@ionivetech/mugiwara 0.7.0 → 0.8.0

package/dist/mugiwara.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { existsSync as existsSync12, readdirSync as readdirSync9, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync15, readdirSync as readdirSync10, readFileSync as readFileSync14, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "node:fs";
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join15, resolve as resolve2 } from "node:path";
+import { join as join20, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/args.ts
-var VALUE_FLAGS = { "--project": "project", "--target": "target", "--before": "before" };
+var VALUE_FLAGS = { "--project": "project", "--target": "target", "--before": "before", "--backend": "backend", "--mission": "mission" };
 var BOOL_FLAGS = {
   "--global": "global",
   "--yes": "yes",
@@ -19,10 +19,13 @@ var BOOL_FLAGS = {
   "--check": "check",
   "--all": "all",
   "--verify": "verify",
+  "--gen-key": "genKey",
   "--help": "help",
   "-h": "help",
   "--version": "version",
-  "-v": "version"
+  "-v": "version",
+  "--json": "json",
+  "--ledger": "ledger"
 };
 function parseArgs(argv) {
   const out = { _: [], flags: {}, command: "install" };
@@ -620,50 +623,118 @@ var targets = { claude: target, opencode: target2, copilot: target3, gemini: tar
 var TARGET_IDS = Object.keys(targets);
 
 // src/installer.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync3, writeFileSync as writeFileSync3, copyFileSync as copyFileSync3, rmSync, lstatSync } from "node:fs";
-import { dirname as dirname3, join as join5 } from "node:path";
-import { homedir } from "node:os";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3, writeFileSync as writeFileSync4, copyFileSync as copyFileSync3, rmSync, lstatSync as lstatSync2 } from "node:fs";
+import { dirname as dirname3, join as join6 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-var CONTENT_DIR = join5(dirname3(fileURLToPath3(import.meta.url)), "..", "content");
-var pkg = JSON.parse(readFileSync3(join5(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf8"));
+
+// src/config.ts
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join5 } from "node:path";
+var DEFAULT_CONFIG = [
+  "mode=guided",
+  "branch=feature/{type}-{issue}-{slug}",
+  "commit=conventional",
+  "auto_commit=on",
+  "coverage_new=85",
+  "coverage_modified=90",
+  "review_depth=full",
+  "quality_depth=full",
+  "verify_merged=off",
+  "delegate_threshold=60",
+  "heal_max_cycles=3",
+  "verbosity=normal",
+  "# context_budget_chars=150000  # optional: fail archive if trail exceeds this (measured in report Cost section)",
+  "# investigation_max_passes=2  # optional: cap investigation passes (spec §13)",
+  "# investigation_max_unrelated_files=5",
+  "# investigation_repeated_read_threshold=2",
+  "# sign=auto            # optional: auto | minisign | pure | off — report attestation",
+  "# enforce=block                # optional: off | warn | block — pipeline-guard policy"
+].join(`
+`) + `
+`;
+function configPaths(projectDir) {
+  return [join5(projectDir, ".mugiwara", "config"), join5(homedir(), ".mugiwara", "config")];
+}
+function readConfig(projectDir) {
+  const out = {};
+  for (const file of configPaths(projectDir)) {
+    if (!existsSync4(file))
+      continue;
+    for (const line of readFileSync3(file, "utf8").split(/\r?\n/)) {
+      const t = line.trim();
+      if (!t || t.startsWith("#"))
+        continue;
+      const eq = t.indexOf("=");
+      if (eq === -1)
+        continue;
+      const key = t.slice(0, eq).trim();
+      if (!key)
+        continue;
+      if (key in out)
+        continue;
+      out[key] = t.slice(eq + 1).trim();
+    }
+  }
+  return out;
+}
+function ensureConfig(projectDir) {
+  const file = join5(projectDir, ".mugiwara", "config");
+  let exists = false;
+  try {
+    exists = lstatSync(file).isFile() || lstatSync(file).isSymbolicLink();
+  } catch {
+    exists = false;
+  }
+  if (exists)
+    return false;
+  mkdirSync3(join5(projectDir, ".mugiwara"), { recursive: true });
+  writeFileSync3(file, DEFAULT_CONFIG);
+  return true;
+}
+
+// src/installer.ts
+var CONTENT_DIR = join6(dirname3(fileURLToPath3(import.meta.url)), "..", "content");
+var pkg = JSON.parse(readFileSync4(join6(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf8"));
 var VERSION = pkg.version;
 function collectContent() {
-  const skillNames = readdirSync3(join5(CONTENT_DIR, "skills"), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  const skillNames = readdirSync3(join6(CONTENT_DIR, "skills"), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   const skills = skillNames.map((name) => {
-    const { data, body } = parseFrontmatter(readFileSync3(join5(CONTENT_DIR, "skills", name, "SKILL.md"), "utf8"));
-    return { name, data, body, refs: collectRefs(join5(CONTENT_DIR, "skills", name)) };
+    const { data, body } = parseFrontmatter(readFileSync4(join6(CONTENT_DIR, "skills", name, "SKILL.md"), "utf8"));
+    return { name, data, body, refs: collectRefs(join6(CONTENT_DIR, "skills", name)) };
   });
-  const agents = readdirSync3(join5(CONTENT_DIR, "agents")).filter((f) => f.endsWith(".md")).map((f) => {
-    const { data, body } = parseFrontmatter(readFileSync3(join5(CONTENT_DIR, "agents", f), "utf8"));
+  const agents = readdirSync3(join6(CONTENT_DIR, "agents")).filter((f) => f.endsWith(".md")).map((f) => {
+    const { data, body } = parseFrontmatter(readFileSync4(join6(CONTENT_DIR, "agents", f), "utf8"));
     return { name: f.replace(/\.md$/, ""), data, body, refs: [], internal: data.internal === "true" };
   });
-  const sharedRefsDir = join5(dirname3(CONTENT_DIR), "references");
+  const sharedRefsDir = join6(dirname3(CONTENT_DIR), "references");
   const sharedRefs = [];
-  if (existsSync4(sharedRefsDir)) {
+  if (existsSync5(sharedRefsDir)) {
     for (const f of readdirSync3(sharedRefsDir)) {
       if (!f.endsWith(".md"))
         continue;
-      sharedRefs.push({ relPath: f, text: readFileSync3(join5(sharedRefsDir, f), "utf8") });
+      sharedRefs.push({ relPath: f, text: readFileSync4(join6(sharedRefsDir, f), "utf8") });
     }
   }
   return { skills, agents, sharedRefs };
 }
 function collectRefs(skillDir) {
-  const refsDir = join5(skillDir, "references");
-  if (!existsSync4(refsDir))
+  const refsDir = join6(skillDir, "references");
+  if (!existsSync5(refsDir))
     return [];
-  return readdirSync3(refsDir, { recursive: true }).map((f) => String(f)).filter((f) => f.endsWith(".md")).map((rel) => ({ relPath: rel, text: readFileSync3(join5(refsDir, rel), "utf8") }));
+  return readdirSync3(refsDir, { recursive: true }).map((f) => String(f)).filter((f) => f.endsWith(".md")).map((rel) => ({ relPath: rel, text: readFileSync4(join6(refsDir, rel), "utf8") }));
 }
 function installTo(target10, opts) {
   const { scope, projectDir, dryRun = false, force = false } = opts;
-  const home = opts.home ?? homedir();
+  const home = opts.home ?? homedir2();
   const { skills, agents, sharedRefs } = collectContent();
   const dirs = target10.paths({ scope, projectDir, home });
-  const backupRoot = join5(scope === "global" ? home : projectDir, ".mugiwara");
+  const backupRoot = join6(scope === "global" ? home : projectDir, ".mugiwara");
   const result = { written: [], skipped: [], backedUp: [], notes: [] };
   const writeOne = (absPath, text) => {
-    if (existsSync4(absPath)) {
-      if (readFileSync3(absPath, "utf8") === text) {
+    if (existsSync5(absPath)) {
+      if (readFileSync4(absPath, "utf8") === text) {
         result.skipped.push(absPath);
         return;
       }
@@ -674,17 +745,17 @@ function installTo(target10, opts) {
       }
       const ts = new Date().toISOString().replace(/[:.]/g, "-");
       const fileName = absPath.replace(/[^a-zA-Z0-9]+/g, "_");
-      const backupDir = join5(backupRoot, "backup", `${ts}-${target10.id}`);
-      const backupFile = join5(backupDir, fileName);
+      const backupDir = join6(backupRoot, "backup", `${ts}-${target10.id}`);
+      const backupFile = join6(backupDir, fileName);
       if (!dryRun) {
-        mkdirSync3(backupDir, { recursive: true });
+        mkdirSync4(backupDir, { recursive: true });
         copyFileSync3(absPath, backupFile);
       }
       result.backedUp.push(absPath);
     }
     if (!dryRun) {
-      mkdirSync3(dirname3(absPath), { recursive: true });
-      writeFileSync3(absPath, text);
+      mkdirSync4(dirname3(absPath), { recursive: true });
+      writeFileSync4(absPath, text);
     }
     result.written.push(absPath);
   };
@@ -695,7 +766,7 @@ function installTo(target10, opts) {
       if (target10.refPointerPrefix !== undefined && target10.refPointerPrefix !== "") {
         text = text.replace(/`_shared\/references\//g, "`" + target10.refPointerPrefix + "_shared/references/");
       }
-      writeOne(join5(dirs.skillsDir, out.relPath), text);
+      writeOne(join6(dirs.skillsDir, out.relPath), text);
     }
     if (target10.transformSkillFull) {
       const full = target10.transformSkillFull(s.data, s.body);
@@ -704,29 +775,29 @@ function installTo(target10, opts) {
         if (target10.refPointerPrefix !== undefined && target10.refPointerPrefix !== "") {
           text = text.replace(/`_shared\/references\//g, "`" + target10.refPointerPrefix + "_shared/references/");
         }
-        writeOne(join5(target10.refsDir({ scope, projectDir, home }, s.name), full.relPath), text);
+        writeOne(join6(target10.refsDir({ scope, projectDir, home }, s.name), full.relPath), text);
       }
     }
     if (s.refs.length && target10.refsDir) {
       const refsRoot = target10.refsDir({ scope, projectDir, home }, s.name);
       for (const r of s.refs)
-        writeOne(join5(refsRoot, r.relPath), r.text);
+        writeOne(join6(refsRoot, r.relPath), r.text);
     }
   }
   for (const a of agents) {
     const out = target10.transformAgent({ ...a.data, ...a.internal ? { "internal-agent": "true" } : {} }, a.body);
     if (out)
-      writeOne(join5(dirs.agentsDir, out.relPath), out.text);
+      writeOne(join6(dirs.agentsDir, out.relPath), out.text);
     if (target10.transformAgentFull) {
       const full = target10.transformAgentFull(a.data, a.body);
       if (full && target10.refsDir)
-        writeOne(join5(target10.refsDir({ scope, projectDir, home }, a.name), full.relPath), full.text);
+        writeOne(join6(target10.refsDir({ scope, projectDir, home }, a.name), full.relPath), full.text);
     }
   }
   if (sharedRefs.length) {
-    const sharedRoot = join5(dirs.skillsDir, "_shared", "references");
+    const sharedRoot = join6(dirs.skillsDir, "_shared", "references");
     for (const r of sharedRefs)
-      writeOne(join5(sharedRoot, r.relPath), r.text);
+      writeOne(join6(sharedRoot, r.relPath), r.text);
   }
   if (target10.postInstall) {
     const post = target10.postInstall({ scope, projectDir, home, dryRun, files: result.written });
@@ -734,34 +805,17 @@ function installTo(target10, opts) {
     result.notes.push(...post.notes);
   }
   if (scope === "project") {
-    const configPath = join5(projectDir, ".mugiwara", "config");
+    const configPath = join6(projectDir, ".mugiwara", "config");
     let configExists = false;
     try {
-      configExists = lstatSync(configPath).isFile() || lstatSync(configPath).isSymbolicLink();
+      configExists = lstatSync2(configPath).isFile() || lstatSync2(configPath).isSymbolicLink();
     } catch {
       configExists = false;
     }
     if (!configExists) {
-      const body = [
-        "mode=guided",
-        "branch=feature/{type}-{issue}-{slug}",
-        "commit=conventional",
-        "auto_commit=on",
-        "coverage_new=90",
-        "coverage_modified=80",
-        "review_depth=full",
-        "quality_depth=full",
-        "verify_merged=off",
-        "delegate_threshold=60",
-        "heal_max_cycles=3",
-        "verbosity=normal",
-        "# context_budget_chars=150000  # optional: fail archive if trail exceeds this (measured in report Cost section)"
-      ].join(`
-`) + `
-`;
       if (!dryRun) {
-        mkdirSync3(dirname3(configPath), { recursive: true });
-        writeFileSync3(configPath, body);
+        mkdirSync4(dirname3(configPath), { recursive: true });
+        writeFileSync4(configPath, DEFAULT_CONFIG);
       }
       result.written.push(configPath);
       result.notes.push(`default config written: ${configPath} (edit it to customise)`);
@@ -772,7 +826,7 @@ function installTo(target10, opts) {
 function removeInstalled(manifest, { dryRun = false } = {}) {
   const removed = [];
   for (const f of manifest.files) {
-    if (existsSync4(f)) {
+    if (existsSync5(f)) {
       if (!dryRun)
         rmSync(f);
       removed.push(f);
@@ -781,7 +835,7 @@ function removeInstalled(manifest, { dryRun = false } = {}) {
   if (!dryRun) {
     for (const f of manifest.files) {
       let d = dirname3(f);
-      while (existsSync4(d) && readdirSync3(d).length === 0) {
+      while (existsSync5(d) && readdirSync3(d).length === 0) {
         if (d.endsWith("/.mugiwara") || d === dirname3(d))
           break;
         rmSync(d, { recursive: true, force: true });
@@ -792,10 +846,10 @@ function removeInstalled(manifest, { dryRun = false } = {}) {
   return removed;
 }
 function assertNotSymlink(file) {
-  if (!existsSync4(file))
+  if (!existsSync5(file))
     return;
   try {
-    if (lstatSync(file).isSymbolicLink())
+    if (lstatSync2(file).isSymbolicLink())
       throw new Error(`refusing to follow symlink: ${file}`);
   } catch (e) {
     if (e.code === "ENOENT")
@@ -816,9 +870,9 @@ var GITIGNORE_BLOCK = `# >>> mugiwara >>> — audit trail is the product: commit
 `;
 function ensureProjectGitignore(projectDir, opts = {}) {
   const { dryRun = false } = opts;
-  const path = join5(projectDir, ".gitignore");
+  const path = join6(projectDir, ".gitignore");
   assertNotSymlink(path);
-  let existing = existsSync4(path) ? readFileSync3(path, "utf8") : "";
+  let existing = existsSync5(path) ? readFileSync4(path, "utf8") : "";
   if (existing) {
     if (existing.includes(GITIGNORE_BLOCK_START) && existing.includes(".mugiwara/missions/**/*.json")) {
       return { appended: false, notes: [] };
@@ -826,24 +880,24 @@ function ensureProjectGitignore(projectDir, opts = {}) {
     const hadOld = GITIGNORE_LEGACY.some((m) => existing.includes(m)) || existing.includes(GITIGNORE_BLOCK_START);
     if (hadOld) {
       const clean = removeProjectGitignore(projectDir, { dryRun });
-      existing = clean.removed ? existsSync4(path) ? readFileSync3(path, "utf8") : "" : existing;
+      existing = clean.removed ? existsSync5(path) ? readFileSync4(path, "utf8") : "" : existing;
     }
   }
   const separator = existing.length && !existing.endsWith(`
 `) ? `
 ` : "";
   if (!dryRun) {
-    mkdirSync3(dirname3(path), { recursive: true });
-    writeFileSync3(path, existing + separator + GITIGNORE_BLOCK);
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, existing + separator + GITIGNORE_BLOCK);
   }
   return { appended: true, notes: [`.gitignore ${dryRun ? "would upgrade+append" : "upgraded"} mugiwara audit-trail block`] };
 }
 function removeProjectGitignore(projectDir, { dryRun = false } = {}) {
-  const path = join5(projectDir, ".gitignore");
+  const path = join6(projectDir, ".gitignore");
   assertNotSymlink(path);
-  if (!existsSync4(path))
+  if (!existsSync5(path))
     return { removed: false, notes: [] };
-  const current = readFileSync3(path, "utf8");
+  const current = readFileSync4(path, "utf8");
   const delimited = current.includes(GITIGNORE_BLOCK_START);
   let cleaned;
   if (delimited) {
@@ -883,33 +937,33 @@ function removeProjectGitignore(projectDir, { dryRun = false } = {}) {
   if (cleaned === current)
     return { removed: false, notes: [] };
   if (!dryRun)
-    writeFileSync3(path, cleaned);
+    writeFileSync4(path, cleaned);
   return { removed: true, notes: [`.gitignore ${dryRun ? "would strip" : "stripped"} mugiwara block`] };
 }
 
