 cd ${opts.name} && haus init${profileFlag} to retry.`
+        detail: `haus init threw (${err instanceof Error ? err.message : String(err)}). Project and repo are intact. Run cd ${opts.name} && haus init${profileFlag} to retry.`
       });
       return { ok: false, projectPath, repoUrl, installHint, steps };
     }
@@ -24218,7 +24727,7 @@ async function createProject(opts, deps = defaultDeps) {
       steps.push({
         step: "init",
         status: "skipped",
-        detail: `setup was declined \u2014 no Claude files were written. Finish it with: ${retryCmd}`
+        detail: `setup was declined, no Claude files were written. Finish it with: ${retryCmd}`
       });
       return { ok: false, projectPath, repoUrl, installHint, steps, ...applied };
     }
@@ -24233,7 +24742,7 @@ async function createProject(opts, deps = defaultDeps) {
         steps.push({
           step: "init",
           status: "failed",
-          detail: `haus init reported failure. Project and repo are intact \u2014 ${retryCmd} to retry.`
+          detail: `haus init reported failure. Project and repo are intact. Run ${retryCmd} to retry.`
         });
         return { ok: false, projectPath, repoUrl, installHint, steps, ...applied };
       }
@@ -24290,12 +24799,12 @@ async function createProject(opts, deps = defaultDeps) {
           const add2 = await deps.git(["add", "-A"], gitOptions);
           if (add2.exitCode !== 0) {
             landedFully = false;
-            detail += `; follow-up git add failed (${add2.stderr.trim()}) \u2014 ${resumeHint}`;
+            detail += `; follow-up git add failed (${add2.stderr.trim()}): ${resumeHint}`;
           } else {
             const st = await deps.git(["status", "--porcelain"], gitOptions);
             if (st.exitCode !== 0) {
               landedFully = false;
-              detail += `; follow-up git status failed (${st.stderr.trim()}) \u2014 ${resumeHint}`;
+              detail += `; follow-up git status failed (${st.stderr.trim()}): ${resumeHint}`;
             } else if (st.stdout.trim() !== "") {
               const commit = await deps.git(
                 ["commit", "-m", "chore: add haus config files"],
@@ -24303,12 +24812,12 @@ async function createProject(opts, deps = defaultDeps) {
               );
               if (commit.exitCode !== 0) {
                 landedFully = false;
-                detail += `; follow-up commit failed (${commit.stderr.trim()}) \u2014 commit manually`;
+                detail += `; follow-up commit failed (${commit.stderr.trim()}), commit manually`;
               } else if (opts.github) {
                 const push = await deps.git(["push", "-u", "origin", "main"], gitOptions);
                 if (push.exitCode !== 0) {
                   landedFully = false;
-                  detail += "; push failed \u2014 run `git push -u origin main`";
+                  detail += "; push failed, run `git push -u origin main`";
                 }
               }
             }
@@ -24316,7 +24825,7 @@ async function createProject(opts, deps = defaultDeps) {
         } catch (err) {
           landedFully = false;
           const reason = err instanceof Error ? err.message : String(err);
-          detail += `; follow-up commit/push failed (${reason}) \u2014 files are on disk but uncommitted, resume with: cd ${opts.name} && git add -A && git commit -m "chore: add haus config files"` + (opts.github ? " && git push -u origin main" : "");
+          detail += `; follow-up commit/push failed (${reason}): files are on disk but uncommitted, resume with: cd ${opts.name} && git add -A && git commit -m "chore: add haus config files"` + (opts.github ? " && git push -u origin main" : "");
         }
         if (!landedFully) overlayIncomplete = true;
         steps.push({ step: "overlay", status: landedFully ? "done" : "partial", detail });
@@ -24329,7 +24838,7 @@ async function createProject(opts, deps = defaultDeps) {
         steps.push({ step: "role-check", status: "done" });
       } else {
         warn(
-          `Scanner did not detect role "${stack.expectedRole}" in the new project \u2014 the upstream scaffolder output may have changed. Review the project layout.`
+          `Scanner did not detect role "${stack.expectedRole}" in the new project. The upstream scaffolder output may have changed. Review the project layout.`
         );
         steps.push({
           step: "role-check",
@@ -24346,7 +24855,7 @@ async function createProject(opts, deps = defaultDeps) {
     steps.push({
       step: phase,
       status: "failed",
-      detail: `Unexpected error during ${phase}: ${err instanceof Error ? err.message : String(err)}. Nothing was auto-deleted \u2014 inspect ${projectPath} and resume manually.`
+      detail: `Unexpected error during ${phase}: ${err instanceof Error ? err.message : String(err)}. Nothing was auto-deleted. Inspect ${projectPath} and resume manually.`
     });
     return { ok: false, projectPath, repoUrl, installHint, steps, ...applied };
   }
@@ -24379,10 +24888,10 @@ function resolveNewOptions(stackArg, nameArg, flags, cwd) {
   const parentDir = flags.dir === void 0 ? cwd : path89.resolve(cwd, flags.dir);
   const pm = flags.pm ?? "yarn";
   if (!PMS.includes(pm)) {
-    return { ok: false, error: `Unsupported --pm "${pm}" \u2014 use yarn, npm, or pnpm.` };
+    return { ok: false, error: `Unsupported --pm "${pm}". Use yarn, npm, or pnpm.` };
   }
   if (flags.profile !== void 0 && !isProfileId(flags.profile)) {
-    return { ok: false, error: `Unsupported --profile "${flags.profile}" \u2014 use production or poc.` };
+    return { ok: false, error: `Unsupported --profile "${flags.profile}". Use production or poc.` };
   }
   if (stackArg === void 0 || nameArg === void 0) {
     return { ok: false, error: "missing-args" };
@@ -24409,7 +24918,7 @@ async function runNew(stackArg, nameArg, flags) {
   if (flags.list) {
     const stacks = STACKS.map(({ id, title }) => ({ id, title }));
     log(
-      flags.json ? JSON.stringify({ stacks }, null, 2) : stacks.map((s) => `${s.id} \u2014 ${s.title}`).join("\n")
+      flags.json ? JSON.stringify({ stacks }, null, 2) : stacks.map((s) => `${s.id}: ${s.title}`).join("\n")
     );
     return;
   }
@@ -24419,7 +24928,7 @@ async function runNew(stackArg, nameArg, flags) {
     try {
       stack ??= await select(
         "Which stack?",
-        STACKS.map((s) => ({ value: s.id, label: `${s.id} \u2014 ${s.title}` }))
+        STACKS.map((s) => ({ value: s.id, label: `${s.id}: ${s.title}` }))
       );
       name ??= await input("Project name?");
     } catch (err) {
@@ -24430,7 +24939,7 @@ async function runNew(stackArg, nameArg, flags) {
   }
   const resolved = resolveNewOptions(stack, name, flags, process.cwd());
   if (!resolved.ok) {
-    const message2 = resolved.error === "missing-args" ? process.stdin.isTTY ? "Missing stack/name \u2014 refusing to prompt under --json; run `haus new <stack> <name>` (see --list)." : "Missing stack/name and no TTY to prompt \u2014 run `haus new <stack> <name>` (see --list)." : resolved.error;
+    const message2 = resolved.error === "missing-args" ? process.stdin.isTTY ? "Missing stack/name, refusing to prompt under --json; run `haus new <stack> <name>` (see --list)." : "Missing stack/name and no TTY to prompt. Run `haus new <stack> <name>` (see --list)." : resolved.error;
     error(message2);
     process.exitCode = 1;
     return;
@@ -24441,7 +24950,7 @@ async function runNew(stackArg, nameArg, flags) {
   } else {
     for (const s of result.steps) {
       log(
-        `${s.status === "done" ? "\u2713" : s.status === "failed" ? "\u2717" : "\xB7"} ${s.step}${s.detail ? ` \u2014 ${s.detail}` : ""}`
+        `${s.status === "done" ? "\u2713" : s.status === "failed" ? "\u2717" : "\xB7"} ${s.step}${s.detail ? `: ${s.detail}` : ""}`
       );
     }
   }
@@ -24880,6 +25389,8 @@ async function runRecommend(options) {
 
