@inerrata-corporation/errata 2.0.6-dev.2564 → 2.0.6-dev.2571

package/errata.mjs

@@ -20549,6 +20549,7 @@ function upgradeAnchorHints(store, workspaceId2, ts) {
   let upgraded = 0;
   let standing = 0;
   let unresolvable = 0;
+  let blocked = 0;
   const filesByPath = /* @__PURE__ */ new Map();
   for (const f of store.findNodesByLabel("File")) {
     if (f.attrs["workspaceId"] && f.attrs["workspaceId"] !== workspaceId2) continue;
@@ -20571,9 +20572,11 @@ function upgradeAnchorHints(store, workspaceId2, ts) {
       consumeAnchorHint(store, p, ts);
       upgraded++;
       standing--;
+    } else {
+      blocked++;
     }
   }
-  return { upgraded, standing, unresolvable };
+  return { upgraded, standing, unresolvable, blocked };
 }
 function resolveDesignProblemByStatement(store, statement, fixNote, t) {
   const problemId = identityId({ kind: "DesignProblem", statement });
@@ -23699,10 +23702,14 @@ var init_mechanism_liveness = __esm({
         // "the field exists at all", the revisit-sweep precedent.
         fed: { labels: ["Problem"], attr: "anchorHint", minFraction: 0 },
         effectCounter: "anchorHintsUpgraded",
-        // The standing hints ARE the queue — without the gauge, "found nothing"
-        // and "runs forever against work it can never clear" read identically.
-        backlogCounter: "anchorHintsStanding",
-        note: "drains as hinted files change; contentChangedAt is forward-only so the backlog moves with real edits"
+        // The gauge is the work the mechanism CAN act on and didn't: hints whose file
+        // changed after the hint yet never upgraded. `anchorHintsStanding` also
+        // counts hints still waiting for their file to be edited — a queue that
+        // drains on the user's schedule, which read STUCK over any quiet stretch
+        // (2026-09-23: 71 standing, none edited, toasted daily). Standing stays in
+        // the ledger as information; it just cannot declare a stall.
+        backlogCounter: "anchorHintsBlocked",
+        note: "a hint upgrades when its file is next edited; stuck means an edited file's hint failed to anchor"
       },
       {
         id: "fold-candidate-resolve",
@@ -28996,6 +29003,186 @@ var init_review2 = __esm({
   }
 });
 
+// src/consent.ts
+function effectiveConsent(config2, profile) {
+  const c = profile?.consoleConsents;
+  if (c) return { sync: c.sync, telemetry: c.telemetry, contributePackages: c.contributePackages };
+  return {
+    sync: config2.consent.sync,
+    telemetry: config2.consent.telemetry,
+    contributePackages: config2.consent.contributePackages
+  };
+}
+var init_consent = __esm({
+  "src/consent.ts"() {
+    "use strict";
+  }
+});
+
+// src/git-remote.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6, statSync } from "node:fs";
+import { isAbsolute, join as join6, resolve } from "node:path";
+function resolveGitDir(root) {
+  const dotGit = join6(root, ".git");
+  try {
+    const st = statSync(dotGit);
+    if (st.isDirectory()) return dotGit;
+    const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync6(dotGit, "utf8"));
+    if (!m) return null;
+    const dir = m[1];
+    return isAbsolute(dir) ? dir : resolve(root, dir);
+  } catch {
+    return null;
+  }
+}
+function gitConfigPath(gitDir) {
+  const commondirFile = join6(gitDir, "commondir");
+  if (existsSync8(commondirFile)) {
+    const common = readFileSync6(commondirFile, "utf8").trim();
+    const commonDir = isAbsolute(common) ? common : resolve(gitDir, common);
+    return join6(commonDir, "config");
+  }
+  return join6(gitDir, "config");
+}
+function readRemotes(root) {
+  const gitDir = resolveGitDir(root);
+  if (!gitDir) return [];
+  const cfgPath = gitConfigPath(gitDir);
+  if (!existsSync8(cfgPath)) return [];
+  let txt;
+  try {
+    txt = readFileSync6(cfgPath, "utf8");
+  } catch {
+    return [];
+  }
+  const out2 = [];
+  const sectionRe = /^\s*\[remote "([^"]+)"\]\s*$([\s\S]*?)(?=^\s*\[|\s*$(?![\s\S]))/gm;
+  for (const m of txt.matchAll(sectionRe)) {
+    const url2 = /^\s*url\s*=\s*(.+?)\s*$/m.exec(m[2])?.[1];
+    if (url2) out2.push({ name: m[1], url: url2 });
+  }
+  return out2;
+}
+function detectRepoLocator(root, remote) {
+  const remotes = readRemotes(root);
+  if (remotes.length === 0) return null;
+  const pick2 = remote ? remotes.find((r) => r.name === remote) ?? null : remotes.find((r) => r.name === "origin") ?? (remotes.length === 1 ? remotes[0] : null);
+  return pick2 ? normalizeRepoLocator(pick2.url) : null;
+}
+var init_git_remote = __esm({
+  "src/git-remote.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
+// src/profile.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { join as join7 } from "node:path";
+function workspaceId(root) {
+  return "wp_" + createHash3("sha256").update(root).digest("hex").slice(0, 12);
+}
+function sessionOriginKey(sessionId) {
+  if (!sessionId) return void 0;
+  return "ws_" + createHash3("sha256").update(sessionId).digest("hex").slice(0, 12);
+}
+function refreshRepoLocator(root, profile) {
+  const detected = detectRepoLocator(root, profile.repoRemote);
+  if (!detected || detected === profile.repoLocator) return false;
+  if (profile.repoLocator) {
+    const aliases = new Set(profile.repoLocatorAliases ?? []);
+    aliases.add(profile.repoLocator);
+    aliases.delete(detected);
+    profile.repoLocatorAliases = [...aliases];
+  }
+  profile.repoLocator = detected;
+  saveProfile(root, profile);
+  return true;
+}
+function loadProfile(root) {
+  const p = workspacePaths(root);
+  if (!existsSync9(p.workspaceJson)) return null;
+  return JSON.parse(readFileSync7(p.workspaceJson, "utf8"));
+}
+function saveProfile(root, profile) {
+  const p = workspacePaths(root);
+  ensureDir(p.configDir);
+  writeFileSync7(p.workspaceJson, JSON.stringify(profile, null, 2), "utf8");
+}
+function autodetectProfile(root) {
+  const id = workspaceId(root);
+  const name2 = root.split(/[\\/]/).filter(Boolean).pop() ?? "workspace";
+  const p = emptyProfile(id, name2);
+  const locator = detectRepoLocator(root);
+  if (locator) p.repoLocator = locator;
+  const pkgPath = join7(root, "package.json");
+  if (existsSync9(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
+      const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+      p.languages.push("javascript");
+      if (existsSync9(join7(root, "tsconfig.json")) || deps["typescript"]) {
+        p.languages.push("typescript");
+      }
+      const nodeVer = pkg.engines?.node?.trim();
+      p.stack.push(nodeVer ? `node@${nodeVer}` : "node");
+      const interesting = [
+        "next",
+        "react",
+        "vue",
+        "svelte",
+        "express",
+        "hono",
+        "fastify",
+        "@modelcontextprotocol/sdk"
+      ];
+      for (const k of interesting) {
+        if (deps[k]) p.stack.push(k);
+      }
+    } catch {
+    }
+  }
+  const pyproject = join7(root, "pyproject.toml");
+  if (existsSync9(pyproject)) {
+    try {
+      const txt = readFileSync7(pyproject, "utf8");
+      const py = /python\s*=\s*"([^"]+)"/.exec(txt)?.[1];
+      p.languages.push("python");
+      p.stack.push(`python@${py ?? "3"}`);
+      const candidates = ["fastapi", "django", "flask", "mcp", "pytest"];
+      for (const k of candidates) {
+        if (new RegExp(`\\b${k}\\b`, "i").test(txt)) p.stack.push(k);
+      }
+    } catch {
+    }
+  }
+  const reqs = join7(root, "requirements.txt");
+  if (existsSync9(reqs)) {
+    if (!p.languages.includes("python")) p.languages.push("python");
+    if (!p.stack.includes("python@3")) p.stack.push("python@3");
+  }
+  if (existsSync9(join7(root, "go.mod"))) {
+    p.languages.push("go");
+    p.stack.push("go");
+  }
+  if (existsSync9(join7(root, "Cargo.toml"))) {
+    p.languages.push("rust");
+    p.stack.push("rust");
+  }
+  p.languages = [...new Set(p.languages)];
+  p.stack = [...new Set(p.stack)];
+  return p;
+}
+var init_profile2 = __esm({
+  "src/profile.ts"() {
+    "use strict";
+    init_src2();
+    init_paths();
+    init_git_remote();
+  }
+});
+
 // src/identity.ts
 function resolveWorkspaceIdentity(cfg, entry, env2 = process.env) {
   if (env2["ERRATA_CONFIG_PATH"]) {
@@ -29071,70 +29258,13 @@ var init_identity2 = __esm({
   }
 });
 
-// src/git-remote.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, statSync } from "node:fs";
-import { isAbsolute, join as join6, resolve } from "node:path";
-function resolveGitDir(root) {
-  const dotGit = join6(root, ".git");
-  try {
-    const st = statSync(dotGit);
-    if (st.isDirectory()) return dotGit;
-    const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync6(dotGit, "utf8"));
-    if (!m) return null;
-    const dir = m[1];
-    return isAbsolute(dir) ? dir : resolve(root, dir);
-  } catch {
-    return null;
-  }
-}
-function gitConfigPath(gitDir) {
-  const commondirFile = join6(gitDir, "commondir");
-  if (existsSync8(commondirFile)) {
-    const common = readFileSync6(commondirFile, "utf8").trim();
-    const commonDir = isAbsolute(common) ? common : resolve(gitDir, common);
-    return join6(commonDir, "config");
-  }
-  return join6(gitDir, "config");
-}
-function readRemotes(root) {
-  const gitDir = resolveGitDir(root);
-  if (!gitDir) return [];
-  const cfgPath = gitConfigPath(gitDir);
-  if (!existsSync8(cfgPath)) return [];
-  let txt;
-  try {
-    txt = readFileSync6(cfgPath, "utf8");
-  } catch {
-    return [];
-  }
-  const out2 = [];
-  const sectionRe = /^\s*\[remote "([^"]+)"\]\s*$([\s\S]*?)(?=^\s*\[|\s*$(?![\s\S]))/gm;
-  for (const m of txt.matchAll(sectionRe)) {
-    const url2 = /^\s*url\s*=\s*(.+?)\s*$/m.exec(m[2])?.[1];
-    if (url2) out2.push({ name: m[1], url: url2 });
-  }
-  return out2;
-}
-function detectRepoLocator(root, remote) {
-  const remotes = readRemotes(root);
-  if (remotes.length === 0) return null;
-  const pick2 = remote ? remotes.find((r) => r.name === remote) ?? null : remotes.find((r) => r.name === "origin") ?? (remotes.length === 1 ? remotes[0] : null);
-  return pick2 ? normalizeRepoLocator(pick2.url) : null;
-}
-var init_git_remote = __esm({
-  "src/git-remote.ts"() {
-    "use strict";
-    init_src();
-  }
-});
-
 // src/checkout-root.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join7, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
+import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join8, resolve as resolve2 } from "node:path";
 function nearestGitRoot(dir) {
   let cur = resolve2(dir);
   for (; ; ) {
-    if (existsSync9(join7(cur, ".git"))) return cur;
+    if (existsSync10(join8(cur, ".git"))) return cur;
     const parent = dirname6(cur);
     if (parent === cur) return null;
     cur = parent;
@@ -29142,19 +29272,19 @@ function nearestGitRoot(dir) {
 }
 function mainCheckoutOfWorktree(root) {
   const gitDir = resolveGitDir(root);
-  if (!gitDir || gitDir === join7(root, ".git")) return null;
-  const commondirFile = join7(gitDir, "commondir");
-  if (!existsSync9(commondirFile)) return null;
+  if (!gitDir || gitDir === join8(root, ".git")) return null;
+  const commondirFile = join8(gitDir, "commondir");
+  if (!existsSync10(commondirFile)) return null;
   let common;
   try {
-    common = readFileSync7(commondirFile, "utf8").trim();
+    common = readFileSync8(commondirFile, "utf8").trim();
   } catch {
     return null;
   }
   const commonDir = resolve2(isAbsolute2(common) ? common : resolve2(gitDir, common));
   if (basename2(commonDir) !== ".git") return null;
   const main2 = dirname6(commonDir);
-  return existsSync9(join7(main2, ".git")) ? main2 : null;
+  return existsSync10(join8(main2, ".git")) ? main2 : null;
 }
 function checkoutRootOf(cwd) {
   const root = nearestGitRoot(cwd);
@@ -29172,16 +29302,16 @@ var init_checkout_root = __esm({
 });
 
 // src/registry.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join9 } from "node:path";
 function registryPath() {
-  return process.env["ERRATA_REGISTRY_PATH"] ?? join8(globalDir(), "workspaces.json");
+  return process.env["ERRATA_REGISTRY_PATH"] ?? join9(globalDir(), "workspaces.json");
 }
 function read() {
   const p = registryPath();
-  if (!existsSync10(p)) return { version: 1, workspaces: {} };
+  if (!existsSync11(p)) return { version: 1, workspaces: {} };
   try {
-    const parsed = JSON.parse(readFileSync8(p, "utf8"));
+    const parsed = JSON.parse(readFileSync9(p, "utf8"));
     return { version: 1, workspaces: parsed.workspaces ?? {} };
   } catch {
     return { version: 1, workspaces: {} };
@@ -29189,9 +29319,9 @@ function read() {
 }
 function registryCorrupt() {
   const p = registryPath();
-  if (!existsSync10(p)) return false;
+  if (!existsSync11(p)) return false;
   try {
-    JSON.parse(readFileSync8(p, "utf8"));
+    JSON.parse(readFileSync9(p, "utf8"));
     return false;
   } catch {
     return true;
@@ -29199,7 +29329,7 @@ function registryCorrupt() {
 }
 function write(reg) {
   ensureDir(globalDir());
-  writeFileSync7(registryPath(), JSON.stringify(reg, null, 2), "utf8");
+  writeFileSync8(registryPath(), JSON.stringify(reg, null, 2), "utf8");
 }
 function registerWorkspace(profile, root, now = Date.now()) {
   if (isLinkedWorktree(root)) return;
@@ -29244,7 +29374,7 @@ function pruneMissingWorkspaces() {
   const reg = read();
   const removed = [];
   for (const [id, entry] of Object.entries(reg.workspaces)) {
-    if (!existsSync10(entry.path)) {
+    if (!existsSync11(entry.path)) {
       removed.push(entry);
       delete reg.workspaces[id];
     }
@@ -29253,13 +29383,13 @@ function pruneMissingWorkspaces() {
   return removed;
 }
 function workspaceStatus(entry) {
-  const missing = !existsSync10(entry.path);
+  const missing = !existsSync11(entry.path);
   const lockPath = workspacePaths(entry.path).daemonLock;
   let running = false;
   let webUiUrl = null;
-  if (existsSync10(lockPath)) {
+  if (existsSync11(lockPath)) {
     try {
-      const lock = JSON.parse(readFileSync8(lockPath, "utf8"));
+      const lock = JSON.parse(readFileSync9(lockPath, "utf8"));
       if (lock.pid && lock.webUiUrl && pidAlive(lock.pid)) {
         running = true;
         webUiUrl = lock.webUiUrl;
@@ -30713,7 +30843,7 @@ var init_diagnostic_matcher = __esm({
 });
 