 // src/manifest.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname4, join as join7 } from "node:path";
 function manifestPath({ scope, projectDir, home }) {
-  return scope === "global" ? join6(home, ".mugiwara", "manifest.json") : join6(projectDir, ".mugiwara", "manifest.json");
+  return scope === "global" ? join7(home, ".mugiwara", "manifest.json") : join7(projectDir, ".mugiwara", "manifest.json");
 }
 function readManifest(file) {
-  return existsSync5(file) ? JSON.parse(readFileSync4(file, "utf8")) : null;
+  return existsSync6(file) ? JSON.parse(readFileSync5(file, "utf8")) : null;
 }
 function writeManifest(file, data) {
-  mkdirSync4(dirname4(file), { recursive: true });
-  writeFileSync4(file, JSON.stringify(data, null, 2) + `
+  mkdirSync5(dirname4(file), { recursive: true });
+  writeFileSync5(file, JSON.stringify(data, null, 2) + `
 `);
 }
 
 // src/mission.ts
-import { existsSync as existsSync8, rmSync as rmSync2, readFileSync as readFileSync7, readdirSync as readdirSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync7, renameSync, openSync, writeSync, closeSync } from "node:fs";
+import { existsSync as existsSync11, rmSync as rmSync2, readFileSync as readFileSync11, readdirSync as readdirSync7, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8, renameSync, openSync, writeSync, closeSync } from "node:fs";
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { join as join11 } from "node:path";
+import { join as join16 } from "node:path";
 