 // src/commands/remove.ts
 import path90 from "node:path";
+import fs56 from "fs-extra";
+init_fs();
 init_logger();
 init_paths();
 function blankReport(dryRun, missing = []) {
@@ -24888,6 +25399,7 @@ function blankReport(dryRun, missing = []) {
     forced: [],
     skipped: [],
     missing,
+    excluded: [],
     backupDir: null,
     backupDirs: [],
     dryRun,
@@ -24910,6 +25422,44 @@ function reportLock(before, after, selfHealed, opts) {
 function emitReport(report2, json) {
   if (json) log(JSON.stringify(report2, null, 2));
 }
+function heldBy(item, others) {
+  return item.existing.flatMap(({ rel, abs }) => {
+    const other = others.find((o) => o.id !== item.id && holdsPath(abs, o.abs));
+    return other === void 0 ? [] : [{ rel, holder: other.id }];
+  });
+}
+function holdSharedPaths(root, lock, cleared, dryRun) {
+  const goingIds = new Set(cleared.map(({ id }) => id));
+  const recordedOnDisk = (row) => recordedPathsOf(row).flatMap((rel) => {
+    const abs = resolveContainedPath(root, recordedRel(rel));
+    if (abs === null) return [];
+    try {
+      fs56.lstatSync(abs);
+    } catch (err) {
+      const code2 = err.code;
+      if (code2 === "ENOENT" || code2 === "ENOTDIR") return [];
+    }
+    return [{ abs, id: rowName(row) }];
+  });
+  const others = lock.filter((row) => !goingIds.has(rowName(row))).flatMap(recordedOnDisk);
+  return holdUntilSettled(cleared, others, dryRun);
+}
+function holdUntilSettled(items, holders, dryRun) {
+  const held = [];
+  for (let changed = true; changed; ) {
+    changed = false;
+    for (const item of items) {
+      if (held.includes(item)) continue;
+      const holding = heldBy(item, holders);
+      if (holding.length === 0) continue;
+      for (const { rel, holder } of holding) warn(inUseLine(rel, item.id, holder, dryRun));
+      held.push(item);
+      holders.push(...item.existing.map(({ abs }) => ({ abs, id: item.id })));
+      changed = true;
+    }
+  }
+  return held;
+}
 async function runRemove(ids, options = {}) {
   const root = process.cwd();
   const dryRun = Boolean(options.dryRun);
@@ -24918,7 +25468,7 @@ async function runRemove(ids, options = {}) {
   } : log;
   const wanted = [...new Set(parseIdList(ids))];
   if (wanted.length === 0) {
-    error("Specify at least one catalog item id \u2014 see `haus doctor` for what is installed.");
+    error("Specify at least one catalog item id. See `haus doctor` for what is installed.");
     process.exitCode = 1;
     emitReport(blankReport(dryRun), options.json);
     return;
@@ -24931,13 +25481,15 @@ async function runRemove(ids, options = {}) {
   }
   const lock = lockRead.rows;
   const byId = new Map(lock.map((entry) => [entry.id, entry]));
-  const missing = wanted.filter((id) => !byId.has(id));
-  const found = wanted.filter((id) => byId.has(id));
+  const headerIds = wanted.filter((id) => Object.hasOwn(HEADER_FILE_RELS, id));
+  const itemIds = wanted.filter((id) => !Object.hasOwn(HEADER_FILE_RELS, id));
+  const missing = itemIds.filter((id) => !byId.has(id));
+  const found = itemIds.filter((id) => byId.has(id));
   for (const id of missing) {
     warn(`Not installed (no lock entry): ${id}`);
   }
-  if (found.length === 0) {
-    error("No installed items matched \u2014 nothing to remove.");
+  if (found.length === 0 && headerIds.length === 0) {
+    error("No installed items matched, nothing to remove.");
     process.exitCode = 1;
     emitReport(blankReport(dryRun, missing), options.json);
     return;
@@ -24948,6 +25500,32 @@ async function runRemove(ids, options = {}) {
     return;
   }
   const report2 = blankReport(dryRun, missing);
+  if (headerIds.length > 0) {
+    if (found.length > 0 && options.json && !options.yes && !dryRun) {
+      error(
+        "`--json` requires `-y` (a destructive command will not prompt on a machine-readable stream)."
+      );
+      process.exitCode = 1;
+      return;
+    }
+    for (const id of headerIds) say(excludedLine(HEADER_FILE_RELS[id] ?? id, id, dryRun));
+    const marked = await addProjectExcludedIds(root, headerIds, { dryRun });
+    if (marked !== null && "refused" in marked) {
+      process.exitCode = 1;
+      emitReport(report2, options.json);
+      return;
+    }
+    if (marked !== null) {
+      report2.records.push(marked);
+      say(recordLine(marked, dryRun));
+    }
+    report2.excluded = headerIds;
+  }
+  if (found.length === 0) {
+    if (report2.missing.length > 0) process.exitCode = 1;
+    emitReport(report2, options.json);
+    return;
+  }
   const cleared = [];
   let unreadable2 = false;
   for (const id of found) {
@@ -24956,11 +25534,7 @@ async function runRemove(ids, options = {}) {
     const unsafeByRel = await unsafeReasonsFor(root, relPaths);
     if ([...unsafeByRel.values()].some((reason) => reason !== null)) {
       for (const [rel, reason] of unsafeByRel) {
-        if (reason === "escapes-root") {
-          warn(`Refusing to touch ${id}'s recorded path outside the project root: ${rel}`);
-        } else if (reason === "symlink") {
-          warn(`Refusing to touch ${id}'s recorded path through a symlink: ${rel}`);
-        }
+        if (reason !== null) warn(unsafePathLine(id, rel, reason));
       }
       report2.skipped.push({ id, reason: "unsafe-path" });
       continue;
@@ -24968,7 +25542,7 @@ async function runRemove(ids, options = {}) {
     const existing = await resolveExistingTrackedPaths(root, id, relPaths, warn, unsafeByRel);
     if (existing.length === 0) {
       if (relPaths.length === 0) {
-        warn(`${id} has no recorded paths \u2014 leaving its lock entry in place.`);
+        warn(`${id} has no recorded paths, leaving its lock entry in place.`);
         report2.skipped.push({ id, reason: "no-paths" });
         continue;
       }
@@ -24992,6 +25566,10 @@ async function runRemove(ids, options = {}) {
     }
     cleared.push({ id, paths: relPaths, existing, forced: gate.ok ? null : gate.reason });
   }
+  for (const held of holdSharedPaths(root, lock, cleared, dryRun)) {
+    cleared.splice(cleared.indexOf(held), 1);
+    report2.skipped.push({ id: held.id, reason: "in-use" });
+  }
   if (report2.missing.length > 0 || report2.skipped.length > 0 || unreadable2) {
     process.exitCode = 1;
   }
@@ -25034,7 +25612,7 @@ async function runRemove(ids, options = {}) {
         say(recordLine(exclusion2, true));
       }
     }
-    if (!options.json) log(`Dry-run complete \u2014 ${cleared.length} item(s) planned, nothing written.`);
+    if (!options.json) log(`Dry-run complete: ${cleared.length} item(s) planned, nothing written.`);
     emitReport(report2, options.json);
     return;
   }
@@ -25046,15 +25624,19 @@ async function runRemove(ids, options = {}) {
       process.exitCode = 1;
       return;
     }
-    const pastGate = cleared.flatMap(
-      ({ id, forced }) => forced === null ? [] : [`${id} (${EDITED_REASON[forced]})`]
+    const going2 = cleared.flatMap(
+      ({ id, existing, forced }) => existing.map(
+        ({ rel }) => forced === null ? `${rel} (${id})` : `${rel} (${id}): ${EDITED_REASON[forced]}; removed with --force`
+      )
     );
-    const forceNote = pastGate.length > 0 ? ` --force includes ${pastGate.join(", ")}.` : "";
+    const listed = going2.length > 0 ? `
+  ${going2.join("\n  ")}
+` : " ";
     const ok2 = await confirm(
-      `Remove ${cleared.length} installed item(s) (${cleared.map((c) => c.id).join(", ")})? Files are backed up first.${forceNote}`
+      `Remove ${cleared.length} installed item(s) (${cleared.map((c) => c.id).join(", ")})?${listed}Files are backed up first.`
     );
     if (!ok2) {
-      log("Aborted \u2014 nothing removed.");
+      log("Aborted, nothing removed.");
       return;
     }
   }
@@ -25123,6 +25705,14 @@ async function runRemove(ids, options = {}) {
   }
   if (copyFailures.length > 0) process.exitCode = 1;
   const failedIds = new Set(copyFailures.map(({ item }) => item.id));
+  const failedPaths = copyFailures.flatMap(
+    ({ item }) => item.existing.map(({ abs }) => ({ abs, id: item.id }))
+  );
+  const copied = cleared.filter(({ id }) => !failedIds.has(id));
+  for (const item of holdUntilSettled(copied, failedPaths, false)) {
+    failedIds.add(item.id);
+    report2.skipped.push({ id: item.id, reason: "in-use" });
+  }
   const going = cleared.filter(({ id }) => !failedIds.has(id));
   report2.backupDirs = copyDirs;
   report2.backupDir = copyDirs.length === 1 ? copyDirs[0] ?? null : null;
@@ -25268,7 +25858,7 @@ async function runScan(options) {
 
 // src/commands/undo.ts
 import path91 from "node:path";
-import fs56 from "fs-extra";
+import fs57 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -25276,7 +25866,8 @@ var FORCE_COMMAND = "haus undo --force";
 var FORCE_LINE = { force: FORCE_COMMAND, forceVerb: "removes" };
 var REFUSED_REASON = {
   symlink: "recorded path is a symlink or reaches through one",
-  "escapes-root": "recorded path is outside the project root"
+  "escapes-root": "recorded path is outside the project root",
+  "outside-install-root": "haus never installs there, so it leaves it"
 };
 var notRegularReason = (what) => what === void 0 ? "is not a regular file" : `is ${what}, not a regular file`;
 var notRegularLine = (rel) => `kept (not owned) ${rel} (${RULES_HAUS_ID}): it is not a regular file, so haus leaves it as it is; delete it by hand.`;
@@ -25380,7 +25971,7 @@ async function claudeMdBlock(root) {
 }
 async function stripProjectSettings(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs56.pathExists(settingsPath)) return false;
+  if (!await fs57.pathExists(settingsPath)) return false;
   const read = await readSettingsOrRefuse(root);
   if (read === null) return false;
   const settings = stripHausHooks(
@@ -25392,7 +25983,7 @@ async function stripProjectSettings(root) {
     log(`Stripped haus rules from ${path91.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
-  await fs56.remove(settingsPath);
+  await fs57.remove(settingsPath);
   log(`Removed ${path91.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
@@ -25413,39 +26004,31 @@ async function stripRootClaudeMd(root) {
   }
   if (edit.text === prev) return false;
   if (edit.text.trim().length === 0) {
-    await fs56.remove(filePath);
+    await fs57.remove(filePath);
     log("Removed CLAUDE.md (only contained haus import block).");
   } else {
-    await fs56.writeFile(filePath, edit.text, "utf8");
+    await fs57.writeFile(filePath, edit.text, "utf8");
     log("Removed haus import block from CLAUDE.md (user content preserved).");
   }
   return true;
 }
-async function pruneDirIfEmpty(dir) {
-  if (!await fs56.pathExists(dir)) return;
-  try {
-    const entries = await fs56.readdir(dir);
-    if (entries.length === 0) await fs56.remove(dir);
-  } catch {
-  }
-}
 async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   if (managedAbsPaths.length === 0) return null;
   const stamp = newBackupStamp();
   const backupRoot = hausPath(root, "backups", dirBackupDirName("undo", stamp));
-  const existedBefore = await fs56.pathExists(backupRoot);
+  const existedBefore = await fs57.pathExists(backupRoot);
   let copied = 0;
   try {
     for (const abs of managedAbsPaths) {
-      if (!await fs56.pathExists(abs)) continue;
+      if (!await fs57.pathExists(abs)) continue;
       const backupPath = path91.join(backupRoot, path91.relative(root, abs));
-      await fs56.ensureDir(path91.dirname(backupPath));
-      const dereference = (await fs56.lstat(abs)).isSymbolicLink();
-      await fs56.copy(abs, backupPath, { dereference });
+      await fs57.ensureDir(path91.dirname(backupPath));
+      const dereference = (await fs57.lstat(abs)).isSymbolicLink();
+      await fs57.copy(abs, backupPath, { dereference });
       copied++;
     }
   } catch (err) {
-    if (!existedBefore) await fs56.remove(backupRoot).catch(() => void 0);
+    if (!existedBefore) await fs57.remove(backupRoot).catch(() => void 0);
     throw err;
   }
   if (copied === 0) return null;
@@ -25482,13 +26065,7 @@ async function runUndo(options) {
   const keptPaths = [...keptItems, ...unreadableItems].flatMap(
     ({ item }) => item.existing.map((e) => path91.resolve(e.abs))
   );
-  const below = (folder) => folder.endsWith(path91.sep) ? folder : `${folder}${path91.sep}`;
-  const holdsKept = (abs) => {
-    const target = path91.resolve(abs);
-    return keptPaths.some(
-      (kept) => kept === target || kept.startsWith(below(target)) || target.startsWith(below(kept))
-    );
-  };
+  const holdsKept = (abs) => keptPaths.some((kept) => holdsPath(abs, kept));
   const toDelete = tracked.filter(
     (item) => item.existing.length > 0 && item.unreadable === void 0 && (item.edited === null || force)
   ).map((item) => ({ item, paths: item.existing.filter((e) => !holdsKept(e.abs)) })).filter(({ paths }) => paths.length > 0);
@@ -25579,7 +26156,7 @@ async function runUndo(options) {
     if (!lockExisted) return;
     if (carried.length === 0) {
       if (dryRun) return;
-      await fs56.remove(lockFile);
+      await fs57.remove(lockFile);
       log(`Removed ${LOCK_FILE}`);
       return;
     }
@@ -25661,7 +26238,7 @@ ${keeping}User-owned .claude/ files will be preserved.`
     return;
   }
   for (const plan of coreRemoved) {
-    await fs56.remove(plan.abs);
+    await fs57.remove(plan.abs);
     log(`Removed ${relOf(plan.abs)}`);
   }
   const failed = /* @__PURE__ */ new Set();
@@ -25688,15 +26265,15 @@ ${keeping}User-owned .claude/ files will be preserved.`
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
   await settleLock();
-  await pruneDirIfEmpty(claudePath(root));
-  await pruneDirIfEmpty(hausPath(root));
+  await pruneEmptyDir(claudePath(root));
+  await pruneEmptyDir(hausPath(root));
   if (failed.size > 0) return;
   log("haus undo complete. Scan artifacts under .haus-workflow/ were left in place.");
 }
 
