@inerrata-corporation/errata 2.0.16-dev.3355 → 2.0.16

package/errata.mjs

@@ -139,7 +139,6 @@ var init_castalia = __esm({
     ROUTING_REASONS = [
       /** Harness org (CTF lane, e2e battery, canary) — forced org-private. */
       "harness-clamp",
-      "witnessed-vulnerability-private",
       /** A signed gateway write target named the destination. */
       "signed-target-public",
       "signed-target-org",
@@ -960,7 +959,7 @@ function lemma(token) {
   }
   return token;
 }
-function tokenize(text, resolve7) {
+function tokenize(text, resolve8) {
   const matches = text.normalize("NFC").toLowerCase().match(TOKEN_RE) ?? [];
   const out2 = /* @__PURE__ */ new Set();
   for (const raw2 of matches) {
@@ -970,7 +969,7 @@ function tokenize(text, resolve7) {
       out2.add(token);
       continue;
     }
-    const canonical = resolve7(token);
+    const canonical = resolve8(token);
     out2.add(canonical ?? lemma(token));
   }
   return [...out2].sort();
@@ -1081,12 +1080,6 @@ function identityId(input) {
     }
     case "Claim":
       return canonicalClaimId(input.text, input.scope);
-    case "WitnessedVulnerability":
-      return genericCanonicalId("dvuln", {
-        workspaceId: input.workspaceId,
-        target: input.target.replace(/\\/g, "/").replace(/^\.\//, ""),
-        statement: canonicalClaimId(input.statement.trim())
-      });
     case "DesignProblem":
       return `${DESIGN_PROBLEM_PREFIX}${canonicalClaimId(input.statement.trim())}`.slice(
         0,
@@ -15856,7 +15849,7 @@ var init_edge_rules = __esm({
       // anchor anything at anything, e.g. at a public `Package`, quietly re-creating
       // the code↔collective bridge the membrane exists to prevent.
       ANCHORED_AT: {
-        from: ["Problem", "Vulnerability", "Solution", "RootCause", "Claim"],
+        from: ["Problem", "Solution", "RootCause", "Claim"],
         to: ["Symbol"]
       },
       // ── Security spine (v1 taxonomy.ts SECURITY_FORWARD_ONLY commentary) ──
@@ -15901,7 +15894,7 @@ var init_edge_rules = __esm({
       // `Component` joined the target set with OM-agent-anchors: an agent-named
       // component ("React Router") is the same knowledge→named-unit anchor shape as
       // a Tool — the knowledge is ABOUT it, not dependent on it.
-      CONCERNS: { from: ["Problem", "Vulnerability", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
+      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
       OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
       INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
       // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
@@ -17574,7 +17567,7 @@ var init_agents_md = __esm({
 });
 
 // ../../packages/context-writer/src/context-file.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join } from "node:path";
 function contextFilePath(root) {
   return join(root, ".errata", "context.md");
@@ -17584,7 +17577,13 @@ function writeContextFile(root, body2) {
   mkdirSync(dirname2(path2), { recursive: true });
   const text = `${body2.trim()}
 `;
-  writeFileSync2(path2, text, "utf8");
+  const temp = `${path2}.${process.pid}.tmp`;
+  try {
+    writeFileSync2(temp, text, { encoding: "utf8", mode: 384 });
+    renameSync(temp, path2);
+  } finally {
+    if (existsSync2(temp)) unlinkSync(temp);
+  }
   return contextHash(text);
 }
 function contextHash(body2) {
@@ -18275,8 +18274,7 @@ CREATE INDEX IF NOT EXISTS nodes_live ON nodes(label, valid_to);
 -- its table row. Partial, so it maintains a few thousand rows instead of adding
 -- a write to every node write. Its label list is FINGERPRINT_INDEXED_LABELS.
 DROP INDEX IF EXISTS nodes_live_fingerprint;
-DROP INDEX IF EXISTS nodes_instance_fingerprint;
-CREATE INDEX IF NOT EXISTS nodes_instance_fingerprint_v2 ON nodes(label, last_updated_at, last_reinforced_at_seq, created_at_seq) WHERE valid_to IS NULL AND label IN ('Problem','Vulnerability','Solution','RootCause');
+CREATE INDEX IF NOT EXISTS nodes_instance_fingerprint ON nodes(label, last_updated_at, last_reinforced_at_seq, created_at_seq) WHERE valid_to IS NULL AND label IN ('Problem','Solution','RootCause');
 CREATE INDEX IF NOT EXISTS nodes_logical ON nodes(logical_id, version);
 CREATE INDEX IF NOT EXISTS edges_live ON edges(valid_to);
 -- Expression index on the per-node relPath (stored in attrs_json) so the
@@ -18290,7 +18288,7 @@ CREATE INDEX IF NOT EXISTS nodes_live_description ON nodes(description, label) W
 -- every edited file of every turn, and a scan parses every Problem's attrs.
 CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_json, '$.anchorHint.path')) WHERE valid_to IS NULL;
 `;
-    FINGERPRINT_INDEXED_LABELS = ["Problem", "Vulnerability", "Solution", "RootCause"];
+    FINGERPRINT_INDEXED_LABELS = ["Problem", "Solution", "RootCause"];
     SqliteGraphStore = class {
       db;
       // Typed edge lookups build their SQL from the number of types asked for, and
@@ -18968,8 +18966,8 @@ CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_js
           const r2 = this.db.prepare(
             `SELECT COUNT(*) AS n, MAX(last_updated_at) AS t,
                   MAX(COALESCE(last_reinforced_at_seq, created_at_seq, 0)) AS s
-             FROM nodes INDEXED BY nodes_instance_fingerprint_v2
-            WHERE valid_to IS NULL AND label IN ('Problem','Vulnerability','Solution','RootCause')`
+             FROM nodes INDEXED BY nodes_instance_fingerprint
+            WHERE valid_to IS NULL AND label IN ('Problem','Solution','RootCause')`
           ).get();
           return `${r2.n}:${r2.t ?? 0}:${r2.s ?? 0}`;
         }
@@ -20265,7 +20263,7 @@ function mergeContextEdge(store, from, to, type, ts) {
 function deriveContextFromAnchors(store, problemId, ts, pkgIndex) {
   const report = { languages: [], packages: [] };
   const p = store.getNode(problemId);
-  if (!p || p.label !== "Problem" && p.label !== "Vulnerability") return report;
+  if (!p || p.label !== "Problem") return report;
   const files = store.outEdges(problemId, ["ANCHORED_AT"]).map((e) => store.getNode(e.to)).filter((n) => !!n && n.label === "File");
   if (files.length === 0) return report;
   const idx = pkgIndex ?? buildPackageIndex(store);
@@ -20903,81 +20901,6 @@ function ingestDesignProblem(store, flag, opts) {
     ...reopenedFromRegression ? { reopenedFromRegression } : {}
   };
 }
-function ingestWitnessedVulnerability(store, flag, opts) {
-  const statement = flag.statement.trim();
-  if (isPlaceholderStatement(statement)) return { id: "", created: false, corroborated: false, upgraded: false, rejected: "statement" };
-  const target = flag.target?.trim().replace(/\\/g, "/").replace(/^\.\//, "") ?? "";
-  const file2 = target ? resolveFileNode(store, target, opts.workspaceId) : null;
-  const symbol2 = file2 && flag.line !== void 0 && flag.fileText !== void 0 ? resolveEnclosingSymbol(store, file2.id, flag.line, flag.fileText) : null;
-  const identityTarget = symbol2 ? String(symbol2.attrs["logicalId"] ?? `${target}#${symbol2.attrs["qname"] ?? symbol2.description}`) : target;
-  const compatibleTarget = (n) => !symbol2 || !n.attrs["identityTarget"] || n.attrs["identityTarget"] === target || n.attrs["identityTarget"] === identityTarget;
-  const bound = flag.existingId ? store.getNode(flag.existingId) : null;
-  if (flag.existingId && (!bound || bound.label !== "Vulnerability" || bound.attrs["workspaceId"] !== opts.workspaceId || target && bound.attrs["affectedTarget"] && bound.attrs["affectedTarget"] !== target || !compatibleTarget(bound))) {
-    return { id: "", created: false, corroborated: false, upgraded: false, rejected: "binding-conflict" };
-  }
-  const statementKey = identityId({ kind: "DesignProblem", statement });
-  const restated = bound ? null : store.findNodesByLabel("Vulnerability").find((n) => n.attrs["workspaceId"] === opts.workspaceId && n.attrs["affectedTarget"] === target && compatibleTarget(n) && [n.description, ...n.attrs["statementAliases"] ?? []].some((s) => identityId({ kind: "DesignProblem", statement: s }) === statementKey));
-  const id = bound?.id ?? restated?.id ?? identityId({ kind: "WitnessedVulnerability", workspaceId: opts.workspaceId, target: identityTarget, statement });
-  const existing = bound ?? store.getNode(id);
-  const sources = existing?.attrs["sources"] ?? [];
-  const corroborated = !!existing && !sources.includes(opts.source);
-  const upgraded = !!existing && existing.attrs["assessment"] !== "asserted" && flag.assessment === "asserted";
-  const assessment = existing?.attrs["assessment"] === "asserted" ? "asserted" : flag.assessment;
-  if (!existing) {
-    store.mergeNode(buildNode(store, id, "Vulnerability", statement, opts.ts, {
-      source: "convo",
-      sourceClass: "agent-observation",
-      privateFinding: id,
-      workspaceId: opts.workspaceId,
-      affectedTarget: target,
-      identityTarget,
-      assessment,
-      anchorDisposition: target ? "unresolved" : "absent",
-      provisional: true,
-      sources: [opts.source],
-      corroborations: 0,
-      ...opts.hostHarness ? { hostHarness: opts.hostHarness } : {}
-    }));
-  } else if (corroborated || upgraded || !existing.attrs["affectedTarget"] && target || symbol2 && existing.attrs["identityTarget"] !== identityTarget) {
-    store.updateNode(id, {
-      attrs: {
-        ...existing.attrs,
-        assessment,
-        ...upgraded && existing.description !== statement ? { statementAliases: [...existing.attrs["statementAliases"] ?? [], existing.description].slice(-5) } : {},
-        affectedTarget: existing.attrs["affectedTarget"] || target,
-        ...symbol2 ? { identityTarget } : {},
-        sources: corroborated ? [...sources, opts.source] : sources,
-        corroborations: (Number(existing.attrs["corroborations"]) || 0) + (corroborated ? 1 : 0)
-      },
-      // Assessment strengthens on evidence, but does not certify exploitability.
-      ...upgraded ? { description: statement } : {},
-      ...corroborated ? { cumulativeHits: existing.cumulativeHits + 1 } : {},
-      ...reinforcedSeqAttrs(store, "Vulnerability"),
-      lastUpdatedAt: opts.ts
-    });
-  }
-  return { id, created: !existing, corroborated, upgraded };
-}
-function recordVulnerabilityCause(store, findingId, causes, ts) {
-  const finding = store.getNode(findingId);
-  if (finding?.label !== "Vulnerability") return 0;
-  let from = findingId;
-  let count = 0;
-  for (const description of causes) {
-    if (isPlaceholderStatement(description)) continue;
-    const id = genericCanonicalId("dcause", { findingId, description: description.trim() });
-    if (!store.getNode(id)) store.mergeNode(buildNode(store, id, "RootCause", description.trim(), ts, {
-      source: "convo",
-      privateFinding: findingId,
-      sources: finding.attrs["sources"],
-      assessment: finding.attrs["assessment"]
-    }));
-    mergeEdge(store, from, id, "CAUSED_BY", ts);
-    from = id;
-    count++;
-  }
-  return count;
-}
 function canonicalizePatternText(name2) {
   const stripped = name2.replace(/^\s*pattern(?:\s*[×x]\s*\d+)?\s*(?:\(exemplar\))?\s*[:—–-]\s*/i, "").replace(/\s+/g, " ").trim();
   return stripped.length > 0 ? stripped : name2.replace(/\s+/g, " ").trim();
@@ -21288,7 +21211,6 @@ function findReusableSolution(store, fixText) {
   const key = solutionTextKey(fixText);
   if (!key) return null;
   for (const s of store.findNodesByLabel("Solution")) {
-    if (s.attrs["privateFinding"]) continue;
     if (s.validTo != null) continue;
     if (isAutoMinted(s)) continue;
     if (solutionTextKey(s.description ?? "") === key) return s;
@@ -21313,7 +21235,7 @@ function priorsForFile(store, relPath) {
   for (const e of store.inEdges(file2.id, ["ANCHORED_AT"])) {
     const n = store.getNode(e.from);
     if (!n) continue;
-    if (n.label === "Problem" || n.label === "Vulnerability") {
+    if (n.label === "Problem") {
       if (seenProblem.has(n.id)) continue;
       seenProblem.add(n.id);
       if (!n.attrs["resolvedAt"]) {
@@ -21383,8 +21305,7 @@ function solutionForProblem(store, problemId) {
 }
 function anchorProblemToWorkingFile(store, problemId, relPath, workspaceId2, ts, provenance = "edited", opts = {}) {
   const p = store.getNode(problemId);
-  if (!p || p.label !== "Problem" && p.label !== "Vulnerability") return false;
-  if (p.label === "Vulnerability" && provenance !== "witnessed") return false;
+  if (!p || p.label !== "Problem") return false;
   if (!isAnchorableCodePath(relPath)) return false;
   const file2 = resolveFileNode(store, relPath, workspaceId2);
   if (!file2) return false;
@@ -21563,22 +21484,18 @@ function resolveDesignProblemById(store, id, fixNote, t) {
 }
 function closeDesignProblem(store, problemId, fixNote, t) {
   const p = store.getNode(problemId);
-  if (!p || p.label !== "Problem" && p.label !== "Vulnerability") return false;
+  if (!p || p.label !== "Problem") return false;
   if (p.attrs["resolvedAs"]) return false;
   if (fixNote?.trim() && !isFragmentFixNote(fixNote)) {
     const sols = store.outEdges(problemId, ["SOLVED_BY"]).map((e) => store.getNode(e.to)).filter((n) => n !== null);
     if (sols.every((s) => isAutoMinted(s))) {
-      const reuse = p.label === "Vulnerability" ? null : findReusableSolution(store, fixNote);
+      const reuse = findReusableSolution(store, fixNote);
       if (reuse) {
         mergeEdge(store, problemId, reuse.id, "SOLVED_BY", t);
       } else {
         const solId = `dfix_${digest({ problemId, fix: fixNote })}`.slice(0, 56);
         store.mergeNode(
-          buildNode(store, solId, "Solution", fixNote.trim(), t, {
-            source: "convo",
-            provisional: false,
-            ...p.label === "Vulnerability" ? { privateFinding: problemId, sources: p.attrs["sources"] } : {}
-          })
+          buildNode(store, solId, "Solution", fixNote.trim(), t, { source: "convo", provisional: false })
         );
         mergeEdge(store, problemId, solId, "SOLVED_BY", t);
       }
@@ -21592,7 +21509,6 @@ function closeDesignProblem(store, problemId, fixNote, t) {
     // mints no Solution, and a legacy placeholder beside it reads as
     // all-heuristic either way.
     attrs: { ...p.attrs, provisional: false, resolvedAt: t, resolutionWitnessed: true },
-    ...reinforcedSeqAttrs(store, p.label),
     lastUpdatedAt: t
   });
   return true;
@@ -23944,7 +23860,7 @@ function detectLocalCommunities(store, opts = {}) {
   const ids = /* @__PURE__ */ new Set();
   for (const label of JOINT_COMMUNITY_LABELS) {
     for (const n of store.findNodesByLabel(label)) {
-      if (n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) continue;
+      if (label === "Problem" && n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) continue;
       ids.add(n.id);
     }
   }
@@ -24081,7 +23997,6 @@ var init_community2 = __esm({
     init_src4();
     JOINT_COMMUNITY_LABELS = [
       "Problem",
-      "Vulnerability",
       "Solution",
       "RootCause",
       "Pattern"
@@ -24943,7 +24858,6 @@ __export(src_exports2, {
   induceAbstractions: () => induceAbstractions,
   induceTriage: () => induceTriage,
   ingestDesignProblem: () => ingestDesignProblem,
-  ingestWitnessedVulnerability: () => ingestWitnessedVulnerability,
   isConstraintProblem: () => isConstraintProblem,
   isFragmentFixNote: () => isFragmentFixNote,
   isPlaceholderStatement: () => isPlaceholderStatement,
@@ -24991,7 +24905,6 @@ __export(src_exports2, {
   recordMisreadPrior: () => recordMisreadPrior,
   recordRenderLedger: () => recordRenderLedger,
   recordTriageObservation: () => recordTriageObservation,
-  recordVulnerabilityCause: () => recordVulnerabilityCause,
   reinforceSameAnchorProblem: () => reinforceSameAnchorProblem,
   relateClaims: () => relateClaims,
   reopenAutoClosedProblems: () => reopenAutoClosedProblems,
@@ -25061,7 +24974,7 @@ function isPassiveInjectable(node2, atCommit) {
   return false;
 }
 function buildSnapshot(opts) {
-  const problems = [...opts.store.findNodesByLabel("Problem"), ...opts.store.findNodesByLabel("Vulnerability")].filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive", atCommit: opts.atCommit }).allow);
+  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive", atCommit: opts.atCommit }).allow);
   const stillOpen = problems.filter((p) => p.attrs["resolvedAt"] == null);
   const allProblems = stillOpen.filter((p) => !isConstraintProblem(p));
   allProblems.sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt);
@@ -25216,11 +25129,11 @@ function sliceForFile(store, relPath, atCommit) {
   const priors = fp ? {
     openProblems: fp.openProblems.slice(0, 3).map((p) => ({
       id: p.id,
-      description: p.label === "Vulnerability" ? `Vulnerability (${p.attrs["assessment"] ?? "unassessed"}): ${p.description}` : p.description,
+      description: p.description,
       ...typeof p.attrs["fixCandidateFile"] === "string" ? { fixCandidateFile: p.attrs["fixCandidateFile"] } : {}
     })),
     constraints: fp.constraints.slice(0, 2).map((c) => ({ id: c.id, description: c.description })),
-    resolvedProblems: fp.resolvedProblems.slice(0, 3).map((p) => ({ id: p.id, description: p.label === "Vulnerability" ? `Vulnerability (${p.attrs["assessment"] ?? "unassessed"}): ${p.description}` : p.description })),
+    resolvedProblems: fp.resolvedProblems.slice(0, 3).map((p) => ({ id: p.id, description: p.description })),
     related: fp.related.slice(0, 4).map((n) => ({ id: n.id, label: n.label, description: n.description })),
     solutionsByProblem: Object.fromEntries(
       [...fp.openProblems.slice(0, 3), ...fp.resolvedProblems.slice(0, 3)].map((p) => [
@@ -25338,8 +25251,7 @@ function renderSnapshot(s) {
     if (s.recentProblems.length > 0) {
       lines.push("_Open \u2014 recently observed here, derived from your work (a recency slice, not an inventory \u2014 burst an id for its full neighborhood):_");
       for (const r of s.recentProblems) {
-        const badge = r.node.label === "Vulnerability" ? `Vulnerability (${r.node.attrs["assessment"] ?? "unassessed"}): ` : "";
-        lines.push(`- **${badge}${r.node.description}** \u2014 \`${r.node.id}\`${tagOf(r.node)}`);
+        lines.push(`- **${r.node.description}** \u2014 \`${r.node.id}\`${tagOf(r.node)}`);
         const hits = r.node.cumulativeHits ?? 0;
         const surprise = (r.node.cumulativeSurprise ?? 0).toFixed(2);
         lines.push(`  - observed ${hits}\xD7 \xB7 cumulativeSurprise ${surprise}`);
@@ -25380,8 +25292,7 @@ function renderSnapshot(s) {
     if (s.recentResolved.length > 0) {
       lines.push("_Recently resolved \u2014 solved here; jumping-off points, not live defects:_");
       for (const r of s.recentResolved) {
-        const badge = r.node.label === "Vulnerability" ? `Vulnerability (${r.node.attrs["assessment"] ?? "unassessed"}): ` : "";
-        lines.push(`- \u2713 **${badge}${r.node.description}** \u2014 \`${r.node.id}\`${tagOf(r.node)}`);
+        lines.push(`- \u2713 **${r.node.description}** \u2014 \`${r.node.id}\`${tagOf(r.node)}`);
         if (r.solution) {
           lines.push(`  - solved: ${r.solution.description.slice(0, 160)} \u2014 \`${r.solution.id}\`${tagOf(r.solution)}`);
         }
@@ -27241,8 +27152,8 @@ var init_config = __esm({
     "use strict";
     init_paths();
     LEGACY_CLOUD_URL = "https://inerrata-gateway.onrender.com";
-    DEFAULT_CLOUD_URL = true ? "https://dev.inerrata.dev" : DEV_CLOUD_URL;
-    DEFAULT_UPDATE_CHANNEL = false ? "latest" : "dev";
+    DEFAULT_CLOUD_URL = true ? "https://inerrata.dev" : DEV_CLOUD_URL;
+    DEFAULT_UPDATE_CHANNEL = true ? "latest" : "dev";
   }
 });
 