 // ../../packages/generalizer/src/generalizer.ts
-import { isAbsolute as isAbsolute3, join as join9, relative } from "node:path";
+import { isAbsolute as isAbsolute3, join as join10, relative } from "node:path";
 async function runGeneralizer(opts) {
   const report = {
     eventsProcessed: 0,
@@ -30821,7 +30951,7 @@ function extractDiagnostics(ev) {
 function diagRelPath(file2, cwd, workspaceRoot) {
   const norm = (p) => p.replace(/\\/g, "/");
   if (!workspaceRoot) return norm(file2);
-  const abs = isAbsolute3(file2) ? file2 : join9(cwd ?? workspaceRoot, file2);
+  const abs = isAbsolute3(file2) ? file2 : join10(cwd ?? workspaceRoot, file2);
   return norm(relative(workspaceRoot, abs));
 }
 function extractErrorSignature(ev) {
@@ -32463,23 +32593,23 @@ var init_src10 = __esm({
 });
 
 // ../../packages/indexer/src/parse-cache.ts
-import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync9, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync8 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync10, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function parseCacheDir() {
-  return process.env["ERRATA_PARSE_CACHE"] ?? join10(homedir3(), ".errata", "parse-cache");
+  return process.env["ERRATA_PARSE_CACHE"] ?? join11(homedir3(), ".errata", "parse-cache");
 }
 function parseCacheKey(source, providerId) {
-  return createHash3("sha256").update(`${PARSE_CACHE_VERSION}:${providerId}:${source}`).digest("hex");
+  return createHash4("sha256").update(`${PARSE_CACHE_VERSION}:${providerId}:${source}`).digest("hex");
 }
 function entryPath(dir, key) {
-  return join10(dir, key.slice(0, 2), `${key.slice(2)}.json`);
+  return join11(dir, key.slice(0, 2), `${key.slice(2)}.json`);
 }
 function readParseCache(dir, key) {
   const file2 = entryPath(dir, key);
   try {
-    const raw2 = readFileSync9(file2, "utf8");
+    const raw2 = readFileSync10(file2, "utf8");
     const parsed = JSON.parse(raw2);
     if (parsed.v !== PARSE_CACHE_VERSION || !Array.isArray(parsed.symbols)) return null;
     return { symbols: parsed.symbols, reExports: parsed.reExports ?? [] };
@@ -32498,8 +32628,8 @@ function writeParseCache(dir, key, providerId, value) {
     const body2 = JSON.stringify(envelope);
     if (body2.length > MAX_ENTRY_BYTES) return;
     const file2 = entryPath(dir, key);
-    mkdirSync6(join10(dir, key.slice(0, 2)), { recursive: true });
-    writeFileSync8(file2, body2);
+    mkdirSync6(join11(dir, key.slice(0, 2)), { recursive: true });
+    writeFileSync9(file2, body2);
   } catch {
   }
 }
@@ -32508,9 +32638,9 @@ function sweepParseCacheOnce(dir, now = Date.now()) {
   sweptThisProcess = true;
   let removed = 0;
   try {
-    if (!existsSync11(dir)) return 0;
+    if (!existsSync12(dir)) return 0;
     for (const bucket of readdirSync2(dir)) {
-      const bucketDir = join10(dir, bucket);
+      const bucketDir = join11(dir, bucket);
       let names;
       try {
         names = readdirSync2(bucketDir);
@@ -32518,7 +32648,7 @@ function sweepParseCacheOnce(dir, now = Date.now()) {
         continue;
       }
       for (const name2 of names) {
-        const file2 = join10(bucketDir, name2);
+        const file2 = join11(bucketDir, name2);
         try {
           if (now - statSync2(file2).mtimeMs > ENTRY_TTL_MS) {
             rmSync2(file2, { force: true });
@@ -32766,10 +32896,10 @@ var init_identity3 = __esm({
 });
 
 // ../../packages/indexer/src/pipeline.ts
-import { appendFileSync, readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
+import { appendFileSync, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
 import { readdir } from "node:fs/promises";
-import { extname, join as join11, relative as relative2, sep } from "node:path";
-import { createHash as createHash4 } from "node:crypto";
+import { extname, join as join12, relative as relative2, sep } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 function nowTs() {
   return indexNow ?? Date.now();
@@ -32778,7 +32908,7 @@ function fingerprintOf(signature, bodyHash) {
   return `${signature ?? ""}|${bodyHash ?? ""}`;
 }
 function sha(s) {
-  return createHash4("sha256").update(s).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(s).digest("hex").slice(0, 16);
 }
 function fileNodeId(workspaceId2, relPath) {
   return `file_${sha(workspaceId2 + ":" + relPath.replace(/\\/g, "/"))}`;
@@ -32906,7 +33036,7 @@ async function incrementalReindex(store, rootPath, workspaceId2, changedAbsPaths
   for (const rel of [...changedRelPaths]) {
     let h;
     try {
-      h = createHash4("sha256").update(readFileSync10(join11(rootPath, rel))).digest("hex");
+      h = createHash5("sha256").update(readFileSync11(join12(rootPath, rel))).digest("hex");
     } catch {
       continue;
     }
@@ -32955,13 +33085,13 @@ async function incrementalReindex(store, rootPath, workspaceId2, changedAbsPaths
   let parsedFiles = 0;
   for (const rel of changedRelPaths) {
     if (parsedFiles++ > 0) await new Promise((r2) => setImmediate(r2));
-    const abs = join11(rootPath, ...rel.split("/"));
+    const abs = join12(rootPath, ...rel.split("/"));
     const ext = extname(abs).toLowerCase();
     const provider = providers.find((p) => p.fileExtensions.includes(ext));
     if (!provider) continue;
     let symbols;
     try {
-      symbols = provider.extractSymbols(readFileSync10(abs, "utf8"), abs);
+      symbols = provider.extractSymbols(readFileSync11(abs, "utf8"), abs);
     } catch {
       continue;
     }
@@ -33281,7 +33411,7 @@ async function runIndexer(store, opts) {
         report.filesSkipped++;
         continue;
       }
-      source = readFileSync10(f.absPath, "utf8");
+      source = readFileSync11(f.absPath, "utf8");
     } catch {
       report.filesSkipped++;
       continue;
@@ -33353,7 +33483,7 @@ async function runIndexer(store, opts) {
     const depth = fileNode.relPath.split("/").length;
     if (depth !== 3) continue;
     try {
-      const pkg = JSON.parse(readFileSync10(fileNode.absPath, "utf8"));
+      const pkg = JSON.parse(readFileSync11(fileNode.absPath, "utf8"));
       if (!pkg.name) continue;
       const pkgDir = fileNode.relPath.replace(/\/package\.json$/, "");
       const candidates = [
@@ -33741,7 +33871,7 @@ async function scan(root, current, ignores, providers, out2) {
   for (const ent of entries) {
     if (ignores.has(ent.name)) continue;
     if (ent.name.startsWith(".") && ent.name !== ".") continue;
-    const abs = join11(current, ent.name);
+    const abs = join12(current, ent.name);
     if (ent.isDirectory()) {
       await scan(root, abs, ignores, providers, out2);
     } else if (ent.isFile()) {
@@ -33796,7 +33926,7 @@ function gitListFiles(root, ignores, providers) {
   if (rels === null) return null;
   const out2 = [];
   for (const rel of rels) {
-    const abs = join11(root, rel);
+    const abs = join12(root, rel);
     let size;
     try {
       size = statSync3(abs).size;
@@ -33819,7 +33949,7 @@ function upsertFile(store, id, f, workspaceId2, skip) {
   const now = nowTs();
   let contentHash;
   try {
-    contentHash = createHash4("sha256").update(readFileSync10(f.absPath)).digest("hex");
+    contentHash = createHash5("sha256").update(readFileSync11(f.absPath)).digest("hex");
   } catch {
   }
   const carried = { ...store.getNode(id)?.attrs ?? {} };
@@ -38192,8 +38322,8 @@ ${JSON.stringify(symbolNames, null, 2)}`);
 
 // ../../packages/indexer/src/languages/tree-sitter-loader.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname7, join as join12 } from "node:path";
-import { existsSync as existsSync12, readdirSync as readdirSync3 } from "node:fs";
+import { dirname as dirname7, join as join13 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync3 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 function entryDir() {
   try {
@@ -38207,27 +38337,27 @@ function entryDir() {
 }
 function findWasmDir() {
   const here = entryDir();
-  const seaWasm = join12(here, "resources", "wasm");
-  if (existsSync12(join12(seaWasm, "tree-sitter-typescript.wasm"))) return seaWasm;
+  const seaWasm = join13(here, "resources", "wasm");
+  if (existsSync13(join13(seaWasm, "tree-sitter-typescript.wasm"))) return seaWasm;
   let dir = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const flat = join12(
+    const flat = join13(
       dir,
       "node_modules",
       "@vscode",
       "tree-sitter-wasm",
       "wasm"
     );
-    if (existsSync12(join12(flat, "tree-sitter-typescript.wasm"))) return flat;
+    if (existsSync13(join13(flat, "tree-sitter-typescript.wasm"))) return flat;
     dir = dirname7(dir);
   }
   let root = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const pnpmDir = join12(root, "node_modules", ".pnpm");
-    if (existsSync12(pnpmDir)) {
+    const pnpmDir = join13(root, "node_modules", ".pnpm");
+    if (existsSync13(pnpmDir)) {
       for (const entry of readdirSync3(pnpmDir)) {
         if (entry.startsWith("@vscode+tree-sitter-wasm@")) {
-          const candidate = join12(
+          const candidate = join13(
             pnpmDir,
             entry,
             "node_modules",
@@ -38235,7 +38365,7 @@ function findWasmDir() {
             "tree-sitter-wasm",
             "wasm"
           );
-          if (existsSync12(join12(candidate, "tree-sitter-typescript.wasm"))) {
+          if (existsSync13(join13(candidate, "tree-sitter-typescript.wasm"))) {
             return candidate;
           }
         }
@@ -38249,27 +38379,27 @@ function findWasmDir() {
 }
 function findRuntimeDir() {
   const here = entryDir();
-  const seaRuntime = join12(here, "resources", "wasm");
-  if (existsSync12(join12(seaRuntime, "web-tree-sitter.wasm"))) return seaRuntime;
+  const seaRuntime = join13(here, "resources", "wasm");
+  if (existsSync13(join13(seaRuntime, "web-tree-sitter.wasm"))) return seaRuntime;
   let dir = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const flat = join12(dir, "node_modules", "web-tree-sitter");
-    if (existsSync12(join12(flat, "web-tree-sitter.wasm"))) return flat;
+    const flat = join13(dir, "node_modules", "web-tree-sitter");
+    if (existsSync13(join13(flat, "web-tree-sitter.wasm"))) return flat;
     dir = dirname7(dir);
   }
   let root = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const pnpmDir = join12(root, "node_modules", ".pnpm");
-    if (existsSync12(pnpmDir)) {
+    const pnpmDir = join13(root, "node_modules", ".pnpm");
+    if (existsSync13(pnpmDir)) {
       for (const entry of readdirSync3(pnpmDir)) {
         if (entry.startsWith("web-tree-sitter@")) {
-          const candidate = join12(
+          const candidate = join13(
             pnpmDir,
             entry,
             "node_modules",
             "web-tree-sitter"
           );
-          if (existsSync12(join12(candidate, "web-tree-sitter.wasm"))) {
+          if (existsSync13(join13(candidate, "web-tree-sitter.wasm"))) {
             return candidate;
           }
         }
@@ -38286,7 +38416,7 @@ async function loadWebTreeSitter() {
     void err2;
   }
   const here = entryDir();
-  const seaResourceBase = join12(here, "resources", "_resolve.js");
+  const seaResourceBase = join13(here, "resources", "_resolve.js");
   const resourceRequire = createRequire2(seaResourceBase);
   return resourceRequire("web-tree-sitter");
 }
@@ -38301,9 +38431,9 @@ async function ensureTreeSitterReady() {
     await Parser2.init({
       locateFile: (name2) => {
         if (name2 === "tree-sitter.wasm" || name2 === "web-tree-sitter.wasm") {
-          return join12(runtime, name2);
+          return join13(runtime, name2);
         }
-        return join12(grammars, name2);
+        return join13(grammars, name2);
       }
     });
   })();
@@ -38315,7 +38445,7 @@ async function loadGrammar(name2) {
   if (cached2) return cached2;
   if (!languageClass) throw new Error("tree-sitter not initialized");
   const grammars = findWasmDir();
-  const lang = await languageClass.load(join12(grammars, `${name2}.wasm`));
+  const lang = await languageClass.load(join13(grammars, `${name2}.wasm`));
   grammarCache.set(name2, lang);
   return lang;
 }
@@ -38338,7 +38468,7 @@ var init_tree_sitter_loader = __esm({
 });
 