 // src/install/uninstall.ts
 import path92 from "node:path";
-import fs57 from "fs-extra";
+import fs58 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -25710,7 +26287,7 @@ async function runUninstall(options = {}) {
     pluginsRemoved: []
   };
   if (!manifest) {
-    warn("No install manifest found \u2014 nothing to uninstall.");
+    warn("No install manifest found, nothing to uninstall.");
     return result;
   }
   await readSettings();
@@ -25718,7 +26295,7 @@ async function runUninstall(options = {}) {
   const malformed = recordedPlugins.filter((entry) => !isValidPin(entry)).length;
   if (malformed > 0) {
     warn(
-      `Ignoring ${malformed} malformed plugin record(s) in the install manifest \u2014 continuing with the rest of the uninstall.`
+      `Ignoring ${malformed} malformed plugin record(s) in the install manifest, continuing with the rest of the uninstall.`
     );
   }
   const managedPlugins = recordedPlugins.filter(isValidPin).map(withDefaultActivation);
@@ -25727,11 +26304,11 @@ async function runUninstall(options = {}) {
     result.pluginsRemoved = pluginRemoval.removed;
   } catch (err) {
     warn(
-      `Could not remove global plugin(s): ${err instanceof Error ? err.message : String(err)} \u2014 continuing with the rest of the uninstall.`
+      `Could not remove global plugin(s): ${err instanceof Error ? err.message : String(err)}. Continuing with the rest of the uninstall.`
     );
   }
   for (const entry of manifest.files) {
-    const exists3 = fs57.pathExistsSync(entry.destPath);
+    const exists3 = fs58.pathExistsSync(entry.destPath);
     if (!exists3) continue;
     const content2 = await readText(entry.destPath);
     if (content2 === void 0) continue;
@@ -25744,12 +26321,12 @@ async function runUninstall(options = {}) {
     const currentHash = hashText(normaliseLF(content2));
     if (currentHash !== entry.hash && !force) {
       warn(
-        `Skipping user-edited haus file (hash mismatch): ${entry.destPath} \u2014 use --force to delete`
+        `Skipping user-edited haus file (hash mismatch): ${entry.destPath}. Use --force to delete`
       );
       result.skipped.push(entry.destPath);
       continue;
     }
-    await fs57.remove(entry.destPath);
+    await fs58.remove(entry.destPath);
     await pruneEmptyDir(path92.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
@@ -25761,14 +26338,14 @@ async function runUninstall(options = {}) {
   result.hooksStripped = true;
   const hausDir = path92.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
-  if (fs57.pathExistsSync(manifestPath2)) {
-    await fs57.remove(manifestPath2);
+  if (fs58.pathExistsSync(manifestPath2)) {
+    await fs58.remove(manifestPath2);
   }
   await removeInstallConfig();
-  if (fs57.pathExistsSync(hausDir)) {
+  if (fs58.pathExistsSync(hausDir)) {
     try {
-      const remaining = await fs57.readdir(hausDir);
-      if (remaining.length === 0) await fs57.remove(hausDir);
+      const remaining = await fs58.readdir(hausDir);
+      if (remaining.length === 0) await fs58.remove(hausDir);
     } catch {
     }
   }
@@ -25800,7 +26377,7 @@ async function runUninstallCommand(options) {
     if (options.dryRun) {
       const manifest = await readManifest();
       if (!manifest) {
-        log("[dry-run] No install manifest found \u2014 nothing would be removed.");
+        log("[dry-run] No install manifest found, nothing would be removed.");
         return;
       }
       if (manifest.files.length > 0) {
@@ -25844,7 +26421,7 @@ init_forbidden_content();
 init_manifest_item_fields();
 init_path_safety();
 init_validation_rules2();
-import fs58 from "node:fs";
+import fs59 from "node:fs";
 import path93 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var ITEM_ID_PATTERN = /^haus\./;
@@ -25954,7 +26531,7 @@ function auditManifestStructure(manifestVersion2, items) {
     if (typeof item.tokenEstimate === "number" && item.tokenEstimate > 0) {
       if (typeof item.tokenBudget !== "number") {
         failures.push(
-          `${item.id}: tokenEstimate ${item.tokenEstimate} but no tokenBudget \u2014 an item that loads into context needs a growth ceiling (estimate + ~30% headroom, so ${Math.ceil(item.tokenEstimate * 1.3)})`
+          `${item.id}: tokenEstimate ${item.tokenEstimate} but no tokenBudget: an item that loads into context needs a growth ceiling (estimate + ~30% headroom, so ${Math.ceil(item.tokenEstimate * 1.3)})`
         );
       } else if (item.tokenEstimate > item.tokenBudget) {
         failures.push(
@@ -26005,7 +26582,7 @@ function checkRequiredFrontmatter(text, label) {
 }
 function readForAudit(absPath, label, failures) {
   try {
-    return fs58.readFileSync(absPath, "utf8");
+    return fs59.readFileSync(absPath, "utf8");
   } catch (err) {
     failures.push(`${label}: unreadable (${err instanceof Error ? err.message : String(err)})`);
     return null;
@@ -26037,7 +26614,7 @@ function auditShippedFiles(manifestDir, items) {
     const absPath = path93.join(manifestDir, item.path);
     if (item.type === "skill") {
       const skillMd = path93.join(absPath, "SKILL.md");
-      if (!fs58.existsSync(skillMd)) {
+      if (!fs59.existsSync(skillMd)) {
         failures.push(`${item.id}: missing ${path93.relative(manifestDir, skillMd)}`);
         continue;
       }
@@ -26048,7 +26625,7 @@ function auditShippedFiles(manifestDir, items) {
         ...auditForbiddenTagsInText(text, `${item.id}: ${path93.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
-      if (!fs58.existsSync(absPath)) {
+      if (!fs59.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
@@ -26058,13 +26635,13 @@ function auditShippedFiles(manifestDir, items) {
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditForbiddenTagsInText(text, `${item.id}: ${rel}`));
     } else if (item.type === "template") {
-      if (!fs58.existsSync(absPath)) {
+      if (!fs59.existsSync(absPath)) {
         failures.push(`${item.id}: missing template file ${item.path}`);
         continue;
       }
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "command") {
-      if (!fs58.existsSync(absPath)) {
+      if (!fs59.existsSync(absPath)) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
@@ -26074,15 +26651,15 @@ function auditShippedFiles(manifestDir, items) {
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "config") {
-      if (!fs58.existsSync(absPath)) {
+      if (!fs59.existsSync(absPath)) {
         failures.push(`${item.id}: missing config path ${item.path}`);
       }
     } else if (item.type === "rule") {
-      if (!fs58.existsSync(absPath)) {
+      if (!fs59.existsSync(absPath)) {
         failures.push(`${item.id}: missing rule file ${item.path}`);
       }
     } else if (item.type === "asset") {
-      if (!fs58.existsSync(absPath)) {
+      if (!fs59.existsSync(absPath)) {
         failures.push(`${item.id}: missing asset file ${item.path}`);
       }
     }
@@ -26117,7 +26694,7 @@ function resolveItemType(relPath, pathTypeMap) {
 function walkAllFiles(dir, fn, failures) {
   let entries;
   try {
-    entries = fs58.readdirSync(dir, { withFileTypes: true });
+    entries = fs59.readdirSync(dir, { withFileTypes: true });
   } catch (err) {
     failures.push(
       `${dir}: unreadable subtree (${err instanceof Error ? err.message : String(err)})`
@@ -26151,7 +26728,7 @@ function auditDiskOrphans(manifestDir, items) {
   const claimedPaths = items.filter((item) => item.path && isSafeCatalogPath(item.path)).map((item) => item.path.replace(/\\/g, "/"));
   for (const dir of CONTENT_ROOTS) {
     const abs = path93.join(manifestDir, dir);
-    if (!fs58.existsSync(abs)) continue;
+    if (!fs59.existsSync(abs)) continue;
     walkAllFiles(
       abs,
       (file) => {
@@ -26168,7 +26745,7 @@ function auditDiskOrphans(manifestDir, items) {
 function walkMd(dir, fn, failures) {
   let entries;
   try {
-    entries = fs58.readdirSync(dir, { withFileTypes: true });
+    entries = fs59.readdirSync(dir, { withFileTypes: true });
   } catch (err) {
     failures.push(
       `${dir}: unreadable subtree (${err instanceof Error ? err.message : String(err)})`
@@ -26187,7 +26764,7 @@ function auditMarkdownContent(manifestDir, items) {
   const pathTypeMap = buildItemPathTypeMap(items);
   for (const dir of ["skills", "agents", "templates", "commands", "sources"]) {
     const abs = path93.join(manifestDir, dir);
-    if (!fs58.existsSync(abs)) continue;
+    if (!fs59.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(
       abs,
@@ -26451,12 +27028,12 @@ async function runVerifyLocal(options) {
 // src/commands/workspace/env.ts
 init_logger();
 import { existsSync as existsSync11 } from "node:fs";
-import fs67 from "node:fs/promises";
+import fs68 from "node:fs/promises";
 import path105 from "node:path";
 
 // src/workspace/env/datastores/container.ts
 init_exec();
-import fs59 from "node:fs/promises";
+import fs60 from "node:fs/promises";
 import path95 from "node:path";
 
 // src/workspace/env/datastores/names.ts
@@ -26687,18 +27264,18 @@ async function dumpToFile(ctx, target, argv, file, what) {
   await dumpCommandToFile(ctx, "docker", composeExecArgs(target, argv), {}, file, what);
 }
 async function dumpCommandToFile(ctx, cmd, args, opts, file, what) {
-  await fs59.mkdir(path95.dirname(file), { recursive: true });
+  await fs60.mkdir(path95.dirname(file), { recursive: true });
   try {
     assertOk(await ctx.exec(cmd, args, { ...opts, stdoutFile: file }), what);
     await assertPrivateNonEmpty(file, what);
   } catch (err) {
-    await fs59.rm(file, { force: true });
+    await fs60.rm(file, { force: true });
     throw err instanceof DatastoreError ? err : new DatastoreError(`${what} failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 async function assertPrivateNonEmpty(file, what) {
-  await fs59.chmod(file, 384);
-  const { size } = await fs59.stat(file);
+  await fs60.chmod(file, 384);
+  const { size } = await fs60.stat(file);
   if (size === 0) throw new DatastoreError(`${what} produced an empty file.`);
 }
 
@@ -27055,7 +27632,7 @@ var mariadbDriver = {
 };
 
 // src/workspace/env/datastores/mssql.ts
-import fs60 from "node:fs/promises";
+import fs61 from "node:fs/promises";
 import path96 from "node:path";
 var MSSQL_TOOLS_IMAGE = "mcr.microsoft.com/mssql-tools:latest";
 var DETECT_SCRIPT = 'for p in /opt/mssql-tools18/bin/sqlcmd /opt/mssql-tools/bin/sqlcmd; do if [ -x "$p" ]; then echo "$p"; exit 0; fi; done; command -v sqlcmd || exit 3';
@@ -27351,7 +27928,7 @@ DROP DATABASE ${q(n.template)};`,
     const dir = dataDir(await databaseFiles(ctx, t.datastore, n.worktree));
     const bak = assertContainerPath(`${dir}/haus-dump-${n.worktree}.bak`);
     const what = `Dumping ${n.worktree}`;
-    await fs60.mkdir(path96.dirname(file), { recursive: true });
+    await fs61.mkdir(path96.dirname(file), { recursive: true });
     try {
       await sqlcmd(
         ctx,
@@ -27369,7 +27946,7 @@ DROP DATABASE ${q(n.template)};`,
       assertOk(await ctx.exec("docker", ["cp", `${cid}:${bak}`, file]), `Copying ${bak} out`);
       await assertPrivateNonEmpty(file, what);
     } catch (err) {
-      await fs60.rm(file, { force: true });
+      await fs61.rm(file, { force: true });
       throw err instanceof DatastoreError ? err : new DatastoreError(`${what} failed: ${err instanceof Error ? err.message : String(err)}`);
     } finally {
       await removeContainerFile(ctx, t.datastore, bak).catch(() => void 0);
@@ -27974,13 +28551,13 @@ function derivedEnvState(instance, base, worktreePath2) {
 
 // src/workspace/env/processes.ts
 import { spawn } from "node:child_process";
-import fs62 from "node:fs";
+import fs63 from "node:fs";
 import http from "node:http";
 import path99 from "node:path";
 
 // src/workspace/env/orphans.ts
 import { execFile } from "node:child_process";
-import fs61 from "node:fs";
+import fs62 from "node:fs";
 import path98 from "node:path";
 function parseLsofListeners(text) {
   const out = [];
@@ -28033,7 +28610,7 @@ function portOwnerOf(port, ctx) {
 function classifyListener(l, ctx) {
   const owner = portOwnerOf(l.port, ctx);
   if (!owner) return void 0;
-  const exists3 = ctx.exists ?? fs61.existsSync;
+  const exists3 = ctx.exists ?? fs62.existsSync;
   const portOwner = owner.kind === "lease" ? owner.lease.slug : "main";
   const result = (cls, reason) => ({
     ...l,
@@ -28075,7 +28652,7 @@ async function resolveCwds(pids, exec = execText) {
 }
 function realOr(p) {
   try {
-    return fs61.realpathSync(p);
+    return fs62.realpathSync(p);
   } catch {
     return p;
   }
@@ -28198,7 +28775,7 @@ async function anyHostHealthy(port, pathname) {
 }
 function tail(file) {
   try {
-    const lines = fs62.readFileSync(file, "utf8").trimEnd().split("\n");
+    const lines = fs63.readFileSync(file, "utf8").trimEnd().split("\n");
     return lines.slice(-LOG_TAIL_LINES).join("\n");
   } catch {
     return "";
@@ -28225,7 +28802,7 @@ function prepare(ctx, name, state) {
   }
   const member = ctx.members.find((m) => m.id === spec.repo || m.folder === spec.repo);
   const cwd = member?.worktreePath;
-  if (!cwd || !fs62.existsSync(cwd)) {
+  if (!cwd || !fs63.existsSync(cwd)) {
     return {
       ok: false,
       reason: ctx.mode === "single-repo" ? `Folder "${spec.repo}" does not exist in this worktree.` : `Repo "${spec.repo}" is not materialised in this worktree. Run \`haus workspace worktree hydrate --materialize\` first.`
@@ -28308,13 +28885,13 @@ async function startProcess(ctx, name, opts = {}) {
   }
   const logRel = logRelPath(name);
   const logAbs = path99.join(p.worktree, logRel);
-  fs62.mkdirSync(path99.dirname(logAbs), { recursive: true });
-  fs62.appendFileSync(
+  fs63.mkdirSync(path99.dirname(logAbs), { recursive: true });
+  fs63.appendFileSync(
     logAbs,
     `--- haus env start ${name} ${(/* @__PURE__ */ new Date()).toISOString()}: ${p.command}
 `
   );
-  const fd = fs62.openSync(logAbs, "a");
+  const fd = fs63.openSync(logAbs, "a");
   let child;
   try {
     child = spawn(p.command, {
@@ -28325,7 +28902,7 @@ async function startProcess(ctx, name, opts = {}) {
       env: { ...process.env, HAUS_ENV_FILE: envStatePath(p.worktree) }
     });
   } finally {
-    fs62.closeSync(fd);
+    fs63.closeSync(fd);
   }
   const pid = child.pid;
   if (pid === void 0) {
@@ -28420,12 +28997,12 @@ function errorText(err) {
 