@@ -31802,7 +31713,7 @@ var init_src8 = __esm({
 
 // src/agent-signals.ts
 function buildFileRecallInstruction(referent = "\u2026") {
-  return `Touching one? paste its token: ${TAG_EXAMPLE.fix(referent)} resolved \xB7 ${TAG_EXAMPLE.prior(referent)} leaned-on \xB7 ${TAG_EXAMPLE.problem()} new \xB7 ${TAG_EXAMPLE.vulnerability()} security. We harvest it.`;
+  return `Touching one? paste its token: ${TAG_EXAMPLE.fix(referent)} resolved \xB7 ${TAG_EXAMPLE.prior(referent)} leaned-on \xB7 ${TAG_EXAMPLE.problem()} new. We harvest it.`;
 }
 function triageBullet(ref) {
   return [
@@ -31838,15 +31749,15 @@ function attemptBullet() {
   ].join("\n");
 }
 function buildAgentInstruction(opts = {}) {
-  const signals = opts.signals ?? ["prior", "problem", "vulnerability", "domain", "fix", "constraint", "triage", "attempt", "link"];
+  const signals = opts.signals ?? ["prior", "problem", "domain", "fix", "constraint", "triage", "attempt", "link"];
   const ref = opts.referent ?? "its-handle";
   const token = (s) => s === "problem" ? TAG_EXAMPLE.problem() : s === "constraint" ? TAG_EXAMPLE.constraint() : s === "attempt" ? TAG_EXAMPLE.tried() : s === "domain" ? TAG_EXAMPLE.domain() : s === "link" ? TAG_EXAMPLE.pattern() : s === "verdict" ? TAG_EXAMPLE.confirm(ref) : TAG_EXAMPLE[s](ref);
-  const head2 = "Tag inline (no fences or backticks). Untagged findings are silently lost. Cite short handles; tag everything, we filter downstream. Requested errata-* answer blocks are the exception: keep their fences in your turn-final reply:";
-  const tail = "Restate mid-turn tags in your final reply; the harness can drop mid-turn text. EXCEPT one already shown with an id: cite [its-handle] instead of retyping (drift mints a duplicate).";
+  const head2 = `We tag the priors we show you with a short handle like [${opts.handleExample ?? "chokidar-glob"}]. Untagged prose is silently lost. Put each tag inline in prose (no fences or backticks). Requested errata-* answer blocks are the exception: keep their fences in your turn-final reply. Tag everything, we filter downstream:`;
+  const tail = "Mid-turn text (between tool calls) can be dropped by the harness \u2014 RESTATE every tag in your turn-final message; the final message is what reliably survives \u2014 EXCEPT one already shown above with an id: that is captured, so cite `[its-handle]` rather than retyping it (drift mints a duplicate).";
   return [
     head2,
     ...signals.map(
-      (s) => s === "triage" ? triageBullet(ref) : s === "vulnerability" ? `  \u2022 ${GLOSS.vulnerability} \u2192 ${TAG_EXAMPLE.vulnerability()}. Uncertain? ${TAG_EXAMPLE.suspectedVulnerability()}. Code review counts, even if immediately fixed. No CVE/exploit needed. For fixes: ${TAG_EXAMPLE.vulnerabilityThread()} ${TAG_EXAMPLE.fixThread("v")}.` : s === "attempt" ? attemptBullet() : s === "link" ? linkBullet(ref) : s === "verdict" ? verdictBullet(ref) : `  \u2022 ${GLOSS[s]} \u2192 ${token(s)}`
+      (s) => s === "triage" ? triageBullet(ref) : s === "attempt" ? attemptBullet() : s === "link" ? linkBullet(ref) : s === "verdict" ? verdictBullet(ref) : `  \u2022 ${GLOSS[s]} \u2192 ${token(s)}`
     ),
     tail
   ].join("\n");
@@ -31858,9 +31769,6 @@ var init_agent_signals = __esm({
     TAG_EXAMPLE = {
       prior: (ref) => `([${ref}])`,
       problem: () => `[!one line on what's wrong]`,
-      vulnerability: () => `[!vuln: who can do what; observed basis @ path:line]`,
-      suspectedVulnerability: () => `[?vuln: consequence; missing check]`,
-      vulnerabilityThread: () => `[!#v vuln: finding here]`,
       fix: (ref) => `(fix:[${ref}])`,
       // CONSTRAINT — the native capture path for a DIFFUSE problem (a constraint/tension/
       // conflict that shaped a decision). Free text, attaches to the decision sentence the
@@ -31881,7 +31789,7 @@ var init_agent_signals = __esm({
       // tags never need one — the id is for diagnoses that unfold over distance.
       problemThread: () => `[!#slug one line on what's wrong]`,
       causeThread: () => `(cause:#slug the mechanism)`,
-      fixThread: (thread = "slug") => `(fix:#${thread} what you changed)`,
+      fixThread: () => `(fix:#slug what you changed)`,
       // ATTEMPT arc — what's being tried and what didn't work. A failed attempt is a
       // witnessed NEGATIVE result: it saves the next agent the same dead end.
       tried: () => `(tried: the approach you're attempting)`,
@@ -31923,9 +31831,8 @@ var init_agent_signals = __esm({
       // problems, and narrated them as progress (a pick-best-before-scoring bug lost).
       // Every example here was diagnosis-framed, so nothing contradicted that sorting.
       // Kept to 29 chars: the instruction sits at the 2600 passive-budget ceiling.
-      problem: "any bug or finding, even in code you just wrote; name affected code: [!what's wrong @ path:42]",
-      vulnerability: "unauthorized actions, data exposure, or execution/disruption an attacker can trigger",
-      fix: "you fixed a shown finding; for your own non-security finding: (fix: what changed) \u2014 a fix resolves a stated problem, completing routine work is not a fix",
+      problem: "a problem you notice or report \u2014 any bug, finding, or thing wrong, even in code you just wrote; about specific code? name the file: [!what's wrong @ src/file.ts:42]",
+      fix: "your edit fixed a PROBLEM we showed you; for one you flagged yourself: (fix: what you changed) \u2014 a fix resolves a stated problem, completing routine work is not a fix",
       constraint: "a design decision forced by conflicting requirements or constraints \u2014 tag the tension, especially when your fix makes it 'only look' resolved",
       triage: "you diagnosed a cause \u2014 fold the chain into the flag with <- (caused-by), deepest sure mechanism rightmost",
       attempt: "attempting an approach / an attempt failed \u2014 a failed attempt is knowledge, it rules out a path",
@@ -31947,7 +31854,7 @@ var init_agent_signals = __esm({
       // Sim note (2026-08-02 shrink): domain emission held 4/4 with just the trigger
       // clause; the pattern convergence hook now rides here too (it fell 0/4 when it
       // only appeared in the link bullet's tail).
-      domain: "no single file? name the area (Title Case), and (pattern: the shape). No code anchor needed; two agents naming the same shape converge on one node",
+      domain: "a problem with no single file \u2014 name the area it's about (Title Case). Also name the general shape it instantiates: (pattern: the shape) \u2014 needs no code anchor, and two agents naming the same shape converge on one node",
       link: "the problem you flagged is an instance of priors/abstractions you can name \u2014 (instance:[h1],[h2],\u2026) / (pattern: \u2026) / (aids:[h]); rendered whole via linkBullet",
       verdict: "you can judge a prior we SHOWED you \u2014 confirm it if it held, refute it (with why) if it didn't; rendered whole via verdictBullet"
     };
@@ -32169,7 +32076,11 @@ function contextCard(store, snapshot) {
   return deliveredCard(store, intent ? `${count} for \u201C${clipIntent(intent)}\u201D` : `${count} in context`, delivered);
 }
 function writeContextCard(root, hash2, card) {
-  writeFileSync6(join7(root, ".errata", CONTEXT_CARD_FILE), JSON.stringify({ hash: hash2, card }));
+  writeFileSync6(join7(root, ".errata", CONTEXT_CARD_FILE), JSON.stringify({
+    hash: hash2,
+    card,
+    line: card && recallCardEnabled() ? renderRecallLine(card) : null
+  }));
 }
 function readContextCard(root, hash2) {
   const path2 = join7(root, ".errata", CONTEXT_CARD_FILE);
@@ -32184,7 +32095,7 @@ function readContextCard(root, hash2) {
 function openProblems(store, now = Date.now()) {
   const hit = openProblemsCache.get(store);
   if (hit && now - hit.at < OPEN_PROBLEMS_TTL_MS) return hit.nodes;
-  const nodes = [...store.findNodesByLabel("Problem"), ...store.findNodesByLabel("Vulnerability")].filter((p) => live(p) && !p.attrs["resolvedAt"] && p.attrs["mergedInto"] === void 0 && !isConstraintProblem(p));
+  const nodes = store.findNodesByLabel("Problem").filter((p) => live(p) && !p.attrs["resolvedAt"] && p.attrs["mergedInto"] === void 0 && !isConstraintProblem(p));
   openProblemsCache.set(store, { at: now, nodes });
   return nodes;
 }
@@ -32634,7 +32545,7 @@ var init_process_identity = __esm({
 });
 