 // src/integrity.ts
-import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync5 } from "node:fs";
-import { isAbsolute, join as join7, relative } from "node:path";
+import { existsSync as existsSync7, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "node:fs";
+import { isAbsolute, join as join8, relative } from "node:path";
 var SECRET_PATTERNS = [
   [/AKIA[0-9A-Z]{16}/, "AWS access key id"],
   [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "private key block"],
@@ -933,12 +987,12 @@ function findSecrets(body) {
   }
   return out;
 }
-var TRAIL_EXTS = new Set([".md", ".json", ".sh"]);
+var TRAIL_EXTS = new Set([".md", ".json", ".sh", ".jsonl"]);
 function trailFiles(dir) {
   const out = [];
   const walk = (d) => {
     for (const e of readdirSync4(d, { withFileTypes: true })) {
-      const p = join7(d, e.name);
+      const p = join8(d, e.name);
       if (e.isDirectory())
         walk(p);
       else if (TRAIL_EXTS.has(e.name.slice(e.name.lastIndexOf(".")) || ""))
@@ -966,7 +1020,7 @@ function collectPassCitedPaths(missionDir) {
   for (const f of trailFiles(missionDir)) {
     let body;
     try {
-      body = readFileSync5(f, "utf8");
+      body = readFileSync6(f, "utf8");
     } catch {
       continue;
     }
@@ -990,16 +1044,16 @@ function checkTrail(missionDir, projectRoot) {
   for (const f of files) {
     let body;
     try {
-      body = readFileSync5(f, "utf8");
+      body = readFileSync6(f, "utf8");
     } catch {
       continue;
     }
     for (const target10 of linkedPaths(body)) {
       if (isAbsolute(target10))
         continue;
-      const fromMission = join7(missionDir, target10);
-      const fromRoot = join7(projectRoot, target10);
-      if (!existsSync6(fromMission) && !existsSync6(fromRoot)) {
+      const fromMission = join8(missionDir, target10);
+      const fromRoot = join8(projectRoot, target10);
+      if (!existsSync7(fromMission) && !existsSync7(fromRoot)) {
         issues.push({
           kind: "dangling-path",
           detail: `${relative(projectRoot, f)} links "${target10}" — no such file (mission dir or repo root)`
@@ -1014,17 +1068,17 @@ function checkTrail(missionDir, projectRoot) {
     }
   }
   const evidencePaths = [];
-  const evidenceFile = join7(missionDir, "state.json");
-  if (existsSync6(evidenceFile)) {
+  const evidenceFile = join8(missionDir, "state.json");
+  if (existsSync7(evidenceFile)) {
     try {
-      const s = JSON.parse(readFileSync5(evidenceFile, "utf8"));
+      const s = JSON.parse(readFileSync6(evidenceFile, "utf8"));
       if (Array.isArray(s.evidence)) {
         for (const e of s.evidence) {
           if (typeof e !== "string" || !e.trim())
             continue;
           evidencePaths.push(e);
-          const cand = join7(projectRoot, e);
-          if (!isAbsolute(e) && !existsSync6(cand) && !existsSync6(join7(missionDir, e))) {
+          const cand = join8(projectRoot, e);
+          if (!isAbsolute(e) && !existsSync7(cand) && !existsSync7(join8(missionDir, e))) {
             issues.push({ kind: "evidence", detail: `state.json evidence "${e}" does not exist` });
           }
         }
@@ -1035,14 +1089,14 @@ function checkTrail(missionDir, projectRoot) {
   for (const e of passCited) {
     if (!e.trim() || isAbsolute(e))
       continue;
-    const candMission = join7(missionDir, e);
-    const candRoot = join7(projectRoot, e);
-    const resolved = existsSync6(candMission) ? candMission : existsSync6(candRoot) ? candRoot : null;
+    const candMission = join8(missionDir, e);
+    const candRoot = join8(projectRoot, e);
+    const resolved = existsSync7(candMission) ? candMission : existsSync7(candRoot) ? candRoot : null;
     if (!resolved)
       continue;
     let body;
     try {
-      body = readFileSync5(resolved, "utf8");
+      body = readFileSync6(resolved, "utf8");
     } catch {
       continue;
     }
@@ -1057,10 +1111,45 @@ function formatIssues(issues) {
 `);
 }
 
+// src/check-artifacts.ts
+import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync5 } from "node:fs";
+import { join as join9 } from "node:path";
+var LANE_MIN = new Set(["standard", "full", "spike"]);
+function checkMissionArtifacts(missionDir) {
+  const statePath = join9(missionDir, "state.json");
+  if (!existsSync8(statePath)) {
+    return { ok: true, missing: [], lane: null };
+  }
+  let lane = "unknown";
+  try {
+    const s = JSON.parse(readFileSyncSafe(statePath));
+    if (typeof s.lane === "string")
+      lane = s.lane;
+  } catch {}
+  if (!LANE_MIN.has(lane)) {
+    return { ok: true, missing: [], lane };
+  }
+  const missing = [];
+  if (!existsSync8(join9(missionDir, "plan.md")))
+    missing.push("plan.md");
+  const flowsDir = join9(missionDir, "flows");
+  const hasFlows = existsSync8(flowsDir) && readdirSync5(flowsDir).length > 0;
+  if (!hasFlows)
+    missing.push("flows/ (no execution evidence)");
+  return { ok: missing.length === 0, missing, lane };
+}
+function readFileSyncSafe(p) {
+  try {
+    return readFileSync7(p, "utf8");
+  } catch {
+    return "";
+  }
+}
+
 // src/rollback.ts
 import { execFileSync } from "node:child_process";
-import { writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join8 } from "node:path";
+import { writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join10 } from "node:path";
 function git(cwd, args) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
 }
@@ -1099,8 +1188,8 @@ function generateRollback(projectDir, missionDir, input) {
     const commitsNewestFirst = [...revList].reverse();
     const filesTouched = input.baseSha === "unknown" ? [] : git(projectDir, ["diff", "--name-only", input.baseSha, input.branch]).split(/\r?\n/).filter(Boolean);
     const body = buildRollback(input, commitsNewestFirst, filesTouched);
-    const file = join8(missionDir, "rollback.sh");
-    writeFileSync5(file, body, { mode: 493 });
+    const file = join10(missionDir, "rollback.sh");
+    writeFileSync6(file, body, { mode: 493 });
     return { file: "rollback.sh", commits: commitsNewestFirst.length };
   } catch {
     return null;
@@ -1109,8 +1198,8 @@ function generateRollback(projectDir, missionDir, input) {
 
 // src/provenance.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join9 } from "node:path";
+import { writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join11 } from "node:path";
 function git2(cwd, args) {
   return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
 }
@@ -1185,7 +1274,7 @@ ${note}`;
 function writeProvenance(projectDir, missionDir, state) {
   const note = buildNote(state);
   const attached = attachGitNote(projectDir, state.branch, note);
-  writeFileSync6(join9(missionDir, "provenance.md"), renderProvenanceMd(note, attached ? attached.sha : null));
+  writeFileSync7(join11(missionDir, "provenance.md"), renderProvenanceMd(note, attached ? attached.sha : null));
 }
 
 // src/routing.ts
@@ -1242,28 +1331,15 @@ function renderRouting(ranked, mission) {
 }
 
 // src/budget.ts
-import { existsSync as existsSync7, readdirSync as readdirSync5, readFileSync as readFileSync6, statSync } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync6, statSync } from "node:fs";
+import { join as join12 } from "node:path";
 function readBudgetConfig(projectDir) {
-  for (const base of [projectDir, homedir2()]) {
-    const file = join10(base, ".mugiwara", "config");
-    if (!existsSync7(file))
-      continue;
-    for (const line of readFileSync6(file, "utf8").split(/\r?\n/)) {
-      const t = line.trim();
-      if (!t || t.startsWith("#"))
-        continue;
-      const eq = t.indexOf("=");
-      if (eq === -1)
-        continue;
-      if (t.slice(0, eq).trim() !== "context_budget_chars")
-        continue;
-      const n = Number(t.slice(eq + 1).trim());
-      return Number.isFinite(n) && n > 0 ? n : 0;
-    }
-  }
-  return 0;
+  const cfg = readConfig(projectDir);
+  const raw = cfg.context_budget_chars;
+  if (raw === undefined || raw === "")
+    return 0;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : 0;
 }
 function measureContextChars(missionDir) {
   let total = 0;
@@ -1272,15 +1348,15 @@ function measureContextChars(missionDir) {
       total += statSync(p).size;
     } catch {}
   };
-  for (const f of readdirSync5(missionDir)) {
+  for (const f of readdirSync6(missionDir)) {
     if (/\.md$/.test(f))
-      add(join10(missionDir, f));
+      add(join12(missionDir, f));
   }
   for (const sub of ["flows", "waves"]) {
-    const dir = join10(missionDir, sub);
-    if (existsSync7(dir)) {
-      for (const f of readdirSync5(dir))
-        add(join10(dir, f));
+    const dir = join12(missionDir, sub);
+    if (existsSync9(dir)) {
+      for (const f of readdirSync6(dir))
+        add(join12(dir, f));
     }
   }
   return total;
@@ -1292,6 +1368,274 @@ function formatFootprint(chars, budget) {
   return chars > budget ? `${base} — OVER budget ${budget}` : `${base} (budget ${budget})`;
 }
 