 // ../../packages/indexer/src/languages/typescript-treesitter.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 function extractNode(node2, source, containerQname, containerKind) {
   switch (node2.type) {
     case "function_declaration":
@@ -38551,7 +38681,7 @@ function scopeRecord(kind, name2, qname, node2, body2, source) {
       const sig = header.replace(/\s+/g, " ").trim();
       if (sig) rec.signature = sig;
       const bodyText = source.slice(body2.startIndex, body2.endIndex);
-      rec.bodyHash = createHash5("sha256").update(bodyText).digest("hex").slice(0, 16);
+      rec.bodyHash = createHash6("sha256").update(bodyText).digest("hex").slice(0, 16);
       rec.bodySimhash = toHex(simhash(bodyText));
     }
   }
@@ -38993,14 +39123,14 @@ var init_typescript_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/python-treesitter.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 function sigAndHash(node2, body2, source) {
   if (!body2) return {};
   const out2 = {};
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash6("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash7("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -39413,7 +39543,7 @@ var init_python_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/cpp-treesitter.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function extractNode3(node2, containerQname, containerIsClass, source) {
   switch (node2.type) {
     case "function_definition":
@@ -39597,7 +39727,7 @@ function sigAndHash2(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash7("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash8("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -39758,7 +39888,7 @@ var init_cpp_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/go-treesitter.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 function extractNode4(node2, containerQname, source) {
   switch (node2.type) {
     case "function_declaration": {
@@ -39920,7 +40050,7 @@ function sigAndHash3(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash8("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash9("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40064,7 +40194,7 @@ var init_go_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/rust-treesitter.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function extractNode5(node2, containerQname, containerIsClass, source) {
   switch (node2.type) {
     case "function_item":
@@ -40279,7 +40409,7 @@ function sigAndHash4(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash9("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash10("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40430,7 +40560,7 @@ var init_rust_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/ruby-treesitter.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 function sigAndHash5(node2, body2, source) {
   if (!body2) {
     const sig2 = source.slice(node2.startIndex, node2.endIndex).replace(/\s+/g, " ").trim();
@@ -40440,7 +40570,7 @@ function sigAndHash5(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash10("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash11("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40786,7 +40916,7 @@ var init_ruby_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/csharp-treesitter.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 function extractNode7(node2, containerQname, containerIsType, source, eof) {
   switch (node2.type) {
     case "method_declaration":
@@ -40988,7 +41118,7 @@ function sigAndHash6(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash11("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash12("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -41219,7 +41349,7 @@ var init_src11 = __esm({
 // src/reconcile.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
-import { join as join13, relative as relative3, sep as sep2 } from "node:path";
+import { join as join14, relative as relative3, sep as sep2 } from "node:path";
 function indexerWouldScan(rel) {
   for (const seg of rel.split(/[\\/]/)) {
     if (seg.length === 0) continue;
@@ -41242,7 +41372,7 @@ function gitSourceFiles(root) {
   const out2 = [];
   for (const rel of stdout.split("\0")) {
     if (!rel || !SOURCE_RE.test(rel) || !indexerWouldScan(rel)) continue;
-    const abs = join13(root, rel);
+    const abs = join14(root, rel);
     if (IGNORED.test(abs)) continue;
     out2.push(abs);
   }
@@ -41257,7 +41387,7 @@ function* walkSource(dir) {
   }
   for (const e of entries) {
     const name2 = String(e.name);
-    const full = join13(dir, name2);
+    const full = join14(dir, name2);
     if (IGNORED.test(full)) continue;
     if (!indexerWouldScan(name2)) continue;
     if (e.isDirectory()) yield* walkSource(full);
@@ -41407,7 +41537,7 @@ __export(mcp_exports, {
   runTool: () => runTool,
   searchGraph: () => searchGraph
 });
-import { existsSync as existsSync13, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
 function collectEnrichmentPulls(store, opts = {}) {
   const pending = store.findNodesByLabel("Solution").filter((s) => s.attrs["enrichmentPending"] === true).filter((s) => !opts.onlyUnsurfaced || s.attrs["enrichmentSurfaced"] !== true);
@@ -41444,7 +41574,7 @@ function takeEnrichmentNudge(store) {
 ` + items;
 }
 function takeDiscriminatorNudge(path2) {
-  if (!path2 || !existsSync13(path2)) return null;
+  if (!path2 || !existsSync14(path2)) return null;
   let shared;
   try {
     shared = openGraphStore({ path: path2 });
@@ -41575,10 +41705,10 @@ function showNode(store, node2, maxLines) {
   if (!relPath) return { found: false, reason: "no file owner for node" };
   const workspaceRoot = process.cwd();
   const absPath = resolve3(workspaceRoot, relPath);
-  if (!existsSync13(absPath)) {
+  if (!existsSync14(absPath)) {
     return { found: false, reason: `file not found on disk: ${absPath}` };
   }
-  const source = readFileSync11(absPath, "utf8");
+  const source = readFileSync12(absPath, "utf8");
   const attrs = node2.attrs;
   let startByte = attrs["bodyStartByte"] ?? attrs["startByte"];
   let endByte = attrs["bodyEndByte"] ?? attrs["endByte"];
@@ -41805,6 +41935,7 @@ function buildToolContext(workspaceRoot) {
   try {
     const cfg = loadConfig();
     const entry = workspaceRoot ? workspaceEntryForPath(resolve3(workspaceRoot)) : null;
+    const syncOk = effectiveConsent(cfg, entry ? loadProfile(entry.path) : null).sync;
     const identity = resolveWorkspaceIdentity(cfg, entry);
     if (identity.invalid) {
       console.error(`[errata mcp] cloud DISABLED for this workspace: ${identity.reason}`);
@@ -41812,13 +41943,13 @@ function buildToolContext(workspaceRoot) {
     }
     if (identity.rule === "workspace-binding" && identity.profileName) {
       const profile = identity.profile;
-      if (cfg.consent.sync && (profile.accessToken || profile.apiKey)) {
+      if (syncOk && (profile.accessToken || profile.apiKey)) {
         console.error(`[errata mcp] workspace identity: profile "${identity.profileName}"`);
         return { ...base, cloud: authedCloudClientForProfile(cfg, identity.profileName) };
       }
       return base;
     }
-    if (cfg.consent.sync && hasCloudCredential(cfg) && cfg.cloudUrl) {
+    if (syncOk && hasCloudCredential(cfg) && cfg.cloudUrl) {
       return { ...base, cloud: authedCloudClient(cfg) };
     }
   } catch {
@@ -41865,6 +41996,8 @@ var init_mcp = __esm({
     "use strict";
     init_cloud_auth();
     init_config();
+    init_consent();
+    init_profile2();
     init_identity2();
     init_registry();
     init_dual_augment();
@@ -42332,7 +42465,7 @@ var init_mcp = __esm({
           const local = causalChain(store, { seedId: id, direction: "both", maxHops, limit });
           try {
             const path2 = sharedStorePath();
-            if (!existsSync13(path2)) return { found: true, ...local };
+            if (!existsSync14(path2)) return { found: true, ...local };
             const shared = openGraphStore({ path: path2 });
             try {
               if (!shared.getNode(id)) return { found: true, ...local };
@@ -42932,7 +43065,7 @@ var init_mcp = __esm({
         inputSchema: { type: "object", properties: {} },
         handler: () => {
           const path2 = sharedStorePath();
-          if (!existsSync13(path2)) return { count: 0, pending: [] };
+          if (!existsSync14(path2)) return { count: 0, pending: [] };
           const shared = openGraphStore({ path: path2 });
           try {
             const pending = pendingAbstractions(shared);
@@ -42960,7 +43093,7 @@ var init_mcp = __esm({
         },
         handler: (args2) => {
           const path2 = sharedStorePath();
-          if (!existsSync13(path2)) return { count: 0, pending: [] };
+          if (!existsSync14(path2)) return { count: 0, pending: [] };
           const shared = openGraphStore({ path: path2 });
           try {
             const pending = pendingDiscriminators(shared, {
@@ -43004,7 +43137,7 @@ var init_mcp = __esm({
         },
         handler: (args2) => {
           const path2 = sharedStorePath();
-          if (!existsSync13(path2)) return { count: 0, routes: [] };
+          if (!existsSync14(path2)) return { count: 0, routes: [] };
           const shared = openGraphStore({ path: path2 });
           try {
             const result = triageOf(shared, {
@@ -43389,8 +43522,8 @@ __export(vfile_exports, {
   resolvePath: () => resolvePath,
   segmentsOf: () => segmentsOf
 });
-import { writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join14, resolve as resolve4, sep as sep3 } from "node:path";
+import { writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15, resolve as resolve4, sep as sep3 } from "node:path";
 function segmentsOf(rawPath) {
   let p = rawPath.replace(/\\/g, "/");
   p = p.replace(/^.*\.errata\/g\//, "").replace(/^\/?g\//, "").replace(/^\/+/, "");
@@ -43464,14 +43597,14 @@ async function renderVFile(rawPath, store, ctx = {}) {
 }
 async function materializeVFile(rawPath, workspaceRoot, store, ctx = {}) {
   const segs = segmentsOf(rawPath);
-  const gRoot = join14(workspaceRoot, ".errata", "g");
+  const gRoot = join15(workspaceRoot, ".errata", "g");
   const abs = resolve4(gRoot, ...segs.length ? segs : ["index"]);
   if (abs !== gRoot && !abs.startsWith(gRoot + sep3)) {
     throw new Error(`refusing to materialize outside .errata/g: ${rawPath}`);
   }
   const text = await renderVFile(rawPath, store, ctx);
   ensureParent(abs);
-  writeFileSync9(abs, text, "utf8");
+  writeFileSync10(abs, text, "utf8");
   return abs;
 }
 async function materializeOverview(workspaceRoot, store, ctx = {}) {
@@ -50891,25 +51024,25 @@ var init_tool_index = __esm({
 
 // src/outbox.ts
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   renameSync,
   unlinkSync,
-  writeFileSync as writeFileSync10
+  writeFileSync as writeFileSync11
 } from "node:fs";
-import { join as join15 } from "node:path";
-import { createHash as createHash12 } from "node:crypto";
+import { join as join16 } from "node:path";
+import { createHash as createHash13 } from "node:crypto";
 function enqueueOutbox(paths, payload) {
   ensureDir(paths.outbox);
-  const id = createHash12("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
-  const file2 = join15(paths.outbox, `${Date.now()}-${id}.json`);
-  writeFileSync10(file2, JSON.stringify(payload, null, 2), "utf8");
+  const id = createHash13("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+  const file2 = join16(paths.outbox, `${Date.now()}-${id}.json`);
+  writeFileSync11(file2, JSON.stringify(payload, null, 2), "utf8");
   return file2;
 }
 async function flushOutbox(paths, client, store) {
   ensureDir(paths.outbox);
-  const entries = existsSync14(paths.outbox) ? readdirSync5(paths.outbox) : [];
+  const entries = existsSync15(paths.outbox) ? readdirSync5(paths.outbox) : [];
   let uploaded = 0;
   let failed = 0;
   const quarantine = (abs, reason) => {
@@ -50920,10 +51053,10 @@ async function flushOutbox(paths, client, store) {
     }
   };
   for (const f of entries.filter((e) => e.endsWith(".json")).sort()) {
-    const abs = join15(paths.outbox, f);
+    const abs = join16(paths.outbox, f);
     let payload;
     try {
-      payload = JSON.parse(readFileSync12(abs, "utf8"));
+      payload = JSON.parse(readFileSync13(abs, "utf8"));
     } catch {
       failed++;
       quarantine(abs, "unparseable JSON");
@@ -50968,7 +51101,7 @@ async function flushOutbox(paths, client, store) {
       }
     }
   }
-  const remainingFiles = existsSync14(paths.outbox) ? readdirSync5(paths.outbox).filter((e) => e.endsWith(".json")) : [];
+  const remainingFiles = existsSync15(paths.outbox) ? readdirSync5(paths.outbox).filter((e) => e.endsWith(".json")) : [];
   return { uploaded, failed, remaining: remainingFiles.length };
 }
 var init_outbox = __esm({
@@ -70913,12 +71046,12 @@ var init_report_render = __esm({
 
 // src/cli.ts
 init_src6();
-import { closeSync as closeSync2, existsSync as existsSync34, openSync as openSync2, readFileSync as readFileSync33, renameSync as renameSync4, statSync as statSync8 } from "node:fs";
-import { join as join38, resolve as pathResolve2 } from "node:path";
+import { closeSync as closeSync2, existsSync as existsSync34, openSync as openSync2, readFileSync as readFileSync34, renameSync as renameSync4, statSync as statSync8 } from "node:fs";
+import { join as join39, resolve as pathResolve2 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/daemon.ts
-import { existsSync as existsSync26, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync26, writeFileSync as writeFileSync22 } from "node:fs";
 
 // ../../node_modules/.pnpm/@hono+node-server@1.19.11_hono@4.12.8/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
@@ -71498,8 +71631,8 @@ init_config();
 
 // src/engine.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync25, statSync as statSync7, appendFileSync as appendFileSync4, readdirSync as readdirSync10, renameSync as renameSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join30, relative as relative6, sep as sep4 } from "node:path";
+import { existsSync as existsSync25, statSync as statSync7, appendFileSync as appendFileSync4, readdirSync as readdirSync10, renameSync as renameSync3, readFileSync as readFileSync26, writeFileSync as writeFileSync21 } from "node:fs";
+import { join as join31, relative as relative6, sep as sep4 } from "node:path";
 
 // ../../node_modules/.pnpm/chokidar@4.0.3/node_modules/chokidar/esm/index.js
 import { stat as statcb } from "fs";
@@ -73447,10 +73580,10 @@ init_src10();
 init_review2();
 