 // src/workspace/env/sites/herd.ts
 import { existsSync as existsSync7, lstatSync, readlinkSync } from "node:fs";
-import fs65 from "node:fs/promises";
+import fs66 from "node:fs/promises";
 import path102 from "node:path";
 
 // src/workspace/env/dotenv-writer.ts
 import { createHash as createHash4 } from "node:crypto";
-import fs63 from "node:fs/promises";
+import fs64 from "node:fs/promises";
 var DOTENV_MODE = 384;
 var LINE_KEY_RE = /^(\s*)(export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)(\s*)=/;
 function hashContent2(content2) {
@@ -28466,7 +29043,7 @@ function linesByKey(content2) {
 }
 async function readIfExists(file) {
   try {
-    return await fs63.readFile(file, "utf8");
+    return await fs64.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
     throw new Error(`Could not read ${file} (${err.code ?? "error"}).`);
@@ -28581,7 +29158,7 @@ function describeDotenvResult(r) {
 
 // src/workspace/env/sites/wp-config-override.ts
 import { existsSync as existsSync6 } from "node:fs";
-import fs64 from "node:fs/promises";
+import fs65 from "node:fs/promises";
 import path101 from "node:path";
 init_paths();
 var WP_CONFIG_FILE = "wp-config.php";
@@ -28662,7 +29239,7 @@ async function patchMainWpConfig(mainDocroot, keys, opts) {
   const file = path101.join(mainDocroot, WP_CONFIG_FILE);
   if (!existsSync6(file)) return { status: "missing", file };
   const exec = opts.exec ?? defaultExec;
-  const source = await fs64.readFile(file, "utf8");
+  const source = await fs65.readFile(file, "utf8");
   const patch = patchWpConfigSource(source, keys);
   if (patch.text === source) {
     return {
@@ -28680,11 +29257,11 @@ async function patchMainWpConfig(mainDocroot, keys, opts) {
     dirBackupDirName("worktreeEnv", newBackupStamp())
   );
   const backup = path101.join(backupDir, inside2 ? rel : WP_CONFIG_FILE);
-  const mode = (await fs64.stat(file)).mode & 511;
-  await fs64.mkdir(path101.dirname(backup), { recursive: true });
-  await fs64.copyFile(file, backup);
-  await fs64.chmod(backup, 384);
-  if (await fs64.readFile(backup, "utf8") !== source) {
+  const mode = (await fs65.stat(file)).mode & 511;
+  await fs65.mkdir(path101.dirname(backup), { recursive: true });
+  await fs65.copyFile(file, backup);
+  await fs65.chmod(backup, 384);
+  if (await fs65.readFile(backup, "utf8") !== source) {
     throw new SiteConfigError(
       `The backup of ${file} does not match the original; wp-config.php was not changed.`
     );
@@ -28692,8 +29269,8 @@ async function patchMainWpConfig(mainDocroot, keys, opts) {
   await writeFileAtomic(file, patch.text, { mode });
   const lint = await exec(opts.php ?? "php", ["-l", file]);
   if (lint.exitCode !== 0) {
-    await fs64.copyFile(backup, file);
-    await fs64.chmod(file, mode);
+    await fs65.copyFile(backup, file);
+    await fs65.chmod(file, mode);
     return {
       status: "restored",
       file,
@@ -28808,8 +29385,8 @@ function normalizeRel(rel) {
   return path102.normalize(rel).replace(/\/+$/, "");
 }
 async function cowCopy(exec, main, dest, skip, rel = "") {
-  await fs65.mkdir(path102.join(dest, rel), { recursive: true });
-  for (const entry of await fs65.readdir(path102.join(main, rel), { withFileTypes: true })) {
+  await fs66.mkdir(path102.join(dest, rel), { recursive: true });
+  for (const entry of await fs66.readdir(path102.join(main, rel), { withFileTypes: true })) {
     const childRel = rel ? path102.join(rel, entry.name) : entry.name;
     if (skip.has(childRel)) continue;
     const nested = [...skip].some((s) => s.startsWith(`${childRel}/`));
@@ -28832,12 +29409,12 @@ async function ensureSymlink(link, target) {
   }
   if (st?.isSymbolicLink()) {
     if (readlinkSync(link) === target) return;
-    await fs65.unlink(link);
+    await fs66.unlink(link);
   } else if (st) {
     throw new SiteError(`${link} exists and is not a symlink; leaving it alone.`);
   }
-  await fs65.mkdir(path102.dirname(link), { recursive: true });
-  await fs65.symlink(target, link);
+  await fs66.mkdir(path102.dirname(link), { recursive: true });
+  await fs66.symlink(target, link);
 }
 function memberPath(ctx, ref) {
   const m = ctx.members.find((x) => x.folder === ref || x.id === ref);
@@ -28866,7 +29443,7 @@ function siteLockPath(workspaceRoot, name) {
 }
 async function readLock2(file) {
   try {
-    const v = JSON.parse(await fs65.readFile(file, "utf8"));
+    const v = JSON.parse(await fs66.readFile(file, "utf8"));
     return typeof v.owner === "string" && typeof v.expiresAt === "string" ? v : void 0;
   } catch {
     return void 0;
@@ -28895,7 +29472,7 @@ async function releaseSiteLock(ctx, name) {
   const file = siteLockPath(ctx.workspaceRoot, name);
   const held = await readLock2(file);
   if (!held || held.owner !== ctx.slug) return false;
-  await fs65.rm(file, { force: true });
+  await fs66.rm(file, { force: true });
   return true;
 }
 function resolvedDefines(site, withSite) {
@@ -28918,19 +29495,19 @@ async function refreshHerdSiteConfig(ctx, name, site, opts = {}) {
   const defines = resolvedDefines(site, siteTemplateValues(ctx, name, site, worktree2));
   let changed = false;
   const instanceFile = path102.join(worktree2, INSTANCE_CONFIG_FILE);
-  const current = existsSync7(instanceFile) ? await fs65.readFile(instanceFile, "utf8") : void 0;
+  const current = existsSync7(instanceFile) ? await fs66.readFile(instanceFile, "utf8") : void 0;
   if (current !== renderInstanceConfig(defines)) {
     changed = true;
     if (!opts.dryRun) await writeInstanceConfig(worktree2, defines);
   }
   const wpConfig = path102.join(worktree2, WP_CONFIG_FILE);
   if (existsSync7(wpConfig)) {
-    const source = await fs65.readFile(wpConfig, "utf8");
+    const source = await fs66.readFile(wpConfig, "utf8");
     const patch = patchWpConfigSource(source, Object.keys(defines));
     if (patch.text !== source) {
       changed = true;
       if (!opts.dryRun) {
-        const mode = (await fs65.stat(wpConfig)).mode & 511;
+        const mode = (await fs66.stat(wpConfig)).mode & 511;
         await writeFileAtomic(wpConfig, patch.text, { mode });
       }
     }
@@ -28977,7 +29554,7 @@ async function provisionHerdSite(ctx, name, site, opts = {}) {
     ctx.log?.(`Cloning ${site.root} (copy-on-write).`);
     const skip = /* @__PURE__ */ new Set([...shares, ...plugins.map((p) => p.rel), INSTANCE_CONFIG_FILE]);
     await cowCopy(ctx.exec, main, partial, skip);
-    await fs65.rename(partial, worktree2);
+    await fs66.rename(partial, worktree2);
     status = "created";
   }
   const links = [];
@@ -29091,7 +29668,7 @@ async function teardownHerdSite(ctx, name, site, recorded) {
     trashed = true;
   } else {
     for (const link of siteLinksInWorktree(ctx.worktreePath, worktree2, site, recorded)) {
-      await fs65.unlink(link);
+      await fs66.unlink(link);
     }
   }
   return { unlinked, trashed, lockReleased: false, notes };
@@ -29831,7 +30408,7 @@ function formatEnvStatus(r) {
 init_fs();
 import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync10 } from "node:fs";
-import fs66 from "node:fs/promises";
+import fs67 from "node:fs/promises";
 import path104 from "node:path";
 function upRefusal(ctx) {
   if (!ctx.enabled) return envEnableHint(ctx);
@@ -30154,7 +30731,7 @@ async function copyLocal(run) {
       continue;
     }
     const key = `copyLocal:${label}`;
-    const bytes = await fs66.readFile(src);
+    const bytes = await fs67.readFile(src);
     const hash = sha(bytes);
     if (existsSync10(dest) && run.prior?.sourceEnvHashes[key] === hash) continue;
     run.changes.copiedLocal.push(label);
@@ -30677,7 +31254,7 @@ async function handlePatchWpConfig(opts) {
   if (opts.dryRun) {
     const file = path105.join(docroot, WP_CONFIG_FILE);
     if (!existsSync11(file)) return fail2(opts, `${file} does not exist.`);
-    const p = patchWpConfigSource(await fs67.readFile(file, "utf8"), keys);
+    const p = patchWpConfigSource(await fs68.readFile(file, "utf8"), keys);
     const doc = {
       ok: true,
       dryRun: true,
@@ -30757,7 +31334,7 @@ init_logger();
 // src/workspace/worktree/add.ts
 init_fs();
 import path111 from "node:path";
-import fs71 from "fs-extra";
+import fs72 from "fs-extra";
 
 // src/workspace/worktree/git-worktree.ts
 init_exec();
@@ -30898,12 +31475,12 @@ async function hasUnpushedWork(cwd) {
 // src/workspace/worktree/hydrate.ts
 init_exec();
 import path109 from "node:path";
-import fs69 from "fs-extra";
+import fs70 from "fs-extra";
 