+// src/cost.ts
+import { appendFileSync, mkdirSync as mkdirSync6, readFileSync as readFileSync8 } from "node:fs";
+import { join as join13 } from "node:path";
+var LANE_BUDGET = {
+  lean: 12000,
+  standard: 25000,
+  full: 50000,
+  spike: 3000
+};
+function budgetForLane(lane) {
+  return LANE_BUDGET[lane] ?? 0;
+}
+function warnAt(budget) {
+  return Math.floor(budget * 3 / 2);
+}
+function stopAt(budget) {
+  return budget * 3;
+}
+function budgetStatus(budget, tokens) {
+  if (budget > 0 && tokens >= stopAt(budget))
+    return "stop";
+  if (budget > 0 && tokens >= warnAt(budget))
+    return "warn";
+  return "ok";
+}
+function costEnvelope(state) {
+  const planned = typeof state.budget === "number" && state.budget > 0 ? state.budget : budgetForLane(state.lane ?? "");
+  const used = typeof state.tokens_est === "number" ? state.tokens_est : 0;
+  const remaining = Math.max(planned - used, 0);
+  const pct = planned > 0 ? Math.round(used / planned * 100) : 0;
+  return {
+    planned,
+    used,
+    remaining,
+    pct,
+    warn_at: warnAt(planned),
+    stop_at: stopAt(planned),
+    status: budgetStatus(planned, used)
+  };
+}
+var COST_EVENTS_FILE = "cost-events.jsonl";
+function isAllowedMissionDir(dir) {
+  if (!dir || dir.includes(".."))
+    return false;
+  if (dir.includes(".mugiwara/missions"))
+    return true;
+  if (dir.includes("mugiwara-"))
+    return true;
+  if (dir.startsWith("/tmp/") && dir.includes("-"))
+    return true;
+  return false;
+}
+function assertMissionDir(dir) {
+  if (!isAllowedMissionDir(dir))
+    throw new Error(`Invalid missionDir: ${dir}`);
+}
+function appendCostEvent(missionDir, event) {
+  assertMissionDir(missionDir);
+  mkdirSync6(missionDir, { recursive: true });
+  const line = Object.assign({ ts: new Date().toISOString() }, event);
+  appendFileSync(join13(missionDir, COST_EVENTS_FILE), JSON.stringify(line) + `
+`, "utf8");
+}
+
+// src/evidence.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync9 } from "node:fs";
+import { join as join14 } from "node:path";
+var REGISTRY_FILE = "context-registry.jsonl";
+function isAllowedMissionDir2(dir) {
+  if (!dir || dir.includes(".."))
+    return false;
+  if (dir.includes(".mugiwara/missions"))
+    return true;
+  if (dir.includes("mugiwara-"))
+    return true;
+  if (dir.startsWith("/tmp/") && dir.includes("-"))
+    return true;
+  return false;
+}
+function assertMissionDir2(dir) {
+  if (!isAllowedMissionDir2(dir))
+    throw new Error(`Invalid missionDir: ${dir}`);
+}
+function loadRegistry(missionDir) {
+  assertMissionDir2(missionDir);
+  const file = join14(missionDir, REGISTRY_FILE);
+  try {
+    const out = [];
+    for (const line of readFileSync9(file, "utf8").split(/\r?\n/)) {
+      if (!line.trim())
+        continue;
+      let e;
+      try {
+        e = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (e === null || typeof e !== "object")
+        continue;
+      const entry = e;
+      const ok = typeof entry.fingerprint === "string" && typeof entry.kind === "string" && typeof entry.file === "string" && typeof entry.id === "string" && typeof entry.ref === "string" && typeof entry.reads === "number" && Number.isFinite(entry.reads) && entry.reads >= 0;
+      if (!ok)
+        continue;
+      entry.reads = Math.floor(entry.reads);
+      out.push(entry);
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+
+// src/context.ts
+function contextStatus(budgetChars, chars) {
+  return budgetChars > 0 && chars > budgetChars ? "over" : "ok";
+}
+function computeContextMetrics(stats) {
+  const reuse_rate = stats.reads_total > 0 ? stats.reads_reused / stats.reads_total : 0;
+  const duplicate_chars = stats.total_chars - stats.unique_chars;
+  return {
+    files_loaded: stats.files_loaded,
+    repeated_reads: stats.repeated_reads,
+    duplicate_chars,
+    reuse_rate,
+    read_avoidance_chars: duplicate_chars
+  };
+}
+
+// src/reporting.ts
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
+function isAllowedMissionDir3(dir) {
+  if (!dir || dir.includes(".."))
+    return false;
+  if (dir.includes(".mugiwara/missions"))
+    return true;
+  if (dir.includes("mugiwara-"))
+    return true;
+  if (dir.startsWith("/tmp/") && dir.includes("-"))
+    return true;
+  return false;
+}
+function assertMissionDir3(dir) {
+  if (!isAllowedMissionDir3(dir))
+    throw new Error(`Invalid missionDir: ${dir}`);
+}
+function parseDecisionTrail(missionDir) {
+  assertMissionDir3(missionDir);
+  const file = join15(missionDir, "decisions.md");
+  if (!existsSync10(file))
+    return [];
+  const raw = readFileSync10(file, "utf8");
+  const lines = raw.split(/\r?\n/);
+  const headerIdx = lines.findIndex((l) => l.trim() === "## Cost governor decisions" || l.trim() === "## Budget");
+  const scan = headerIdx >= 0 ? lines.slice(headerIdx) : lines;
+  const out = [];
+  const bulletRe = /^-\s+(.+?)\s+—\s+(.+?):\s+(.+?)\s+—\s+reason:\s+(.+?)(?:\s+—\s+evidence:\s+(.+))?\s*$/;
+  for (const line of scan) {
+    const m = bulletRe.exec(line.trim());
+    if (!m)
+      continue;
+    out.push({ ts: m[1], actor: m[2], decision: m[3], reason: m[4], ...m[5] ? { evidence: m[5] } : {} });
+  }
+  return out;
+}
+function loadCostEvents(missionDir) {
+  assertMissionDir3(missionDir);
+  const file = join15(missionDir, "cost-events.jsonl");
+  if (!existsSync10(file))
+    return [];
+  const out = [];
+  for (const line of readFileSync10(file, "utf8").split(/\r?\n/)) {
+    if (!line.trim())
+      continue;
+    try {
+      const e = JSON.parse(line);
+      if (e && typeof e === "object" && typeof e.mission === "string")
+        out.push(e);
+    } catch {
+      continue;
+    }
+  }
+  return out;
+}
+function computeAvoidedMetrics(input) {
+  const dup = input.registryMetrics?.duplicateCount ?? 0;
+  const rep = input.registryMetrics?.repeatedReads ?? 0;
+  const contexts_avoided = dup + rep;
+  const stages_avoided = input.workMetrics?.stagesAvoided ?? 0;
+  const slop_interventions = input.slopMetrics?.interventions ?? 0;
+  const tokens_avoided_est = contexts_avoided * 150;
+  return { stages_avoided, contexts_avoided, slop_interventions, tokens_avoided_est };
+}
+function computeEfficiencyMetrics(input) {
+  const reuse_rate = input.totalReads > 0 ? Math.round(input.reuseHits / input.totalReads * 100) / 100 : 0;
+  const duplicate_avoidance_chars = input.duplicateChars;
+  const budget_efficiency_pct = input.budget > 0 ? Math.round(input.used / input.budget * 100) : 0;
+  return { reuse_rate, duplicate_avoidance_chars, budget_efficiency_pct };
+}
+function buildCostLedger(input) {
+  assertMissionDir3(input.missionDir);
+  const events = loadCostEvents(input.missionDir);
+  let registrySize = 0;
+  let totalReads = 0;
+  let reuseHits = 0;
+  let duplicateChars = 0;
+  try {
+    const reg = loadRegistry(input.missionDir);
+    registrySize = reg.length;
+    totalReads = reg.reduce((s, e) => s + e.reads, 0);
+    reuseHits = reg.reduce((s, e) => s + Math.max(e.reads - 1, 0), 0);
+    const unique = reg.reduce((s, e) => s + (e.chars ?? 0), 0);
+    const total = reg.reduce((s, e) => s + (e.chars ?? 0) * e.reads, 0);
+    duplicateChars = total - unique;
+    if (duplicateChars < 0)
+      duplicateChars = 0;
+  } catch {
+    registrySize = 0;
+  }
+  const decisions = parseDecisionTrail(input.missionDir);
+  const repeatedReads = reuseHits;
+  const duplicateCount = duplicateChars > 0 ? 1 : 0;
+  const avoided = computeAvoidedMetrics({
+    registryMetrics: { duplicateCount: 0, repeatedReads: reuseHits },
+    workMetrics: { stagesAvoided: input.workSummary?.stagesAvoided ?? 0 },
+    slopMetrics: { interventions: input.slopSummary?.interventions ?? 0 }
+  });
+  if (duplicateChars > 0 && avoided.contexts_avoided === 0) {
+    avoided.contexts_avoided = 1;
+    avoided.tokens_avoided_est = 150;
+  }
+  const efficiency = computeEfficiencyMetrics({
+    totalReads,
+    reuseHits,
+    duplicateChars,
+    budget: input.envelope.planned,
+    used: input.envelope.used
+  });
+  return {
+    envelope: input.envelope,
+    ledger: { events, registrySize, decisions },
+    avoided,
+    efficiency,
+    trail: decisions
+  };
+}
+function toCostJSON(ledger) {
+  return JSON.stringify({ envelope: ledger.envelope, ledger: ledger.ledger, avoided: ledger.avoided, efficiency: ledger.efficiency, trail: ledger.trail }, null, 2);
+}
+function summarizeAdaptation(missionDir) {
+  const trail = parseDecisionTrail(missionDir);
+  const postureRe = /posture|switch|adapt|pause|parallel-workers|context-relief|phase-isolated|team-scoped/i;
+  const rows = trail.filter((t) => postureRe.test(`${t.decision} ${t.reason}`)).map((t) => ({ ts: t.ts, decision: t.decision, reason: t.reason }));
+  return { count: rows.length, rows };
+}
+function renderAdaptationSection(missionDir) {
+  const { count, rows } = summarizeAdaptation(missionDir);
+  if (count === 0)
+    return "";
+  const lines = ["", "## Adaptation", "", "| Time | Decision | Reason |", "|---|---|---|"];
+  for (const r of rows)
+    lines.push(`| ${r.ts} | ${r.decision} | ${r.reason} |`);
+  if (rows.length === 0)
+    lines.push("| — | (posture rows recorded in decisions.md) | |");
+  return lines.join(`
+`);
+}
+
 // src/mission.ts
 function isStateFile(f) {
   const stem = f.replace(/\.json$/, "");
@@ -1302,7 +1646,7 @@ function primaryState(dir, files) {
   if (!name)
     return null;
   try {
-    return JSON.parse(readFileSync7(join11(dir, name), "utf8"));
+    return JSON.parse(readFileSync11(join16(dir, name), "utf8"));
   } catch {
     return null;
   }
@@ -1323,16 +1667,16 @@ function changedFiles(projectDir, state) {
   }
 }
 function activeActor(projectDir) {
-  const missionsDir = join11(projectDir, ".mugiwara", "missions");
-  if (!existsSync8(missionsDir))
+  const missionsDir = join16(projectDir, ".mugiwara", "missions");
+  if (!existsSync11(missionsDir))
     return null;
-  const missions = readdirSync6(missionsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  const missions = readdirSync7(missionsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   let latest = null;
   for (const mission of missions) {
-    const d = join11(missionsDir, mission);
-    for (const f of readdirSync6(d).filter(isStateFile)) {
+    const d = join16(missionsDir, mission);
+    for (const f of readdirSync7(d).filter(isStateFile)) {
       try {
-        const s = JSON.parse(readFileSync7(join11(d, f), "utf8"));
+        const s = JSON.parse(readFileSync11(join16(d, f), "utf8"));
         const t = Date.parse(s.updated_at || "") || 0;
         if (!latest || t > latest.updated)
           latest = { actor: s.actor || null, updated: t };
@@ -1342,8 +1686,8 @@ function activeActor(projectDir) {
   return latest ? latest.actor : null;
 }
 function resetMission(projectDir, keepLogs, force) {
-  const root = join11(projectDir, ".mugiwara");
-  if (!existsSync8(root))
+  const root = join16(projectDir, ".mugiwara");
+  if (!existsSync11(root))
     return { removed: [], kept: [] };
   if (!force) {
     const actor = activeActor(projectDir);
@@ -1354,49 +1698,49 @@ function resetMission(projectDir, keepLogs, force) {
   const removed = [];
   const kept = [];
   for (const dir of ["missions", "spec", "plans", "results", "review", "issues", "reports", "state", "continue"]) {
-    const p = join11(root, dir);
-    if (existsSync8(p)) {
+    const p = join16(root, dir);
+    if (existsSync11(p)) {
       rmSync2(p, { recursive: true, force: true });
       removed.push(dir);
     }
   }
-  for (const f of readdirSync6(root)) {
+  for (const f of readdirSync7(root)) {
     if (/^state(-.+)?\.json$/.test(f)) {
-      const p = join11(root, f);
-      if (existsSync8(p)) {
+      const p = join16(root, f);
+      if (existsSync11(p)) {
         rmSync2(p);
         removed.push(f);
       }
     }
   }
   if (!keepLogs) {
-    for (const p of [join11(root, "lessons.md"), join11(root, "logs")]) {
-      if (existsSync8(p)) {
+    for (const p of [join16(root, "lessons.md"), join16(root, "logs")]) {
+      if (existsSync11(p)) {
         rmSync2(p, { recursive: true, force: true });
-        removed.push(p.startsWith(join11(root, "logs")) ? "logs" : "lessons.md");
+        removed.push(p.startsWith(join16(root, "logs")) ? "logs" : "lessons.md");
       }
     }
   } else {
-    if (existsSync8(join11(root, "lessons.md")))
+    if (existsSync11(join16(root, "lessons.md")))
       kept.push("lessons.md");
-    else if (existsSync8(join11(root, join11("logs", "lessons.md"))))
-      kept.push(join11("logs", "lessons.md"));
+    else if (existsSync11(join16(root, join16("logs", "lessons.md"))))
+      kept.push(join16("logs", "lessons.md"));
   }
   for (const f of ["config", "manifest.json", "backup"]) {
-    if (existsSync8(join11(root, f)))
+    if (existsSync11(join16(root, f)))
       kept.push(f);
   }
   return { removed, kept };
 }
 function archiveMission(projectDir, mission, opts = {}) {
   const { dryRun = false } = opts;
-  const root = join11(projectDir, ".mugiwara");
+  const root = join16(projectDir, ".mugiwara");
   if (!mission || /[^a-zA-Z0-9._-]/.test(mission) || /^\.+$/.test(mission))
     throw new Error(`invalid mission name "${mission}" (allowlist: [a-zA-Z0-9._-], not a dot-path)`);
   const removed = [];
   const kept = [];
-  const dir = join11(root, "missions", mission);
-  if (!existsSync8(dir))
+  const dir = join16(root, "missions", mission);
+  if (!existsSync11(dir))
     return { report: null, removed, kept };
   if (!dryRun) {
     const issues = checkTrail(dir, projectDir);
@@ -1404,12 +1748,16 @@ function archiveMission(projectDir, mission, opts = {}) {
       throw new Error(`closure integrity gate failed — fix these before archiving:
 ${formatIssues(issues)}`);
     }
+    const artifacts = checkMissionArtifacts(dir);
+    if (!artifacts.ok) {
+      throw new Error(`archive artifact gate failed — missing: ${artifacts.missing.join(", ")} (lane ${artifacts.lane}). Write the evidence trail before archiving.`);
+    }
   }
-  const files = readdirSync6(dir);
+  const files = readdirSync7(dir);
   const state = primaryState(dir, files);
   const stageModels = [...new Set(files.filter(isStateFile).map((f) => {
     try {
-      const s = JSON.parse(readFileSync7(join11(dir, f), "utf8"));
+      const s = JSON.parse(readFileSync11(join16(dir, f), "utf8"));
       return typeof s.model === "string" ? s.model : "";
     } catch {
       return "";
@@ -1420,22 +1768,36 @@ ${formatIssues(issues)}`);
     const chars = measureContextChars(dir);
     const budget = readBudgetConfig(projectDir);
     const footprintLine = formatFootprint(chars, budget);
-    if (budget && chars > budget) {
-      throw new Error(`closure context budget failed — ${footprintLine}. Trim the trail or raise context_budget_chars.`);
-    }
     const est = typeof state.tokens_est === "number" ? state.tokens_est : 0;
     const src = typeof state.tokens_source === "string" ? state.tokens_source : "computed";
     const lane = typeof state.lane === "string" ? state.lane : "unknown";
-    const laneBudget = lane === "lean" ? 12000 : lane === "standard" ? 25000 : lane === "full" ? 50000 : lane === "spike" ? 3000 : 0;
+    const laneBudget = budgetForLane(lane);
+    const env = costEnvelope({ lane, budget: laneBudget, tokens_est: est });
     const effBudget = budget || laneBudget;
-    const pct = effBudget ? Math.round(est / effBudget * 100) : 0;
     const delta = effBudget ? est <= effBudget ? `${(effBudget - est).toLocaleString()} under` : `${(est - effBudget).toLocaleString()} over` : "no budget configured";
     const srcLabel = src === "reported" ? "provider-reported" : "estimator";
+    const statusLabel = env.status.toUpperCase();
+    const ctxStatus = contextStatus(budget, chars);
+    const registry = loadRegistry(dir);
+    const reads_total = registry.reduce((s, e) => s + e.reads, 0);
+    const repeated_reads = registry.reduce((s, e) => s + Math.max(e.reads - 1, 0), 0);
+    const unique_chars = registry.reduce((s, e) => s + (e.chars ?? 0), 0);
+    const total_chars = registry.reduce((s, e) => s + (e.chars ?? 0) * e.reads, 0);
+    const charTracked = registry.length > 0 && total_chars > 0;
+    const metrics = registry.length ? computeContextMetrics({
+      files_loaded: registry.length,
+      reads_total,
+      reads_reused: repeated_reads,
+      unique_chars,
+      total_chars,
+      repeated_reads
+    }) : { files_loaded: 0, repeated_reads: 0, duplicate_chars: 0, reuse_rate: 0, read_avoidance_chars: 0 };
+    const ctxNote = registry.length ? charTracked ? "" : " (char data not tracked)" : " (no registry — reads not tracked)";
     let reportedTotal = 0;
     let hasReported = false;
     for (const f of files.filter(isStateFile)) {
       try {
-        const s = JSON.parse(readFileSync7(join11(dir, f), "utf8"));
+        const s = JSON.parse(readFileSync11(join16(dir, f), "utf8"));
         if (s.tokens_source === "reported" && typeof s.tokens_est === "number") {
           reportedTotal += s.tokens_est;
           hasReported = true;
@@ -1452,17 +1814,57 @@ ${formatIssues(issues)}`);
       "| Metric | Value |",
       "|--------|-------|",
       `| **Tokens used** | ${est.toLocaleString()} (${srcLabel}) |`,
-      `| **Lane** | ${lane} (budget ${effBudget ? effBudget.toLocaleString() : "—"} · warn ${effBudget ? Math.round(effBudget * 1.5).toLocaleString() : "—"} · stop ${effBudget ? (effBudget * 3).toLocaleString() : "—"}) |`,
-      `| **Budget status** | ${effBudget ? `${pct}% of budget · ${delta} · ${est >= effBudget * 3 ? "STOP" : est >= effBudget * 1.5 ? "WARN" : "OK"}` : "no lane budget"} |`,
-      `| **Context footprint** | ${chars.toLocaleString()} chars${budget ? ` (budget ${budget.toLocaleString()})` : " (no context budget configured)"} |`
+      `| **Lane** | ${lane} (budget ${effBudget ? effBudget.toLocaleString() : "—"} · warn ${effBudget ? env.warn_at.toLocaleString() : "—"} · stop ${effBudget ? env.stop_at.toLocaleString() : "—"}) |`,
+      `| **Budget status** | ${effBudget ? `${env.pct}% of budget · ${delta} · ${statusLabel}` : "no lane budget"} |`,
+      `| **Context footprint** | ${chars.toLocaleString()} chars${budget ? ` (budget ${budget.toLocaleString()})` : " (no context budget configured)"} |`,
+      `| **Context budget status** | ${ctxStatus.toUpperCase()}${budget ? ` (budget ${budget.toLocaleString()})` : " (no context budget configured)"} |`,
+      `| **Context efficiency** | files_loaded: ${metrics.files_loaded} · repeated_reads: ${metrics.repeated_reads} · duplicate_chars: ${charTracked ? metrics.duplicate_chars : "n/a"} · reuse_rate: ${metrics.reuse_rate} · read_avoidance_chars: ${charTracked ? metrics.read_avoidance_chars : "n/a"}${ctxNote} |`
     ].join(`
 `);
     if (hasReported) {
       costSection += `
 | **Provider total** | ${reportedTotal.toLocaleString()} (provider-reported — sum of reported stages) |`;
     }
+    try {
+      const ledger = buildCostLedger({ missionDir: dir, envelope: env });
+      costSection += `
+| Budget | ${ledger.envelope.status} ${ledger.envelope.pct}% (${ledger.envelope.used}/${ledger.envelope.planned}) |`;
+      costSection += `
+| Context | ${chars.toLocaleString()} chars, reuse ${ledger.efficiency.reuse_rate} |`;
+      costSection += `
+| Avoided | ${ledger.avoided.stages_avoided} stages, ${ledger.avoided.contexts_avoided} contexts, ${ledger.avoided.tokens_avoided_est} tokens est |`;
+      costSection += `
+| Efficiency | reuse ${ledger.efficiency.reuse_rate}, dup ${ledger.efficiency.duplicate_avoidance_chars} chars, budget ${ledger.efficiency.budget_efficiency_pct}% |`;
+      costSection += `
+| Trail | ${ledger.trail.length} decisions |`;
+      if (ledger.trail.length) {
+        const show = ledger.trail.slice(0, 5);
+        for (const t of show)
+          costSection += `
+- ${t.ts} — ${t.actor}: ${t.decision} — reason: ${t.reason}${t.evidence ? ` — evidence: ${t.evidence}` : ""}`;
+        if (ledger.trail.length > 5)
+          costSection += `
+… ${ledger.trail.length - 5} more`;
+      }
+    } catch {}
     costSection += `
 `;
+    try {
+      costSection += renderAdaptationSection(dir);
+    } catch {}
+    appendCostEvent(dir, {
+      kind: "closure",
+      mission,
+      tokens_est: est,
+      budget: laneBudget,
+      status: env.status,
+      context_chars: chars,
+      context_status: ctxStatus,
+      context_metrics: metrics
+    });
+    if (budget && chars > budget) {
+      throw new Error(`closure context budget failed — ${footprintLine}. Trim the trail or raise context_budget_chars.`);
+    }
   }
   const FOLD_TOP = ["decisions.md", "blockers.md", "review.md", "security.md", "spec.md"];
   const fold = [];
@@ -1470,25 +1872,40 @@ ${formatIssues(issues)}`);
     if (files.includes(f))
       fold.push(f);
   }
-  const flowsDir = join11(dir, "flows");
-  const legacyWavesDir = join11(dir, "waves");
-  const artDir = existsSync8(flowsDir) ? flowsDir : existsSync8(legacyWavesDir) ? legacyWavesDir : flowsDir;
+  const PR_VERDICT = "pr-verdict.md";
+  const PR_VERDICT_SRC = join16("flows", "07-pr-verdict.md");
+  const flowsDir = join16(dir, "flows");
+  const legacyWavesDir = join16(dir, "waves");
+  const artDir = existsSync11(flowsDir) ? flowsDir : existsSync11(legacyWavesDir) ? legacyWavesDir : flowsDir;
   const artRel = artDir === legacyWavesDir ? "waves" : "flows";
-  if (existsSync8(artDir)) {
-    for (const f of readdirSync6(artDir).sort())
-      fold.push(join11(artRel, f));
+  if (existsSync11(artDir)) {
+    for (const f of readdirSync7(artDir).sort()) {
+      if (artRel === "flows" && f === "07-pr-verdict.md")
+        continue;
+      fold.push(join16(artRel, f));
+    }
   }
+  if (existsSync11(join16(dir, "cost-events.jsonl")))
+    fold.push("cost-events.jsonl");
+  if (existsSync11(join16(dir, "context-registry.jsonl")))
+    fold.push("context-registry.jsonl");
   let report = "";
-  const reportPath = join11(dir, "report.md");
+  const reportPath = join16(dir, "report.md");
   if (files.includes("report.md"))
-    report = readFileSync7(reportPath, "utf8");
-  else if (existsSync8(join11(artDir, "06-closure.md")))
-    report = readFileSync7(join11(artDir, "06-closure.md"), "utf8");
+    report = readFileSync11(reportPath, "utf8");
+  else if (existsSync11(join16(artDir, "06-closure.md")))
+    report = readFileSync11(join16(artDir, "06-closure.md"), "utf8");
   if (!dryRun) {
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync8(dir, { recursive: true });
+    const prVerdictSrc = join16(dir, PR_VERDICT_SRC);
+    if (existsSync11(prVerdictSrc)) {
+      const prVerdictPath = join16(dir, PR_VERDICT);
+      writeFileSync8(prVerdictPath, readFileSync11(prVerdictSrc, "utf8"));
+      kept.push(join16("missions", mission, PR_VERDICT));
+    }
     if (fold.length) {
       const sections = fold.map((f) => {
-        const body = readFileSync7(join11(dir, f), "utf8").trim();
+        const body = readFileSync11(join16(dir, f), "utf8").trim();
         const name = f.includes("/") ? f.split("/").pop() ?? f : f;
         return `
 