 // src/lock.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11, unlinkSync } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "node:fs";
 function daemonLockPayload(lock) {
   return JSON.stringify({
     pid: lock.pid,
@@ -32715,7 +32626,7 @@ function stopLockedDaemon(lockPath) {
   }
   if (state === "unknown") return "unknown";
   if (state === "stale") {
-    unlinkSync(lockPath);
+    unlinkSync2(lockPath);
     return "stale";
   }
   process.kill(lock.pid, "SIGTERM");
@@ -36116,13 +36027,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url2) => {
         if (isFileURI(url2)) {
-          return new Promise((resolve7, reject) => {
+          return new Promise((resolve8, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url2, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve7(xhr.response);
+                resolve8(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -36318,9 +36229,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info2 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve7, reject) => {
+      return new Promise((resolve8, reject) => {
         Module["instantiateWasm"](info2, (mod, inst) => {
-          resolve7(receiveInstance(mod, inst));
+          resolve8(receiveInstance(mod, inst));
         });
       });
     }
@@ -37651,8 +37562,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve7, reject) => {
-      readyPromiseResolve = resolve7;
+    moduleRtn = new Promise((resolve8, reject) => {
+      readyPromiseResolve = resolve8;
       readyPromiseReject = reject;
     });
   }
@@ -43571,9 +43482,47 @@ var init_mcp = __esm({
     init_reconcile();
     init_agent_signals();
     INSTRUCTIONS = [
-      "errata is a live code and knowledge graph, a SEPARATE DIAGNOSTIC AXIS alongside grep/read for callers, blast radius, rename lineage and prior fixes. Fall back to read/search on found:false (unresolved is not an empty answer), or for unindexed code. Confirm exact bytes before editing.",
-      buildAgentInstruction({ signals: ["prior", "problem", "vulnerability", "fix"], referent: "its-id" }),
-      "Read .errata/g/index for graph-as-files query paths. A tool result may ask for a root cause; answer via errata.annotate_resolution when known."
+      // KEEP THIS UNDER THE CLIENT'S ~2 KB instruction-injection budget (the client
+      // truncates `instructions` on connect, ~2008 chars observed). Capture no longer
+      // depends on a standing emit-instruction block: the daemon derives problems/fixes
+      // from your WORK deterministically, and the one thing it asks of the agent — a
+      // one-line root cause at a fix — rides INLINE on the next tool response (the ⚡
+      // errata line; see the dispatch's enrichment piggyback) instead of a fenced
+      // protocol the agent has to remember. So this stays short: tool-routing steering
+      // plus a single line about the inline nudge. Per-tool routing lives in each tool's
+      // own `description` (delivered via tools/list). Don't re-add a tool table here.
+      "errata is a LIVE, bi-temporal code graph of this workspace, kept current by a",
+      "file watcher \u2014 a SEPARATE DIAGNOSTIC AXIS to run ALONGSIDE grep/glob/read, not",
+      "instead of them. For STRUCTURAL questions (callers of callers, blast-radius,",
+      "rename lineage) prefer it: faster, more complete, and it reaches relationships",
+      "grep can't. Each tool's description says when to reach for it. Fall back to",
+      'grep/read when a tool returns found:false (ESPECIALLY reason:"unresolved" \u2014 the',
+      "name was not recognized, NOT an empty answer; an empty list like callers:[] is a",
+      'confident "none" \u2014 trust it), when you need EXACT bytes before a high-stakes',
+      "edit, or for an unindexed file/language. Always confirm exact bytes with a read",
+      "before editing.",
+      "",
+      "errata is a cloud knowledge substrate \u2014 AND ALSO this workspace's code graph.",
+      "The problems you hit and the fixes you make become shared knowledge other agents",
+      "recall. That capture is automatic: derived from your edits/commands/commits \u2014 no",
+      "emit needed. Just after you resolve something a tool result may carry a one-line",
+      "\u26A1 errata note asking the ROOT CAUSE; answer via errata.annotate_resolution when",
+      "you know it, skip it otherwise.",
+      "",
+      "Two things it CAN'T derive \u2014 only you witness them, and this is a CAPTURE",
+      "PROTOCOL, not optional formatting: a problem or fix you state only in prose, a",
+      "list, or your own numbering is SILENTLY LOST \u2014 the tag is the ONLY thing recorded.",
+      "So the moment you state one, wrap it inline (no fence, no extra call):",
+      // Signal tokens come from the single source (agent-signals.ts) so this always-on
+      // block can't teach a grammar the parser rejects. Referent is "its-id" here — the
+      // raw MCP channel has no primed handles, so the agent cites a tool-result id.
+      `  \u2022 ${TAG_EXAMPLE.problem()}  \u2014 EVERY problem you notice or report ([?\u2026] = TODO)`,
+      `  \u2022 ${TAG_EXAMPLE.fix("its-id")}               \u2014 your edit fixed a problem errata showed you`,
+      "Tag every one you state \u2014 we filter downstream, so don't self-censor or batch.",
+      "",
+      "Graph-as-files: the graph is ALSO a virtual FS \u2014 Read (or `cat`)",
+      ".errata/g/<verb>/<seed> to run a query as a file read (e.g. .errata/g/burst/",
+      "<symbol>, /why/<sym>, /trace/<a>..<b>). Read .errata/g/index for the vocabulary."
     ].join("\n");
     AUDIT_RUN_THRESHOLD = 5;
     AUDIT_NUDGE_COOLDOWN = 12;
@@ -44165,7 +44114,7 @@ var init_mcp = __esm({
       },
       {
         name: "errata.problems",
-        description: "List the workspace's Problem and Vulnerability backlog \u2014 the triage view that search/why/impact can't give because they need a seed. status: 'open' (default) | 'resolved' (a real fix) | 'retracted' (false alarms \u2014 false_positive/dissolution) | 'constraint' (design TENSIONS captured via `(constraint: \u2026)` \u2014 standing context, not open work, so they're excluded from 'open') | 'all'. Also returns a `retracted` breakdown so the false-positive rate stays visible.",
+        description: "List the workspace's Problem backlog \u2014 the triage view that search/why/impact can't give because they need a seed. status: 'open' (default) | 'resolved' (a real fix) | 'retracted' (false alarms \u2014 false_positive/dissolution) | 'constraint' (design TENSIONS captured via `(constraint: \u2026)` \u2014 standing context, not open work, so they're excluded from 'open') | 'all'. Also returns a `retracted` breakdown so the false-positive rate stays visible.",
         inputSchema: {
           type: "object",
           properties: {
@@ -44177,15 +44126,13 @@ var init_mcp = __esm({
           const want = String(args2["status"] ?? "open");
           const limit = Math.max(1, Math.min(200, Number(args2["limit"] ?? 50)));
           const RETRACTIONS = /* @__PURE__ */ new Set(["false_positive", "invalid", "duplicate"]);
-          const rows = [...store.findAllVersionsByLabel("Problem"), ...store.findAllVersionsByLabel("Vulnerability")].map((p) => {
+          const rows = store.findAllVersionsByLabel("Problem").map((p) => {
             const ra = p.attrs["resolvedAs"];
             const status = ra && RETRACTIONS.has(ra) ? ra : p.attrs["resolvedAt"] != null ? "resolved" : isConstraintProblem(p) ? "constraint" : "open";
             const anchorEdge = store.outEdges(p.id, ["ANCHORED_AT"])[0];
             const anchor = anchorEdge ? store.getNode(anchorEdge.to)?.description : void 0;
             return {
               id: p.id,
-              label: p.label,
-              ...p.label === "Vulnerability" ? { assessment: p.attrs["assessment"] } : {},
               problem: p.description,
               status,
               createdAt: p.createdAt,
@@ -52553,8 +52500,8 @@ import {
   existsSync as existsSync17,
   readdirSync as readdirSync5,
   readFileSync as readFileSync16,
-  renameSync,
-  unlinkSync as unlinkSync2,
+  renameSync as renameSync2,
+  unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync12
 } from "node:fs";
 import { join as join17 } from "node:path";
@@ -52573,7 +52520,7 @@ async function flushOutbox(paths, client, store) {
   let failed = 0;
   const quarantine = (abs, reason) => {
     try {
-      renameSync(abs, `${abs}.bad`);
+      renameSync2(abs, `${abs}.bad`);
       console.warn(`[errata] outbox: quarantined ${abs} (${reason})`);
     } catch {
     }
@@ -52617,7 +52564,7 @@ async function flushOutbox(paths, client, store) {
           }
         }
       }
-      unlinkSync2(abs);
+      unlinkSync3(abs);
       if (res.accepted === 0) uploaded++;
     } catch (err2) {
       failed++;
@@ -52750,8 +52697,7 @@ function errorRecallTerms(errorText) {
 }
 function recallLine(n, token) {
   const desc = (n.description ?? "").replace(/\s+/g, " ").slice(0, 120);
-  const label = n.label === "Vulnerability" ? `Vulnerability; ${n.attrs["assessment"] ?? "unassessed"}` : n.label;
-  return `- [${label}] ${desc}  \u2192  ${token}`;
+  return `- [${n.label}] ${desc}  \u2192  ${token}`;
 }
 function recallForFile(store, relPath) {
   return fileRecall(store, relPath)?.context ?? null;
@@ -52772,7 +52718,7 @@ function fileRecall(store, relPath) {
   const shownRelated = priors.related.slice(0, 4);
   for (const p of shownProblems) {
     const hasCause = store.outEdges(p.id, ["CAUSED_BY"]).some((e) => store.getNode(e.to)?.label === "RootCause");
-    const causeCue = hasCause ? "" : ` \xB7 ${p.label === "Vulnerability" ? `(cause:#${p.id} the mechanism)` : TAG_EXAMPLE.triageMint()} to diagnose its cause`;
+    const causeCue = hasCause ? "" : ` \xB7 ${TAG_EXAMPLE.triageMint()} to diagnose its cause`;
     lines.push(
       recallLine(p, `${TAG_EXAMPLE.fix(p.id)} if you resolved it \xB7 ${TAG_EXAMPLE.prior(p.id)} to cite${causeCue}`)
     );
@@ -55721,9 +55667,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve7, reject) => {
+          return new Promise((resolve8, reject) => {
             this.close((err2, data) => {
-              return err2 ? reject(err2) : resolve7(data);
+              return err2 ? reject(err2) : resolve8(data);
             });
           });
         }
@@ -55761,12 +55707,12 @@ var require_dispatcher_base = __commonJS({
           err2 = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve7, reject) => {
+          return new Promise((resolve8, reject) => {
             this.destroy(err2, (err3, data) => {
               return err3 ? (
                 /* istanbul ignore next: should never error */
                 reject(err3)
-              ) : resolve7(data);
+              ) : resolve8(data);
             });
           });
         }
@@ -58033,8 +57979,8 @@ var require_util2 = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise2 = new Promise((resolve7, reject) => {
-        res = resolve7;
+      const promise2 = new Promise((resolve8, reject) => {
+        res = resolve8;
         rej = reject;
       });
       return { promise: promise2, resolve: res, reject: rej };
@@ -60175,12 +60121,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve7, reject) => {
+      const waitForDrain = () => new Promise((resolve8, reject) => {
         assert2(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve7;
+          callback = resolve8;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -60817,12 +60763,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve7, reject) => {
+      const waitForDrain = () => new Promise((resolve8, reject) => {
         assert2(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve7;
+          callback = resolve8;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -61299,16 +61245,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       async [kClose]() {
-        return new Promise((resolve7) => {
+        return new Promise((resolve8) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve7;
+            this[kClosedResolve] = resolve8;
           } else {
-            resolve7(null);
+            resolve8(null);
           }
         });
       }
       async [kDestroy](err2) {
-        return new Promise((resolve7) => {
+        return new Promise((resolve8) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i2 = 0; i2 < requests.length; i2++) {
             const request = requests[i2];
@@ -61319,7 +61265,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve7(null);
+            resolve8(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err2, callback);
@@ -61370,7 +61316,7 @@ var require_client = __commonJS({
         });
       }
       try {
-        const socket = await new Promise((resolve7, reject) => {
+        const socket = await new Promise((resolve8, reject) => {
           client[kConnector]({
             host,
             hostname: hostname3,
@@ -61382,7 +61328,7 @@ var require_client = __commonJS({
             if (err2) {
               reject(err2);
             } else {
-              resolve7(socket2);
+              resolve8(socket2);
             }
           });
         });
@@ -61718,8 +61664,8 @@ var require_pool_base = __commonJS({
         if (this[kQueue].isEmpty()) {
           await Promise.all(this[kClients].map((c) => c.close()));
         } else {
-          await new Promise((resolve7) => {
-            this[kClosedResolve] = resolve7;
+          await new Promise((resolve8) => {
+            this[kClosedResolve] = resolve8;
           });
         }
       }
@@ -62934,7 +62880,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return null;
         }
-        return await new Promise((resolve7, reject) => {
+        return await new Promise((resolve8, reject) => {
           if (this[kContentLength] > limit) {
             this.destroy(new AbortError());
           }
@@ -62947,7 +62893,7 @@ var require_readable = __commonJS({
             if (signal?.aborted) {
               reject(signal.reason ?? new AbortError());
             } else {
-              resolve7(null);
+              resolve8(null);
             }
           }).on("error", noop).on("data", function(chunk) {
             limit -= chunk.length;
@@ -62966,7 +62912,7 @@ var require_readable = __commonJS({
     }
     async function consume(stream, type) {
       assert2(!stream[kConsume]);
-      return new Promise((resolve7, reject) => {
+      return new Promise((resolve8, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -62983,7 +62929,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve: resolve7,
+              resolve: resolve8,
               reject,
               length: 0,
               body: []
@@ -63053,18 +62999,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2) {
-      const { type, body: body2, resolve: resolve7, stream, length } = consume2;
+      const { type, body: body2, resolve: resolve8, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve7(chunksDecode(body2, length));
+          resolve8(chunksDecode(body2, length));
         } else if (type === "json") {
-          resolve7(JSON.parse(chunksDecode(body2, length)));
+          resolve8(JSON.parse(chunksDecode(body2, length)));
         } else if (type === "arrayBuffer") {
-          resolve7(chunksConcat(body2, length).buffer);
+          resolve8(chunksConcat(body2, length).buffer);
         } else if (type === "blob") {
-          resolve7(new Blob(body2, { type: stream[kContentType] }));
+          resolve8(new Blob(body2, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve7(chunksConcat(body2, length));
+          resolve8(chunksConcat(body2, length));
         }
         consumeFinish(consume2);
       } catch (err2) {
@@ -63321,9 +63267,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve8, reject) => {
           request.call(this, opts, (err2, data) => {
-            return err2 ? reject(err2) : resolve7(data);
+            return err2 ? reject(err2) : resolve8(data);
           });
         });
       }
@@ -63546,9 +63492,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve8, reject) => {
           stream.call(this, opts, factory, (err2, data) => {
-            return err2 ? reject(err2) : resolve7(data);
+            return err2 ? reject(err2) : resolve8(data);
           });
         });
       }
@@ -63833,9 +63779,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve8, reject) => {
           upgrade.call(this, opts, (err2, data) => {
-            return err2 ? reject(err2) : resolve7(data);
+            return err2 ? reject(err2) : resolve8(data);
           });
         });
       }
@@ -63927,9 +63873,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve8, reject) => {
           connect.call(this, opts, (err2, data) => {
-            return err2 ? reject(err2) : resolve7(data);
+            return err2 ? reject(err2) : resolve8(data);
           });
         });
       }
@@ -67791,7 +67737,7 @@ var require_fetch = __commonJS({
       function dispatch({ body: body2 }) {
         const url2 = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        return new Promise((resolve7, reject) => agent.dispatch(
+        return new Promise((resolve8, reject) => agent.dispatch(
           {
             path: url2.pathname + url2.search,
             origin: url2.origin,
@@ -67867,7 +67813,7 @@ var require_fetch = __commonJS({
                 }
               }
               const onError = this.onError.bind(this);
-              resolve7({
+              resolve8({
                 status,
                 statusText,
                 headersList,
@@ -67913,7 +67859,7 @@ var require_fetch = __commonJS({
               for (let i2 = 0; i2 < rawHeaders.length; i2 += 2) {
                 headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i2]), rawHeaders[i2 + 1].toString("latin1"), true);
               }
-              resolve7({
+              resolve8({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -71552,8 +71498,8 @@ var require_util8 = __commonJS({
       return true;
     }
     function delay(ms) {
-      return new Promise((resolve7) => {
-        setTimeout(resolve7, ms).unref();
+      return new Promise((resolve8) => {
+        setTimeout(resolve8, ms).unref();
       });
     }
     module2.exports = {
@@ -72700,8 +72646,8 @@ var init_report_render = __esm({
 