 // src/workspace/worktree/cow-copy.ts
 init_exec();
 import path107 from "node:path";
-import fs68 from "fs-extra";
+import fs69 from "fs-extra";
 async function getMacFilesystemType(dir) {
   const df = await runCommand("df", ["-P", dir]);
   if (df.exitCode !== 0) return void 0;
@@ -30934,14 +31511,14 @@ async function detectCowStrategy(dir) {
   return "unknown-platform";
 }
 async function cowCopyDir(src, dest) {
-  const srcExists = await fs68.pathExists(src);
+  const srcExists = await fs69.pathExists(src);
   if (!srcExists)
     return { strategy: "unsupported", attempted: false, ok: false, error: "source missing" };
   const strategy = await detectCowStrategy(path107.dirname(dest));
   if (strategy === "unsupported" || strategy === "unknown-platform") {
     return { strategy, attempted: false, ok: false };
   }
-  await fs68.ensureDir(path107.dirname(dest));
+  await fs69.ensureDir(path107.dirname(dest));
   const args = strategy === "darwin-clonefile" ? ["-c", "-R", src, dest] : ["-a", "--reflink=always", src, dest];
   const result = await runCommand("cp", args);
   return {
@@ -31119,7 +31696,7 @@ function summarizeInstall(install) {
   }
   if (install.plan.manager === "none") return "no install step (no recognized lockfile)";
   const envNotes = (install.missingEnvVars ?? []).map(
-    (name) => `${name} not set in environment \u2014 yarn install will fail`
+    (name) => `${name} not set in environment, so yarn install will fail`
   );
   if (!install.ran) {
     const skip = `install skipped (${install.skippedReason ?? "unavailable"})`;
@@ -31234,8 +31811,8 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
   for (const target of HYDRATION_TARGETS) {
     const src = path109.join(mainMemberPath, target);
     const dest = path109.join(worktreeMemberPath, target);
-    if (!await fs69.pathExists(src)) continue;
-    const destExists = await fs69.pathExists(dest);
+    if (!await fs70.pathExists(src)) continue;
+    const destExists = await fs70.pathExists(dest);
     if (!opts.force && destExists) continue;
     if (opts.force && destExists) {
       const refusal2 = await replaceRefusal(worktreeMemberPath, target);
@@ -31243,7 +31820,7 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
         refusedTargets.push({ target, path: dest, reason: refusal2 });
         continue;
       }
-      await fs69.remove(dest);
+      await fs70.remove(dest);
     }
     const copy = await cowCopyDir(src, dest);
     targets.push({ target, copy });
@@ -31286,7 +31863,7 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
 init_exec();
 init_fs();
 import path110 from "node:path";
-import fs70 from "fs-extra";
+import fs71 from "fs-extra";
 var MACHINE_LOCAL_FILES = [
   "docker-compose.local.yml",
   path110.join(".claude", "settings.local.json")
@@ -31305,7 +31882,7 @@ async function copyLocalFiles(mainMemberPath, worktreeMemberPath, relPaths, opts
       result.skipped.push({ path: rel, reason: "outside-repo" });
       continue;
     }
-    if (!await fs70.pathExists(src)) {
+    if (!await fs71.pathExists(src)) {
       result.skipped.push({ path: rel, reason: "missing" });
       continue;
     }
@@ -31313,9 +31890,9 @@ async function copyLocalFiles(mainMemberPath, worktreeMemberPath, relPaths, opts
       result.skipped.push({ path: rel, reason: "tracked" });
       continue;
     }
-    await fs70.ensureDir(path110.dirname(dest));
-    await fs70.copy(src, dest, { overwrite: true });
-    if (opts.mode !== void 0) await fs70.chmod(dest, opts.mode);
+    await fs71.ensureDir(path110.dirname(dest));
+    await fs71.copy(src, dest, { overwrite: true });
+    if (opts.mode !== void 0) await fs71.chmod(dest, opts.mode);
     result.copied.push(rel);
   }
   return result;
@@ -31350,10 +31927,10 @@ async function runAdd(opts) {
   }
   const branch = opts.branch ?? opts.slug;
   const wsWorktreePath = worktreePath(workspaceRoot, opts.slug);
-  if (await fs71.pathExists(wsWorktreePath)) {
+  if (await fs72.pathExists(wsWorktreePath)) {
     return {
       ok: false,
-      error: `Workspace worktree already exists at ${wsWorktreePath} \u2014 run \`haus workspace worktree hydrate --materialize\` from inside it to check out any missing members (e.g. a worktree created by plain \`git worktree add\`), or \`remove\` first to start over.`
+      error: `Workspace worktree already exists at ${wsWorktreePath}. Run \`haus workspace worktree hydrate --materialize\` from inside it to check out any missing members (e.g. a worktree created by plain \`git worktree add\`), or \`remove\` first to start over.`
     };
   }
   if (opts.dryRun) {
@@ -31363,7 +31940,7 @@ async function runAdd(opts) {
   if (!wsOutcome.ok) {
     return {
       ok: false,
-      error: wsOutcome.checkedOutElsewhere ? `Branch "${branch}" is already checked out elsewhere in the workspace repo \u2014 pick a different --branch.` : `Failed to create the workspace worktree: ${wsOutcome.stderr ?? "unknown error"}`
+      error: wsOutcome.checkedOutElsewhere ? `Branch "${branch}" is already checked out elsewhere in the workspace repo. Pick a different --branch.` : `Failed to create the workspace worktree: ${wsOutcome.stderr ?? "unknown error"}`
     };
   }
   const memberResults = [];
@@ -31380,7 +31957,7 @@ async function runAdd(opts) {
         status: "failed",
         branch,
         branchAction: outcome.branchAction,
-        error: outcome.checkedOutElsewhere ? `Branch "${branch}" is already checked out elsewhere in ${member.id} \u2014 pick a different --branch.` : outcome.stderr ?? "unknown error",
+        error: outcome.checkedOutElsewhere ? `Branch "${branch}" is already checked out elsewhere in ${member.id}. Pick a different --branch.` : outcome.stderr ?? "unknown error",
         durationMs: Date.now() - start
       });
       continue;
@@ -31468,7 +32045,7 @@ async function runDryRun(args) {
 import { spawn as spawn2 } from "node:child_process";
 import fsSync from "node:fs";
 import path117 from "node:path";
-import fs73 from "fs-extra";
+import fs74 from "fs-extra";
 
 // src/workspace/worktree/doctor.ts
 import { existsSync as existsSync14 } from "node:fs";
@@ -31477,7 +32054,7 @@ import path114 from "node:path";
 // src/workspace/worktree/hydrate-lock.ts
 init_paths();
 import path112 from "node:path";
-import fs72 from "fs-extra";
+import fs73 from "fs-extra";
 var STALE_LOCK_MS = 30 * 60 * 1e3;
 function locksDir(mainRoot) {
   return hausPath(mainRoot, "locks");
@@ -31488,7 +32065,7 @@ function logsDir(mainRoot) {
 function assertSlug(slug) {
   if (!isValidWorktreeSlug(slug)) {
     throw new Error(
-      `Invalid worktree slug ${JSON.stringify(slug)} \u2014 slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
+      `Invalid worktree slug ${JSON.stringify(slug)}: slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
     );
   }
   return slug;
@@ -31512,7 +32089,7 @@ function defaultIsAlive2(pid) {
 }
 async function readOwnerPid(lockPath) {
   try {
-    const raw = (await fs72.readFile(path112.join(lockPath, "pid"), "utf8")).trim();
+    const raw = (await fs73.readFile(path112.join(lockPath, "pid"), "utf8")).trim();
     if (raw === "") return void 0;
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
@@ -31521,13 +32098,13 @@ async function readOwnerPid(lockPath) {
   }
 }
 async function claim(lockPath, pid) {
-  await fs72.ensureDir(path112.dirname(lockPath));
+  await fs73.ensureDir(path112.dirname(lockPath));
   try {
-    await fs72.mkdir(lockPath);
+    await fs73.mkdir(lockPath);
   } catch {
     return false;
   }
-  await fs72.writeFile(path112.join(lockPath, "pid"), String(pid), "utf8");
+  await fs73.writeFile(path112.join(lockPath, "pid"), String(pid), "utf8");
   return true;
 }
 async function acquireHydrateLock(mainRoot, slug, deps = {}) {
@@ -31546,7 +32123,7 @@ async function acquireHydrateLock(mainRoot, slug, deps = {}) {
     }
     if (alive) return { acquired: false, reason: "live", ownerPid, lockPath };
   } else {
-    const stat2 = await fs72.stat(lockPath).catch(() => void 0);
+    const stat2 = await fs73.stat(lockPath).catch(() => void 0);
     if (stat2 === void 0) {
       return await claim(lockPath, pid) ? { acquired: true, lockPath } : { acquired: false, reason: "live", lockPath };
     }
@@ -31554,18 +32131,18 @@ async function acquireHydrateLock(mainRoot, slug, deps = {}) {
       return { acquired: false, reason: "starting", lockPath };
     }
   }
-  await fs72.remove(lockPath);
+  await fs73.remove(lockPath);
   return await claim(lockPath, pid) ? { acquired: true, lockPath } : { acquired: false, reason: "live", ownerPid, lockPath };
 }
 async function recordHydrateLockOwner(mainRoot, slug, pid) {
-  await fs72.writeFile(path112.join(hydrateLockPath(mainRoot, slug), "pid"), String(pid), "utf8");
+  await fs73.writeFile(path112.join(hydrateLockPath(mainRoot, slug), "pid"), String(pid), "utf8");
 }
 async function releaseHydrateLock(mainRoot, slug) {
-  await fs72.remove(hydrateLockPath(mainRoot, slug));
+  await fs73.remove(hydrateLockPath(mainRoot, slug));
 }
 async function readHydrateLock(mainRoot, slug) {
   const lockPath = hydrateLockPath(mainRoot, slug);
-  const stat2 = await fs72.stat(lockPath).catch(() => void 0);
+  const stat2 = await fs73.stat(lockPath).catch(() => void 0);
   if (stat2 === void 0) return { held: false };
   const ownerPid = await readOwnerPid(lockPath);
   return {
@@ -31659,7 +32236,7 @@ async function runDoctor2() {
       members: [],
       orphans: [],
       problems: [
-        `Not a haus workspace \u2014 no ${WORKSPACE_FILE} or ${REPOS_MANIFEST_FILE} at ${workspaceRoot}.`
+        `Not a haus workspace: no ${WORKSPACE_FILE} or ${REPOS_MANIFEST_FILE} at ${workspaceRoot}.`
       ],
       remedies: [],
       autoHydrate: false,
@@ -31719,7 +32296,7 @@ async function runDoctor2() {
     }
     if (memberChecks.some((m) => !m.materialized)) {
       remedies.push(
-        hydrationInProgress ? `A hydration is already running for "${slug}"${hydrationOwnerPid !== void 0 ? ` (pid ${hydrationOwnerPid})` : ""} \u2014 wait for ${lock.held ? lock.lockPath : "the lock"} to disappear rather than starting another.` : "Run `haus workspace worktree hydrate --materialize` to materialize the missing members."
+        hydrationInProgress ? `A hydration is already running for "${slug}"${hydrationOwnerPid !== void 0 ? ` (pid ${hydrationOwnerPid})` : ""}. Wait for ${lock.held ? lock.lockPath : "the lock"} to disappear rather than starting another.` : "Run `haus workspace worktree hydrate --materialize` to materialize the missing members."
       );
     }
   }
@@ -31793,7 +32370,7 @@ async function runHydrateWorktree(opts) {
             member: member.id,
             folder: member.folder,
             status: "skipped",
-            error: "not materialized in this worktree \u2014 re-run with --materialize to create it"
+            error: "not materialized in this worktree. Re-run with --materialize to create it"
           };
         }
         const branchAction = await branchExists(member.absPath, targetBranch) ? "checkout" : "create";
@@ -31813,7 +32390,7 @@ async function runHydrateWorktree(opts) {
             member: member.id,
             folder: member.folder,
             status: "skipped",
-            error: "not materialized in this worktree \u2014 re-run with --materialize to create it"
+            error: "not materialized in this worktree. Re-run with --materialize to create it"
           };
         }
         const outcome = await addWorktree(member.absPath, memberPath2, targetBranch, {
@@ -31824,7 +32401,7 @@ async function runHydrateWorktree(opts) {
             member: member.id,
             folder: member.folder,
             status: "failed",
-            error: outcome.checkedOutElsewhere ? `Branch "${targetBranch}" is already checked out elsewhere in ${member.id} \u2014 remove that worktree or resolve the branch conflict first.` : outcome.stderr ?? "unknown error creating the member worktree"
+            error: outcome.checkedOutElsewhere ? `Branch "${targetBranch}" is already checked out elsewhere in ${member.id}. Remove that worktree or resolve the branch conflict first.` : outcome.stderr ?? "unknown error creating the member worktree"
           };
         }
         branchAction = outcome.branchAction;
@@ -31977,11 +32554,11 @@ async function consumeLastRunFailure(mainRoot, slug) {
   const file = hydrateLastRunPath(mainRoot, slug);
   let parsed;
   try {
-    parsed = JSON.parse(await fs73.readFile(file, "utf8"));
+    parsed = JSON.parse(await fs74.readFile(file, "utf8"));
   } catch {
     return void 0;
   }
-  await fs73.remove(file).catch(() => void 0);
+  await fs74.remove(file).catch(() => void 0);
   if (parsed && parsed.ok === false) return parsed;
   return void 0;
 }
@@ -32053,7 +32630,7 @@ async function runAutoHydrate(opts = {}, deps = {}) {
       reason: "could not determine the haus CLI entry point to re-invoke"
     };
   }
-  await fs73.ensureDir(logsDir(mainRoot));
+  await fs74.ensureDir(logsDir(mainRoot));
   appendLog(
     logPath,
     `autohydrate: forking hydrate --materialize for "${slug}" (${missingMembers.join(", ")})`
@@ -32105,7 +32682,7 @@ async function runDetachedHydration() {
     }
     const detail = "results" in result ? result.results : [];
     const failures = detail.filter((r) => r.status === "failed" || anyInstallFailed(r.hydration)).map(
-      (r) => r.status === "failed" ? `${r.member}: failed to materialize \u2014 ${r.error ?? "unknown error"}` : `${r.member}: materialized, but its install FAILED via ${failedManagers(r.hydration)}`
+      (r) => r.status === "failed" ? `${r.member}: failed to materialize: ${r.error ?? "unknown error"}` : `${r.member}: materialized, but its install FAILED via ${failedManagers(r.hydration)}`
     );
     await writeLastRun(mainRoot, slug, result.ok, failures);
     appendLog(logPath, `hydrate finished: ${result.ok ? "ok" : `FAILED (${failures.join("; ")})`}`);
@@ -32122,22 +32699,22 @@ async function runDetachedHydration() {
 async function writeLastRun(mainRoot, slug, ok2, failures) {
   const file = hydrateLastRunPath(mainRoot, slug);
   if (ok2) {
-    await fs73.remove(file).catch(() => void 0);
+    await fs74.remove(file).catch(() => void 0);
     return;
   }
   const record = { slug, finishedAt: (/* @__PURE__ */ new Date()).toISOString(), ok: ok2, failures };
-  await fs73.ensureDir(path117.dirname(file));
-  await fs73.writeJson(file, record, { spaces: 2 }).catch(() => void 0);
+  await fs74.ensureDir(path117.dirname(file));
+  await fs74.writeJson(file, record, { spaces: 2 }).catch(() => void 0);
 }
 