@@ -1502,22 +1919,26 @@ ${body}`;
         evidence: Array.isArray(state.evidence) ? state.evidence : [],
         sensitive_paths: Array.isArray(state.sensitive_paths) ? state.sensitive_paths : []
       }), mission) : "";
-      writeFileSync7(tmp, report.trimEnd() + sections + (routingSection || "") + (costSection ? `
+      writeFileSync8(tmp, report.trimEnd() + sections + (routingSection || "") + (costSection ? `
 ${costSection}
 ` : "") + `
 `);
       renameSync(tmp, reportPath);
     }
     for (const f of fold) {
-      rmSync2(join11(dir, f), { force: true, recursive: true });
-      removed.push(join11("missions", mission, f));
+      rmSync2(join16(dir, f), { force: true, recursive: true });
+      removed.push(join16("missions", mission, f));
+    }
+    if (existsSync11(prVerdictSrc)) {
+      rmSync2(join16(dir, PR_VERDICT_SRC), { force: true });
+      removed.push(join16("missions", mission, PR_VERDICT_SRC));
     }
     for (const f of files.filter((f2) => f2.endsWith(".json")))
-      rmSync2(join11(dir, f), { force: true });
-    if (existsSync8(artDir) && readdirSync6(artDir).length === 0)
+      rmSync2(join16(dir, f), { force: true });
+    if (existsSync11(artDir) && readdirSync7(artDir).length === 0)
       rmSync2(artDir, { recursive: true, force: true });
-    if (!existsSync8(reportPath)) {
-      writeFileSync7(reportPath, `# Mission: ${mission}
+    if (!existsSync11(reportPath)) {
+      writeFileSync8(reportPath, `# Mission: ${mission}
 