 // src/turn.ts
-import { closeSync, existsSync as existsSync15, fstatSync, openSync, readdirSync as readdirSync6, readSync, realpathSync, statSync as statSync5 } from "node:fs";
-import { basename as basename5, delimiter, dirname as dirname10, join as join18, normalize as normalize3 } from "node:path";
+import { closeSync, existsSync as existsSync16, fstatSync, openSync, readdirSync as readdirSync6, readSync, realpathSync, statSync as statSync5 } from "node:fs";
+import { basename as basename5, delimiter, dirname as dirname10, join as join19, normalize as normalize3 } from "node:path";
 import { homedir as homedir4 } from "node:os";
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function readFrom(path2, fromByte, maxBytes) {
   let fd;
   try {
@@ -73826,11 +73959,11 @@ function turnsSince(turns, mark) {
   return at >= 0 ? turns.slice(at + 1) : turns;
 }
 function claudeProjectDir(cwd, home = homedir4()) {
-  return join18(home, ".claude", "projects", cwd.replace(/[\\/:.]/g, "-"));
+  return join19(home, ".claude", "projects", cwd.replace(/[\\/:.]/g, "-"));
 }
 function recentTranscripts(cwd, opts = {}) {
   const dir = claudeProjectDir(cwd, opts.home ?? homedir4());
-  if (!existsSync15(dir)) return [];
+  if (!existsSync16(dir)) return [];
   let names;
   try {
     names = readdirSync6(dir);
@@ -73841,7 +73974,7 @@ function recentTranscripts(cwd, opts = {}) {
   const refs = [];
   for (const name2 of names) {
     if (!name2.endsWith(".jsonl")) continue;
-    const path2 = join18(dir, name2);
+    const path2 = join19(dir, name2);
     let mtimeMs;
     try {
       mtimeMs = statSync5(path2).mtimeMs;
@@ -73856,8 +73989,8 @@ function recentTranscripts(cwd, opts = {}) {
 }
 function subagentTranscripts(mainTranscriptPath, sessionId) {
   if (!mainTranscriptPath || !sessionId) return [];
-  const dir = join18(dirname10(mainTranscriptPath), sessionId, "subagents");
-  if (!existsSync15(dir)) return [];
+  const dir = join19(dirname10(mainTranscriptPath), sessionId, "subagents");
+  if (!existsSync16(dir)) return [];
   let names;
   try {
     names = readdirSync6(dir);
@@ -73867,7 +74000,7 @@ function subagentTranscripts(mainTranscriptPath, sessionId) {
   const refs = [];
   for (const name2 of names) {
     if (!name2.endsWith(".jsonl")) continue;
-    const path2 = join18(dir, name2);
+    const path2 = join19(dir, name2);
     let mtimeMs;
     try {
       mtimeMs = statSync5(path2).mtimeMs;
@@ -73886,8 +74019,8 @@ function splitPathList(value, sep5 = delimiter) {
 function codexSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_CODEX_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["CODEX_HOME"]) roots.add(join18(env2["CODEX_HOME"], "sessions"));
-  roots.add(join18(home, ".codex", "sessions"));
+  if (env2["CODEX_HOME"]) roots.add(join19(env2["CODEX_HOME"], "sessions"));
+  roots.add(join19(home, ".codex", "sessions"));
   return [...roots];
 }
 function readCodexRolloutCwd(path2) {
@@ -73932,7 +74065,7 @@ function codexRolloutsForCwd(cwd, opts = {}) {
   const limit = opts.limit ?? 25;
   const out2 = [];
   for (const root of codexSessionRoots(opts.env, opts.home)) {
-    if (!existsSync15(root)) continue;
+    if (!existsSync16(root)) continue;
     const stack = [{ dir: root, depth: 0 }];
     while (stack.length > 0) {
       const { dir, depth } = stack.pop();
@@ -73943,7 +74076,7 @@ function codexRolloutsForCwd(cwd, opts = {}) {
         continue;
       }
       for (const name2 of names) {
-        const full = join18(dir, name2);
+        const full = join19(dir, name2);
         let st;
         try {
           st = statSync5(full);
@@ -73968,12 +74101,12 @@ function codexRolloutsForCwd(cwd, opts = {}) {
 function geminiSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_GEMINI_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["GEMINI_CLI_HOME"]) roots.add(join18(env2["GEMINI_CLI_HOME"], ".gemini", "tmp"));
-  roots.add(join18(home, ".gemini", "tmp"));
+  if (env2["GEMINI_CLI_HOME"]) roots.add(join19(env2["GEMINI_CLI_HOME"], ".gemini", "tmp"));
+  roots.add(join19(home, ".gemini", "tmp"));
   return [...roots];
 }
 function geminiProjectHash(cwd) {
-  return createHash13("sha256").update(cwd).digest("hex");
+  return createHash14("sha256").update(cwd).digest("hex");
 }
 function geminiHashesFor(cwd) {
   const variants = /* @__PURE__ */ new Set([cwd, cwd.replace(/\/+$/, "")]);
@@ -74009,7 +74142,7 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
   const hashes = geminiHashesFor(cwd);
   const out2 = [];
   for (const root of geminiSessionRoots(opts.env, opts.home)) {
-    if (!existsSync15(root)) continue;
+    if (!existsSync16(root)) continue;
     let slugs;
     try {
       slugs = readdirSync6(root);
@@ -74017,7 +74150,7 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
       continue;
     }
     for (const slug2 of slugs) {
-      const chats = join18(root, slug2, "chats");
+      const chats = join19(root, slug2, "chats");
       let names;
       try {
         names = readdirSync6(chats);
@@ -74026,7 +74159,7 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
       }
       for (const name2 of names) {
         if (!name2.startsWith("session-") || !name2.endsWith(".jsonl")) continue;
-        const full = join18(chats, name2);
+        const full = join19(chats, name2);
         let st;
         try {
           st = statSync5(full);
@@ -74046,8 +74179,8 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
 function opencodeSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_OPENCODE_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["XDG_DATA_HOME"]) roots.add(join18(env2["XDG_DATA_HOME"], "opencode", "errata"));
-  roots.add(join18(home, ".local", "share", "opencode", "errata"));
+  if (env2["XDG_DATA_HOME"]) roots.add(join19(env2["XDG_DATA_HOME"], "opencode", "errata"));
+  roots.add(join19(home, ".local", "share", "opencode", "errata"));
   return [...roots];
 }
 function readOpencodeTranscriptDirectory(path2) {
@@ -74080,7 +74213,7 @@ function opencodeTranscriptsForCwd(cwd, opts = {}) {
   }
   const out2 = [];
   for (const root of opencodeSessionRoots(opts.env, opts.home)) {
-    if (!existsSync15(root)) continue;
+    if (!existsSync16(root)) continue;
     let names;
     try {
       names = readdirSync6(root);
@@ -74089,7 +74222,7 @@ function opencodeTranscriptsForCwd(cwd, opts = {}) {
     }
     for (const name2 of names) {
       if (!name2.endsWith(".jsonl")) continue;
-      const full = join18(root, name2);
+      const full = join19(root, name2);
       let st;
       try {
         st = statSync5(full);
@@ -74112,7 +74245,7 @@ init_src2();
 init_agent_signals();
 init_tool_index();
 init_src5();
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync11 } from "node:fs";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync12 } from "node:fs";
 var NEG = /n['']t|\b(?:not|never|no|none|neither|nor|unrelated|irrelevant|would|might|could|if)\b/i;
 var CITE_GROUP_RE = /\(((?:[^()\n]|\([^()\n]*\)){1,200})\)/g;
 var HANDLE_RE = /\[([a-z0-9][\w-]{0,80})\]|((?:pat|sol|drc|dcause|dfix|dprob|prob|claim|err)_[0-9a-f]{6,})/gi;
@@ -74791,13 +74924,13 @@ function writePrimingHandles(path2, nodes, now = Date.now()) {
       entries.sort((a, b) => (b[1].seenAt ?? 0) - (a[1].seenAt ?? 0));
       entries.length = HANDLE_MAP_MAX;
     }
-    writeFileSync11(path2, JSON.stringify(Object.fromEntries(entries)));
+    writeFileSync12(path2, JSON.stringify(Object.fromEntries(entries)));
   } catch {
   }
 }
 function readPrimingHandles(path2) {
   try {
-    return JSON.parse(readFileSync13(path2, "utf8"));
+    return JSON.parse(readFileSync14(path2, "utf8"));
   } catch {
     return {};
   }
@@ -75272,8 +75405,8 @@ ${conversation}` }]
 // src/constraint-backfill.ts
 init_src5();
 init_src2();
-import { existsSync as existsSync16, readFileSync as readFileSync14, readdirSync as readdirSync7, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync15, readdirSync as readdirSync7, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join20 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 var BACKFILL_VERSION = 1;
 var EMPTY = {
@@ -75287,13 +75420,13 @@ var EMPTY = {
   recoverable: 0
 };
 function markerPath(configDir) {
-  return join19(configDir, "constraint-backfill.json");
+  return join20(configDir, "constraint-backfill.json");
 }
 function alreadyDone(configDir) {
   const p = markerPath(configDir);
-  if (!existsSync16(p)) return false;
+  if (!existsSync17(p)) return false;
   try {
-    const raw2 = JSON.parse(readFileSync14(p, "utf8"));
+    const raw2 = JSON.parse(readFileSync15(p, "utf8"));
     return raw2?.version === BACKFILL_VERSION;
   } catch {
     return false;
@@ -75303,7 +75436,7 @@ function replay(root) {
   const statements = /* @__PURE__ */ new Set();
   const citedByFix = /* @__PURE__ */ new Set();
   const dir = claudeProjectDir(root, homedir5());
-  if (!existsSync16(dir)) return { statements, citedByFix };
+  if (!existsSync17(dir)) return { statements, citedByFix };
   let names;
   try {
     names = readdirSync7(dir).filter((n) => n.endsWith(".jsonl"));
@@ -75313,7 +75446,7 @@ function replay(root) {
   for (const f of names) {
     let lines;
     try {
-      lines = readFileSync14(join19(dir, f), "utf8").split("\n");
+      lines = readFileSync15(join20(dir, f), "utf8").split("\n");
     } catch {
       continue;
     }
@@ -75427,7 +75560,7 @@ function backfillConstraintKind(store, opts) {
     }
   });
   try {
-    writeFileSync12(
+    writeFileSync13(
       markerPath(opts.configDir),
       JSON.stringify({ version: BACKFILL_VERSION, at: opts.now, ...report, cloudTwins: report.cloudTwins.length }, null, 2),
       "utf8"
@@ -75440,8 +75573,8 @@ function backfillConstraintKind(store, opts) {
 // src/edge-repair.ts
 init_src();
 init_src5();
-import { existsSync as existsSync17, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync16, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join21 } from "node:path";
 function citeEdgeId(from, type, to) {
   return `edge_${digest({ from, type, to })}`.slice(0, 24);
 }
@@ -75456,13 +75589,13 @@ var EMPTY2 = {
   byType: {}
 };
 function markerPath2(configDir) {
-  return join20(configDir, "edge-repair.json");
+  return join21(configDir, "edge-repair.json");
 }
 function alreadyDone2(configDir) {
   const p = markerPath2(configDir);
-  if (!existsSync17(p)) return false;
+  if (!existsSync18(p)) return false;
   try {
-    return JSON.parse(readFileSync15(p, "utf8"))?.version === EDGE_REPAIR_VERSION;
+    return JSON.parse(readFileSync16(p, "utf8"))?.version === EDGE_REPAIR_VERSION;
   } catch {
     return false;
   }
@@ -75511,7 +75644,7 @@ function repairInvalidEdges(store, opts) {
   });
   store.pruneEdgeRejections(opts.now - REJECTION_RETENTION_MS);
   try {
-    writeFileSync13(
+    writeFileSync14(
       markerPath2(opts.configDir),
       JSON.stringify({ version: EDGE_REPAIR_VERSION, at: opts.now, ...report }, null, 2),
       "utf8"
@@ -75525,8 +75658,8 @@ function repairInvalidEdges(store, opts) {
 init_reconcile();
 
 // src/pass-ledger.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync18, readFileSync as readFileSync16, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join21 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync19, readFileSync as readFileSync17, writeFileSync as writeFileSync15 } from "node:fs";
+import { join as join22 } from "node:path";
 
 // src/isolate-census.ts
 var live = 0;
@@ -75549,7 +75682,7 @@ var PER_KIND_MAX = 100;
 var TRIM_EVERY = 50;
 var appendsSinceTrim = /* @__PURE__ */ new Map();
 function passLedgerPath(configDir) {
-  return join21(configDir, "pass-ledger.jsonl");
+  return join22(configDir, "pass-ledger.jsonl");
 }
 function appendPassLedger(configDir, kind, durationMs, counts) {
   const path2 = passLedgerPath(configDir);
@@ -75578,7 +75711,7 @@ function appendPassLedger(configDir, kind, durationMs, counts) {
       return;
     }
     appendsSinceTrim.set(path2, 0);
-    const lines = readFileSync16(path2, "utf8").split("\n").filter(Boolean);
+    const lines = readFileSync17(path2, "utf8").split("\n").filter(Boolean);
     const keptByKind = /* @__PURE__ */ new Map();
     const kept = [];
     for (let i2 = lines.length - 1; i2 >= 0; i2--) {
@@ -75594,16 +75727,16 @@ function appendPassLedger(configDir, kind, durationMs, counts) {
       kept.push(lines[i2]);
     }
     if (kept.length < lines.length) {
-      writeFileSync14(path2, kept.reverse().join("\n") + "\n");
+      writeFileSync15(path2, kept.reverse().join("\n") + "\n");
     }
   } catch {
   }
 }
 function readPassLedger(configDir) {
   const path2 = passLedgerPath(configDir);
-  if (!existsSync18(path2)) return [];
+  if (!existsSync19(path2)) return [];
   try {
-    return readFileSync16(path2, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l)).filter(
+    return readFileSync17(path2, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l)).filter(
       (e) => typeof e?.ts === "number" && typeof e?.kind === "string" && typeof e?.durationMs === "number"
     ).map((e) => ({ ...e, counts: e.counts ?? {} }));
   } catch {
@@ -75971,11 +76104,11 @@ init_outbox();
 init_src9();
 init_src();
 init_src2();
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 function loadClaimIgnorePatterns(workspaceRoot) {
   try {
-    return readFileSync17(join22(workspaceRoot, ".errataignore"), "utf8").split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#")).map((l) => l.toLowerCase());
+    return readFileSync18(join23(workspaceRoot, ".errataignore"), "utf8").split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#")).map((l) => l.toLowerCase());
   } catch {
     return [];
   }
@@ -76338,9 +76471,9 @@ async function pullCloudTriage(shared, cloud, profile, limit = 50) {
 // src/retrieval-stack.ts
 init_src();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync18, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync19, statSync as statSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var RETRIEVAL_STACK_CAP = 24;
 var MANIFEST_SCAN_CAP = 400;
 var RUNTIME_TOKENS = /* @__PURE__ */ new Set([
@@ -76630,51 +76763,51 @@ function mavenGroupIsSelfDisclosing(name2, selfTokens) {
 function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
   const read2 = (p) => {
     try {
-      return readFileSync18(p, "utf8");
+      return readFileSync19(p, "utf8");
     } catch {
       return null;
     }
   };
   const texts = (...paths) => paths.map(read2).filter((t) => t !== null);
   const home = homedir6();
-  const npm = parseNpmrcPolicy(texts(join23(root, ".npmrc"), join23(home, ".npmrc")));
+  const npm = parseNpmrcPolicy(texts(join24(root, ".npmrc"), join24(home, ".npmrc")));
   const blocked = /* @__PURE__ */ new Set();
   if (!npm.defaultPublic) blocked.add("npm");
   if (pypiIndexIsPrivate(
     texts(
-      join23(root, "pip.conf"),
-      join23(root, "pip.ini"),
-      join23(root, "pyproject.toml"),
-      join23(root, "requirements.txt"),
-      join23(home, ".pip", "pip.conf"),
-      join23(home, ".config", "pip", "pip.conf"),
-      join23(env2["APPDATA"] ?? home, "pip", "pip.ini")
+      join24(root, "pip.conf"),
+      join24(root, "pip.ini"),
+      join24(root, "pyproject.toml"),
+      join24(root, "requirements.txt"),
+      join24(home, ".pip", "pip.conf"),
+      join24(home, ".config", "pip", "pip.conf"),
+      join24(env2["APPDATA"] ?? home, "pip", "pip.ini")
     )
   )) {
     blocked.add("pypi");
   }
   if (cargoRegistryIsPrivate(
     texts(
-      join23(root, ".cargo", "config.toml"),
-      join23(root, ".cargo", "config"),
-      join23(home, ".cargo", "config.toml"),
-      join23(home, ".cargo", "config")
+      join24(root, ".cargo", "config.toml"),
+      join24(root, ".cargo", "config"),
+      join24(home, ".cargo", "config.toml"),
+      join24(home, ".cargo", "config")
     )
   )) {
     blocked.add("cargo");
   }
   if (nugetSourcesArePrivate(
     texts(
-      join23(root, "NuGet.config"),
-      join23(root, "nuget.config"),
-      join23(root, "NuGet.Config"),
-      join23(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
-      join23(home, ".nuget", "NuGet", "NuGet.Config")
+      join24(root, "NuGet.config"),
+      join24(root, "nuget.config"),
+      join24(root, "NuGet.Config"),
+      join24(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
+      join24(home, ".nuget", "NuGet", "NuGet.Config")
     )
   )) {
     blocked.add("nuget");
   }
-  const goEnvFile = env2["GOENV"] ?? join23(env2["APPDATA"] ?? join23(home, ".config"), "go", "env");
+  const goEnvFile = env2["GOENV"] ?? join24(env2["APPDATA"] ?? join24(home, ".config"), "go", "env");
   const goEnvText = read2(goEnvFile) ?? "";
   const fromFile = ["GOPRIVATE", "GONOSUMDB", "GONOSUMCHECK"].map(
     (k) => new RegExp(`^${k}=(.*)$`, "m").exec(goEnvText)?.[1]
@@ -76685,10 +76818,10 @@ function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
     env2["GONOSUMCHECK"],
     ...fromFile
   ]);
-  const gemfiles = texts(join23(root, "Gemfile"));
+  const gemfiles = texts(join24(root, "Gemfile"));
   if (gemSourceIsPrivate(gemfiles)) blocked.add("gem");
   if (mavenReposArePrivate(
-    texts(join23(root, "pom.xml"), join23(home, ".m2", "settings.xml"))
+    texts(join24(root, "pom.xml"), join24(home, ".m2", "settings.xml"))
   )) {
     blocked.add("maven");
   }
@@ -76855,8 +76988,8 @@ function readDirectDependencies(root) {
   const familiesSeen = /* @__PURE__ */ new Set();
   for (const c of LOCKFILES) {
     if (familiesSeen.has(c.family)) continue;
-    const p = join23(root, c.file);
-    if (!existsSync19(p)) continue;
+    const p = join24(root, c.file);
+    if (!existsSync20(p)) continue;
     try {
       const s = statSync6(p);
       stamps.push(`${c.file}:${s.mtimeMs}:${s.size}`);
@@ -76876,7 +77009,7 @@ function readDirectDependencies(root) {
   const direct = [];
   for (const { c, path: path2 } of found) {
     try {
-      direct.push(...c.parse(readFileSync18(path2, "utf8")).direct ?? []);
+      direct.push(...c.parse(readFileSync19(path2, "utf8")).direct ?? []);
     } catch {
     }
   }
@@ -76919,14 +77052,14 @@ function manifestPaths(root) {
     "project.godot"
   ];
   return {
-    paths: ROOT_MANIFESTS.filter((f) => existsSync19(join23(root, f))),
+    paths: ROOT_MANIFESTS.filter((f) => existsSync20(join24(root, f))),
     tracked: false,
     truncated: false
   };
 }
 var WORKSPACE_MARKERS = ["pnpm-workspace.yaml", "lerna.json", "go.work", "settings.gradle", "settings.gradle.kts"];
 function rootDeclaresWorkspace(root, texts) {
-  if (WORKSPACE_MARKERS.some((f) => existsSync19(join23(root, f)))) return true;
+  if (WORKSPACE_MARKERS.some((f) => existsSync20(join24(root, f)))) return true;
   return /"workspaces"\s*:/.test(texts.get("package.json") ?? "") || /<modules>/.test(texts.get("pom.xml") ?? "") || /^\s*\[workspace\]/m.test(texts.get("Cargo.toml") ?? "");
 }
 var EMPTY_SCAN = { deps: [], self: [], complete: true };
@@ -76940,11 +77073,11 @@ function scanManifests(root) {
   const texts = /* @__PURE__ */ new Map();
   const stamps = [];
   for (const rel of paths) {
-    const abs = join23(root, rel);
+    const abs = join24(root, rel);
     try {
       const s = statSync6(abs);
       stamps.push(`${rel}:${s.mtimeMs}:${s.size}`);
-      texts.set(rel, readFileSync18(abs, "utf8"));
+      texts.set(rel, readFileSync19(abs, "utf8"));
     } catch {
     }
   }
@@ -76973,22 +77106,22 @@ function readManifestDependencies(root) {
 }
 