 // src/workspace/worktree/dematerialize.ts
 import { existsSync as existsSync17 } from "node:fs";
 import path121 from "node:path";
-import fs77 from "fs-extra";
+import fs78 from "fs-extra";
 
 // src/workspace/worktree/member-targets.ts
 import path118 from "node:path";
-import fs74 from "fs-extra";
+import fs75 from "fs-extra";
 function normalizeStateMembers(state, allMembers) {
   return state?.members.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath })) ?? allMembers.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath }));
 }
@@ -32162,15 +32739,15 @@ function resolveMemberTargets(wsWorktreePath, stateMembers, allMembers) {
 async function filterExistingTargets(targets) {
   const existing = [];
   for (const target of targets) {
-    if (await fs74.pathExists(target.path)) existing.push(target);
+    if (await fs75.pathExists(target.path)) existing.push(target);
   }
   return existing;
 }
 function unresolvedDroppedBlockerReason() {
-  return "no longer in the workspace config and this worktree predates absPath tracking \u2014 cannot verify for uncommitted work or unregister its git worktree; removing anyway will delete its directory here but leak the registration in whatever repo it came from (run `git worktree prune` there manually afterward)";
+  return "no longer in the workspace config and this worktree predates absPath tracking: cannot verify for uncommitted work or unregister its git worktree; removing anyway will delete its directory here but leak the registration in whatever repo it came from (run `git worktree prune` there manually afterward)";
 }
 function unresolvedDroppedFailureReason() {
-  return "directory removed, but its git worktree registration could not be unregistered (no recorded absPath) \u2014 run `git worktree prune` in its original owning repo";
+  return "directory removed, but its git worktree registration could not be unregistered (no recorded absPath); run `git worktree prune` in its original owning repo";
 }
 async function findWorkBlockers(targets, ignorePathsFor = () => [], envLinksFor = () => []) {
   const blockers = [];
@@ -32194,12 +32771,12 @@ async function findWorkBlockers(targets, ignorePathsFor = () => [], envLinksFor
 // src/workspace/worktree/remove.ts
 import { existsSync as existsSync16 } from "node:fs";
 import path120 from "node:path";
-import fs76 from "fs-extra";
+import fs77 from "fs-extra";
 
 // src/workspace/worktree/snapshot.ts
 import { realpathSync as realpathSync3 } from "node:fs";
 import path119 from "node:path";
-import fs75 from "fs-extra";
+import fs76 from "fs-extra";
 init_exec();
 init_paths();
 function pathspec(ignore) {
@@ -32213,7 +32790,7 @@ function samePath(a, b) {
   }
 }
 async function probeDirty(target) {
-  if (!await fs75.pathExists(target.path)) return { state: "not-a-worktree" };
+  if (!await fs76.pathExists(target.path)) return { state: "not-a-worktree" };
   const notOwnWorktree = (cause) => target.skipIfNotWorktree ? { state: "not-a-worktree" } : { state: "unknown", cause };
   const top = await runGit(["rev-parse", "--show-toplevel"], { cwd: target.path });
   if (top.exitCode !== 0) {
@@ -32270,9 +32847,9 @@ async function writeOne(target, dest) {
   const branch = (await gitOrThrow(["rev-parse", "--abbrev-ref", "HEAD"], target.path)).trim();
   const commit = (await gitOrThrow(["rev-parse", "HEAD"], target.path)).trim();
   const untracked = (await gitOrThrow(["ls-files", "--others", "--exclude-standard", "-z", ...spec], target.path)).split("\0").filter((entry) => entry.length > 0);
-  await fs75.ensureDir(dest);
-  await fs75.writeFile(path119.join(dest, "changes.patch"), patch);
-  await fs75.writeFile(
+  await fs76.ensureDir(dest);
+  await fs76.writeFile(path119.join(dest, "changes.patch"), patch);
+  await fs76.writeFile(
     path119.join(dest, "HEAD.txt"),
     `branch: ${branch}
 commit: ${commit}
@@ -32281,14 +32858,14 @@ worktree: ${target.path}
   );
   for (const rel of untracked) {
     const to = path119.join(dest, "untracked", rel);
-    await fs75.ensureDir(path119.dirname(to));
-    await fs75.copy(path119.join(target.path, rel), to, { dereference: false });
+    await fs76.ensureDir(path119.dirname(to));
+    await fs76.copy(path119.join(target.path, rel), to, { dereference: false });
   }
-  if (!(await fs75.readFile(path119.join(dest, "changes.patch"))).equals(patch)) {
+  if (!(await fs76.readFile(path119.join(dest, "changes.patch"))).equals(patch)) {
     throw new Error("changes.patch does not read back as written");
   }
   for (const rel of untracked) {
-    const copied = await fs75.lstat(path119.join(dest, "untracked", rel)).catch(() => void 0);
+    const copied = await fs76.lstat(path119.join(dest, "untracked", rel)).catch(() => void 0);
     if (!copied) throw new Error(`untracked/${rel} is missing from the snapshot`);
   }
 }
@@ -32303,7 +32880,7 @@ async function snapshotDirtyWorktrees(workspaceRoot, targets) {
     try {
       await writeOne(target, path119.join(abs, target.label));
     } catch (err) {
-      await fs75.remove(abs).catch(() => {
+      await fs76.remove(abs).catch(() => {
       });
       const message2 = err instanceof Error ? err.message : String(err);
       const fix = err instanceof GitStepError ? "fix that git error in the worktree and run again" : `fix the backup location (${dir}) and run again`;
@@ -32363,7 +32940,7 @@ async function runRemove2(opts, deps = {}) {
   if (!resolved.ok) return { ok: false, error: resolved.reason };
   const { rootInfo, workspaceRoot } = resolved;
   const wsWorktreePath = worktreePath(workspaceRoot, opts.slug);
-  if (!await fs76.pathExists(wsWorktreePath)) {
+  if (!await fs77.pathExists(wsWorktreePath)) {
     return { ok: false, error: `No workspace worktree found at ${wsWorktreePath}.` };
   }
   const state = await readWorktreeState(wsWorktreePath);
@@ -32443,8 +33020,8 @@ async function runRemove2(opts, deps = {}) {
     }
     await pruneWorktrees(workspaceRoot);
   }
-  if (wsRemoveOk && await fs76.pathExists(wsWorktreePath)) {
-    await fs76.remove(wsWorktreePath);
+  if (wsRemoveOk && await fs77.pathExists(wsWorktreePath)) {
+    await fs77.remove(wsWorktreePath);
   }
   return {
     ok: failed.length === 0,
@@ -32479,14 +33056,14 @@ async function runDematerialize(opts, deps = {}) {
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
-  if (!await fs77.pathExists(wsWorktreePath)) {
+  if (!await fs78.pathExists(wsWorktreePath)) {
     return { ok: false, error: `No workspace worktree found at ${wsWorktreePath}.` };
   }
   const lock = await readHydrateLock(workspaceRoot, slug);
   if (lock.held) {
     return {
       ok: false,
-      error: `A hydration is running for "${slug}"${lock.ownerPid !== void 0 ? ` (pid ${lock.ownerPid})` : ""} \u2014 wait for ${lock.lockPath} to disappear before dematerializing it.`
+      error: `A hydration is running for "${slug}"${lock.ownerPid !== void 0 ? ` (pid ${lock.ownerPid})` : ""}. Wait for ${lock.lockPath} to disappear before dematerializing it.`
     };
   }
   const state = await readWorktreeState(wsWorktreePath);
@@ -32539,8 +33116,8 @@ async function runDematerialize(opts, deps = {}) {
   }
   for (const folder of unresolvedDroppedMembers) {
     const droppedPath = path121.join(wsWorktreePath, folder);
-    if (await fs77.pathExists(droppedPath)) {
-      await fs77.remove(droppedPath);
+    if (await fs78.pathExists(droppedPath)) {
+      await fs78.remove(droppedPath);
       failed.push({ repo: folder, error: unresolvedDroppedFailureReason() });
     }
   }
@@ -32563,14 +33140,14 @@ async function runDematerialize(opts, deps = {}) {
 