 // src/cli.ts
 init_src6();
-import { closeSync as closeSync2, existsSync as existsSync36, openSync as openSync2, readFileSync as readFileSync38, renameSync as renameSync4, statSync as statSync10 } from "node:fs";
-import { join as join44, resolve as pathResolve2 } from "node:path";
+import { closeSync as closeSync2, existsSync as existsSync37, openSync as openSync2, readFileSync as readFileSync40, renameSync as renameSync6, statSync as statSync11 } from "node:fs";
+import { join as join47, resolve as pathResolve2 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
 
 // src/daemon.ts
@@ -73135,7 +73081,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i2 === 1) {
-            await new Promise((resolve7) => setTimeout(resolve7));
+            await new Promise((resolve8) => setTimeout(resolve8));
             maxReadCount = 3;
             continue;
           }
@@ -73282,10 +73228,11 @@ var serve = (options, listeningListener) => {
 init_cloud_auth();
 init_webui();
 init_config();
+init_lock();
 
 // src/engine.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync27, statSync as statSync8, appendFileSync as appendFileSync4, readdirSync as readdirSync10, renameSync as renameSync3, readFileSync as readFileSync31, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync27, statSync as statSync8, appendFileSync as appendFileSync4, readdirSync as readdirSync10, renameSync as renameSync4, readFileSync as readFileSync31, writeFileSync as writeFileSync22 } from "node:fs";
 import { basename as basename7, join as join35, relative as relative6, sep as sep4 } from "node:path";
 
 // src/source-watcher.ts
@@ -74022,9 +73969,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname14 = sysPath.dirname(file2);
+    const dirname15 = sysPath.dirname(file2);
     const basename9 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname14);
+    const parent = this.fsw._getWatchedDir(dirname15);
     let prevStats = stats;
     if (parent.has(basename9))
       return;
@@ -74051,7 +73998,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error48) {
-          this.fsw._remove(dirname14, basename9);
+          this.fsw._remove(dirname15, basename9);
         }
       } else if (parent.has(basename9)) {
         const at = newStats.atimeMs;
@@ -74147,7 +74094,7 @@ var NodeFsHandler = class {
         this._addToNodeFs(path2, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       if (!stream)
         return reject();
       stream.once(STR_END, () => {
@@ -74156,7 +74103,7 @@ var NodeFsHandler = class {
           return;
         }
         const wasThrottled = throttler ? throttler.clear() : false;
-        resolve7(void 0);
+        resolve8(void 0);
         previous.getChildren().filter((item2) => {
           return item2 !== directory && !current.has(item2);
         }).forEach((item2) => {
@@ -76041,7 +75988,7 @@ init_src5();
 import { readFileSync as readFileSync17, writeFileSync as writeFileSync13 } from "node:fs";
 var NEG = /n['']t|\b(?:not|never|no|none|neither|nor|unrelated|irrelevant|would|might|could|if)\b/i;
 var CITE_GROUP_RE = /\(((?:[^()\n]|\([^()\n]*\)){1,200})\)/g;
-var HANDLE_RE = /\[([a-z0-9][\w-]{0,80})\]|((?:pat|sol|drc|dcause|dfix|dprob|dvuln|prob|claim|err)_[0-9a-f]{6,})/gi;
+var HANDLE_RE = /\[([a-z0-9][\w-]{0,80})\]|((?:pat|sol|drc|dcause|dfix|dprob|prob|claim|err)_[0-9a-f]{6,})/gi;
 var PLACEHOLDER_HANDLES = /* @__PURE__ */ new Set([
   "handle",
   "its-handle",
@@ -76056,7 +76003,7 @@ var PLACEHOLDER_HANDLES = /* @__PURE__ */ new Set([
   "b"
 ]);
 var isPlaceholderHandle = (h) => PLACEHOLDER_HANDLES.has(h.toLowerCase());
-var FLAG_BODY_HANDLE_RE = /^(?:[a-z0-9]+(?:-[a-z0-9]+){2,}-(?=[0-9a-f]{0,3}\d)[0-9a-f]{4}|(?:pat|sol|drc|dcause|dfix|dprob|dvuln|prob|claim|err)_[0-9a-f]{6,})$/i;
+var FLAG_BODY_HANDLE_RE = /^(?:[a-z0-9]+(?:-[a-z0-9]+){2,}-(?=[0-9a-f]{0,3}\d)[0-9a-f]{4}|(?:pat|sol|drc|dcause|dfix|dprob|prob|claim|err)_[0-9a-f]{6,})$/i;
 var FIX_PREFIX = /^\s*fix:(?:#([a-z][\w-]{0,63}))?\s*/i;
 var CONSTRAINT_RE = /\(\s*constraint:\s*([^()\n]{8,}?)\s*\)/gi;
 var CAUSE_PREFIX = /^\s*cause:(?:#([a-z][\w-]{0,63}))?\s*/i;
@@ -76081,7 +76028,7 @@ var DOMAIN_RE = /\(\s*domain:\s*([^()\n]{3,}?)\s*\)/gi;
 var PACKAGE_RE = /\(\s*package:\s*([^()\n]{2,}?)\s*\)/gi;
 var COMPONENT_RE = /\(\s*component:\s*([^()\n]{2,}?)\s*\)/gi;
 var CAUSE_TEXT_MIN = 8;
-var FLAG_RE = /\[([!?])(?:#([a-z][\w-]{0,63})\s+)?\s*((?:\[[^\]\n]*\]|[^\]\n])*?)\s*(?:@\s*([^\s\]]+?)(?::(\d+))?\s*)?\]/g;
+var FLAG_RE = /\[([!?])(?:#([a-z][\w-]{0,63})\s+)?\s*((?:\[[^\]\n]*\]|[^\]\n]){8,}?)\s*(?:@\s*([^\s\]]+?)(?::(\d+))?\s*)?\]/g;
 var CONSTRAINT_MIN = 8;
 function clauseBefore(sentence, idx) {
   const win = sentence.slice(Math.max(0, idx - 80), idx);
@@ -76225,7 +76172,6 @@ function cleanEmittedTags(tags) {
 }
 function emptyTagDispositions() {
   return {
-    invalidVulnerability: 0,
     oversizeSegments: 0,
     codeSpanNeutralized: 0,
     refuteTooShort: 0,
@@ -76238,7 +76184,6 @@ function emptyTagDispositions() {
   };
 }
 function addTagDispositions(a, b) {
-  a.invalidVulnerability += b.invalidVulnerability;
   a.oversizeSegments += b.oversizeSegments;
   a.codeSpanNeutralized += b.codeSpanNeutralized;
   a.refuteTooShort += b.refuteTooShort;
@@ -76252,31 +76197,12 @@ function addTagDispositions(a, b) {
 function parseInlineTags(text) {
   return parseInlineTagsWithDispositions(text).tags;
 }
-function* captureSentences(text) {
-  for (const line of text.split(/\n+/)) {
-    if (line.length > 2e4) {
-      yield line;
-      continue;
-    }
-    const flags2 = [...line.matchAll(new RegExp(FLAG_RE.source, FLAG_RE.flags))].map((m) => ({ start: m.index, end: m.index + m[0].length }));
-    let flag = 0;
-    let start2 = 0;
-    for (const boundary of line.matchAll(/(?<=[.!?])\s+(?!\(fix:)/g)) {
-      const index = boundary.index;
-      while (flags2[flag] && flags2[flag].end <= index) flag++;
-      if (flags2[flag] && flags2[flag].start < index) continue;
-      yield line.slice(start2, index);
-      start2 = index + boundary[0].length;
-    }
-    yield line.slice(start2);
-  }
-}
 function parseInlineTagsWithDispositions(text) {
   const out2 = [];
   const dispositions = emptyTagDispositions();
   const deFenced = text.replace(/```[\s\S]*?```/g, " ");
   let seqNo = -1;
-  for (const raw2 of captureSentences(deFenced)) {
+  for (const raw2 of deFenced.split(/(?<=[.!?])\s+(?!\(fix:)|\n+/)) {
     seqNo++;
     if (raw2.length > 2e4) {
       dispositions.oversizeSegments++;
@@ -76502,29 +76428,6 @@ function parseInlineTagsWithDispositions(text) {
     while ((f = FLAG_RE.exec(sentence)) !== null) {
       const flagThread = f[2];
       const raw3 = f[3].trim();
-      if (/^vuln\b/i.test(raw3)) {
-        const typed = /^vuln:\s*([\s\S]*)$/i.exec(raw3);
-        const body2 = typed?.[1]?.trim() ?? "";
-        const parts2 = body2.split(CAUSE_ARROW).map((s) => s.trim());
-        const symptom = f[1] === "!" && parts2.length > 1 && !f[4] ? new RegExp(FLAG_RE.source, "i").exec(`[!${parts2[0]}]`) : null;
-        const statement = f[1] === "?" ? body2 : symptom?.[3]?.trim() ?? parts2[0];
-        if (statement.length < 8 || /^<[^>]*>$/.test(statement)) {
-          dispositions.invalidVulnerability++;
-          continue;
-        }
-        const path2 = (f[4] ?? symptom?.[4])?.trim();
-        const line = f[5] ?? symptom?.[5];
-        out2.push({
-          kind: "vulnerability",
-          statement,
-          assessment: f[1] === "!" ? "asserted" : "suspected",
-          ...f[1] === "!" && parts2.length > 1 ? { vulnerabilityCauses: parts2.slice(1).filter((s) => s.length >= CAUSE_TEXT_MIN) } : {},
-          ...path2 ? { location: { path: path2, ...line ? { line: Number(line) } : {} } } : {},
-          ...flagThread ? { threadId: flagThread } : {},
-          sentence: sfield
-        });
-        continue;
-      }
       if (FLAG_BODY_HANDLE_RE.test(raw3) && !f[4]) {
         dispositions.flagAsHandle++;
         out2.push({ kind: "prior", handle: raw3, sentence: sfield });
@@ -76895,7 +76798,7 @@ function harvestInlineTags(store, text, opts) {
   const parsed = parseInlineTagsWithDispositions(text);
   const tags = parsed.tags;
   plan.dispositions = parsed.dispositions;
-  const symptomSeqs = tags.filter((t) => (t.kind === "problem" || t.kind === "todo" || t.kind === "vulnerability") && t.statement).map((t) => ({ seq: t.seq ?? -1, statement: t.statement, threadId: t.threadId, kind: t.kind })).sort((a, b) => a.seq - b.seq);
+  const symptomSeqs = tags.filter((t) => (t.kind === "problem" || t.kind === "todo") && t.statement).map((t) => ({ seq: t.seq ?? -1, statement: t.statement, threadId: t.threadId })).sort((a, b) => a.seq - b.seq);
   const bindSymptom = (seq, threadId) => {
     if (threadId) {
       const hit = symptomSeqs.find((s) => s.threadId === threadId);
@@ -76908,7 +76811,6 @@ function harvestInlineTags(store, text, opts) {
     if (seq == null) return { evidence: "inferred" };
     let best;
     for (const s of symptomSeqs) {
-      if (s.kind === "vulnerability") continue;
       if (s.seq <= seq) best = s;
       else break;
     }
@@ -76923,13 +76825,10 @@ function harvestInlineTags(store, text, opts) {
     return id;
   };
   for (const tag of tags) {
-    if (tag.kind === "problem" || tag.kind === "todo" || tag.kind === "vulnerability") {
+    if (tag.kind === "problem" || tag.kind === "todo") {
       plan.problems.push({
         statement: tag.statement,
         kind: tag.kind,
-        ...tag.assessment ? { assessment: tag.assessment } : {},
-        ...tag.vulnerabilityCauses ? { vulnerabilityCauses: tag.vulnerabilityCauses } : {},
-        ...tag.kind === "vulnerability" && tag.seq !== void 0 ? { seq: tag.seq } : {},
         ...tag.location ? { location: tag.location } : {},
         ...tag.threadId ? { threadId: tag.threadId } : {}
       });
@@ -76952,7 +76851,7 @@ function harvestInlineTags(store, text, opts) {
         } else if (tag.threadId && !b.statement) {
           plan.fixes.push({ inScope: true, fixNote: tag.fixRationale, threadId: tag.threadId });
         } else if (b.statement && b.evidence === "witnessed") {
-          plan.fixes.push({ inScope: true, fixNote: tag.fixRationale, boundStatement: b.statement, ...tag.threadId ? { threadId: tag.threadId } : {} });
+          plan.fixes.push({ inScope: true, fixNote: tag.fixRationale, boundStatement: b.statement });
         } else {
           plan.fixes.push({ inScope: true, fixNote: tag.fixRationale, ambiguous: true });
         }
@@ -77155,7 +77054,6 @@ function harvestInlineTags(store, text, opts) {
 }
 var CORROBORATABLE_LABELS = /* @__PURE__ */ new Set([
   "Problem",
-  "Vulnerability",
   "Solution",
   "RootCause",
   "Pattern",
@@ -77875,8 +77773,8 @@ var PassWorker = class {
       const id = this.nextId++;
       try {
         await this.ready;
-        return await new Promise((resolve7, reject) => {
-          this.pending.set(id, { resolve: resolve7, reject });
+        return await new Promise((resolve8, reject) => {
+          this.pending.set(id, { resolve: resolve8, reject });
           this.worker.postMessage({ id, kind, ...payload !== void 0 ? { payload } : {} });
         });
       } finally {
@@ -77910,12 +77808,12 @@ var PassWorker = class {
     });
     noteIsolateSpawned();
     this.worker = worker;
-    this.ready = new Promise((resolve7, reject) => {
+    this.ready = new Promise((resolve8, reject) => {
       const onReady = (m) => {
         if (m?.ready) {
           worker.off("message", onReady);
           worker.off("error", onErr);
-          resolve7();
+          resolve8();
         }
       };
       const onErr = (err2) => reject(err2);
@@ -79071,7 +78969,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
 // src/git-delta.ts
 import { execFile } from "node:child_process";
 function git(repoDir, args2) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     execFile(
       "git",
       ["-C", repoDir, ...args2],
@@ -79082,7 +78980,7 @@ function git(repoDir, args2) {
         // git-sensor runs on every commit/checkout.
         windowsHide: true
       },
-      (err2, stdout) => err2 ? reject(err2) : resolve7(stdout)
+      (err2, stdout) => err2 ? reject(err2) : resolve8(stdout)
     );
   });
 }
@@ -80240,12 +80138,12 @@ function headerPaths(diff) {
   return out2.filter((p) => p !== "/dev/null");
 }
 function git2(repoDir, args2) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     execFile2(
       "git",
       ["-C", repoDir, ...args2],
       { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, windowsHide: true },
-      (err2, stdout) => err2 ? reject(err2) : resolve7(stdout)
+      (err2, stdout) => err2 ? reject(err2) : resolve8(stdout)
     );
   });
 }
@@ -80518,7 +80416,7 @@ import {
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync26,
   readdirSync as readdirSync8,
-  unlinkSync as unlinkSync3,
+  unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { basename as basename6, join as join30 } from "node:path";
@@ -80579,7 +80477,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     if (!f.endsWith(".md")) continue;
     if (keep.has(basename6(f))) continue;
     try {
-      unlinkSync3(join30(paths.skillsDir, f));
+      unlinkSync4(join30(paths.skillsDir, f));
       pruned++;
     } catch {
     }
@@ -80861,7 +80759,7 @@ init_paths();
 init_profile2();
 