 // src/git-sensor.ts
-import { existsSync as existsSync20, readFileSync as readFileSync19, watch as fsWatch } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync20, watch as fsWatch } from "node:fs";
+import { join as join25 } from "node:path";
 function readFirstLine(path2) {
   try {
-    return readFileSync19(path2, "utf8").split(/\r?\n/, 1)[0].trim();
+    return readFileSync20(path2, "utf8").split(/\r?\n/, 1)[0].trim();
   } catch {
     return null;
   }
 }
 function readGitRefState(gitDir) {
-  const head2 = readFirstLine(join24(gitDir, "HEAD"));
+  const head2 = readFirstLine(join25(gitDir, "HEAD"));
   const m = head2 ? /^ref:\s*refs\/heads\/(.+)$/.exec(head2) : null;
   const branch = m ? m[1] : null;
   let sha2 = null;
   if (branch) {
-    sha2 = readFirstLine(join24(gitDir, "refs", "heads", branch));
+    sha2 = readFirstLine(join25(gitDir, "refs", "heads", branch));
     if (!sha2) sha2 = shaFromPackedRefs(gitDir, `refs/heads/${branch}`);
   } else if (head2 && /^[0-9a-f]{7,40}$/i.test(head2)) {
     sha2 = head2;
@@ -76996,13 +77129,13 @@ function readGitRefState(gitDir) {
   return {
     branch,
     sha: sha2,
-    mergeHeadExists: existsSync20(join24(gitDir, "MERGE_HEAD")),
-    origHeadExists: existsSync20(join24(gitDir, "ORIG_HEAD"))
+    mergeHeadExists: existsSync21(join25(gitDir, "MERGE_HEAD")),
+    origHeadExists: existsSync21(join25(gitDir, "ORIG_HEAD"))
   };
 }
 function shaFromPackedRefs(gitDir, ref) {
   try {
-    for (const line of readFileSync19(join24(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync20(join25(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
       const [sha2, name2] = line.split(/\s+/);
       if (name2 === ref && sha2) return sha2;
     }
@@ -77036,7 +77169,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
   const settle = () => {
     if (timer) clearTimeout(timer);
     timer = setTimeout(() => {
-      if (existsSync20(join24(gitDir, "index.lock"))) {
+      if (existsSync21(join25(gitDir, "index.lock"))) {
         settle();
         return;
       }
@@ -77047,7 +77180,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
     }, debounceMs);
   };
   for (const sub of ["HEAD", "logs/HEAD", "MERGE_HEAD", "ORIG_HEAD"]) {
-    const p = join24(gitDir, sub);
+    const p = join25(gitDir, sub);
     try {
       watchers.push(fsWatch(p, settle));
     } catch {
@@ -77272,21 +77405,21 @@ var TelemetryRecorder = class {
 
 // src/skills.ts
 import {
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync8,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync15
+  writeFileSync as writeFileSync16
 } from "node:fs";
-import { basename as basename6, join as join25 } from "node:path";
+import { basename as basename6, join as join26 } from "node:path";
 function skillFileName(id) {
   return `${id.replace(/[^A-Za-z0-9_.-]/g, "_")}.md`;
 }
 function readSkillManifest(manifestPath) {
-  if (!existsSync21(manifestPath)) return [];
+  if (!existsSync22(manifestPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync20(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync21(manifestPath, "utf8"));
     return (parsed.skills ?? []).map((s) => ({
       title: s.title ?? "",
       layer: s.layer ?? "technique",
@@ -77310,7 +77443,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
   for (const s of res.skills) {
     const fileName = skillFileName(s.id);
     keep.add(fileName);
-    writeFileSync15(join25(paths.skillsDir, fileName), s.markdown, "utf8");
+    writeFileSync16(join26(paths.skillsDir, fileName), s.markdown, "utf8");
     rows.push({
       id: s.id,
       title: s.title,
@@ -77323,7 +77456,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     const fileName = skillFileName(p.id);
     if (keep.has(fileName)) continue;
     keep.add(fileName);
-    writeFileSync15(join25(paths.skillsDir, fileName), p.markdown, "utf8");
+    writeFileSync16(join26(paths.skillsDir, fileName), p.markdown, "utf8");
     rows.push({
       id: p.id,
       title: p.title,
@@ -77337,13 +77470,13 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     if (!f.endsWith(".md")) continue;
     if (keep.has(basename6(f))) continue;
     try {
-      unlinkSync2(join25(paths.skillsDir, f));
+      unlinkSync2(join26(paths.skillsDir, f));
       pruned++;
     } catch {
     }
   }
   rows.sort((a, b) => a.id.localeCompare(b.id));
-  writeFileSync15(
+  writeFileSync16(
     paths.skillsManifest,
     JSON.stringify({ generatedAt: Date.now(), skills: rows }, null, 2),
     "utf8"
@@ -77355,22 +77488,22 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
 init_src2();
 import {
   cpSync,
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   lstatSync,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   readdirSync as readdirSync9,
   rmSync as rmSync3,
   symlinkSync,
-  writeFileSync as writeFileSync16
+  writeFileSync as writeFileSync17
 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 var SKILL_NS = "errata-";
 var HARNESS_SKILL_DIRS = [
-  { configDir: ".claude", skillsDir: join26(".claude", "skills") },
+  { configDir: ".claude", skillsDir: join27(".claude", "skills") },
   // Cursor adopted the standard; its exact project dir is still moving — kept
   // best-effort and gated on `.cursor/` presence so we never create it blind.
-  { configDir: ".cursor", skillsDir: join26(".cursor", "skills") }
+  { configDir: ".cursor", skillsDir: join27(".cursor", "skills") }
 ];
 function skillSlug(title, id) {
   const base = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || id.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
@@ -77415,12 +77548,12 @@ function skillCiteHandle(s) {
   return priorHandle({ id: s.id, description: s.title });
 }
 function reconcileNamespaced(dir, keep) {
-  if (!existsSync22(dir)) return 0;
+  if (!existsSync23(dir)) return 0;
   let pruned = 0;
   for (const name2 of readdirSync9(dir)) {
     if (!name2.startsWith(SKILL_NS) || keep.has(name2)) continue;
     try {
-      rmSync3(join26(dir, name2), { recursive: true, force: true });
+      rmSync3(join27(dir, name2), { recursive: true, force: true });
       pruned++;
     } catch {
     }
@@ -77429,7 +77562,7 @@ function reconcileNamespaced(dir, keep) {
 }
 function linkOrCopy(linkPath, target) {
   try {
-    if (existsSync22(linkPath) || safeLstat(linkPath)) rmSync3(linkPath, { recursive: true, force: true });
+    if (existsSync23(linkPath) || safeLstat(linkPath)) rmSync3(linkPath, { recursive: true, force: true });
   } catch {
   }
   try {
@@ -77450,7 +77583,7 @@ function safeLstat(p) {
   }
 }
 function emitAndProjectSkills(root, skills) {
-  const agentsSkillsDir = join26(root, ".agents", "skills");
+  const agentsSkillsDir = join27(root, ".agents", "skills");
   mkdirSync8(agentsSkillsDir, { recursive: true });
   const slugs = [];
   const keep = /* @__PURE__ */ new Set();
@@ -77458,7 +77591,7 @@ function emitAndProjectSkills(root, skills) {
   for (const s of skills) {
     let body2;
     try {
-      body2 = readFileSync21(s.bodyPath, "utf8");
+      body2 = readFileSync22(s.bodyPath, "utf8");
     } catch {
       continue;
     }
@@ -77467,9 +77600,9 @@ function emitAndProjectSkills(root, skills) {
     keep.add(slug2);
     slugs.push(slug2);
     const description = deriveDescription(s.title, s.layer, body2);
-    mkdirSync8(join26(agentsSkillsDir, slug2), { recursive: true });
-    writeFileSync16(
-      join26(agentsSkillsDir, slug2, "SKILL.md"),
+    mkdirSync8(join27(agentsSkillsDir, slug2), { recursive: true });
+    writeFileSync17(
+      join27(agentsSkillsDir, slug2, "SKILL.md"),
       renderSkillMd(slug2, description, body2, skillCiteHandle(s)),
       "utf8"
     );
@@ -77478,11 +77611,11 @@ function emitAndProjectSkills(root, skills) {
   reconcileNamespaced(agentsSkillsDir, keep);
   let projected = 0;
   for (const h of HARNESS_SKILL_DIRS) {
-    if (!existsSync22(join26(root, h.configDir))) continue;
-    const dir = join26(root, h.skillsDir);
+    if (!existsSync23(join27(root, h.configDir))) continue;
+    const dir = join27(root, h.skillsDir);
     mkdirSync8(dir, { recursive: true });
     for (const slug2 of slugs) {
-      linkOrCopy(join26(dir, slug2), join26(agentsSkillsDir, slug2));
+      linkOrCopy(join27(dir, slug2), join27(agentsSkillsDir, slug2));
       projected++;
     }
     reconcileNamespaced(dir, keep);
@@ -77491,15 +77624,15 @@ function emitAndProjectSkills(root, skills) {
   return { slugs, emitted, projected };
 }
 function emitInputsFromManifest(erretaDir, manifestPath) {
-  if (!existsSync22(manifestPath)) return [];
+  if (!existsSync23(manifestPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync21(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync22(manifestPath, "utf8"));
     return (parsed.skills ?? []).filter((s) => Boolean(s.id && s.file)).map((s) => ({
       id: s.id,
       title: s.title ?? s.id,
       layer: s.layer ?? "technique",
       confidence: s.confidence ?? 0,
-      bodyPath: join26(erretaDir, s.file)
+      bodyPath: join27(erretaDir, s.file)
     }));
   } catch {
     return [];
@@ -77513,17 +77646,17 @@ var GITIGNORE_LINES = [
   ".cursor/skills/errata-*/"
 ];
 function ensureSkillGitignore(root) {
-  const path2 = join26(root, ".gitignore");
+  const path2 = join27(root, ".gitignore");
   let current = "";
   try {
-    current = existsSync22(path2) ? readFileSync21(path2, "utf8") : "";
+    current = existsSync23(path2) ? readFileSync22(path2, "utf8") : "";
   } catch {
     return;
   }
   if (current.includes(GITIGNORE_MARK)) return;
   const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
   try {
-    writeFileSync16(path2, `${current}${prefix}
+    writeFileSync17(path2, `${current}${prefix}
 ${GITIGNORE_LINES.join("\n")}
 `, "utf8");
   } catch {
@@ -77616,108 +77749,7 @@ function createToolRunState() {
 // src/engine.ts
 init_tool_index();
 init_paths();
-
-// src/profile.ts
-init_src2();
-init_paths();
-init_git_remote();
-import { existsSync as existsSync23, readFileSync as readFileSync22, writeFileSync as writeFileSync17 } from "node:fs";
-import { createHash as createHash14 } from "node:crypto";
-import { join as join27 } from "node:path";
-function workspaceId(root) {
-  return "wp_" + createHash14("sha256").update(root).digest("hex").slice(0, 12);
-}
-function sessionOriginKey(sessionId) {
-  if (!sessionId) return void 0;
-  return "ws_" + createHash14("sha256").update(sessionId).digest("hex").slice(0, 12);
-}
-function refreshRepoLocator(root, profile) {
-  const detected = detectRepoLocator(root, profile.repoRemote);
-  if (!detected || detected === profile.repoLocator) return false;
-  if (profile.repoLocator) {
-    const aliases = new Set(profile.repoLocatorAliases ?? []);
-    aliases.add(profile.repoLocator);
-    aliases.delete(detected);
-    profile.repoLocatorAliases = [...aliases];
-  }
-  profile.repoLocator = detected;
-  saveProfile(root, profile);
-  return true;
-}
-function loadProfile(root) {
-  const p = workspacePaths(root);
-  if (!existsSync23(p.workspaceJson)) return null;
-  return JSON.parse(readFileSync22(p.workspaceJson, "utf8"));
-}
-function saveProfile(root, profile) {
-  const p = workspacePaths(root);
-  ensureDir(p.configDir);
-  writeFileSync17(p.workspaceJson, JSON.stringify(profile, null, 2), "utf8");
-}
-function autodetectProfile(root) {
-  const id = workspaceId(root);
-  const name2 = root.split(/[\\/]/).filter(Boolean).pop() ?? "workspace";
-  const p = emptyProfile(id, name2);
-  const locator = detectRepoLocator(root);
-  if (locator) p.repoLocator = locator;
-  const pkgPath = join27(root, "package.json");
-  if (existsSync23(pkgPath)) {
-    try {
-      const pkg = JSON.parse(readFileSync22(pkgPath, "utf8"));
-      const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
-      p.languages.push("javascript");
-      if (existsSync23(join27(root, "tsconfig.json")) || deps["typescript"]) {
-        p.languages.push("typescript");
-      }
-      const nodeVer = pkg.engines?.node?.trim();
-      p.stack.push(nodeVer ? `node@${nodeVer}` : "node");
-      const interesting = [
-        "next",
-        "react",
-        "vue",
-        "svelte",
-        "express",
-        "hono",
-        "fastify",
-        "@modelcontextprotocol/sdk"
-      ];
-      for (const k of interesting) {
-        if (deps[k]) p.stack.push(k);
-      }
-    } catch {
-    }
-  }
-  const pyproject = join27(root, "pyproject.toml");
-  if (existsSync23(pyproject)) {
-    try {
-      const txt = readFileSync22(pyproject, "utf8");
-      const py = /python\s*=\s*"([^"]+)"/.exec(txt)?.[1];
-      p.languages.push("python");
-      p.stack.push(`python@${py ?? "3"}`);
-      const candidates = ["fastapi", "django", "flask", "mcp", "pytest"];
-      for (const k of candidates) {
-        if (new RegExp(`\\b${k}\\b`, "i").test(txt)) p.stack.push(k);
-      }
-    } catch {
-    }
-  }
-  const reqs = join27(root, "requirements.txt");
-  if (existsSync23(reqs)) {
-    if (!p.languages.includes("python")) p.languages.push("python");
-    if (!p.stack.includes("python@3")) p.stack.push("python@3");
-  }
-  if (existsSync23(join27(root, "go.mod"))) {
-    p.languages.push("go");
-    p.stack.push("go");
-  }
-  if (existsSync23(join27(root, "Cargo.toml"))) {
-    p.languages.push("rust");
-    p.stack.push("rust");
-  }
-  p.languages = [...new Set(p.languages)];
-  p.stack = [...new Set(p.stack)];
-  return p;
-}
+init_profile2();
 