 // src/workspace/worktree/list.ts
 import path122 from "node:path";
-import fs78 from "fs-extra";
+import fs79 from "fs-extra";
 async function runList2() {
   const resolved = await resolveWorkspaceForWorktree();
   if (!resolved.ok) return { ok: false, error: resolved.reason };
   const { rootInfo, workspaceRoot } = resolved;
   const dir = worktreesDir(workspaceRoot);
-  if (!await fs78.pathExists(dir)) return { ok: true, workspaceRoot, worktrees: [] };
-  const entries = await fs78.readdir(dir, { withFileTypes: true });
+  if (!await fs79.pathExists(dir)) return { ok: true, workspaceRoot, worktrees: [] };
+  const entries = await fs79.readdir(dir, { withFileTypes: true });
   const slugs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
   const configuredMembers = await readMembers(rootInfo);
   const worktrees = [];
@@ -32581,7 +33158,7 @@ async function runList2() {
     const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
     for (const m of source) {
       const memberPath2 = path122.join(wtPath, m.folder);
-      const materialized = await fs78.pathExists(memberPath2);
+      const materialized = await fs79.pathExists(memberPath2);
       const actualBranch = materialized ? await currentBranch(memberPath2) : void 0;
       members.push({
         id: m.id,
@@ -32604,12 +33181,12 @@ async function runList2() {
 // src/workspace/worktree/reclaim.ts
 import { existsSync as existsSync18 } from "node:fs";
 import path123 from "node:path";
-import fs79 from "fs-extra";
+import fs80 from "fs-extra";
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
 async function lastTouchedMs(worktreeRoot) {
   const candidates = [worktreeRoot, path123.join(worktreeRoot, ".haus-worktree.json")];
   try {
-    const dotGit = await fs79.readFile(path123.join(worktreeRoot, ".git"), "utf8");
+    const dotGit = await fs80.readFile(path123.join(worktreeRoot, ".git"), "utf8");
     const match = /^gitdir:\s*(.+)$/m.exec(dotGit);
     if (match?.[1]) {
       const gitdir = match[1].trim();
@@ -32619,7 +33196,7 @@ async function lastTouchedMs(worktreeRoot) {
   }
   let newest = 0;
   for (const candidate of candidates) {
-    const stat2 = await fs79.stat(candidate).catch(() => void 0);
+    const stat2 = await fs80.stat(candidate).catch(() => void 0);
     if (stat2 && stat2.mtimeMs > newest) newest = stat2.mtimeMs;
   }
   return newest;
@@ -32646,7 +33223,7 @@ async function runReclaim(opts = {}, deps = {}) {
   if (!existsSync18(dir)) {
     return { ok: true, dryRun: !opts.write, olderThanDays, candidates: [], reclaimed: 0 };
   }
-  const allEntries = (await fs79.readdir(dir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  const allEntries = (await fs80.readdir(dir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name).sort();
   const entries = allEntries.filter((name) => isValidWorktreeSlug(name));
   const unaddressable = allEntries.filter((name) => !isValidWorktreeSlug(name));
   const members = await readMembers(rootInfo);
@@ -32659,7 +33236,7 @@ async function runReclaim(opts = {}, deps = {}) {
       ageDays: (Date.now() - await lastTouchedMs(path123.join(dir, name))) / MS_PER_DAY,
       materializedMembers: 0,
       action: "skip",
-      reason: "directory name is not a valid worktree slug \u2014 no haus worktree command can address it; remove it by hand if it is debris"
+      reason: "directory name is not a valid worktree slug: no haus worktree command can address it; remove it by hand if it is debris"
     });
   }
   for (const slug of entries) {
@@ -32812,10 +33389,10 @@ async function handleAdd(opts) {
       const hydrationNote = m.hydration ? describeInstall(m.hydration) : "not hydrated (--no-hydrate)";
       emitMemberLine(
         m.hydration,
-        `  ${m.member}: ${m.branchAction} "${m.branch}" \u2014 ${hydrationNote} (${m.durationMs}ms)`
+        `  ${m.member}: ${m.branchAction} "${m.branch}": ${hydrationNote} (${m.durationMs}ms)`
       );
     } else {
-      warn(`  ${m.member}: FAILED \u2014 ${m.error}`);
+      warn(`  ${m.member}: FAILED: ${m.error}`);
     }
   }
   if (!result.ok) {
@@ -32862,7 +33439,7 @@ async function handleHydrate(opts) {
         warn(`  ${refusedTargetLine(r.member, refused)}`);
       }
     } else {
-      warn(`  ${r.member}: ${r.status}${r.error ? ` \u2014 ${r.error}` : ""}`);
+      warn(`  ${r.member}: ${r.status}${r.error ? `: ${r.error}` : ""}`);
     }
   }
   if (!result.ok) {
@@ -32902,7 +33479,7 @@ async function handleRemove(opts) {
     return;
   }
   if (!result.ok && "blocked" in result && result.blocked) {
-    error(`Refusing to remove "${opts.slug}" \u2014 uncommitted or unpushed work found:`);
+    error(`Refusing to remove "${opts.slug}": uncommitted or unpushed work found:`);
     for (const b of result.blockers) error(`  ${b.repo}: ${b.reason}`);
     error("Re-run with --force to remove anyway.");
     process.exitCode = 1;
@@ -32961,7 +33538,7 @@ function pruneLines(r) {
   const left = r.orphans.filter((o) => !r.removed.includes(o));
   if (left.length > 0) {
     const label = r.error === STILL_REGISTERED_ERROR ? "Not pruned" : "FAILED to prune";
-    const detail = r.error ? ` \u2014 ${r.error}` : "";
+    const detail = r.error ? `: ${r.error}` : "";
     lines.push(`${label} ${r.repo}: ${left.join(", ")}${detail}`);
   }
   return lines;
@@ -33053,7 +33630,7 @@ function describeAutoHydrate(result) {
   switch (result.status) {
     case "started":
       lines.push(
-        `The member repos are missing in this worktree and are being hydrated in the background now (${result.missingMembers?.join(", ")}). This takes minutes, not seconds. Wait until ${result.lockPath} disappears before reading any file in a member repo \u2014 \`haus workspace worktree doctor\` turns green before the work is finished. Log: ${result.logPath}`
+        `The member repos are missing in this worktree and are being hydrated in the background now (${result.missingMembers?.join(", ")}). This takes minutes, not seconds. Wait until ${result.lockPath} disappears before reading any file in a member repo: \`haus workspace worktree doctor\` turns green before the work is finished. Log: ${result.logPath}`
       );
       break;
     case "in-progress":
@@ -33129,7 +33706,7 @@ async function handleDematerialize(opts) {
     return;
   }
   if (!result.ok && "blocked" in result) {
-    error(`Refusing to dematerialize "${result.slug}" \u2014 uncommitted or unpushed work found:`);
+    error(`Refusing to dematerialize "${result.slug}": uncommitted or unpushed work found:`);
     for (const b of result.blockers) error(`  ${b.repo}: ${b.reason}`);
     error("Re-run with --force to dematerialize anyway.");
     process.exitCode = 1;
@@ -33150,7 +33727,7 @@ async function handleDematerialize(opts) {
     if (result.backup) log(snapshotLine(result.backup));
     logEnvironment(result.environment);
     log(
-      `Dematerialized "${result.slug}": ${result.removed.join(", ") || "(nothing)"}. The workspace worktree and its branch are untouched \u2014 run \`haus workspace worktree hydrate --materialize\` to bring the members back.`
+      `Dematerialized "${result.slug}": ${result.removed.join(", ") || "(nothing)"}. The workspace worktree and its branch are untouched. Run \`haus workspace worktree hydrate --materialize\` to bring the members back.`
     );
     if (result.failed.length > 0) {
       for (const f of result.failed) error(`  Failed to dematerialize ${f.repo}: ${f.error}`);
@@ -33190,14 +33767,14 @@ async function handleReclaim(opts) {
         );
         break;
       case "blocked":
-        warn(`Blocked ${c.slug} (${age}) \u2014 uncommitted or unpushed work:`);
+        warn(`Blocked ${c.slug} (${age}): uncommitted or unpushed work:`);
         for (const b of c.blockers ?? []) warn(`  ${b.repo}: ${b.reason}`);
         break;
       case "failed":
         error(`FAILED ${c.slug} (${age}): ${c.reason ?? "unknown error"}`);
         break;
       case "skip":
-        log(`Keeping ${c.slug} (${age}) \u2014 ${c.reason ?? "not a candidate"}`);
+        log(`Keeping ${c.slug} (${age}): ${c.reason ?? "not a candidate"}`);
         break;
     }
   }
@@ -33476,17 +34053,17 @@ init_paths();
 // src/workspace/link-context/copy-record.ts
 import os13 from "node:os";
 import path127 from "node:path";
-import fs80 from "fs-extra";
+import fs81 from "fs-extra";
 init_fs();
 init_paths();
 async function copyWithoutLinks(source, dest) {
-  await fs80.copy(source, dest, {
+  await fs81.copy(source, dest, {
     overwrite: true,
     errorOnExist: false,
     dereference: false,
     filter: (s) => {
       try {
-        return !fs80.lstatSync(s).isSymbolicLink();
+        return !fs81.lstatSync(s).isSymbolicLink();
       } catch {
         return false;
       }
@@ -33494,11 +34071,11 @@ async function copyWithoutLinks(source, dest) {
   });
 }
 async function withStage(fn) {
-  const stage = await fs80.mkdtemp(path127.join(os13.tmpdir(), "haus-staged-link-"));
+  const stage = await fs81.mkdtemp(path127.join(os13.tmpdir(), "haus-staged-link-"));
   try {
     return await fn(stage);
   } finally {
-    await fs80.remove(stage);
+    await fs81.remove(stage);
   }
 }
 async function stagedCopyHash(sourceAbs, destRel) {
@@ -33516,7 +34093,7 @@ async function recordedCopyHash(workspaceRoot, entry) {
   const rel = recordedRel(entry.path);
   if (await unsafeTrackedPath(workspaceRoot, rel) !== null) return void 0;
   const copyAbs = path127.resolve(workspaceRoot, rel);
-  if (!await fs80.pathExists(copyAbs)) return void 0;
+  if (!await fs81.pathExists(copyAbs)) return void 0;
   if (!await holdsOnlyPlainFiles(copyAbs)) return void 0;
   const sourceRel = entry.sourceRelPath.replace(/\\/g, "/");
   const staged = await withStage(async (stage) => {
@@ -33542,7 +34119,10 @@ var EDITED_COPY_REASON = {
 };
 var UNSAFE_PATH_LINE = {
   "escapes-root": (rel) => `Refusing to remove linked context path outside the workspace root: ${rel}`,
-  symlink: (rel) => `Refusing to remove linked context path through a symlink: ${rel}`
+  symlink: (rel) => `Refusing to remove linked context path through a symlink: ${rel}`,
+  // A copy lands below the workspace root's `.claude/` only, so an entry naming anything else
+  // was edited by hand (#758): its path is left, and so is the entry.
+  "outside-install-root": (rel) => `Refusing to remove linked context path ${rel}: haus never copies there (only into a copy's own path below .claude/), so it leaves it. Delete the entry from .haus-workflow/workspace.manifest.json by hand.`
 };
 async function removeLinkedCopies(workspaceRoot, entries, opts, say) {
   const result = {
@@ -33804,7 +34384,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     flag({
       repo: "(workspace)",
       kind: "no-config",
-      detail: "Missing or malformed haus.workspace.yaml \u2014 run `haus workspace discover --write` or `init`."
+      detail: "Missing or malformed haus.workspace.yaml. Run `haus workspace discover --write` or `init`."
     });
     return report2();
   }
@@ -33831,7 +34411,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     flag({
       repo: "(workspace)",
       kind: "no-manifest",
-      detail: "No workspace.manifest.json \u2014 run `haus workspace setup --write` first."
+      detail: "No workspace.manifest.json. Run `haus workspace setup --write` first."
     });
     return report2();
   }
@@ -33839,7 +34419,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     flag({
       repo: "(workspace)",
       kind: "no-manifest",
-      detail: 'workspace.manifest.json\'s "repos" field is not an array \u2014 run `haus workspace setup --write` to regenerate it.'
+      detail: 'workspace.manifest.json\'s "repos" field is not an array. Run `haus workspace setup --write` to regenerate it.'
     });
     return report2();
   }
@@ -33852,7 +34432,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
       flag({
         repo: repo.name,
         kind: "missing-from-manifest",
-        detail: "Configured in yaml but absent from the manifest \u2014 run `haus workspace setup --write`."
+        detail: "Configured in yaml but absent from the manifest. Run `haus workspace setup --write`."
       });
       continue;
     }
@@ -33868,14 +34448,14 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
       flag({
         repo: repo.name,
         kind: "version-mismatch",
-        detail: `Set up at haus ${entry.hausVersionAtSetup}, current is ${currentVersion} \u2014 re-run setup.`
+        detail: `Set up at haus ${entry.hausVersionAtSetup}, current is ${currentVersion}. Re-run setup.`
       });
     }
     if (!existsSync19(claudePath(repoRoot))) {
       flag({
         repo: repo.name,
         kind: "missing-claude",
-        detail: "Missing .claude/ \u2014 run `haus workspace setup --write`."
+        detail: "Missing .claude/. Run `haus workspace setup --write`."
       });
     }
     const lock = await checkLock(repoRoot);
@@ -33888,7 +34468,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
       flag({
         repo: repo.name,
         kind: "missing-lock",
-        detail: "Missing .haus-workflow/haus.lock.json \u2014 run `haus workspace setup --write`."
+        detail: "Missing .haus-workflow/haus.lock.json. Run `haus workspace setup --write`."
       });
     } else if (lock.count > 0 && !lock.ok) {
       flag({ repo: repo.name, kind: "invalid-lock", detail: describeUnhealthyLock(lock) });
@@ -33902,7 +34482,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     flag({
       repo: "(workspace)",
       kind: "catalog-ref-mismatch",
-      detail: `Repos are on different catalog refs \u2014 ${catalogRefByRepo.map((r) => `${r.repo}: ${r.ref}`).join(", ")}. Run \`haus workspace setup --write\` to bring them onto the same ref.`
+      detail: `Repos are on different catalog refs: ${catalogRefByRepo.map((r) => `${r.repo}: ${r.ref}`).join(", ")}. Run \`haus workspace setup --write\` to bring them onto the same ref.`
     });
   }
   if (manifest.linkedContext && manifest.linkedContext.length > 0) {
@@ -34070,7 +34650,7 @@ function describeUnhealthyLock(lock) {
     );
   }
   if (parts.length === 0) {
-    return "haus.lock.json present but invalid (e.g. a malformed version) \u2014 re-run `haus workspace setup --write`.";
+    return "haus.lock.json present but invalid (e.g. a malformed version). Re-run `haus workspace setup --write`.";
   }
   return `haus.lock.json: ${parts.join("; ")}.`;
 }
@@ -34081,7 +34661,7 @@ init_logger();
 // src/workspace/link-context/link.ts
 import { rm } from "node:fs/promises";
 import path132 from "node:path";
-import fs82 from "fs-extra";
+import fs83 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -34091,7 +34671,7 @@ import path131 from "node:path";
 