 // src/witness-queue.ts
-import { readFileSync as readFileSync28, renameSync as renameSync2, writeFileSync as writeFileSync19 } from "node:fs";
+import { readFileSync as readFileSync28, renameSync as renameSync3, writeFileSync as writeFileSync19 } from "node:fs";
 import { dirname as dirname11, join as join32 } from "node:path";
 var WITNESS_QUEUE_CAP = 500;
 var WITNESS_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
@@ -80887,7 +80785,7 @@ function saveWitnessQueue(path2, queue) {
   try {
     const tmp = join32(dirname11(path2), `.${Date.now()}.witness-queue.tmp`);
     writeFileSync19(tmp, JSON.stringify(queue), "utf8");
-    renameSync2(tmp, path2);
+    renameSync3(tmp, path2);
   } catch {
   }
 }
@@ -80934,9 +80832,9 @@ function partitionReplayable(queue, channel, isShipped) {
 function retireWitnesses(queue, channel, settledKeys) {
   return queue.filter((w) => !(w.channel === channel && settledKeys.has(w.witnessKey)));
 }
-var WIRE_SHIPPED_LABELS = /* @__PURE__ */ new Set(["Problem", "Vulnerability", "Solution", "RootCause"]);
+var WIRE_SHIPPED_LABELS = /* @__PURE__ */ new Set(["Problem", "Solution", "RootCause"]);
 var MOTIF_ID_PREFIX = "motif_community_";
-var CANONICAL_ID_RE = /^(?:pat|sol|drc|dcause|dfix|dprob|dvuln|prob|claim|err)_[0-9a-f]{6,}$/i;
+var CANONICAL_ID_RE = /^(?:pat|sol|drc|dcause|dfix|dprob|prob|claim|err)_[0-9a-f]{6,}$/i;
 function classifyWitnessTarget(nodeId, getNode) {
   if (nodeId.startsWith(MOTIF_ID_PREFIX)) {
     const exemplar = nodeId.slice(MOTIF_ID_PREFIX.length);
@@ -81506,7 +81404,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.16-dev.3355" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.16" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -81519,7 +81417,7 @@ function appendIdentityAudit(path2, record2, line) {
   if (!record2.accepted && record2.score <= 0) return;
   try {
     if (existsSync27(path2) && statSync8(path2).size >= IDENTITY_AUDIT_MAX_BYTES) {
-      renameSync3(path2, `${path2}.1`);
+      renameSync4(path2, `${path2}.1`);
     }
     appendFileSync4(path2, line);
   } catch {
@@ -82398,9 +82296,6 @@ function createWorkspaceEngine(opts) {
   const harvestTextsInner = async (sessionId, items) => {
     let minted = 0;
     let tagsSeen = 0;
-    let vulnerabilitiesSeen = 0;
-    let vulnerabilitiesMinted = 0;
-    let vulnerabilitiesSuspected = 0;
     let tagsRejected = 0;
     let tagsRestated = 0;
     let resolved = 0;
@@ -82631,73 +82526,10 @@ function createWorkspaceEngine(opts) {
         if ((toolRuns.get(sessionId)?.size ?? 0) > 0) touchedToolTurns++;
         const wf = workingFiles.get(sessionId);
         let inScopeProblemId;
-        const findingIds = /* @__PURE__ */ new Map();
-        const conflictingThreads = /* @__PURE__ */ new Set();
         const threads = sessionThreads.get(sessionId) ?? /* @__PURE__ */ new Map();
         sessionThreads.set(sessionId, threads);
         for (const p of plan.problems) {
           tagsSeen++;
-          if (p.kind === "vulnerability") {
-            vulnerabilitiesSeen++;
-            if (p.assessment === "suspected") vulnerabilitiesSuspected++;
-            let fileText;
-            let anchorReadFailed = false;
-            if (p.location) {
-              try {
-                fileText = readFileSync31(join35(opts.workspaceRoot, p.location.path), "utf8");
-              } catch {
-                anchorReadFailed = true;
-              }
-            }
-            const result = ingestWitnessedVulnerability(store, {
-              statement: p.statement,
-              assessment: p.assessment,
-              target: p.location?.path,
-              line: p.location?.line,
-              fileText,
-              existingId: p.threadId ? threads.get(p.threadId) ?? handleMap[p.threadId]?.id ?? store.getNode(p.threadId)?.id : void 0
-            }, { workspaceId: profile.id, source: sessionId, ts: t, hostHarness: turn.hostHarness });
-            let anchorDisposition = p.location ? "unresolved" : "absent";
-            if (result.rejected) {
-              tagsRejected++;
-              if (p.threadId) conflictingThreads.add(p.threadId);
-            } else {
-              findingIds.set(p.statement, result.id);
-              if (p.threadId) threads.set(p.threadId, result.id);
-              if (result.created || result.corroborated || result.upgraded) minted++;
-              else tagsRestated++;
-              if (result.created) vulnerabilitiesMinted++;
-              if (p.location) {
-                try {
-                  const anchored = anchorProblemToWorkingFile(store, result.id, p.location.path, profile.id, t, "witnessed", { line: p.location.line, fileText });
-                  anchorDisposition = anchored ? "resolved" : anchorReadFailed ? "error" : "unresolved";
-                  if (anchored) deriveContextFromAnchors(store, result.id, t);
-                } catch {
-                  anchorDisposition = "error";
-                }
-              }
-              const node2 = store.getNode(result.id);
-              store.updateNode(result.id, { attrs: { ...node2.attrs, anchorDisposition } });
-              if (p.vulnerabilityCauses) triaged += recordVulnerabilityCause(store, result.id, p.vulnerabilityCauses, t);
-            }
-            log.append({
-              kind: "vulnerability.witness",
-              workspaceId: profile.id,
-              ts: t,
-              digest: digest({ kind: "vulnerability.witness", workspaceId: profile.id, sessionId, turnId: turn.uuid, statement: p.statement, assessment: p.assessment, location: p.location }),
-              sessionId,
-              turnId: turn.uuid,
-              harness: turn.hostHarness,
-              findingId: result.id,
-              statement: p.statement,
-              assessment: p.assessment,
-              location: p.location,
-              seq: p.seq,
-              anchorDisposition,
-              disposition: result.rejected ?? (result.created ? "created" : result.upgraded ? "upgraded" : result.corroborated ? "corroborated" : "restated")
-            });
-            continue;
-          }
           const anchorPath = p.location?.path ?? editedTurnFile;
           const anchorProvenance = p.location?.path ? "witnessed" : "edited";
           const hintPath = anchorPath ? void 0 : turnFile ?? wf;
@@ -82792,10 +82624,10 @@ function createWorkspaceEngine(opts) {
           if (r.created || r.corroborated) {
             minted++;
             if (p.kind !== "constraint") {
-              sessionLastProblem.set(sessionId, r.problemId);
-              inScopeProblemId = r.problemId;
+              sessionLastProblem.set(sessionId, designProblemId(p.statement));
+              inScopeProblemId = designProblemId(p.statement);
             }
-            if (p.threadId) threads.set(p.threadId, r.problemId);
+            if (p.threadId) threads.set(p.threadId, designProblemId(p.statement));
             try {
               if (anchorPath) {
                 let enclosing = {};
@@ -82832,8 +82664,7 @@ function createWorkspaceEngine(opts) {
           );
         }
         for (const fx of plan.fixes) {
-          if (fx.threadId && conflictingThreads.has(fx.threadId)) continue;
-          const pid = fx.problemId ?? (fx.threadId ? threads.get(fx.threadId) : void 0) ?? (fx.boundStatement ? findingIds.get(fx.boundStatement) ?? designProblemId(fx.boundStatement) : void 0);
+          const pid = fx.problemId ?? (fx.threadId ? threads.get(fx.threadId) : void 0) ?? (fx.boundStatement ? designProblemId(fx.boundStatement) : void 0);
           if (!pid) {
             if (fx.inScope) {
               console.warn(
@@ -82845,7 +82676,7 @@ function createWorkspaceEngine(opts) {
           const closed = resolveDesignProblemById(store, pid, fx.fixNote, t);
           if (!closed) {
             const n = store.getNode(pid);
-            if (!n || n.label !== "Problem" && n.label !== "Vulnerability" || n.attrs["resolvedAs"] != null) {
+            if (!n || n.label !== "Problem" || n.attrs["resolvedAs"] != null) {
               console.warn(
                 `[errata] fix tag went nowhere: ${!n ? `id ${pid.slice(0, 32)} unknown` : n.label !== "Problem" ? `${pid.slice(0, 32)} is a ${n.label}, not a Problem` : "the problem was retracted \u2014 a retraction is not fixable"} \u2014 the fix was NOT recorded`
               );
@@ -82864,23 +82695,10 @@ function createWorkspaceEngine(opts) {
             }
           }
         }
-        const vulnerabilityTriages = /* @__PURE__ */ new Set();
-        for (const tr of plan.triages) {
-          if (tr.threadId && conflictingThreads.has(tr.threadId)) {
-            vulnerabilityTriages.add(tr);
-            continue;
-          }
-          const id = tr.symptomProblemId ?? (tr.threadId ? threads.get(tr.threadId) : void 0) ?? (tr.symptomStatement ? findingIds.get(tr.symptomStatement) : void 0);
-          if (id && store.getNode(id)?.label === "Vulnerability") {
-            vulnerabilityTriages.add(tr);
-            if (tr.evidence === "witnessed" && tr.causeDescription) triaged += recordVulnerabilityCause(store, id, [tr.causeDescription], t);
-          }
-        }
         if (opts.sharedStore && plan.triages.length > 0) {
           const fallbackId = sessionLastProblem.get(sessionId);
           const fallbackStatement = fallbackId ? store.getNode(fallbackId)?.description : void 0;
           for (const tr of plan.triages) {
-            if (vulnerabilityTriages.has(tr)) continue;
             let presentingStatement = tr.symptomStatement;
             let evidence = tr.evidence;
             if (!presentingStatement && tr.threadId) {
@@ -82898,7 +82716,7 @@ function createWorkspaceEngine(opts) {
               evidence = "inferred";
             }
             if (!presentingStatement) continue;
-            const presentingId = tr.symptomProblemId ?? (tr.threadId ? threads.get(tr.threadId) : void 0) ?? designProblemId(presentingStatement);
+            const presentingId = tr.symptomProblemId ?? designProblemId(presentingStatement);
             if (tr.causeId === presentingId) continue;
             try {
               recordTriageObservation(
@@ -82956,7 +82774,7 @@ function createWorkspaceEngine(opts) {
           }
         }
         for (const at of plan.attempts) {
-          const pid = at.problemId ?? (at.threadId ? threads.get(at.threadId) : void 0) ?? (at.boundStatement ? findingIds.get(at.boundStatement) ?? designProblemId(at.boundStatement) : void 0);
+          const pid = at.problemId ?? (at.threadId ? threads.get(at.threadId) : void 0) ?? (at.boundStatement ? designProblemId(at.boundStatement) : void 0);
           const node2 = pid ? store.getNode(pid) : void 0;
           if (!pid || !node2) continue;
           try {
@@ -82972,7 +82790,7 @@ function createWorkspaceEngine(opts) {
           }
         }
         const bindPid = (tag) => {
-          const pid = tag.problemId ?? (tag.threadId ? threads.get(tag.threadId) : void 0) ?? (tag.boundStatement ? findingIds.get(tag.boundStatement) ?? designProblemId(tag.boundStatement) : void 0) ?? inScopeProblemId ?? sessionLastProblem.get(sessionId);
+          const pid = tag.problemId ?? (tag.threadId ? threads.get(tag.threadId) : void 0) ?? (tag.boundStatement ? designProblemId(tag.boundStatement) : void 0) ?? inScopeProblemId ?? sessionLastProblem.get(sessionId);
           return pid && store.getNode(pid) ? pid : void 0;
         };
         const mintCiteEdge = (from, to, type, confidence, extraAttrs) => {
@@ -83126,12 +82944,7 @@ function createWorkspaceEngine(opts) {
           for (const [session, items2] of groups) {
             if (items2.length === 0) continue;
             try {
-              const wireItems = items2.map(({ nodeId, witnessKey }) => {
-                const node2 = store.getNode(nodeId);
-                const cloudId = node2?.attrs["privateFinding"] ? node2.attrs["cloudNodeId"] : void 0;
-                return { nodeId: typeof cloudId === "string" ? cloudId : nodeId, witnessKey };
-              });
-              const raw2 = await send(wireItems, session);
+              const raw2 = await send(items2, session);
               const d = {
                 recorded: raw2?.recorded ?? 0,
                 unmatched: raw2?.unmatched ?? 0,
@@ -83144,8 +82957,8 @@ function createWorkspaceEngine(opts) {
               duplicate += d.duplicate;
               selfGated += d.selfGated;
               const missing = new Set(d.unmatchedIds);
-              for (const [index, it] of items2.entries()) {
-                if (missing.has(wireItems[index].nodeId)) stillUnmatched.push({ channel, ...it, sessionKey: session, counted: isShipped(it.nodeId) });
+              for (const it of items2) {
+                if (missing.has(it.nodeId)) stillUnmatched.push({ channel, ...it, sessionKey: session, counted: isShipped(it.nodeId) });
                 else settled.add(it.witnessKey);
               }
             } catch (err2) {
@@ -83315,10 +83128,6 @@ function createWorkspaceEngine(opts) {
         // but nothing judgeable was cited.
         tagsVerdictNoHandle: dispositions.verdictNoHandle,
         tagsFlagAsHandle: dispositions.flagAsHandle,
-        tagsInvalidVulnerability: dispositions.invalidVulnerability,
-        vulnerabilitiesSeen,
-        vulnerabilitiesMinted,
-        vulnerabilitiesSuspected,
         unresolvedHandles,
         priorEdgesFlagOff,
         priorEdgesNoSource,
@@ -83386,7 +83195,7 @@ function createWorkspaceEngine(opts) {
       }
       turns = next.turns;
       nextOffset = next.nextOffset;
-      await new Promise((resolve7) => setImmediate(resolve7));
+      await new Promise((resolve8) => setImmediate(resolve8));
     }
   };
   const seenMessageIds = /* @__PURE__ */ new Set();
@@ -84013,6 +83822,7 @@ B: ${b}`,
 
 // src/daemon.ts
 async function startDaemon(opts) {
+  const processStartedAt = Date.now();
   const cfg = loadConfig();
   const merged = { ...cfg, cloudUrl: opts.cloudUrl ?? cfg.cloudUrl };
   if (opts.apiKey) {
@@ -84036,7 +83846,7 @@ async function startDaemon(opts) {
   const writeLockFile = (url2) => {
     writeFileSync23(
       engine.paths.daemonLock,
-      JSON.stringify({ pid: process.pid, webUiUrl: url2, startedAt: Date.now() }),
+      daemonLockPayload({ pid: process.pid, webUiUrl: url2, processStartedAt, version: DAEMON_VERSION }),
       "utf8"
     );
   };
@@ -84085,9 +83895,9 @@ async function startDaemon(opts) {
   };
 }
 async function listenServer(fetchFn, port) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const server = serve({ fetch: fetchFn, hostname: "127.0.0.1", port }, (info2) => {
-      resolve7({ server, port: info2.port });
+      resolve8({ server, port: info2.port });
     });
   });
 }
@@ -84278,7 +84088,7 @@ function instanceReceiptSequence(n) {
 // src/multi.ts
 init_dist();
 init_src5();
-import { existsSync as existsSync33, readFileSync as readFileSync35, unlinkSync as unlinkSync4, writeFileSync as writeFileSync25 } from "node:fs";
+import { existsSync as existsSync33, readFileSync as readFileSync35, unlinkSync as unlinkSync5, writeFileSync as writeFileSync25 } from "node:fs";
 import { resolve as pathResolve } from "node:path";
 