 Archived before closure — no wave artifacts were present.
 `);
@@ -1529,7 +1950,7 @@ Archived before closure — no wave artifacts were present.
         baseSha: typeof state.base_sha === "string" ? state.base_sha : "unknown"
       });
       if (rb)
-        kept.push(join11("missions", mission, rb.file));
+        kept.push(join16("missions", mission, rb.file));
       try {
         writeProvenance(projectDir, dir, {
           mission,
@@ -1542,25 +1963,25 @@ Archived before closure — no wave artifacts were present.
           evidence: Array.isArray(state.evidence) ? state.evidence : [],
           models: stageModels
         });
-        kept.push(join11("missions", mission, "provenance.md"));
+        kept.push(join16("missions", mission, "provenance.md"));
       } catch {}
     }
   } else {
     for (const f of fold)
-      removed.push(join11("missions", mission, f));
+      removed.push(join16("missions", mission, f));
   }
-  removed.push(join11("missions", mission, "<session state>"));
+  removed.push(join16("missions", mission, "<session state>"));
   if (files.includes("plan.md"))
-    kept.push(join11("missions", mission, "plan.md"));
+    kept.push(join16("missions", mission, "plan.md"));
   if (files.includes("handoff.md"))
-    kept.push(join11("missions", mission, "handoff.md"));
-  kept.push(join11("missions", mission, "report.md"));
+    kept.push(join16("missions", mission, "handoff.md"));
+  kept.push(join16("missions", mission, "report.md"));
   let index;
-  const indexFile = join11(root, "index.md");
+  const indexFile = join16(root, "index.md");
   const line = `- ${mission} — ${new Date().toISOString().slice(0, 10)}
 `;
   if (!dryRun) {
-    const existing = existsSync8(indexFile) ? readFileSync7(indexFile, "utf8") : "";
+    const existing = existsSync11(indexFile) ? readFileSync11(indexFile, "utf8") : "";
     if (!existing.split(/\r?\n/).some((l) => l.startsWith(`- ${mission} —`))) {
       const header = existing ? "" : `# Mission index
 
@@ -1574,28 +1995,28 @@ Archived before closure — no wave artifacts were present.
     }
     index = "index.md";
   }
-  return { report: join11("missions", mission, "report.md"), removed, kept, index };
+  return { report: join16("missions", mission, "report.md"), removed, kept, index };
 }
 