 // src/witness-queue.ts
 import { readFileSync as readFileSync23, renameSync as renameSync2, writeFileSync as writeFileSync18 } from "node:fs";
@@ -77918,7 +77950,9 @@ var CausalBuffer = class {
 };
 
 // src/engine.ts
+init_profile2();
 init_config();
+init_consent();
 init_cloud_auth();
 
 // src/notify.ts
@@ -78049,6 +78083,8 @@ function maybeFlushDigests() {
 
 // src/liveness-watch.ts
 init_src5();
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync20 } from "node:fs";
+import { join as join30 } from "node:path";
 
 // src/loop-lag.ts
 var HEARTBEAT_MS = 500;
@@ -78171,9 +78207,26 @@ function watchCensusLine(c = watchCensus(), now = Date.now()) {
 // src/liveness-watch.ts
 var LIVENESS_WATCH_INTERVAL_MS = 60 * 60 * 1e3;
 var ALARM_RENOTIFY_MS = 24 * 60 * 60 * 1e3;
+function alarmStatePath(configDir) {
+  return join30(configDir, "liveness-alarms.json");
+}
+function loadAlarmState(configDir) {
+  try {
+    const raw2 = JSON.parse(readFileSync25(alarmStatePath(configDir), "utf8"));
+    return new Map(Object.entries(raw2).filter((e) => typeof e[1] === "number"));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function saveAlarmState(configDir, state) {
+  try {
+    writeFileSync20(alarmStatePath(configDir), JSON.stringify(Object.fromEntries(state)));
+  } catch {
+  }
+}
 function createLivenessWatch(deps) {
   let lastRunAt = 0;
-  const lastAlarmedAt = /* @__PURE__ */ new Map();
+  const lastAlarmedAt = loadAlarmState(deps.configDir);
   return {
     maybeRun(nowMs = Date.now()) {
       if (nowMs - lastRunAt < LIVENESS_WATCH_INTERVAL_MS) return null;
@@ -78222,6 +78275,7 @@ function createLivenessWatch(deps) {
             const at = lastAlarmedAt.get(r.id) ?? 0;
             if (nowMs - at < ALARM_RENOTIFY_MS) continue;
             lastAlarmedAt.set(r.id, nowMs);
+            saveAlarmState(deps.configDir, lastAlarmedAt);
             const line = lines.find((l) => l.includes(r.id)) ?? `${r.verdict} ${r.id}`;
             deps.onAlarm(r.id, `${line.trim()} \u2014 ${r.what}`);
           }
@@ -78335,7 +78389,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.2564" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2571" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -78356,7 +78410,7 @@ function appendIdentityAudit(path2, record2, line) {
 var yieldToLoop = () => new Promise((r) => setImmediate(r));
 function loadTurnCursors(path2) {
   try {
-    const raw2 = JSON.parse(readFileSync25(path2, "utf8"));
+    const raw2 = JSON.parse(readFileSync26(path2, "utf8"));
     return new Map(
       Object.entries(raw2).map(([k, v]) => [k, typeof v === "string" ? v : String(v?.uuid ?? "")])
     );
@@ -78366,7 +78420,7 @@ function loadTurnCursors(path2) {
 }
 function loadTurnOffsets(path2) {
   try {
-    const raw2 = JSON.parse(readFileSync25(path2, "utf8"));
+    const raw2 = JSON.parse(readFileSync26(path2, "utf8"));
     const out2 = /* @__PURE__ */ new Map();
     for (const [k, v] of Object.entries(raw2)) {
       const off = typeof v === "object" && v !== null ? v.offset : void 0;
@@ -78382,7 +78436,7 @@ function saveTurnCursors(path2, cursors, offsets) {
     const merged = {};
     for (const [k, uuid3] of cursors) merged[k] = { uuid: uuid3, offset: offsets.get(k) ?? 0 };
     for (const [k, offset] of offsets) if (!merged[k]) merged[k] = { uuid: "", offset };
-    writeFileSync20(path2, JSON.stringify(merged), "utf8");
+    writeFileSync21(path2, JSON.stringify(merged), "utf8");
   } catch {
   }
 }
@@ -78404,7 +78458,7 @@ function gitSourceWatchTargets(root) {
         ["-C", root, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"],
         { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }
       );
-      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join30(root, d) + sep4));
+      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join31(root, d) + sep4));
     } catch {
     }
     const hasIgnoredChild = (dir) => ignoredDirs.some((ig) => ig.startsWith(dir + "/"));
@@ -78416,19 +78470,19 @@ function gitSourceWatchTargets(root) {
         if (!f.startsWith(prefix)) continue;
         const rest2 = f.slice(prefix.length);
         if (rest2.includes("/")) children.add(dir === "" ? rest2.slice(0, rest2.indexOf("/")) : dir + "/" + rest2.slice(0, rest2.indexOf("/")));
-        else targets.add(join30(root, f));
+        else targets.add(join31(root, f));
       }
       for (const c of children) {
-        if (IGNORED_PATH.test(join30(root, c) + sep4)) continue;
+        if (IGNORED_PATH.test(join31(root, c) + sep4)) continue;
         if (hasIgnoredChild(c)) addUnder(c);
-        else targets.add(join30(root, c));
+        else targets.add(join31(root, c));
       }
     };
     addUnder("");
     if (targets.size > 0) return [...targets];
   } catch {
   }
-  return readdirSync10(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join30(root, String(e.name)) + sep4)).map((e) => join30(root, String(e.name)));
+  return readdirSync10(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join31(root, String(e.name)) + sep4)).map((e) => join31(root, String(e.name)));
 }
 function createWorkspaceEngine(opts) {
   const paths = workspacePaths(opts.workspaceRoot);
@@ -78442,6 +78496,7 @@ function createWorkspaceEngine(opts) {
   } else {
     refreshRepoLocator(opts.workspaceRoot, profile);
   }
+  const consentNow = () => effectiveConsent(loadConfig(), profile);
   const store = openGraphStore({ path: paths.castalia });
   const witnessLoad = loadWitnessQueueWithLosses(witnessQueuePath(paths.configDir));
   const witnessPrune = pruneWitnessQueueWithDispositions(witnessLoad.queue, Date.now());
@@ -78621,7 +78676,7 @@ function createWorkspaceEngine(opts) {
       const srcPaths = diff.changedPaths.filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(p));
       let episodeId2;
       if (srcPaths.length > 0) {
-        const abs = srcPaths.map((p) => join30(opts.workspaceRoot, p));
+        const abs = srcPaths.map((p) => join31(opts.workspaceRoot, p));
         try {
           const r = await runReindexPass(
             `git-reindex:${profile.name} (${abs.length} files)`,
@@ -78657,7 +78712,7 @@ function createWorkspaceEngine(opts) {
         `[errata] git: ${ev.kind} ${ev.newSha.slice(0, 7)} by ${meta3.authorName} \u2014 ${diff.changedPaths.length} file(s), ${diff.renames.length} rename(s)`
       );
     };
-    const gitDir = join30(opts.workspaceRoot, ".git");
+    const gitDir = join31(opts.workspaceRoot, ".git");
     if (existsSync25(gitDir)) {
       stopGit = startGitSensor(gitDir, (ev) => {
         void handleGitEvent(ev).catch((err2) => {
@@ -78839,10 +78894,10 @@ function createWorkspaceEngine(opts) {
       console.warn("[errata] render ledger failed:", err2.message?.slice(0, 120));
     }
     writeContextFile(opts.workspaceRoot, body2);
-    const target = join30(opts.workspaceRoot, "AGENTS.md");
+    const target = join31(opts.workspaceRoot, "AGENTS.md");
     writeManagedBlock(target, { body: AGENTS_POINTER_BODY, stable: true, force: true });
     if (elicit) {
-      writePrimingHandles(join30(paths.configDir, "priming-handles.json"), [
+      writePrimingHandles(join31(paths.configDir, "priming-handles.json"), [
         ...snapshot.recentProblems.map((r) => r.node),
         // Resolved-band handles: the ✓ problem AND its Solution are citable
         // (a fix tag on an already-resolved problem no-ops idempotently; the
@@ -78870,7 +78925,7 @@ function createWorkspaceEngine(opts) {
     // resolves each token against both the Package and Language namespaces,
     // and the profile keeps them in separate fields.
     languages: profile?.languages ?? [],
-    contributePackages: loadConfig().consent.contributePackages,
+    contributePackages: consentNow().contributePackages,
     // `repoLocator` feeds the Maven self-disclosure rule ONLY: a groupId
     // carrying this project's own owner/repo token is the project naming
     // itself, not a library it depends on.
@@ -78881,7 +78936,7 @@ function createWorkspaceEngine(opts) {
     if (opts.skipContextWriter || remoteInFlight) return;
     const now = Date.now();
     if (now - lastRemoteAt < REMOTE_REFRESH_MS) return;
-    const syncOk = opts.syncConsent ?? loadConfig().consent.sync;
+    const syncOk = opts.syncConsent ?? consentNow().sync;
     if (!syncOk) return;
     if (typeof cloud.search !== "function") return;
     remoteInFlight = true;
@@ -78921,7 +78976,7 @@ function createWorkspaceEngine(opts) {
   const maybeRefreshIntentPriors = (liveIntent) => {
     if (!liveIntent || opts.skipContextWriter || intentRemoteInFlight) return;
     if (intentRemote?.forIntent === liveIntent) return;
-    const syncOk = opts.syncConsent ?? loadConfig().consent.sync;
+    const syncOk = opts.syncConsent ?? consentNow().sync;
     if (!syncOk) return;
     if (typeof cloud.search !== "function") return;
     intentRemoteInFlight = true;
@@ -79154,7 +79209,7 @@ function createWorkspaceEngine(opts) {
       resultSummary: { exitCode: e.exitCode ?? 1, errorTokens: e.errorTokens }
     });
   };
-  const turnCursorPath = join30(paths.configDir, "turn-cursors.json");
+  const turnCursorPath = join31(paths.configDir, "turn-cursors.json");
   const lastTurnUuid = loadTurnCursors(turnCursorPath);
   const turnOffset = loadTurnOffsets(turnCursorPath);
   const readLosses = { parseFailures: 0, ioFailures: 0, bytesUnreachable: 0, sliceGuardHits: 0 };
@@ -79209,7 +79264,7 @@ function createWorkspaceEngine(opts) {
     let processedTurns = 0;
     const seqAtStart = store.currentIngestSeq();
     const elicit = isEdgeElicitationEnabled();
-    const handleMap = elicit ? readPrimingHandles(join30(paths.configDir, "priming-handles.json")) : {};
+    const handleMap = elicit ? readPrimingHandles(join31(paths.configDir, "priming-handles.json")) : {};
     const wsRoot = (opts.workspaceRoot ?? "").replace(/\\/g, "/");
     const toRel = (abs) => {
       const p = abs.replace(/\\/g, "/");
@@ -79501,10 +79556,10 @@ function createWorkspaceEngine(opts) {
                 let enclosing = {};
                 if (p.location?.line !== void 0) {
                   try {
-                    const headSha = readGitRefState(join30(opts.workspaceRoot, ".git")).sha ?? void 0;
+                    const headSha = readGitRefState(join31(opts.workspaceRoot, ".git")).sha ?? void 0;
                     enclosing = {
                       line: p.location.line,
-                      fileText: readFileSync25(join30(opts.workspaceRoot, anchorPath), "utf8"),
+                      fileText: readFileSync26(join31(opts.workspaceRoot, anchorPath), "utf8"),
                       ...headSha ? { headSha } : {}
                     };
                   } catch {
@@ -80227,7 +80282,7 @@ B: ${b}`,
     });
   }
   const pullSkills = async () => {
-    if ((opts.syncConsent ?? loadConfig().consent.sync) === true) {
+    if ((opts.syncConsent ?? consentNow().sync) === true) {
       for (const req of communityInductionRequests(store)) {
         try {
           const r = await cloud.induceSkill({ members: req.members, context: req.context });
@@ -80247,7 +80302,7 @@ B: ${b}`,
     const pins = profile?.projectId ? await cloud.getSkillPins(profile.projectId).then((r) => r.pins).catch(() => []) : [];
     const anchorMap = buildBucketTokenAnchors(
       profile.languages ?? [],
-      loadConfig().consent.contributePackages ? store.findNodesByLabel("Package").map((p) => ({
+      consentNow().contributePackages ? store.findNodesByLabel("Package").map((p) => ({
         name: String(p.attrs["name"] ?? ""),
         purl: String(p.attrs["purl"] ?? p.id)
       })) : []
@@ -80262,7 +80317,7 @@ B: ${b}`,
     try {
       const inputs = emitInputsFromManifest(paths.configDir, paths.skillsManifest);
       emitAndProjectSkills(opts.workspaceRoot, inputs);
-      writePrimingHandles(join30(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
+      writePrimingHandles(join31(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
     } catch (err2) {
       console.warn("[skills] agent-skills projection failed (non-fatal):", err2 instanceof Error ? err2.message : err2);
     }
@@ -80354,7 +80409,7 @@ B: ${b}`,
     semanticMaintenance() {
       const seqBefore = store.currentIngestSeq();
       const report = runSemanticMaintenance(store);
-      let hintUpgrade = { upgraded: 0, standing: 0, unresolvable: 0 };
+      let hintUpgrade = { upgraded: 0, standing: 0, unresolvable: 0, blocked: 0 };
       try {
         hintUpgrade = upgradeAnchorHints(store, profile.id, Date.now());
       } catch {
@@ -80372,7 +80427,8 @@ B: ${b}`,
         seqAdvanced: store.currentIngestSeq() - seqBefore,
         anchorHintsUpgraded: hintUpgrade.upgraded,
         anchorHintsStanding: hintUpgrade.standing,
-        anchorHintsUnresolvable: hintUpgrade.unresolvable
+        anchorHintsUnresolvable: hintUpgrade.unresolvable,
+        anchorHintsBlocked: hintUpgrade.blocked
       });
       if (report.revisitsCleared > 0 || report.fixCandidatesSettled > 0 || report.designResolved > 0) {
         refreshContextNow();
@@ -80553,7 +80609,7 @@ B: ${b}`,
       };
     },
     async syncNow() {
-      const syncOk = opts.syncConsent ?? loadConfig().consent.sync;
+      const syncOk = opts.syncConsent ?? consentNow().sync;
       if (!syncOk) {
         console.log(
           "[errata] sync skipped \u2014 cloud sync consent is off (enable with `errata consent sync on`)"
@@ -80584,14 +80640,14 @@ B: ${b}`,
       }
       try {
         const freshCfg = loadConfig();
-        if (freshCfg.consent.telemetry) {
+        if (consentNow().telemetry) {
           telemetry.event("graph_snapshot", store.nodeCount(), {
             problemsLive: store.findNodesByLabel("Problem").length
           });
           telemetry.event("heartbeat");
         }
         const t = await telemetry.flush(cloud, {
-          consent: freshCfg.consent.telemetry,
+          consent: consentNow().telemetry,
           credentialPresent: Boolean(opts.apiKey) || hasCloudCredential(freshCfg)
         });
         if (t.sent > 0) {
@@ -80649,7 +80705,7 @@ async function startDaemon(opts) {
     reviewUrl: () => webUiUrl + "/review"
   });
   const writeLockFile = (url2) => {
-    writeFileSync21(
+    writeFileSync22(
       engine.paths.daemonLock,
       JSON.stringify({ pid: process.pid, webUiUrl: url2, startedAt: Date.now() }),
       "utf8"
@@ -80714,7 +80770,7 @@ init_identity2();
 // src/multi.ts
 init_dist();
 init_src5();
-import { existsSync as existsSync32, readFileSync as readFileSync31, unlinkSync as unlinkSync3, writeFileSync as writeFileSync23 } from "node:fs";
+import { existsSync as existsSync32, readFileSync as readFileSync32, unlinkSync as unlinkSync3, writeFileSync as writeFileSync24 } from "node:fs";
 import { resolve as pathResolve } from "node:path";
 