 // src/principle-sync.ts
@@ -84655,7 +84465,7 @@ function internalSymbolsFor(description, lexiconHas, publicIndex) {
 
 // src/instance-ingest.ts
 init_generalize_graph();
-var INSTANCE_LABELS = ["Problem", "Vulnerability", "Solution", "RootCause"];
+var INSTANCE_LABELS = ["Problem", "Solution", "RootCause"];
 var INSTANCE_EDGES = ["CAUSED_BY", "SOLVED_BY"];
 var ANCHOR_EDGES = ["OCCURS_IN", "DEPENDS_ON", "PERTAIN_TO", "CONCERNS"];
 var ANCHOR_TARGET_LABELS = ["Language", "Package", "Domain", "Component"];
@@ -84790,10 +84600,6 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       attrs: {
         scope: stripCodebaseScope(n.attrs["scope"]),
         ...n.attrs["kind"] ? { kind: n.attrs["kind"] } : {},
-        ...n.attrs["privateFinding"] ? { privateFinding: true } : {},
-        ...n.attrs["assessment"] ? { assessment: n.attrs["assessment"] } : {},
-        ...n.attrs["sourceClass"] ? { sourceClass: n.attrs["sourceClass"] } : {},
-        ...n.attrs["resolutionWitnessed"] ? { resolutionWitnessed: true, resolvedAt: n.attrs["resolvedAt"] } : {},
         ...n.attrs["resolvedAs"] ? { resolvedAs: n.attrs["resolvedAs"] } : {},
         ...preserved.length > 0 ? { preservedSymbols: preserved } : {},
         ...internal.length > 0 ? { internalSymbols: internal } : {}
@@ -84808,7 +84614,6 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
   const semanticEndpoints = /* @__PURE__ */ new Map();
   const includedByLabel = /* @__PURE__ */ new Map();
   const composition = {
-    privateTargetMissing: 0,
     candidates: 0,
     shipped: 0,
     cloudSourced: 0,
@@ -84854,15 +84659,11 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       if (walked.has(n.id)) continue;
       walked.add(n.id);
       composition.candidates++;
-      if ((n.attrs["privateFinding"] || n.label === "Vulnerability") && !opts.project) {
-        composition.privateTargetMissing++;
-        continue;
-      }
       if (n.attrs["source"] === "cloud") {
         composition.cloudSourced++;
         continue;
       }
-      if (n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) {
+      if (label === "Problem" && n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) {
         composition.falsePositive++;
         continue;
       }
@@ -84885,7 +84686,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
         composition.terminalRefused++;
         continue;
       }
-      if (!n.attrs["privateFinding"] && !noveltyAgainst(n, ref, noveltyOpts).ready) {
+      if (!noveltyAgainst(n, ref, noveltyOpts).ready) {
         composition.notNovel++;
         continue;
       }
@@ -84928,7 +84729,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
     }
     if (targets.length === 0) continue;
     const shipped = shippedById.get(sourceId);
-    if (shipped && !shipped.attrs["privateFinding"]) {
+    if (shipped) {
       const anchors = (label) => targets.filter((x) => x.t.label === label).map(
         (x) => label === "Language" ? langAnchor(x.t) : label === "Component" ? `component:${x.wireId}` : x.wireId
       ).filter((a) => a != null).sort();
@@ -85300,8 +85101,8 @@ var ConsolidateWorker = class {
       const id = this.nextId++;
       try {
         await this.ready;
-        return await new Promise((resolve7, reject) => {
-          this.pending.set(id, { resolve: resolve7, reject });
+        return await new Promise((resolve8, reject) => {
+          this.pending.set(id, { resolve: resolve8, reject });
           this.worker.postMessage({ ...req, id });
         });
       } finally {
@@ -85330,12 +85131,12 @@ var ConsolidateWorker = class {
     });
     noteIsolateSpawned();
     this.worker = worker;
-    this.ready = new Promise((resolve7, reject) => {
+    this.ready = new Promise((resolve8, reject) => {
       const onReady = (m) => {
         if (m?.ready) {
           worker.off("message", onReady);
           worker.off("error", onErr);
-          resolve7();
+          resolve8();
         }
       };
       const onErr = (err2) => {
@@ -85420,6 +85221,7 @@ init_config();
 
 // src/update.ts
 import { spawn as spawn2 } from "node:child_process";
+import { isAbsolute as isAbsolute5, join as join38 } from "node:path";
 var PACKAGE_NAME = "@inerrata-corporation/errata";
 function parse3(v) {
   const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z][0-9A-Za-z.-]*))?/.exec(v.trim());
@@ -85539,13 +85341,40 @@ function startUpdatePoller(opts) {
   };
 }
 function runNpmInstall(channel) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const child = spawn2("npm", ["install", "-g", `${PACKAGE_NAME}@${channel}`], {
       stdio: "inherit",
       shell: true
     });
-    child.on("close", (code) => resolve7(code ?? 1));
-    child.on("error", () => resolve7(1));
+    child.on("close", (code) => resolve8(code ?? 1));
+    child.on("error", () => resolve8(1));
+  });
+}
+async function runInstalledHookRefresh() {
+  const root = await new Promise((resolve8) => {
+    const child = spawn2("npm", ["root", "-g"], {
+      shell: true,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15e3
+    });
+    let output = "";
+    child.stdout.on("data", (chunk) => {
+      output += chunk;
+      if (output.length > 32768) child.kill();
+    });
+    child.on("error", () => resolve8(""));
+    child.on("close", (code) => resolve8(code === 0 ? output.trim() : ""));
+  });
+  if (!isAbsolute5(root)) return 1;
+  return new Promise((resolve8) => {
+    const child = spawn2(process.execPath, [join38(root, PACKAGE_NAME, "errata.mjs"), "install-hooks", "codex", "--refresh-existing"], {
+      windowsHide: true,
+      stdio: "inherit",
+      timeout: 3e4
+    });
+    child.on("error", () => resolve8(1));
+    child.on("close", (code) => resolve8(code ?? 1));
   });
 }
 
@@ -85560,7 +85389,7 @@ function liveCloudClient(src) {
   let current = null;
   let currentKey = "";
   let checkedAt = -Infinity;
-  const resolve7 = () => {
+  const resolve8 = () => {
     const t = now();
     if (current && t - checkedAt < recheckMs) return current;
     checkedAt = t;
@@ -85580,7 +85409,7 @@ function liveCloudClient(src) {
   };
   return new Proxy({}, {
     get(_target, prop) {
-      const client = resolve7();
+      const client = resolve8();
       const value = Reflect.get(client, prop, client);
       return typeof value === "function" ? value.bind(client) : value;
     }
@@ -86015,7 +85844,7 @@ async function syncHistoryRevision(opts) {
       changed += result.changed;
       remaining = result.remaining;
       if (!remaining || Date.now() - started2 >= (opts.budgetMs ?? 45e3)) break;
-      await new Promise((resolve7) => setImmediate(resolve7));
+      await new Promise((resolve8) => setImmediate(resolve8));
     }
     return { changed, remaining };
   })();
@@ -86119,7 +85948,7 @@ init_src7();
 init_src();
 import { execFile as execFile5 } from "node:child_process";
 import { readFileSync as readFileSync34 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
 // src/history-walk.ts
@@ -86519,8 +86348,8 @@ var GitBlobReader = class {
     if (this.failed) return Promise.reject(this.failed);
     if (/[\r\n]/.test(spec)) return Promise.resolve(null);
     const proc = this.start();
-    return new Promise((resolve7, reject) => {
-      this.queue.push({ resolve: resolve7, reject });
+    return new Promise((resolve8, reject) => {
+      this.queue.push({ resolve: resolve8, reject });
       proc.stdin.write(`${spec}
 `);
     });
@@ -86534,14 +86363,14 @@ var GitBlobReader = class {
     const proc = this.proc;
     this.proc = null;
     if (!proc || proc.exitCode !== null) return Promise.resolve();
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       const timer = setTimeout(() => {
         proc.kill();
-        resolve7();
+        resolve8();
       }, timeoutMs);
       proc.once("exit", () => {
         clearTimeout(timer);
-        resolve7();
+        resolve8();
       });
       proc.stdin.end();
     });
@@ -86666,7 +86495,7 @@ async function defaultGit(root, args2) {
 function readIgnoreLines(root, profile) {
   let lines = [];
   try {
-    lines = readFileSync34(join38(root, ".errataignore"), "utf8").split("\n");
+    lines = readFileSync34(join39(root, ".errataignore"), "utf8").split("\n");
   } catch {
   }
   return [...lines, ...profile.ignoreExtra ?? []].map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
@@ -87097,7 +86926,7 @@ init_cloud_auth();
 import { createHash as createHash19 } from "node:crypto";
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { existsSync as existsSync31, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 
 // src/device-poll.ts
 var THROTTLED_POLL_MIN_WAIT_MS = 11e3;
@@ -87186,7 +87015,7 @@ async function loginOAuthDevice(opts) {
   let deviceSession = null;
   let approvedInstallation = null;
   while (Date.now() < deadline) {
-    await (opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(waitMs);
+    await (opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(waitMs);
     waitMs = intervalMs;
     const poll = await fetchDevicePoll(fetchFn, device.token, {
       method: "POST",
@@ -87311,7 +87140,7 @@ async function loginOAuthLoopback(opts) {
   const state = randomState();
   const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
   const { code, redirectUri, clientId } = await new Promise(
-    (resolve7, reject) => {
+    (resolve8, reject) => {
       const server = createServer((req, res) => {
         const u = new URL(req.url ?? "/", "http://127.0.0.1");
         if (u.pathname !== "/callback") {
@@ -87334,7 +87163,7 @@ async function loginOAuthLoopback(opts) {
         res.writeHead(200, { "content-type": "text/html" });
         res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
         server.close();
-        resolve7({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
+        resolve8({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
       });
       let activeClientId = oauthClientId();
       server.on("error", reject);
@@ -87433,7 +87262,7 @@ async function linkThroughConsole(opts) {
   const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
   let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
   let waitMs = intervalMs;
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   while (Date.now() < deadline) {
     await sleep(waitMs);
     waitMs = intervalMs;
@@ -87555,7 +87384,7 @@ function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
   delete nextProfile.projectLinkHold;
   let wroteIgnore = false;
   if (decision.writeIgnoreStarter !== false) {
-    const target = join39(root, ".errataignore");
+    const target = join40(root, ".errataignore");
     if (!existsSync31(target)) {
       writeFileSync24(target, IGNORE_STARTER, "utf8");
       wroteIgnore = true;
@@ -87571,11 +87400,11 @@ init_registry();
 // src/adopt.ts
 init_git_remote();
 import { existsSync as existsSync32 } from "node:fs";
-import { dirname as dirname12, join as join40 } from "node:path";
+import { dirname as dirname12, join as join41 } from "node:path";
 function findGitRoot(absPath) {
   let dir = absPath;
   for (let depth = 0; depth < 64; depth++) {
-    if (existsSync32(join40(dir, ".git"))) return dir;
+    if (existsSync32(join41(dir, ".git"))) return dir;
     const parent = dirname12(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -88868,7 +88697,7 @@ async function startMultiDaemon(opts = {}) {
   const packageAutoAll = async () => {
     const out2 = /* @__PURE__ */ new Map();
     for (const r of records) {
-      await new Promise((resolve7) => setImmediate(resolve7));
+      await new Promise((resolve8) => setImmediate(resolve8));
       const done = markPass(`package-index:${r.entry.name}`);
       try {
         out2.set(
@@ -89607,7 +89436,7 @@ async function startMultiDaemon(opts = {}) {
       clearTimeout(codexWakeBoot);
       try {
         const cur = readFileSync35(lockPath, "utf8");
-        if (JSON.parse(cur).pid === process.pid) unlinkSync4(lockPath);
+        if (JSON.parse(cur).pid === process.pid) unlinkSync5(lockPath);
       } catch {
       }
       await new Promise(
@@ -90030,7 +89859,7 @@ import { spawnSync } from "node:child_process";
 
 // src/codex-runtime.ts
 import { readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 function resolveCodexExecutable(options = {}) {
   const platform = options.platform ?? process.platform;
   const env2 = options.env ?? process.env;
@@ -90045,13 +89874,13 @@ function resolveCodexExecutable(options = {}) {
   };
   for (const dir of (env2["PATH"] ?? env2["Path"] ?? "").split(";")) {
     if (!dir.trim()) continue;
-    const path2 = join41(dir.trim().replace(/^"|"$/g, ""), "codex.exe");
+    const path2 = join42(dir.trim().replace(/^"|"$/g, ""), "codex.exe");
     if (fileTime(path2) !== null) return path2;
   }
   if (!env2["LOCALAPPDATA"]) return "codex";
-  const root = join41(env2["LOCALAPPDATA"], "OpenAI", "Codex", "bin");
+  const root = join42(env2["LOCALAPPDATA"], "OpenAI", "Codex", "bin");
   try {
-    const candidates = readdirSync12(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join41(root, entry.name, "codex.exe")).map((path2) => ({ path: path2, mtime: fileTime(path2) })).filter((candidate) => candidate.mtime !== null).sort((a, b) => b.mtime - a.mtime || a.path.localeCompare(b.path));
+    const candidates = readdirSync12(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join42(root, entry.name, "codex.exe")).map((path2) => ({ path: path2, mtime: fileTime(path2) })).filter((candidate) => candidate.mtime !== null).sort((a, b) => b.mtime - a.mtime || a.path.localeCompare(b.path));
     return candidates[0]?.path ?? "codex";
   } catch {
     return "codex";
@@ -90167,12 +89996,14 @@ async function diagnoseInstallation(cfg, dependencies) {
 
 // src/codex-doctor.ts
 import { spawn as spawn4 } from "node:child_process";
+import { readFileSync as readFileSync37, statSync as statSync10 } from "node:fs";
+import { join as join44 } from "node:path";
 import { createInterface } from "node:readline";
 
 // src/codex-hooks.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync9, readFileSync as readFileSync36, writeFileSync as writeFileSync26 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync9, readFileSync as readFileSync36, renameSync as renameSync5, unlinkSync as unlinkSync6, writeFileSync as writeFileSync26 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 
 // src/hook-commands.ts
 function hookCurlCommand(port, path2 = "/api/hook") {
@@ -90211,9 +90042,12 @@ function buildCodexHooksToml(port, options) {
 