 // src/run.ts
-import { existsSync as existsSync9, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync12, readdirSync as readdirSync8 } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { dirname as dirname5, join as join12, resolve } from "node:path";
+import { dirname as dirname5, join as join17, resolve } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var here3 = dirname5(fileURLToPath4(import.meta.url));
-var SCRIPTS_DIR = join12(here3, "..", "scripts");
+var SCRIPTS_DIR = join17(here3, "..", "scripts");
 var RUNNABLE = ["savepoint.sh", "lane.sh"];
 function findBash() {
   const explicit = process.env.MUGIWARA_BASH?.trim();
   if (explicit)
-    return existsSync9(explicit) ? explicit : null;
+    return existsSync12(explicit) ? explicit : null;
   const candidates = process.platform === "win32" ? [
     "C:\\Program Files\\Git\\bin\\bash.exe",
     "C:\\Program Files (x86)\\Git\\bin\\bash.exe",
-    join12(process.env.LOCALAPPDATA ?? "", "Programs", "Git", "bin", "bash.exe")
+    join17(process.env.LOCALAPPDATA ?? "", "Programs", "Git", "bin", "bash.exe")
   ] : ["/bin/bash", "/usr/bin/bash", "/usr/local/bin/bash", "/opt/homebrew/bin/bash"];
   for (const p of candidates) {
-    if (p && existsSync9(p))
+    if (p && existsSync12(p))
       return p;
   }
   const probe = spawnSync(process.platform === "win32" ? "where" : "which", ["bash"], {
@@ -1612,9 +2033,9 @@ function runScript(name, args, projectDir) {
   if (!/^[a-z0-9-]+\.sh$/.test(name)) {
     throw new Error(`invalid script name "${name}" (expected one of: ${RUNNABLE.join(", ")})`);
   }
-  const script = join12(SCRIPTS_DIR, name);
-  if (!existsSync9(script)) {
-    const have = existsSync9(SCRIPTS_DIR) ? readdirSync7(SCRIPTS_DIR).filter((f) => f.endsWith(".sh")) : [];
+  const script = join17(SCRIPTS_DIR, name);
+  if (!existsSync12(script)) {
+    const have = existsSync12(SCRIPTS_DIR) ? readdirSync8(SCRIPTS_DIR).filter((f) => f.endsWith(".sh")) : [];
     throw new Error(`script not found: ${name}${have.length ? ` (available: ${have.join(", ")})` : ""}`);
   }
   const bash = findBash();
@@ -1631,9 +2052,9 @@ function runScript(name, args, projectDir) {
 }
 
 // src/continue.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync12, readdirSync as readdirSync9 } from "node:fs";
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { join as join13 } from "node:path";
+import { join as join18 } from "node:path";
 var SAFE = /^[A-Za-z0-9._-]+$/;
 var isSafeKey = (s) => SAFE.test(s) && !/^\.+$/.test(s);
 var num = (v) => {
@@ -1662,14 +2083,14 @@ function gitActor(cwd) {
   return name || process.env.USER || process.env.USERNAME || "";
 }
 function scan(projectDir, kind, map) {
-  const base = join13(projectDir, ".mugiwara", "missions");
-  if (!existsSync10(base))
+  const base = join18(projectDir, ".mugiwara", "missions");
+  if (!existsSync13(base))
     return [];
   const out = [];
-  const missions = readdirSync8(base, { withFileTypes: true }).filter((e) => e.isDirectory() && isSafeKey(e.name)).map((e) => e.name).sort();
+  const missions = readdirSync9(base, { withFileTypes: true }).filter((e) => e.isDirectory() && isSafeKey(e.name)).map((e) => e.name).sort();
   for (const mission of missions) {
-    const dir = join13(base, mission);
-    for (const f of readdirSync8(dir).filter((n) => n.endsWith(".json")).sort()) {
+    const dir = join18(base, mission);
+    for (const f of readdirSync9(dir).filter((n) => n.endsWith(".json")).sort()) {
       const stem = f.slice(0, -".json".length);
       let member;
       if (kind === "state") {
@@ -1687,7 +2108,7 @@ function scan(projectDir, kind, map) {
       if (member !== null && !isSafeKey(member))
         continue;
       try {
-        const raw = JSON.parse(readFileSync8(join13(dir, f), "utf8"));
+        const raw = JSON.parse(readFileSync12(join18(dir, f), "utf8"));
         if (text(raw.mission) !== mission)
           continue;
         out.push(map(raw, member));
@@ -1804,9 +2225,10 @@ function formatResume(e) {
 
 // src/sign.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync11 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join19 } from "node:path";
 function signArgs(reportPath, secretKey) {
   return ["-Sm", reportPath, "-s", secretKey];
 }
@@ -1822,39 +2244,200 @@ function hasMinisign() {
   }
 }
 function defaultKey(flag) {
-  return join14(homedir3(), ".mugiwara", flag === "secret" ? "minisign.key" : "minisign.pub");
+  return join19(homedir3(), ".mugiwara", flag === "secret" ? "minisign.key" : "minisign.pub");
+}
+function generatePureKey() {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const privJwk = privateKey.export({ format: "jwk" });
+  const pubJwk = publicKey.export({ format: "jwk" });
+  return {
+    key: Buffer.from(privJwk.d, "base64url").toString("base64"),
+    pub: Buffer.from(pubJwk.x, "base64url").toString("base64")
+  };
+}
+function ensurePureKey(homeDir) {
+  const dir = join19(homeDir, ".mugiwara");
+  const keyPath = join19(dir, "mugiwara.key");
+  const pubPath = join19(dir, "mugiwara.pub");
+  if (!existsSync14(keyPath) || !existsSync14(pubPath)) {
+    mkdirSync9(dir, { recursive: true });
+    const { key, pub } = generatePureKey();
+    if (!existsSync14(keyPath)) {
+      writeFileSync9(keyPath, key + `
+`, { mode: 384 });
+    }
+    if (!existsSync14(pubPath))
+      writeFileSync9(pubPath, pub + `
+`);
+  }
+  try {
+    chmodSync2(keyPath, 384);
+  } catch {}
+  return dir;
+}
+function pureSign(content, seedBase64, opts) {
+  const seed = Buffer.from(seedBase64.trim(), "base64");
+  if (seed.length !== 32)
+    return { ok: false, message: "invalid seed (want 32B base64)" };
+  const pubBuf = Buffer.from(opts.pub.trim(), "base64");
+  if (pubBuf.length !== 32)
+    return { ok: false, message: "invalid pub (want 32B base64)" };
+  const privateKey = createPrivateKey({
+    key: {
+      kty: "OKP",
+      crv: "Ed25519",
+      d: seed.toString("base64url"),
+      x: pubBuf.toString("base64url")
+    },
+    format: "jwk"
+  });
+  const sig = sign(null, Buffer.from(content, "utf8"), privateKey).toString("base64");
+  const out = { algo: "ed25519-pure", sig, pub: opts.pub, mission: opts.mission, commit: opts.commit, ts: opts.ts };
+  if (opts.outputPath)
+    writeFileSync9(opts.outputPath, JSON.stringify(out, null, 2) + `
+`);
+  return { ...out, ok: true };
+}
+function pureVerify(content, sig) {
+  try {
+    const pub = Buffer.from(sig.pub, "base64");
+    if (pub.length !== 32)
+      return false;
+    const publicKey = createPublicKey({
+      key: { kty: "OKP", crv: "Ed25519", x: pub.toString("base64url") },
+      format: "jwk"
+    });
+    return verify(null, Buffer.from(content, "utf8"), publicKey, Buffer.from(sig.sig, "base64"));
+  } catch {
+    return false;
+  }
+}
+function resolveBackend(configured, env) {
+  switch (configured) {
+    case "off":
+      return "off";
+    case "minisign":
+      return env.hasMinisign ? "minisign" : "minisign-fail";
+    case "pure":
+      return "pure";
+    case "auto":
+    default:
+      return env.hasMinisign && env.hasKey ? "minisign" : "pure";
+  }
+}
+function configuredBackend(projectDir) {
+  return readConfig(projectDir).sign;
+}
+function missionMeta(projectDir, mission) {
+  let commit = "unknown";
+  try {
+    commit = execFileSync5("git", ["rev-parse", "HEAD"], { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {}
+  return { commit, ts: new Date().toISOString() };
 }
 function signReport(projectDir, missionDir) {
-  const report = join14(missionDir, "report.md");
-  if (!existsSync11(report))
+  const report = join19(missionDir, "report.md");
+  if (!existsSync14(report))
     return { ok: false, message: "no report.md to sign — archive first" };
-  if (!hasMinisign()) {
-    return { ok: false, message: "minisign not installed — signing skipped (install minisign to enable attestation)" };
+  const mission = missionDir.split(join19(".mugiwara", "missions", "")).pop() ?? "unknown";
+  const backend = resolveBackend(configuredBackend(projectDir), { hasMinisign: hasMinisign(), hasKey: existsSync14(defaultKey("secret")) });
+  if (backend === "off")
+    return { ok: false, message: "signing disabled (sign=off)" };
+  if (backend === "minisign-fail")
+    return { ok: false, message: "sign=minisign but minisign not installed — install it or set sign=pure" };
+  if (backend === "minisign") {
+    const secretKey = process.env.MUGIWARA_SIGN_KEY?.trim() || defaultKey("secret");
+    try {
+      execFileSync5("minisign", signArgs(report, secretKey), { cwd: projectDir, stdio: "pipe", input: process.env.MUGIWARA_SIGN_PASSWORD ?? "" });
+      return { ok: true, message: `signed ${report}.minisig (minisign, key: ${secretKey})` };
+    } catch (e) {
+      return { ok: false, message: `signing failed: ${e.message}` };
+    }
+  }
+  const dir = ensurePureKey(homedir3());
+  const seed = process.env.MUGIWARA_SIGN_KEY?.trim() || readFileSyncSafe2(join19(dir, "mugiwara.key"));
+  const pub = process.env.MUGIWARA_SIGN_PUB?.trim() || readFileSyncSafe2(join19(dir, "mugiwara.pub"));
+  if (!seed || !pub)
+    return { ok: false, message: "pure keys missing — run `mugiwara sign --gen-key --backend pure`" };
+  const content = readFileSafe(report);
+  if (content === null)
+    return { ok: false, message: `cannot read ${report}` };
+  const { commit, ts } = missionMeta(projectDir, mission);
+  const sig = pureSign(content, seed, { mission, commit, ts, pub, outputPath: `${report}.mugisig` });
+  if (!sig.ok)
+    return { ok: false, message: `signing failed: ${sig.message}` };
+  return { ok: true, message: `signed ${report}.mugisig (pure ed25519, key: ${join19(dir, "mugiwara.key")})` };
+}
+function verifyReport(projectDir, missionDir) {
+  const report = join19(missionDir, "report.md");
+  const minisig = `${report}.minisig`;
+  const mugisig = `${report}.mugisig`;
+  if (!existsSync14(minisig) && !existsSync14(mugisig)) {
+    return { ok: false, message: "not signed (no .minisig or .mugisig beside report.md)" };
+  }
+  if (existsSync14(minisig)) {
+    if (!hasMinisign())
+      return { ok: false, message: "minisig present but minisign not installed — cannot verify that signature" };
+    const pubKey = existsSync14(defaultKey("public")) ? defaultKey("public") : null;
+    try {
+      execFileSync5("minisign", verifyArgs(report, pubKey), { cwd: projectDir, stdio: "pipe" });
+      return { ok: true, message: "signature verifies against report.md (minisig)" };
+    } catch {
+      return { ok: false, message: "SIGNATURE INVALID — report.md changed after signing (minisig)" };
+    }
   }
-  const secretKey = process.env.MUGIWARA_SIGN_KEY?.trim() || defaultKey("secret");
   try {
-    execFileSync5("minisign", signArgs(report, secretKey), { cwd: projectDir, stdio: "pipe", input: process.env.MUGIWARA_SIGN_PASSWORD ?? "" });
-    return { ok: true, message: `signed ${report}.minisig (key: ${secretKey})` };
-  } catch (e) {
-    return { ok: false, message: `signing failed: ${e.message}` };
+    const parsed = JSON.parse(readFileSafe(mugisig) ?? "{}");
+    const content = readFileSafe(report);
+    if (content === null || parsed.algo !== "ed25519-pure")
+      return { ok: false, message: "invalid .mugisig file" };
+    return pureVerify(content, parsed) ? { ok: true, message: "signature verifies against report.md (mugisig, ed25519-pure)" } : { ok: false, message: "SIGNATURE INVALID — report.md changed after signing (mugisig)" };
+  } catch {
+    return { ok: false, message: "invalid .mugisig file" };
   }
 }
-function verifyReport(projectDir, missionDir) {
-  const report = join14(missionDir, "report.md");
-  const sig = `${report}.minisig`;
-  if (!existsSync11(sig))
-    return { ok: false, message: "not signed (no .minisig beside report.md)" };
-  if (!hasMinisign())
-    return { ok: false, message: "minisign not installed — cannot verify" };
-  const pubKey = existsSync11(defaultKey("public")) ? defaultKey("public") : null;
+function readFileSafe(p) {
+  try {
+    return readFileSync13(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+function readFileSyncSafe2(p) {
   try {
-    execFileSync5("minisign", verifyArgs(report, pubKey), { cwd: projectDir, stdio: "pipe" });
-    return { ok: true, message: "signature verifies against report.md" };
+    return readFileSync13(p, "utf8").trim();
   } catch {
-    return { ok: false, message: "SIGNATURE INVALID — report.md changed after signing" };
+    return "";
   }
 }
 