 // src/principle-sync.ts
@@ -80743,8 +80799,8 @@ init_reconcile();
 
 // src/lockfile-auto.ts
 init_src();
-import { existsSync as existsSync27, readFileSync as readFileSync26 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync27 } from "node:fs";
+import { join as join32 } from "node:path";
 
 // src/package-index.ts
 init_src();
@@ -80893,11 +80949,11 @@ function runLockfilePass(opts) {
     { file: "package-lock.json", parse: parsePackageLockJson }
   ];
   for (const c of candidates) {
-    const p = join31(opts.root, c.file);
+    const p = join32(opts.root, c.file);
     if (!existsSync27(p)) continue;
     let sbom;
     try {
-      sbom = c.parse(readFileSync26(p, "utf8"));
+      sbom = c.parse(readFileSync27(p, "utf8"));
     } catch {
       continue;
     }
@@ -80953,9 +81009,12 @@ function noveltyAgainst(node2, neighbors, opts = {}) {
   };
 }
 
+// src/instance-ingest.ts
+init_profile2();
+
 // src/public-symbols.ts
-import { readFileSync as readFileSync27, readdirSync as readdirSync11, existsSync as existsSync28 } from "node:fs";
-import { join as join32 } from "node:path";
+import { readFileSync as readFileSync28, readdirSync as readdirSync11, existsSync as existsSync28 } from "node:fs";
+import { join as join33 } from "node:path";
 var HEAD_BYTES = 8 * 1024;
 var INDEX_TTL_MS = 10 * 60 * 1e3;
 var MIN_SYMBOL_LEN = 4;
@@ -80988,20 +81047,20 @@ function bindingNames(clause) {
 function internalPackageNames(workspaceRoot) {
   const names = /* @__PURE__ */ new Set();
   const tryRead = (dir) => {
-    const pj = join32(dir, "package.json");
+    const pj = join33(dir, "package.json");
     if (!existsSync28(pj)) return;
     try {
-      const name2 = JSON.parse(readFileSync27(pj, "utf8")).name;
+      const name2 = JSON.parse(readFileSync28(pj, "utf8")).name;
       if (typeof name2 === "string" && name2.length > 0) names.add(name2);
     } catch {
     }
   };
   tryRead(workspaceRoot);
   for (const group of ["packages", "apps"]) {
-    const groupDir = join32(workspaceRoot, group);
+    const groupDir = join33(workspaceRoot, group);
     if (!existsSync28(groupDir)) continue;
     try {
-      for (const entry of readdirSync11(groupDir)) tryRead(join32(groupDir, entry));
+      for (const entry of readdirSync11(groupDir)) tryRead(join33(groupDir, entry));
     } catch {
     }
   }
@@ -81014,7 +81073,7 @@ function publicSymbolIndex(store, workspaceRoot, deps = {}) {
   if (cached2 && now - cached2.builtAt < INDEX_TTL_MS) return cached2;
   const readHead = deps.readHead ?? ((absPath) => {
     try {
-      return readFileSync27(absPath, "utf8").slice(0, HEAD_BYTES);
+      return readFileSync28(absPath, "utf8").slice(0, HEAD_BYTES);
     } catch {
       return "";
     }
@@ -81034,7 +81093,7 @@ function publicSymbolIndex(store, workspaceRoot, deps = {}) {
   }
   const symbols = /* @__PURE__ */ new Set();
   for (const rel of files) {
-    const head2 = readHead(join32(workspaceRoot, rel));
+    const head2 = readHead(join33(workspaceRoot, rel));
     if (!head2) continue;
     for (const re of [NAMED_IMPORT_RE, REQUIRE_RE]) {
       re.lastIndex = 0;
@@ -81752,7 +81811,7 @@ function cloudTargetDrift(daemon, shell2) {
 }
 
 // src/lock.ts
-import { existsSync as existsSync29, readFileSync as readFileSync28 } from "node:fs";
+import { existsSync as existsSync29, readFileSync as readFileSync29 } from "node:fs";
 function daemonLockPayload(lock) {
   return JSON.stringify({
     pid: lock.pid,
@@ -81792,7 +81851,7 @@ function isProcessAlive(pid) {
 function readDaemonLock(lockPath) {
   if (!existsSync29(lockPath)) return null;
   try {
-    const lock = JSON.parse(readFileSync28(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync29(lockPath, "utf8"));
     return typeof lock.pid === "number" ? lock : null;
   } catch {
     return null;
@@ -81972,6 +82031,7 @@ function liveCloudClient(src) {
 init_identity2();
 
 // src/project-link.ts
+init_profile2();
 async function ensureProjectLink(root, profile, client) {
   if (profile.projectLinkDisabled) return { linked: false, reason: "disabled" };
   const locator = profile.repoLocator;
@@ -81996,10 +82056,12 @@ async function ensureProjectLink(root, profile, client) {
 
 // src/project-hydrate.ts
 init_src11();
+init_profile2();
 
 // src/project-reanchor.ts
 init_src();
 init_src11();
+init_profile2();
 var DEFAULT_LIMIT = 50;
 var ANCHOR_SYMBOL_KINDS2 = [
   "Function",
@@ -82307,8 +82369,8 @@ async function hydrateProject(opts) {
 init_src7();
 init_src();
 import { execFile as execFile3 } from "node:child_process";
-import { readFileSync as readFileSync30 } from "node:fs";
-import { join as join34 } from "node:path";
+import { readFileSync as readFileSync31 } from "node:fs";
+import { join as join35 } from "node:path";
 import { promisify } from "node:util";
 
 // src/history-walk.ts
@@ -82530,8 +82592,8 @@ function narrative(unit, group) {
 
 // src/history-bundle.ts
 import { execFile as execFile2 } from "node:child_process";
-import { readFileSync as readFileSync29 } from "node:fs";
-import { join as join33 } from "node:path";
+import { readFileSync as readFileSync30 } from "node:fs";
+import { join as join34 } from "node:path";
 
 // ../../packages/privacy/src/patterns/credentials.ts
 var CREDENTIAL_PATTERNS = [
@@ -83313,7 +83375,7 @@ function pathAllowedByFloor(path2) {
 function loadRepoIgnore(root, extraPatterns = []) {
   let source = "";
   try {
-    source = readFileSync29(join33(root, ".errataignore"), "utf8");
+    source = readFileSync30(join34(root, ".errataignore"), "utf8");
   } catch {
     source = "";
   }
@@ -83715,6 +83777,7 @@ async function buildUnitBundle(root, unit, opts = {}) {
 }
 
 // src/project-history.ts
+init_profile2();
 var execFileAsync = promisify(execFile3);
 var HISTORY_EXTRACTOR_VERSION = "history-1";
 var LEASE_POLL_MS = 2e4;
@@ -83727,7 +83790,7 @@ async function defaultGit(root, args2) {
 function readIgnoreLines(root, profile) {
   let lines = [];
   try {
-    lines = readFileSync30(join34(root, ".errataignore"), "utf8").split("\n");
+    lines = readFileSync31(join35(root, ".errataignore"), "utf8").split("\n");
   } catch {
   }
   return [...lines, ...profile.ignoreExtra ?? []].map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
@@ -84056,8 +84119,8 @@ async function startHistoryStage(root, input, client, walk10 = {}) {
 init_cloud_auth();
 import { createHash as createHash15 } from "node:crypto";
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync30, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync30, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join36 } from "node:path";
 
 // src/device-poll.ts
 var THROTTLED_POLL_MIN_WAIT_MS = 11e3;
@@ -84455,18 +84518,16 @@ fixtures/
 *.sql.gz
 `;
 function applyConsents(profile, config2, c, decidedAt, now = Date.now) {
-  const nextConfig = {
-    ...config2,
-    consent: {
-      ...config2.consent,
-      sync: c.sync !== "off",
-      telemetry: c.telemetry,
-      contributePackages: c.packages && c.sync !== "off"
-    },
-    onboardedAt: config2.onboardedAt ?? now()
+  const nextConfig = { ...config2, onboardedAt: config2.onboardedAt ?? now() };
+  const consoleConsents = {
+    sync: c.sync !== "off",
+    telemetry: c.telemetry,
+    contributePackages: c.packages && c.sync !== "off",
+    decidedAt
   };
   const nextProfile = {
     ...profile,
+    consoleConsents,
     syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
     linkConsents: {
       structure: c.structure,
@@ -84476,7 +84537,8 @@ function applyConsents(profile, config2, c, decidedAt, now = Date.now) {
     }
   };
   const prev = profile.linkConsents;
-  const changed = profile.syncConsent !== nextProfile.syncConsent || config2.consent.sync !== nextConfig.consent.sync || config2.consent.telemetry !== nextConfig.consent.telemetry || config2.consent.contributePackages !== nextConfig.consent.contributePackages || !prev || prev.structure !== nextProfile.linkConsents.structure || prev.mineHistory !== nextProfile.linkConsents.mineHistory || prev.contributeHistory !== nextProfile.linkConsents.contributeHistory;
+  const prevConsole = profile.consoleConsents;
+  const changed = profile.syncConsent !== nextProfile.syncConsent || prevConsole?.sync !== consoleConsents.sync || prevConsole?.telemetry !== consoleConsents.telemetry || prevConsole?.contributePackages !== consoleConsents.contributePackages || !prev || prev.structure !== nextProfile.linkConsents.structure || prev.mineHistory !== nextProfile.linkConsents.mineHistory || prev.contributeHistory !== nextProfile.linkConsents.contributeHistory;
   return { profile: nextProfile, config: nextConfig, changed };
 }
 function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
@@ -84490,9 +84552,9 @@ function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
   delete nextProfile.projectLinkDisabled;
   let wroteIgnore = false;
   if (decision.writeIgnoreStarter !== false) {
-    const target = join35(root, ".errataignore");
+    const target = join36(root, ".errataignore");
     if (!existsSync30(target)) {
-      writeFileSync22(target, IGNORE_STARTER, "utf8");
+      writeFileSync23(target, IGNORE_STARTER, "utf8");
       wroteIgnore = true;
     }
   }
@@ -84500,16 +84562,17 @@ function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
 }
 
 // src/multi.ts
+init_consent();
 init_registry();
 
 // src/adopt.ts
 init_git_remote();
 import { existsSync as existsSync31 } from "node:fs";
-import { dirname as dirname12, join as join36 } from "node:path";
+import { dirname as dirname12, join as join37 } from "node:path";
 function findGitRoot(absPath) {
   let dir = absPath;
   for (let depth = 0; depth < 64; depth++) {
-    if (existsSync31(join36(dir, ".git"))) return dir;
+    if (existsSync31(join37(dir, ".git"))) return dir;
     const parent = dirname12(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -84696,6 +84759,9 @@ function codexWakeCandidates(input) {
   return out2;
 }
 
+// src/multi.ts
+init_profile2();
+
 // src/hook-route.ts
 function msysToWindowsPath(p, platform = process.platform) {
   if (platform !== "win32") return p;
@@ -85124,7 +85190,7 @@ async function startMultiDaemon(opts = {}) {
     records.push(rec);
     void ambientLinkAll();
     try {
-      writeFileSync23(
+      writeFileSync24(
         rec.engine.paths.daemonLock,
         daemonLockPayload({
           pid: process.pid,
@@ -85443,7 +85509,7 @@ async function startMultiDaemon(opts = {}) {
   baseUrl = `http://127.0.0.1:${port}`;
   try {
     ensureDir(globalDir());
-    writeFileSync23(
+    writeFileSync24(
       lockPath,
       daemonLockPayload({ pid: process.pid, webUiUrl: baseUrl, processStartedAt: PROCESS_STARTED_AT, entry: SELF_ENTRY, version: DAEMON_VERSION }),
       "utf8"
@@ -85452,7 +85518,7 @@ async function startMultiDaemon(opts = {}) {
   }
   for (const r of records) {
     try {
-      writeFileSync23(
+      writeFileSync24(
         r.engine.paths.daemonLock,
         daemonLockPayload({
           pid: process.pid,
@@ -85512,11 +85578,11 @@ async function startMultiDaemon(opts = {}) {
   const ANCHOR_PULL_INTERVAL_MS = 10 * 60 * 1e3;
   const anchorPullAll = async () => {
     const c = loadConfig();
-    if (!c.consent.sync || !hasCloudCredential(c)) return;
+    if (!hasCloudCredential(c)) return;
     const client = cloudNow();
     for (const r of records) {
       const projectId = r.engine.profile.projectId;
-      if (!projectId) continue;
+      if (!projectId || !effectiveConsent(c, r.engine.profile).sync) continue;
       try {
         const { salt } = await resolveProjectSymbolSalt(client, projectId);
         await pullProjectAnchors(r, client, salt);
@@ -85530,9 +85596,10 @@ async function startMultiDaemon(opts = {}) {
   }, ANCHOR_PULL_INTERVAL_MS);
   const ambientLinkAll = async () => {
     const c = loadConfig();
-    if (!c.consent.sync || !hasCloudCredential(c)) return;
+    if (!hasCloudCredential(c)) return;
     const client = cloudNow();
     for (const r of records) {
+      if (!effectiveConsent(c, r.engine.profile).sync) continue;
       const out2 = await ensureProjectLink(r.root, r.engine.profile, client);
       if (out2.linked) {
         console.log(
@@ -85599,14 +85666,14 @@ async function startMultiDaemon(opts = {}) {
             };
             void startHistoryStage(root, engine.profile, client, {
               anchors: { index: anchorIndex, salt },
-              // PS-web projects: the console's consents (Privacy tab) win over
-              // the profile's memory; applied to config and profile here, with
+              // PS-web projects: the console's consents (Privacy tab) are this
+              // project's, applied to ITS profile only (DC-consent-scope), with
               // the change printed so a flipped switch is visible in the log.
               applyConsents: (p, consents) => {
                 const cfg2 = loadConfig();
                 const applied = applyConsents(p, cfg2, consents, (/* @__PURE__ */ new Date()).toISOString());
                 if (applied.changed) {
-                  saveConfig(applied.config);
+                  if (applied.config.onboardedAt !== cfg2.onboardedAt) saveConfig(applied.config);
                   Object.assign(engine.profile, applied.profile);
                   saveProfile(root, engine.profile);
                   console.log(
@@ -85888,7 +85955,7 @@ async function startMultiDaemon(opts = {}) {
       const ignore2 = loadClaimIgnorePatterns(globalDir());
       const primaryLanguage = machineDominantLanguage();
       const languages = records.flatMap((r) => r.engine.profile.languages ?? []);
-      const packages = cfg2.consent.contributePackages ? records.flatMap(
+      const packages = cfg2.consent.contributePackages ? records.filter((r) => effectiveConsent(cfg2, r.engine.profile).contributePackages).flatMap(
         (r) => r.engine.store.findNodesByLabel("Package").map((p) => ({
           name: String(p.attrs["name"] ?? ""),
           purl: String(p.attrs["purl"] ?? p.id)
@@ -85907,7 +85974,9 @@ async function startMultiDaemon(opts = {}) {
     },
     async syncInstancesPublic() {
       const cfg2 = loadConfig();
-      if (!cfg2.consent.sync) return { uploaded: 0, skipped: "consent-off" };
+      if (!records.some((r) => effectiveConsent(cfg2, r.engine.profile).sync)) {
+        return { uploaded: 0, skipped: "consent-off" };
+      }
       if (registryCorrupt()) {
         const msg = "workspace registry unreadable \u2014 holding ALL per-workspace cloud push (bindings unprovable; fail-closed)";
         console.error(`[identity] ${msg}`);
@@ -85983,6 +86052,8 @@ async function startMultiDaemon(opts = {}) {
         }
       };
       for (const r of records) {
+        const recordConsent = effectiveConsent(cfg2, r.engine.profile);
+        if (!recordConsent.sync) continue;
         const recordIdentity = identityFor(liveWorkspaceEntry(r.entry));
         if (recordIdentity.invalid) {
           noteIdentityBlock(r.id, r.entry.name, recordIdentity);
@@ -86018,7 +86089,7 @@ async function startMultiDaemon(opts = {}) {
           profile: r.engine.profile,
           daemonVersion: DAEMON_VERSION,
           ignorePatterns: [...ignore2],
-          includePackages: cfg2.consent.contributePackages
+          includePackages: recordConsent.contributePackages
         });
         if (context) {
           await lane("context", projectName, async () => {
@@ -86049,7 +86120,7 @@ async function startMultiDaemon(opts = {}) {
           profile: r.engine.profile,
           daemonVersion: DAEMON_VERSION,
           ignorePatterns: [...ignore2],
-          includePackages: cfg2.consent.contributePackages,
+          includePackages: recordConsent.contributePackages,
           workspaceRoot: r.root,
           ...project ? { project } : {}
         });
@@ -86317,7 +86388,7 @@ async function startMultiDaemon(opts = {}) {
       clearInterval(anchorPull);
       clearTimeout(codexWakeBoot);
       try {
-        const cur = readFileSync31(lockPath, "utf8");
+        const cur = readFileSync32(lockPath, "utf8");
         if (JSON.parse(cur).pid === process.pid) unlinkSync3(lockPath);
       } catch {
       }
@@ -86365,6 +86436,8 @@ async function startMultiDaemon(opts = {}) {
 