 // src/codex-hook-relay.ts
 var CODEX_RELAY_SOURCE = String.raw`// errata-managed: regenerated by errata install-hooks codex
-import { readFileSync, statSync } from 'node:fs';
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 const workspaceRoot = null;
+// Stdout closing early is not delivery. Never stamp a receipt on EPIPE.
+process.stdout.on('error', () => process.exit(0));
 
 try {
   const payload = JSON.parse(readFileSync(0, 'utf8') || '{}');
@@ -90225,6 +90059,19 @@ try {
   if (!Number.isInteger(port) || port < 1 || port > 65535) process.exit(0);
   const contexts = [];
   const messages = [];
+  const hash = (text) => createHash('sha256').update(text).digest('hex');
+  const boundedRead = (path, max) => statSync(path).size <= max ? readFileSync(path, 'utf8') : '';
+  const stateDir = workspaceRoot && join(workspaceRoot, '.errata', 'codex-hook-state');
+  const statePath = stateDir && typeof payload.session_id === 'string' && payload.session_id
+    ? join(stateDir, hash(payload.session_id) + '.json') : null;
+  let previous = {};
+  try {
+    if (statePath) {
+      const saved = JSON.parse(boundedRead(statePath, 4096));
+      if (saved && typeof saved === 'object') previous = saved;
+    }
+  } catch {}
+  let receipt = null;
   const post = async (endpoint, relay = false) => {
     try {
       const response = await fetch('http://127.0.0.1:' + port + '/api/' + endpoint, {
@@ -90244,33 +90091,52 @@ try {
   if (event === 'PreToolUse' || event === 'PostToolUse') await post('hook', true);
   // Stop sees the final assistant message, including turns with no tools.
   if (event === 'PostToolUse' || event === 'Stop') await post('turn');
-  if (['SessionStart', 'UserPromptSubmit', 'PostToolUse'].includes(event)) {
-    // Run after capture, so changes already rendered by the daemon arrive now.
-    // Background extraction finishing later arrives at the next tool boundary.
-    const available = await post('context-inject', true);
-    // Startup/resume/compaction must not depend on the daemon's busy event loop.
-    // Read only the installer's resolved workspace, never a caller-supplied path
-    // or tracked AGENTS.md. SessionStart already re-injects unconditionally;
-    // prompt/tool refreshes retain daemon hash deduplication (no repeated copies).
-    if (!available && event === 'SessionStart' && workspaceRoot) {
-      try {
-        const path = join(workspaceRoot, '.errata', 'context.md');
-        if (statSync(path).size <= 128 * 1024) {
-          const body = readFileSync(path, 'utf8').trim();
-          if (body) {
-            contexts.push('Errata loaded the maintained local workspace context while the daemon response was unavailable. This block REPLACES any earlier errata context block in this conversation. It is the last saved snapshot; live updates resume when the daemon responds.\n\n' + body);
-            if (!/^(0|off|false|no)$/i.test((process.env.ERRATA_RECALL_CARD || '').trim())) messages.push('⚡ errata · saved workspace priors loaded');
-          }
+  if (['SessionStart', 'UserPromptSubmit'].includes(event)) {
+    // Wake/route the engine, bounded independently of context delivery. Older
+    // daemons may stamp their HTTP dedup gate before a timed-out response arrives;
+    // that gate is deliberately NOT authoritative for this file-based relay.
+    await post('context-inject', !workspaceRoot);
+  }
+  if (workspaceRoot && ['SessionStart', 'UserPromptSubmit', 'PostToolUse'].includes(event)) {
+    let body = '';
+    try { body = boundedRead(join(workspaceRoot, '.errata', 'context.md'), 128 * 1024).trim(); } catch {}
+    if (body) {
+      const digest = hash(body.replace(/\r\n?/g, '\n')).slice(0, 16);
+      // Receipt is local to this graph + session, survives daemon restarts, and
+      // records stdout emission, not a server's intention to send a response.
+      if (event === 'SessionStart' || previous.hash !== digest) {
+        contexts.push('Errata loaded the maintained local workspace context. This block REPLACES any earlier errata context block in this conversation. It is the latest saved snapshot; the daemon maintains it as work proceeds.\n\n' + body);
+        if (!/^(0|off|false|no)$/i.test((process.env.ERRATA_RECALL_CARD || '').trim())) {
+          try {
+            const card = JSON.parse(boundedRead(join(workspaceRoot, '.errata', 'context-card.json'), 128 * 1024));
+            if (card.hash === digest && typeof card.line === 'string' && card.line) messages.push(card.line);
+          } catch { /* Never show a card for a different snapshot. */ }
         }
-      } catch { /* No saved context is honest; never substitute another project. */ }
+        receipt = { hash: digest, at: Date.now() };
+      }
+    } else if (event === 'SessionStart' || !previous.unavailable) {
+      messages.push('errata: workspace priors are unavailable; run errata doctor in this checkout.');
+      receipt = { unavailable: true, at: Date.now() };
     }
+  } else if (!workspaceRoot && event === 'PostToolUse') {
+    await post('context-inject', true);
   }
   if (contexts.length || messages.length) {
-    process.stdout.write(JSON.stringify({
+    await new Promise((resolve) => process.stdout.write(JSON.stringify({
       ...(messages.length ? { systemMessage: messages.join('\n\n') } : {}),
       ...(contexts.length ? { hookSpecificOutput: {
         hookEventName: event, additionalContext: contexts.join('\n\n'),
       } } : {}),
+    }), (error) => {
+      if (!error && receipt && statePath) {
+        try {
+          mkdirSync(stateDir, { recursive: true });
+          const temp = statePath + '.' + process.pid + '.tmp';
+          writeFileSync(temp, JSON.stringify(receipt), { mode: 0o600 });
+          renameSync(temp, statePath);
+        } catch { /* Read-only workspace: retry next time rather than drop context. */ }
+      }
+      resolve();
     }));
   }
 } catch { /* Invalid input is also fail-open. */ }
@@ -90282,8 +90148,35 @@ function buildCodexRelaySource(workspaceRoot) {
 // src/codex-hooks.ts
 init_checkout_root();
 var CODEX_HOOK_REVIEW_HELP = "Codex desktop: Settings > Hooks, select this project, expand each event and Trust the Errata hook. CLI users can use /hooks.";
-function hasCodexConfig(root, codexHome = process.env["CODEX_HOME"] || join42(homedir7(), ".codex")) {
-  return existsSync34(join42(root, ".codex")) || existsSync34(codexHome);
+function writeRelay(file2, source) {
+  if (existsSync34(file2) && readFileSync36(file2, "utf8") === source) return;
+  const temp = `${file2}.${process.pid}.tmp`;
+  try {
+    writeFileSync26(temp, source, { encoding: "utf8", mode: 384 });
+    renameSync5(temp, file2);
+  } finally {
+    if (existsSync34(temp)) unlinkSync6(temp);
+  }
+}
+function refreshCodexRelay(root) {
+  const config2 = join43(root, ".codex", "config.toml");
+  if (!existsSync34(config2)) return "absent";
+  const existing = readFileSync36(config2, "utf8");
+  if (!existing.includes(CODEX_HOOKS_BEGIN) && !existing.includes(CODEX_HOOKS_END)) return "absent";
+  replaceCodexHooks(existing, "");
+  const relay = join43(root, ".codex", "hooks", "errata-relay.mjs");
+  const prior = existsSync34(relay) ? readFileSync36(relay, "utf8") : "";
+  if (prior && !prior.startsWith("// errata-managed: regenerated by errata install-hooks codex")) {
+    throw new Error("Codex relay is not Errata-managed; preserved it. Run errata install-hooks codex to explicitly replace it.");
+  }
+  const source = buildCodexRelaySource(checkoutRootOf(root));
+  if (prior === source) return "current";
+  mkdirSync9(join43(root, ".codex", "hooks"), { recursive: true });
+  writeRelay(relay, source);
+  return "updated";
+}
+function hasCodexConfig(root, codexHome = process.env["CODEX_HOME"] || join43(homedir7(), ".codex")) {
+  return existsSync34(join43(root, ".codex")) || existsSync34(codexHome);
 }
 function replaceCodexHooks(existing, block) {
   const begin = existing.indexOf(CODEX_HOOKS_BEGIN);
@@ -90299,20 +90192,43 @@ function replaceCodexHooks(existing, block) {
   return existing.trimEnd() + (existing.trim() ? "\n\n" : "") + block;
 }
 function writeCodexHooks(root, port, nodePath = process.execPath) {
-  const dir = join42(root, ".codex");
-  const file2 = join42(dir, "config.toml");
-  const relay = join42(dir, "hooks", "errata-relay.mjs");
+  const dir = join43(root, ".codex");
+  const file2 = join43(dir, "config.toml");
+  const relay = join43(dir, "hooks", "errata-relay.mjs");
   const block = buildCodexHooksToml(port, { nodePath, relayPath: relay });
   const final = replaceCodexHooks(existsSync34(file2) ? readFileSync36(file2, "utf8") : "", block);
-  mkdirSync9(join42(dir, "hooks"), { recursive: true });
-  writeFileSync26(relay, buildCodexRelaySource(checkoutRootOf(root)), "utf8");
-  writeFileSync26(file2, final, "utf8");
+  mkdirSync9(join43(dir, "hooks"), { recursive: true });
+  writeRelay(relay, buildCodexRelaySource(checkoutRootOf(root)));
+  if (!existsSync34(file2) || readFileSync36(file2, "utf8") !== final) writeFileSync26(file2, final, "utf8");
   return file2;
 }
 
 // src/codex-doctor.ts
+init_checkout_root();
+function inspectCodexRelay(cwd) {
+  const root = nearestGitRoot(cwd) ?? cwd;
+  try {
+    const source = readFileSync37(join44(root, ".codex", "hooks", "errata-relay.mjs"), "utf8");
+    if (source === buildCodexRelaySource(checkoutRootOf(root))) {
+      return { id: "codex_relay", status: "pass", detail: "Installed Codex relay matches this Errata version" };
+    }
+  } catch {
+  }
+  return { id: "codex_relay", status: "fail", detail: "Codex relay is missing or outdated; run errata install-hooks codex --refresh-existing, or errata install-hooks codex for a new setup" };
+}
+function inspectCodexContext(cwd) {
+  const root = checkoutRootOf(nearestGitRoot(cwd) ?? cwd);
+  try {
+    const file2 = join44(root, ".errata", "context.md");
+    if (statSync10(file2).size <= 128 * 1024 && readFileSync37(file2, "utf8").trim()) {
+      return { id: "codex_context", status: "pass", detail: "Saved workspace context is readable by the relay; this does not prove live daemon freshness" };
+    }
+  } catch {
+  }
+  return { id: "codex_context", status: "fail", detail: "No usable saved workspace context; run errata start here and check the daemon log if context.md remains unavailable" };
+}
 function readCodexHookState(cwd, options = {}) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const child = spawn4(options.bin ?? resolveCodexExecutable(), options.args ?? ["app-server", "--stdio"], {
       cwd,
       windowsHide: true,
@@ -90328,9 +90244,14 @@ function readCodexHookState(cwd, options = {}) {
       settled = true;
       clearTimeout(timer);
       lines.close();
+      const reap = setTimeout(() => child.kill("SIGKILL"), 1e3);
+      reap.unref();
+      child.once("close", () => {
+        clearTimeout(reap);
+        if (error48) reject(error48);
+        else resolve8({ ...hooks, features });
+      });
       child.kill();
-      if (error48) reject(error48);
-      else resolve7({ ...hooks, features });
     };
     const timer = setTimeout(() => finish(new Error("Codex hook inspection timed out")), options.timeoutMs ?? 1e4);
     const send = (id, method, params) => {
@@ -90395,10 +90316,11 @@ function assessCodexHooks(state, platform = process.platform) {
   return checks.length ? checks : check2("pass", "Codex discovers enabled, trusted Errata hooks; verify live context and capture in a session");
 }
 async function diagnoseCodexHooks(cwd) {
+  const local = [inspectCodexRelay(cwd), inspectCodexContext(cwd)];
   try {
-    return assessCodexHooks(await readCodexHookState(cwd));
+    return [...local, ...assessCodexHooks(await readCodexHookState(cwd))];
   } catch (error48) {
-    return [{ id: "codex_hooks", status: "fail", detail: error48 instanceof Error ? error48.message : "Cannot verify Codex hooks" }];
+    return [...local, { id: "codex_hooks", status: "fail", detail: error48 instanceof Error ? error48.message : "Cannot verify Codex hooks" }];
   }
 }
 
@@ -90472,10 +90394,51 @@ function consolidationGapMs(lastPassMs, policy) {
   return Math.max(policy.baseFloorMs, lastPassMs * policy.dutyFactor);
 }
 
+// src/codex-hook-refresh.ts
+init_checkout_root();
+import { existsSync as existsSync35, readdirSync as readdirSync13, readFileSync as readFileSync38 } from "node:fs";
+import { dirname as dirname13, join as join45, resolve as resolve7 } from "node:path";
+init_registry();
+function codexHookRoots(roots) {
+  const found = new Set(roots.map((root) => resolve7(root)));
+  for (const root of [...found]) {
+    const main2 = mainCheckoutOfWorktree(root) ?? root;
+    found.add(main2);
+    const dir = join45(main2, ".git", "worktrees");
+    if (!existsSync35(dir)) continue;
+    let names;
+    try {
+      names = readdirSync13(dir);
+    } catch {
+      continue;
+    }
+    for (const name2 of names) {
+      try {
+        const checkout = dirname13(readFileSync38(join45(dir, name2, "gitdir"), "utf8").trim());
+        if (mainCheckoutOfWorktree(checkout) === main2) found.add(checkout);
+      } catch {
+      }
+    }
+  }
+  return [...found];
+}
+function refreshInstalledCodexRelays(roots = listWorkspaceEntries().map((entry) => entry.path)) {
+  const results = [];
+  for (const root of codexHookRoots(roots)) {
+    try {
+      const status = refreshCodexRelay(root);
+      if (status !== "absent") results.push({ root, status });
+    } catch (error48) {
+      results.push({ root, status: "error", detail: error48 instanceof Error ? error48.message : String(error48) });
+    }
+  }
+  return results;
+}
+
 // src/claude-statusline.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync10, readFileSync as readFileSync37, writeFileSync as writeFileSync27 } from "node:fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync10, readFileSync as readFileSync39, writeFileSync as writeFileSync27 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname13, join as join43 } from "node:path";
+import { dirname as dirname14, join as join46 } from "node:path";
 var STATUSLINE_RELAY_SOURCE = String.raw`// errata-managed: regenerated by errata init / install-hooks claude
 import { readFileSync } from 'node:fs';
 