 // src/workspace/link-context/scan-source.ts
 import path130 from "node:path";
-import fs81 from "fs-extra";
+import fs82 from "fs-extra";
 var ASSET_SUBDIR = {
   skill: "skills",
   agent: "agents",
@@ -34099,7 +34679,7 @@ var ASSET_SUBDIR = {
 };
 async function sourceExists(abs) {
   try {
-    await fs81.stat(abs);
+    await fs82.stat(abs);
     return true;
   } catch (err) {
     const code2 = err.code;
@@ -34116,11 +34696,11 @@ async function hasLinkableContext(member) {
 async function collectSkills(member) {
   const dir = path130.join(member.absPath, ".claude", "skills");
   if (!await sourceExists(dir)) return [];
-  const names4 = await fs81.readdir(dir);
+  const names4 = await fs82.readdir(dir);
   const out = [];
   for (const name of [...names4].sort()) {
     const abs = path130.join(dir, name);
-    const stat2 = await fs81.lstat(abs);
+    const stat2 = await fs82.lstat(abs);
     if (!stat2.isDirectory()) continue;
     if (!await sourceExists(path130.join(abs, "SKILL.md"))) continue;
     out.push({ type: "skill", name, sourceRelPath: path130.posix.join(".claude", "skills", name) });
@@ -34131,12 +34711,12 @@ async function collectFlatMarkdown(member, type) {
   const subdir = ASSET_SUBDIR[type];
   const dir = path130.join(member.absPath, ".claude", subdir);
   if (!await sourceExists(dir)) return [];
-  const names4 = await fs81.readdir(dir);
+  const names4 = await fs82.readdir(dir);
   const out = [];
   for (const fileName of [...names4].sort()) {
     if (!fileName.endsWith(".md")) continue;
     const abs = path130.join(dir, fileName);
-    if (!(await fs81.lstat(abs)).isFile()) continue;
+    if (!(await fs82.lstat(abs)).isFile()) continue;
     const name = fileName.slice(0, -".md".length);
     out.push({ type, name, sourceRelPath: path130.posix.join(".claude", subdir, fileName) });
   }
@@ -34265,7 +34845,7 @@ async function runLinkContext(workspaceRoot, opts = {}) {
     const detail = plan.collisions.map((c) => `${c.type} "${c.destKey}" claimed by: ${c.repos.join(", ")}`).join("; ");
     return {
       ok: false,
-      error: `Name collision(s) after the repo-folder prefix \u2014 refusing to overwrite either copy. Rename one of the conflicting repos' folders (in haus.workspace.yaml/repos.manifest.json) or the conflicting skill/agent/command itself to resolve: ${detail}`,
+      error: `Name collision(s) after the repo-folder prefix, refusing to overwrite either copy. Rename one of the conflicting repos' folders (in haus.workspace.yaml/repos.manifest.json) or the conflicting skill/agent/command itself to resolve: ${detail}`,
       collisions: plan.collisions,
       refusedFiles: []
     };
@@ -34499,8 +35079,8 @@ async function swapInCopy(workspaceRoot, sourceAbs, destRel) {
   const destAbs = path132.join(workspaceRoot, destRel);
   let folder;
   try {
-    await fs82.ensureDir(path132.dirname(destAbs));
-    folder = await fs82.mkdtemp(path132.join(path132.dirname(destAbs), STAGING_PREFIX));
+    await fs83.ensureDir(path132.dirname(destAbs));
+    folder = await fs83.mkdtemp(path132.join(path132.dirname(destAbs), STAGING_PREFIX));
   } catch (err) {
     return { failure: messageOf(err) };
   }
@@ -34519,13 +35099,13 @@ async function swapInCopy(workspaceRoot, sourceAbs, destRel) {
     }
     if (recordFailure === void 0) {
       const hadOld = await isOnDisk2(destAbs);
-      if (hadOld) await fs82.rename(destAbs, aside);
+      if (hadOld) await fs83.rename(destAbs, aside);
       try {
-        await fs82.rename(staged, destAbs);
+        await fs83.rename(staged, destAbs);
       } catch (err) {
         if (hadOld) {
           try {
-            await fs82.rename(aside, destAbs);
+            await fs83.rename(aside, destAbs);
           } catch (back) {
             return {
               failure: `${messageOf(err)}; putting the old copy back failed too (${messageOf(back)})`,
@@ -34549,7 +35129,7 @@ async function swapInCopy(workspaceRoot, sourceAbs, destRel) {
 }
 async function isOnDisk2(abs) {
   try {
-    await fs82.lstat(abs);
+    await fs83.lstat(abs);
     return true;
   } catch (err) {
     const code2 = err.code;
@@ -34688,7 +35268,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       continue;
     }
     if (!res.setupOk) {
-      const catalogReason = !res.catalogInstallOk ? "No catalog items were installed for this repo (zero installable content) \u2014 see the per-repo output above, or re-run with --allow-empty-cache." : void 0;
+      const catalogReason = !res.catalogInstallOk ? "No catalog items were installed for this repo (zero installable content). See the per-repo output above, or re-run with --allow-empty-cache." : void 0;
       const reasons = [
         ...catalogReason === void 0 ? [] : [catalogReason],
         ...res.refusals ?? []
@@ -34844,7 +35424,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     const manifest = buildManifest2({
       client: config.client,
       repos: manifestRepos,
-      // buildManifest rebuilds the manifest from scratch each run — carry the prior
+      // buildManifest rebuilds the manifest from scratch each run, carry the prior
       // `linkedContext` section forward so a plain `setup --write` never silently
       // drops entries `link-context` wrote on an earlier run.
       linkedContext: prior?.linkedContext
@@ -34935,7 +35515,7 @@ async function linkContextStep(workspaceRoot, json, written, say) {
 // src/commands/workspace/undo.ts
 import { existsSync as existsSync21, statSync as statSync2 } from "node:fs";
 import path134 from "node:path";
-import fs83 from "fs-extra";
+import fs84 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -35015,7 +35595,7 @@ async function planWorkspaceRoot(workspaceRoot, config) {
   const aggregates = [];
   for (const name of WORKSPACE_AGGREGATE_FILES) {
     const abs = hausPath(workspaceRoot, name);
-    if (await fs83.pathExists(abs)) aggregates.push({ abs, rel: `.haus-workflow/${name}` });
+    if (await fs84.pathExists(abs)) aggregates.push({ abs, rel: `.haus-workflow/${name}` });
   }
   if (manifestRead.status === "refused") {
     return {
@@ -35088,7 +35668,7 @@ async function settleManifest(workspaceRoot, kept, dryRun) {
       log(`[dry-run] would remove ${WORKSPACE_MANIFEST_FILE}`);
       return false;
     }
-    await fs83.remove(manifestPath(workspaceRoot));
+    await fs84.remove(manifestPath(workspaceRoot));
     log(`Removed ${WORKSPACE_MANIFEST_FILE}`);
     return false;
   }
@@ -35174,11 +35754,11 @@ async function undoWorkspaceRoot(plan, workspaceRoot, force) {
   );
   if (removal.exitCode === 1) owesExit = true;
   for (const { abs, rel } of plan.aggregates) {
-    await fs83.remove(abs);
+    await fs84.remove(abs);
     log(`Removed ${rel}`);
   }
   if (docGoes) {
-    await fs83.remove(docFile.abs);
+    await fs84.remove(docFile.abs);
     log(
       doc.kind === "kept" ? `Removed ${WORKSPACE_DOC_FILE} (${doc.reason}; removed with --force)` : `Removed ${WORKSPACE_DOC_FILE}`
     );
@@ -35186,10 +35766,10 @@ async function undoWorkspaceRoot(plan, workspaceRoot, force) {
   if (strip !== null) {
     const what = strip.legacy ? "pre-upgrade workspace haus import block" : "workspace haus import block";
     if (strip.remaining.length === 0) {
-      await fs83.remove(claudeMd.abs);
+      await fs84.remove(claudeMd.abs);
       log(`Removed CLAUDE.md (only contained the ${what}).`);
     } else {
-      await fs83.writeFile(claudeMd.abs, strip.remaining, "utf8");
+      await fs84.writeFile(claudeMd.abs, strip.remaining, "utf8");
       log(
         strip.legacy ? "Removed pre-upgrade workspace haus import block from CLAUDE.md (user content preserved)." : "Removed haus import block from CLAUDE.md (user content preserved)."
       );
@@ -35552,7 +36132,7 @@ catalogBundle.command("import <file>").description("Unpack a catalog bundle into
 );
 program.command("update").description("Sync the remote catalog cache, refresh the lockfile, and check for CLI updates").option("--check").option("--fast", "With --check, skip per-item content hashing (cheap count+ref only)").option("--from-hook", "Emit JSON for the Claude Code SessionStart hook (silent if up to date)").action(runUpdate);
 program.command("ci-gate").description(
-  "Aggregate `doctor` + `decisions check` + `update --check --fast` into one pass/fail gate for CI. Uses the fast/cheap update-check tier (no per-item content hashing) to keep CI runs quick \u2014 run `haus update --check` directly for the fully-hashed tier. Each constituent command remains independently runnable with its own unchanged exit-code contract."
+  "Aggregate `doctor` + `decisions check` + `update --check --fast` into one pass/fail gate for CI. Uses the fast/cheap update-check tier (no per-item content hashing) to keep CI runs quick. Run `haus update --check` directly for the fully-hashed tier. Each constituent command remains independently runnable with its own unchanged exit-code contract."
 ).option("--json", "Emit machine-readable {doctor, decisions, update, ok}").option(
   "--no-update",
   "Skip the catalog leg (update --check), which needs the network; the Lefthook gate uses it"
@@ -35683,7 +36263,7 @@ worktree.command("prune").description(
 );
 worktree.command("autohydrate").description(
   "Materialize + hydrate this worktree's missing member repos in the background when `worktree.autoHydrate` is enabled (the acting half of the flag; see ADR-0074)"
-).option("--from-hook", "Emit for the SessionStart hook \u2014 always exits 0").option("--dry-run", "Report what would be hydrated without forking anything").option("--json", "Emit the structured autohydrate result as JSON").addOption(new Option("--detached-child", "internal: run the forked hydration").hideHelp()).action(
+).option("--from-hook", "Emit for the SessionStart hook (always exits 0)").option("--dry-run", "Report what would be hydrated without forking anything").option("--json", "Emit the structured autohydrate result as JSON").addOption(new Option("--detached-child", "internal: run the forked hydration").hideHelp()).action(
   (opts) => runWorktree("autohydrate", {
     fromHook: opts.fromHook,
     dryRun: opts.dryRun,
@@ -35702,7 +36282,7 @@ worktree.command("dematerialize [slug]").description(
   })
 );
 worktree.command("reclaim").description(
-  "Dematerialize workspace worktrees untouched for longer than `worktree.reclaimAfterDays` \u2014 previews unless --write (ADR-0075)"
+  "Dematerialize workspace worktrees untouched for longer than `worktree.reclaimAfterDays`; previews unless --write (ADR-0075)"
 ).option("--older-than-days <n>", "Override worktree.reclaimAfterDays", Number.parseFloat).option("--write", "Perform the reclamation (default previews only)").option("--json", "Emit the structured reclaim result as JSON").action(
   (opts) => runWorktree("reclaim", {
     olderThanDays: opts.olderThanDays,
@@ -35710,7 +36290,7 @@ worktree.command("reclaim").description(
     json: opts.json
   })
 );
-worktree.command("doctor").description("Fast, side-effect-free health check for the current workspace worktree").option("--from-hook", "Emit for the SessionStart hook \u2014 always exits 0").action((opts) => runWorktree("doctor", { fromHook: opts.fromHook }));
+worktree.command("doctor").description("Fast, side-effect-free health check for the current workspace worktree").option("--from-hook", "Emit for the SessionStart hook (always exits 0)").action((opts) => runWorktree("doctor", { fromHook: opts.fromHook }));
 var worktreeEnv = worktree.command("env").description(
   "Per-worktree local environment from localdev.yml's `instance:` section: own ports, databases, Redis index, index prefix and site (ADR-0163; enabled by `worktree.env: true`)"
 );