 // src/cli.ts
 init_src5();
+init_profile2();
+init_consent();
 init_git_remote();
 init_config();
 init_src7();
@@ -86940,9 +87013,9 @@ function buildCodexHooksToml(port, options) {
 }
 
 // src/codex-hooks.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync9, readFileSync as readFileSync32, writeFileSync as writeFileSync24 } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync9, readFileSync as readFileSync33, writeFileSync as writeFileSync25 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 
 // src/codex-hook-relay.ts
 var CODEX_RELAY_SOURCE = String.raw`// errata-managed: regenerated by errata install-hooks codex
@@ -86982,8 +87055,8 @@ try {
 `;
 
 // src/codex-hooks.ts
-function hasCodexConfig(root, codexHome = process.env["CODEX_HOME"] || join37(homedir7(), ".codex")) {
-  return existsSync33(join37(root, ".codex")) || existsSync33(codexHome);
+function hasCodexConfig(root, codexHome = process.env["CODEX_HOME"] || join38(homedir7(), ".codex")) {
+  return existsSync33(join38(root, ".codex")) || existsSync33(codexHome);
 }
 function replaceCodexHooks(existing, block) {
   const begin = existing.indexOf(CODEX_HOOKS_BEGIN);
@@ -86999,14 +87072,14 @@ function replaceCodexHooks(existing, block) {
   return existing.trimEnd() + (existing.trim() ? "\n\n" : "") + block;
 }
 function writeCodexHooks(root, port, nodePath = process.execPath) {
-  const dir = join37(root, ".codex");
-  const file2 = join37(dir, "config.toml");
-  const relay = join37(dir, "hooks", "errata-relay.mjs");
+  const dir = join38(root, ".codex");
+  const file2 = join38(dir, "config.toml");
+  const relay = join38(dir, "hooks", "errata-relay.mjs");
   const block = buildCodexHooksToml(port, { nodePath, relayPath: relay });
-  const final = replaceCodexHooks(existsSync33(file2) ? readFileSync32(file2, "utf8") : "", block);
-  mkdirSync9(join37(dir, "hooks"), { recursive: true });
-  writeFileSync24(relay, CODEX_RELAY_SOURCE, "utf8");
-  writeFileSync24(file2, final, "utf8");
+  const final = replaceCodexHooks(existsSync33(file2) ? readFileSync33(file2, "utf8") : "", block);
+  mkdirSync9(join38(dir, "hooks"), { recursive: true });
+  writeFileSync25(relay, CODEX_RELAY_SOURCE, "utf8");
+  writeFileSync25(file2, final, "utf8");
   return file2;
 }
 
@@ -87416,13 +87489,13 @@ async function cmdInit() {
     console.log("");
     console.log("installing harness hooks...");
     const { existsSync: existsSync35 } = await import("node:fs");
-    const { join: join39 } = await import("node:path");
+    const { join: join40 } = await import("node:path");
     try {
       await installClaudeHooks(port);
     } catch (err2) {
       console.warn(`  \u26A0\uFE0F  Claude hook install failed: ${err2 instanceof Error ? err2.message : err2}`);
     }
-    if (existsSync35(join39(ROOT, ".cursor"))) {
+    if (existsSync35(join40(ROOT, ".cursor"))) {
       try {
         await installCursorMcpConfig();
       } catch (err2) {
@@ -87707,8 +87780,14 @@ async function cmdStatus() {
   );
   const cs = cfg.consent;
   console.log(
-    `  consent:   sync ${cs.sync ? "on" : "off"} \xB7 telemetry ${cs.telemetry ? "on" : "off"} \xB7 packages ${cs.contributePackages ? "on" : "off"}`
+    `  consent:   sync ${cs.sync ? "on" : "off"} \xB7 telemetry ${cs.telemetry ? "on" : "off"} \xB7 packages ${cs.contributePackages ? "on" : "off"} (machine default)`
   );
+  const pc = profile?.consoleConsents;
+  if (pc) {
+    console.log(
+      `             this project (console): sync ${pc.sync ? "on" : "off"} \xB7 telemetry ${pc.telemetry ? "on" : "off"} \xB7 packages ${pc.contributePackages ? "on" : "off"}`
+    );
+  }
   console.log(`  cloud:`);
   console.log(`    url:    ${cfg.cloudUrl}`);
   if (daemonCloud) {
@@ -88157,12 +88236,11 @@ async function cmdLoginOAuthDevice(cfg, input) {
   }
 }
 async function linkRegisteredWorkspaces(cfg) {
-  if (!cfg.consent.sync) return;
   const client = authedCloudClient(cfg);
   for (const w of listWorkspaces()) {
     try {
       const profile = loadProfile(w.path);
-      if (!profile) continue;
+      if (!profile || !effectiveConsent(cfg, profile).sync) continue;
       refreshRepoLocator(w.path, profile);
       const out2 = await ensureProjectLink(w.path, profile, client);
       if (out2.linked) {
@@ -88247,7 +88325,7 @@ async function cmdLink(args2) {
         `linked${d.existed ? "" : " (created)"}: ${d.locator} \u2192 project ${d.projectId} \xB7 ${where} \xB7 ${d.visibility} \xB7 grant v${d.grantVersion}`
       );
       console.log(
-        `consents: sync=${d.consents.sync} telemetry=${d.consents.telemetry ? "on" : "off"} packages=${applied.config.consent.contributePackages ? "on" : "off"} structure=${d.consents.structure ? "on" : "off"} history=${d.consents.mineHistory ? applied.profile.linkConsents?.contributeHistory ? "mine+contribute" : "mine" : "off"}`
+        `consents (this project): sync=${d.consents.sync} telemetry=${d.consents.telemetry ? "on" : "off"} packages=${applied.profile.consoleConsents?.contributePackages ? "on" : "off"} structure=${d.consents.structure ? "on" : "off"} history=${d.consents.mineHistory ? applied.profile.linkConsents?.contributeHistory ? "mine+contribute" : "mine" : "off"}`
       );
       await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");
@@ -88520,7 +88598,7 @@ async function cmdReview() {
     console.log("(review queue empty)");
     return;
   }
-  const queue = JSON.parse(readFileSync33(paths.reviewQueue, "utf8"));
+  const queue = JSON.parse(readFileSync34(paths.reviewQueue, "utf8"));
   if (queue.length === 0) {
     console.log("(review queue empty)");
     return;
@@ -89230,7 +89308,7 @@ async function gatherReportData(generatedAt) {
   };
 }
 async function cmdReport(args2) {
-  const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync25 } = await import("node:fs");
+  const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync26 } = await import("node:fs");
   const { renderReport: renderReport2 } = await Promise.resolve().then(() => (init_report_render(), report_render_exports));
   const includeFutureVerbs = args2.includes("--future-verbs");
   const now = /* @__PURE__ */ new Date();
@@ -89243,8 +89321,8 @@ async function cmdReport(args2) {
   const outDir = workspacePaths(ROOT).configDir;
   mkdirSync10(outDir, { recursive: true });
   const files = renderReport2(data, { includeFutureVerbs });
-  for (const f of files) writeFileSync25(join38(outDir, f.name), f.html, "utf8");
-  const indexPath = join38(outDir, "report.html");
+  for (const f of files) writeFileSync26(join39(outDir, f.name), f.html, "utf8");
+  const indexPath = join39(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
   console.log(
     `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
@@ -89364,24 +89442,24 @@ async function cmdInstallHooks(args2) {
   }
 }
 async function installOpencodePlugin(port) {
-  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
-  const { join: join39 } = await import("node:path");
-  const dir = join39(ROOT, ".opencode", "plugin");
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync35, writeFileSync: writeFileSync26 } = await import("node:fs");
+  const { join: join40 } = await import("node:path");
+  const dir = join40(ROOT, ".opencode", "plugin");
   if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
-  const file2 = join39(dir, "inerrata.js");
+  const file2 = join40(dir, "inerrata.js");
   if (existsSync35(file2)) {
-    const head2 = readFileSync34(file2, "utf8").split("\n")[0] ?? "";
+    const head2 = readFileSync35(file2, "utf8").split("\n")[0] ?? "";
     if (head2.trim() !== OPENCODE_PLUGIN_MARKER) {
       console.error(`refusing to overwrite ${file2}: not an errata-managed plugin (line 1 lacks the marker)`);
       process.exit(2);
     }
   }
-  writeFileSync25(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
-  const cfgFile = join39(ROOT, "opencode.json");
+  writeFileSync26(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
+  const cfgFile = join40(ROOT, "opencode.json");
   let cfg = { $schema: "https://opencode.ai/config.json" };
   if (existsSync35(cfgFile)) {
     try {
-      cfg = JSON.parse(readFileSync34(cfgFile, "utf8"));
+      cfg = JSON.parse(readFileSync35(cfgFile, "utf8"));
     } catch {
       console.error(`refusing to touch invalid JSON at ${cfgFile} \u2014 fix it and re-run`);
       process.exit(2);
@@ -89392,7 +89470,7 @@ async function installOpencodePlugin(port) {
   if (!hadErrata) {
     const inv = errataMcpInvocation();
     cfg.mcp["errata"] = { type: "local", command: [inv.command, ...inv.args] };
-    writeFileSync25(cfgFile, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+    writeFileSync26(cfgFile, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   }
   console.log(`installed OpenCode plugin \u2192 ${file2}`);
   if (hadErrata) console.log(`  mcp.errata already present in ${cfgFile} \u2014 left untouched`);
@@ -89412,15 +89490,15 @@ function errataMcpInvocation() {
   return { command: cmd2, args: args2 };
 }
 async function installClaudeHooks(port) {
-  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
-  const { join: join39 } = await import("node:path");
-  const dir = join39(ROOT, ".claude");
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync35, writeFileSync: writeFileSync26 } = await import("node:fs");
+  const { join: join40 } = await import("node:path");
+  const dir = join40(ROOT, ".claude");
   if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
-  const file2 = join39(dir, "settings.json");
+  const file2 = join40(dir, "settings.json");
   let settings = {};
   if (existsSync35(file2)) {
     try {
-      settings = JSON.parse(readFileSync34(file2, "utf8"));
+      settings = JSON.parse(readFileSync35(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -89466,10 +89544,10 @@ async function installClaudeHooks(port) {
     dropErrata(list);
     list.push({ hooks: [{ type: "command", command: injectCmd }] });
   }
-  writeFileSync25(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  writeFileSync26(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code hooks \u2192 ${file2}`);
   await installClaudeMcpConfig();
-  const claudeMd = join39(ROOT, "CLAUDE.md");
+  const claudeMd = join40(ROOT, "CLAUDE.md");
   const recall = writeManagedBlock(claudeMd, { body: RECALL_FIRST_BLOCK });
   if (recall.kind === "collision") {
     console.warn(
@@ -89481,15 +89559,15 @@ async function installClaudeHooks(port) {
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
 }
 async function installClaudeMcpConfig() {
-  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
-  const { join: join39, dirname: dirname13 } = await import("node:path");
-  const file2 = join39(ROOT, ".mcp.json");
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync35, writeFileSync: writeFileSync26 } = await import("node:fs");
+  const { join: join40, dirname: dirname13 } = await import("node:path");
+  const file2 = join40(ROOT, ".mcp.json");
   const dir = dirname13(file2);
   if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
   let cfg = {};
   if (existsSync35(file2)) {
     try {
-      cfg = JSON.parse(readFileSync34(file2, "utf8"));
+      cfg = JSON.parse(readFileSync35(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -89497,21 +89575,21 @@ async function installClaudeMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync25(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync26(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code MCP server config \u2192 ${file2}`);
   console.log(`  Claude Code will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses / show / similar`);
 }
 async function installCursorMcpConfig() {
-  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
-  const { join: join39 } = await import("node:path");
-  const dir = join39(ROOT, ".cursor");
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync35, writeFileSync: writeFileSync26 } = await import("node:fs");
+  const { join: join40 } = await import("node:path");
+  const dir = join40(ROOT, ".cursor");
   if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
-  const file2 = join39(dir, "mcp.json");
+  const file2 = join40(dir, "mcp.json");
   let cfg = {};
   if (existsSync35(file2)) {
     try {
-      cfg = JSON.parse(readFileSync34(file2, "utf8"));
+      cfg = JSON.parse(readFileSync35(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -89519,7 +89597,7 @@ async function installCursorMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync25(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync26(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Cursor MCP server config \u2192 ${file2}`);
   console.log(`  Cursor will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses`);
@@ -89871,7 +89949,7 @@ async function cmdDash(args2) {
       await yieldToLoop2();
       try {
         const items = selectDurableMemory(handle2.sharedStore, r.engine.profile);
-        const res = bleedRules(join38(r.root, ".claude", "rules"), items);
+        const res = bleedRules(join39(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(
             `[rules:${r.entry.name}] ${res.written} collective principle(s) \u2192 .claude/rules` + (res.pruned ? `, ${res.pruned} pruned` : "")