@@ -90508,8 +90471,8 @@ function removeProjectStatusLine(settings) {
   return true;
 }
 function userClaudeSettingsPath() {
-  const base = process.env["CLAUDE_CONFIG_DIR"] ?? join43(homedir8(), ".claude");
-  return join43(base, "settings.json");
+  const base = process.env["CLAUDE_CONFIG_DIR"] ?? join46(homedir8(), ".claude");
+  return join46(base, "settings.json");
 }
 function ensureUserStatusLine(opts) {
   const env2 = opts.env ?? process.env;
@@ -90517,9 +90480,9 @@ function ensureUserStatusLine(opts) {
   if (off === "0" || off === "off" || off === "false" || off === "no") return "disabled";
   const settingsPath = opts.userSettingsPath ?? userClaudeSettingsPath();
   let settings = {};
-  if (existsSync35(settingsPath)) {
+  if (existsSync36(settingsPath)) {
     try {
-      const parsed = JSON.parse(readFileSync37(settingsPath, "utf8"));
+      const parsed = JSON.parse(readFileSync39(settingsPath, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "unreadable";
       settings = parsed;
     } catch {
@@ -90527,15 +90490,15 @@ function ensureUserStatusLine(opts) {
     }
   }
   if (settings["statusLine"] !== void 0 && !isErrataStatusLine(settings["statusLine"])) return "kept-own";
-  const relay = join43(opts.relayDir, STATUSLINE_RELAY_FILE);
+  const relay = join46(opts.relayDir, STATUSLINE_RELAY_FILE);
   mkdirSync10(opts.relayDir, { recursive: true });
-  if (!existsSync35(relay) || readFileSync37(relay, "utf8") !== STATUSLINE_RELAY_SOURCE) {
+  if (!existsSync36(relay) || readFileSync39(relay, "utf8") !== STATUSLINE_RELAY_SOURCE) {
     writeFileSync27(relay, STATUSLINE_RELAY_SOURCE, "utf8");
   }
   const next = buildStatusLine(opts.port, opts.nodePath ?? process.execPath, relay);
   if (JSON.stringify(settings["statusLine"]) === JSON.stringify(next)) return "unchanged";
   settings["statusLine"] = next;
-  mkdirSync10(dirname13(settingsPath), { recursive: true });
+  mkdirSync10(dirname14(settingsPath), { recursive: true });
   writeFileSync27(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
   return "installed";
 }
@@ -90959,14 +90922,14 @@ async function cmdInit() {
   if (!skipHooks) {
     console.log("");
     console.log("installing harness hooks...");
-    const { existsSync: existsSync37 } = await import("node:fs");
-    const { join: join45 } = await import("node:path");
+    const { existsSync: existsSync38 } = await import("node:fs");
+    const { join: join48 } = await import("node:path");
     try {
       await installClaudeHooks(port);
     } catch (err2) {
       console.warn(`  \u26A0\uFE0F  Claude hook install failed: ${err2 instanceof Error ? err2.message : err2}`);
     }
-    if (existsSync37(join45(ROOT, ".cursor"))) {
+    if (existsSync38(join48(ROOT, ".cursor"))) {
       try {
         await installCursorMcpConfig();
       } catch (err2) {
@@ -91050,6 +91013,7 @@ async function cmdNotifyTest() {
   }
 }
 async function cmdStart() {
+  refreshExistingCodexHooks();
   if (!loadProfile(ROOT)) {
     const cfg = loadConfig();
     const locator = detectRepoLocator(ROOT);
@@ -91159,9 +91123,9 @@ async function cmdStatus() {
     console.log(`    stack:     ${profile.stack.join(", ") || "(none)"}`);
     console.log(`    languages: ${profile.languages.join(", ") || "(none)"}`);
   }
-  console.log(`  graph db:  ${existsSync36(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
-  console.log(`  event log: ${existsSync36(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
-  if (existsSync36(paths.castalia)) {
+  console.log(`  graph db:  ${existsSync37(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
+  console.log(`  event log: ${existsSync37(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
+  if (existsSync37(paths.castalia)) {
     try {
       const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
       const store = openGraphStore2({ path: paths.castalia });
@@ -91497,6 +91461,9 @@ async function cmdUpdate(args2) {
 `);
   const code = await runNpmInstall(channel);
   if (code === 0) {
+    if (await runInstalledHookRefresh() !== 0) {
+      console.warn("[!] Package updated, but some Codex relays could not be refreshed. Run `errata install-hooks codex --refresh-existing`; daemon startup also retries.");
+    }
     console.log(`
 [OK] updated to ${status.latest}. Restart the daemon to run it:`);
     console.log(`  errata stop      (autostart relaunches it at next logon, or run 'errata dash')`);
@@ -92129,11 +92096,11 @@ async function cmdInstallationProfile(args2) {
 }
 async function cmdReview() {
   const paths = workspacePaths(ROOT);
-  if (!existsSync36(paths.reviewQueue)) {
+  if (!existsSync37(paths.reviewQueue)) {
     console.log("(review queue empty)");
     return;
   }
-  const queue = JSON.parse(readFileSync38(paths.reviewQueue, "utf8"));
+  const queue = JSON.parse(readFileSync40(paths.reviewQueue, "utf8"));
   if (queue.length === 0) {
     console.log("(review queue empty)");
     return;
@@ -92804,7 +92771,7 @@ async function gatherRepo(store, ws) {
   };
 }
 async function gatherReportData(generatedAt) {
-  const { existsSync: existsSync37 } = await import("node:fs");
+  const { existsSync: existsSync38 } = await import("node:fs");
   const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
   const cfg = loadConfig();
   const outbound = cfg.consent.sync ? "auto" : "off";
@@ -92812,7 +92779,7 @@ async function gatherReportData(generatedAt) {
   for (const ws of listWorkspaces()) {
     if (ws.missing) continue;
     const dbPath = workspacePaths(ws.path).castalia;
-    if (!existsSync37(dbPath)) continue;
+    if (!existsSync38(dbPath)) continue;
     let store = null;
     try {
       store = openGraphStore2({ path: dbPath });
@@ -92856,8 +92823,8 @@ async function cmdReport(args2) {
   const outDir = workspacePaths(ROOT).configDir;
   mkdirSync11(outDir, { recursive: true });
   const files = renderReport2(data, { includeFutureVerbs });
-  for (const f of files) writeFileSync28(join44(outDir, f.name), f.html, "utf8");
-  const indexPath = join44(outDir, "report.html");
+  for (const f of files) writeFileSync28(join47(outDir, f.name), f.html, "utf8");
+  const indexPath = join47(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
   console.log(
     `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
@@ -92901,7 +92868,7 @@ function spawnDaemonDetached(options = {}) {
   try {
     const logPath = daemonLogPath();
     try {
-      if (statSync10(logPath).size > 5 * 1024 * 1024) renameSync4(logPath, `${logPath}.1`);
+      if (statSync11(logPath).size > 5 * 1024 * 1024) renameSync6(logPath, `${logPath}.1`);
     } catch {
     }
     out2 = openSync2(logPath, "a");
@@ -92951,6 +92918,10 @@ async function cmdInstallHooks(args2) {
       await installCursorMcpConfig();
       return;
     case "codex":
+      if (args2.includes("--refresh-existing")) {
+        if (!refreshExistingCodexHooks()) process.exitCode = 1;
+        return;
+      }
       await installCodexHooks(port);
       return;
     case "opencode":
@@ -92966,24 +92937,24 @@ async function cmdInstallHooks(args2) {
   }
 }
 async function installOpencodePlugin(port) {
-  const { mkdirSync: mkdirSync11, existsSync: existsSync37, readFileSync: readFileSync39, writeFileSync: writeFileSync28 } = await import("node:fs");
-  const { join: join45 } = await import("node:path");
-  const dir = join45(ROOT, ".opencode", "plugin");
-  if (!existsSync37(dir)) mkdirSync11(dir, { recursive: true });
-  const file2 = join45(dir, "inerrata.js");
-  if (existsSync37(file2)) {
-    const head2 = readFileSync39(file2, "utf8").split("\n")[0] ?? "";
+  const { mkdirSync: mkdirSync11, existsSync: existsSync38, readFileSync: readFileSync41, writeFileSync: writeFileSync28 } = await import("node:fs");
+  const { join: join48 } = await import("node:path");
+  const dir = join48(ROOT, ".opencode", "plugin");
+  if (!existsSync38(dir)) mkdirSync11(dir, { recursive: true });
+  const file2 = join48(dir, "inerrata.js");
+  if (existsSync38(file2)) {
+    const head2 = readFileSync41(file2, "utf8").split("\n")[0] ?? "";
     if (head2.trim() !== OPENCODE_PLUGIN_MARKER) {
       console.error(`refusing to overwrite ${file2}: not an errata-managed plugin (line 1 lacks the marker)`);
       process.exit(2);
     }
   }
   writeFileSync28(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
-  const cfgFile = join45(ROOT, "opencode.json");
+  const cfgFile = join48(ROOT, "opencode.json");
   let cfg = { $schema: "https://opencode.ai/config.json" };
-  if (existsSync37(cfgFile)) {
+  if (existsSync38(cfgFile)) {
     try {
-      cfg = JSON.parse(readFileSync39(cfgFile, "utf8"));
+      cfg = JSON.parse(readFileSync41(cfgFile, "utf8"));
     } catch {
       console.error(`refusing to touch invalid JSON at ${cfgFile} \u2014 fix it and re-run`);
       process.exit(2);
@@ -93021,15 +92992,15 @@ function ensureStatusLine(port) {
   }
 }
 async function installClaudeHooks(port) {
-  const { mkdirSync: mkdirSync11, existsSync: existsSync37, readFileSync: readFileSync39, writeFileSync: writeFileSync28 } = await import("node:fs");
-  const { join: join45 } = await import("node:path");
-  const dir = join45(ROOT, ".claude");
-  if (!existsSync37(dir)) mkdirSync11(dir, { recursive: true });
-  const file2 = join45(dir, "settings.json");
+  const { mkdirSync: mkdirSync11, existsSync: existsSync38, readFileSync: readFileSync41, writeFileSync: writeFileSync28 } = await import("node:fs");
+  const { join: join48 } = await import("node:path");
+  const dir = join48(ROOT, ".claude");
+  if (!existsSync38(dir)) mkdirSync11(dir, { recursive: true });
+  const file2 = join48(dir, "settings.json");
   let settings = {};
-  if (existsSync37(file2)) {
+  if (existsSync38(file2)) {
     try {
-      settings = JSON.parse(readFileSync39(file2, "utf8"));
+      settings = JSON.parse(readFileSync41(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -93081,7 +93052,7 @@ async function installClaudeHooks(port) {
   console.log(`installed Claude Code hooks \u2192 ${file2}`);
   console.log(`  ${ensureStatusLine(port)}`);
   await installClaudeMcpConfig();
-  const claudeMd = join45(ROOT, "CLAUDE.md");
+  const claudeMd = join48(ROOT, "CLAUDE.md");
   const recall = writeManagedBlock(claudeMd, { body: RECALL_FIRST_BLOCK });
   if (recall.kind === "collision") {
     console.warn(
@@ -93093,15 +93064,15 @@ async function installClaudeHooks(port) {
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
 }
 async function installClaudeMcpConfig() {
-  const { mkdirSync: mkdirSync11, existsSync: existsSync37, readFileSync: readFileSync39, writeFileSync: writeFileSync28 } = await import("node:fs");
-  const { join: join45, dirname: dirname14 } = await import("node:path");
-  const file2 = join45(ROOT, ".mcp.json");
-  const dir = dirname14(file2);
-  if (!existsSync37(dir)) mkdirSync11(dir, { recursive: true });
+  const { mkdirSync: mkdirSync11, existsSync: existsSync38, readFileSync: readFileSync41, writeFileSync: writeFileSync28 } = await import("node:fs");
+  const { join: join48, dirname: dirname15 } = await import("node:path");
+  const file2 = join48(ROOT, ".mcp.json");
+  const dir = dirname15(file2);
+  if (!existsSync38(dir)) mkdirSync11(dir, { recursive: true });
   let cfg = {};
-  if (existsSync37(file2)) {
+  if (existsSync38(file2)) {
     try {
-      cfg = JSON.parse(readFileSync39(file2, "utf8"));
+      cfg = JSON.parse(readFileSync41(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -93115,15 +93086,15 @@ async function installClaudeMcpConfig() {
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses / show / similar`);
 }
 async function installCursorMcpConfig() {
-  const { mkdirSync: mkdirSync11, existsSync: existsSync37, readFileSync: readFileSync39, writeFileSync: writeFileSync28 } = await import("node:fs");
-  const { join: join45 } = await import("node:path");
-  const dir = join45(ROOT, ".cursor");
-  if (!existsSync37(dir)) mkdirSync11(dir, { recursive: true });
-  const file2 = join45(dir, "mcp.json");
+  const { mkdirSync: mkdirSync11, existsSync: existsSync38, readFileSync: readFileSync41, writeFileSync: writeFileSync28 } = await import("node:fs");
+  const { join: join48 } = await import("node:path");
+  const dir = join48(ROOT, ".cursor");
+  if (!existsSync38(dir)) mkdirSync11(dir, { recursive: true });
+  const file2 = join48(dir, "mcp.json");
   let cfg = {};
-  if (existsSync37(file2)) {
+  if (existsSync38(file2)) {
     try {
-      cfg = JSON.parse(readFileSync39(file2, "utf8"));
+      cfg = JSON.parse(readFileSync41(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -93142,7 +93113,7 @@ async function installCodexHooks(port) {
   const gitRoot = nearestGitRoot(process.cwd());
   const hookRoot = gitRoot && mainCheckoutOfWorktree(gitRoot) ? gitRoot : ROOT;
   const file2 = writeCodexHooks(hookRoot, port);
-  const instructions = writeManagedBlock(join44(hookRoot, "AGENTS.md"), {
+  const instructions = writeManagedBlock(join47(hookRoot, "AGENTS.md"), {
     body: AGENTS_POINTER_BODY,
     stable: true
   });
@@ -93160,6 +93131,21 @@ async function installCodexHooks(port) {
   console.log("  Run `errata doctor` here to check hook discovery and trust; installation alone is not activation.");
   console.log("  Respect an explicit [features] hooks = false setting (older builds use codex_hooks).");
   console.log("  Older Codex versions may not support every event; update if hooks do not fire.");
+  for (const check2 of await diagnoseCodexHooks(hookRoot)) {
+    console.log(`  ${check2.status === "pass" ? "\u2713" : "!"} ${check2.detail}`);
+  }
+}
+function refreshExistingCodexHooks() {
+  let ok = true;
+  const roots = [...listWorkspaceEntries().map((entry) => entry.path), process.cwd()];
+  for (const result of refreshInstalledCodexRelays(roots)) {
+    if (result.status === "updated") console.log(`updated existing Codex relay \u2192 ${result.root} (hook definitions preserved)`);
+    if (result.status === "error") {
+      ok = false;
+      console.warn(`Codex relay refresh needs attention in ${result.root}: ${result.detail}`);
+    }
+  }
+  return ok;
 }
 async function refreshLinkedCodexHooks(args2) {
   if (args2.includes("--skip-hooks") || !hasCodexConfig(ROOT)) return;
@@ -93314,6 +93300,7 @@ function installLogTimestamps() {
 async function cmdDash(args2) {
   process.title = "errata-daemon";
   installLogTimestamps();
+  refreshExistingCodexHooks();
   const portIdx = args2.indexOf("--port");
   const port = portIdx >= 0 && args2[portIdx + 1] ? Number(args2[portIdx + 1]) : 7891;
   const reindexOnStart = !args2.includes("--no-reindex");
@@ -93468,7 +93455,7 @@ async function cmdDash(args2) {
   const hotspotScanMark = /* @__PURE__ */ new Map();
   const HOTSPOT_FANIN = 20;
   const runNightlyPass = async (dueIds) => {
-    const yieldToLoop2 = () => new Promise((resolve7) => setImmediate(resolve7));
+    const yieldToLoop2 = () => new Promise((resolve8) => setImmediate(resolve8));
     const fullReclusterPass = nightlyCount++ % FULL_RECLUSTER_EVERY === 0;
     const m = dueIds ? await handle2.nightlyFor(dueIds) : await handle2.nightlyAll();
     let skillsLearned = 0;
@@ -93546,9 +93533,9 @@ async function cmdDash(args2) {
       await yieldToLoop2();
       try {
         const items = selectDurableMemory(handle2.sharedStore, r.engine.profile, {
-          atCommit: readGitRefState(join44(r.root, ".git")).sha ?? void 0
+          atCommit: readGitRefState(join47(r.root, ".git")).sha ?? void 0
         });
-        const res = bleedRules(join44(r.root, ".claude", "rules"), items);
+        const res = bleedRules(join47(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(
             `[rules:${r.entry.name}] ${res.written} collective principle(s) \u2192 .claude/rules` + (res.pruned ? `, ${res.pruned} pruned` : "")