+// src/slop.ts
+function detectHealingSlop(input) {
+  const kind = "healing";
+  const max = input.max_cycles ?? 3;
+  const hasZeroHistory = input.history_fixes.some((n) => n === 0);
+  if (input.fixes_in_cycle === 0 && hasZeroHistory) {
+    return { slop: true, reason: `slop: healing — no fixes in cycle ${input.cycle} with previous zero-fix cycle`, kind };
+  }
+  if (input.cycle >= max && input.fixes_in_cycle === 0) {
+    return { slop: true, reason: `slop: healing — cycle ${input.cycle} ≥ max ${max} with no fixes`, kind };
+  }
+  return { slop: false, reason: "no slop — healing making progress", kind };
+}
+function computeLiveSlop(input) {
+  const rows = [];
+  const thr = input.repeated_read_threshold ?? 3;
+  const heal = detectHealingSlop({ cycle: input.heal_cycle, fixes_in_cycle: 0, history_fixes: [], max_cycles: input.max_heal_cycles ?? 3 });
+  if (heal.slop)
+    rows.push({ role: "Brook", kind: "healing", reason: heal.reason });
+  if (input.repeated_reads >= thr)
+    rows.push({ role: "all", kind: "context", reason: `repeated reads ${input.repeated_reads} ≥ ${thr}` });
+  const perRole = {};
+  for (const r of rows)
+    perRole[r.role] = (perRole[r.role] ?? 0) + 1;
+  return { interventions: rows.length, perRole, rows };
+}
+
 // src/cli.ts
 var str = (v) => typeof v === "string" ? v : undefined;
 var flag = (v) => v === true;
@@ -1866,6 +2449,16 @@ async function run(argv) {
     console.log(`mugiwara ${VERSION}`);
     return;
   }
+  if (command === "continue" || command === "status") {
+    return command === "continue" ? continueCmd(flags, _) : statusCmd(flags);
+  }
+  const isDryRunInstall = (command === "install" || command === "update") && flag(flags.dryRun);
+  if (!isDryRunInstall) {
+    const projectDir = resolve2(str(flags.project) ?? process.cwd());
+    if (ensureConfig(projectDir)) {
+      console.log(`default .mugiwara/config written at ${join20(projectDir, ".mugiwara", "config")} (edit it to customise)`);
+    }
+  }
   switch (command) {
     case "install":
       return install(flags);
@@ -1885,6 +2478,8 @@ async function run(argv) {
       return continueCmd(flags, _);
     case "status":
       return statusCmd(flags);
+    case "cost":
+      return costCmd(flags, _);
     case "run":
       return runCmd(flags, _);
     case "savepoint":
@@ -1936,8 +2531,8 @@ function archive(flags, positionals) {
 function cleanCmd(flags) {
   const projectDir = resolve2(str(flags.project) ?? process.cwd());
   const dryRun = flag(flags.dryRun);
-  const root = join15(projectDir, ".mugiwara", "missions");
-  if (!existsSync12(root)) {
+  const root = join20(projectDir, ".mugiwara", "missions");
+  if (!existsSync15(root)) {
     console.log("nothing to clean (.mugiwara/missions/ does not exist).");
     return;
   }
@@ -1947,8 +2542,8 @@ function cleanCmd(flags) {
     console.error(`invalid --before date: ${before}`);
     process.exit(1);
   }
-  let candidates = readdirSync9(root, { withFileTypes: true }).filter((e) => e.isDirectory() && /^[A-Za-z0-9._-]+$/.test(e.name) && !/^\.+$/.test(e.name)).map((e) => e.name);
-  const stateFiles = (m) => readdirSync9(join15(root, m)).filter((f) => {
+  let candidates = readdirSync10(root, { withFileTypes: true }).filter((e) => e.isDirectory() && /^[A-Za-z0-9._-]+$/.test(e.name) && !/^\.+$/.test(e.name)).map((e) => e.name);
+  const stateFiles = (m) => readdirSync10(join20(root, m)).filter((f) => {
     const stem = f.replace(/\.json$/, "");
     return f.endsWith(".json") && stem !== "continue" && !stem.startsWith("continue-");
   });
@@ -1958,7 +2553,7 @@ function cleanCmd(flags) {
       return false;
     for (const f of stateFiles(m)) {
       try {
-        const ts = Date.parse(JSON.parse(readFileSync9(join15(root, m, f), "utf8")).updated_at ?? "") || 0;
+        const ts = Date.parse(JSON.parse(readFileSync14(join20(root, m, f), "utf8")).updated_at ?? "") || 0;
         if (ts === 0 || ts >= beforeMs)
           return false;
       } catch {
@@ -1968,7 +2563,7 @@ function cleanCmd(flags) {
     return true;
   };
   if (!flag(flags.all)) {
-    candidates = candidates.filter((m) => existsSync12(join15(root, m, "report.md")) && !hasLiveState(m) || staleBefore(m));
+    candidates = candidates.filter((m) => existsSync15(join20(root, m, "report.md")) && !hasLiveState(m) || staleBefore(m));
   } else if (!flag(flags.force)) {
     const live = candidates.filter((m) => hasLiveState(m) && !staleBefore(m));
     if (live.length) {
@@ -2002,7 +2597,7 @@ async function resolveOptions(flags) {
         scope = await choose(rl, "Install scope?", ["global (user-wide)", "project (this repo)"]) === 0 ? "global" : "project";
     }
     const projectDir = resolve2(str(flags.project) ?? process.cwd());
-    if (scope === "project" && !existsSync12(projectDir))
+    if (scope === "project" && !existsSync15(projectDir))
       throw new Error(`Project dir not found: ${projectDir}`);
     let targetIds = str(flags.target)?.split(",").map((s) => s.trim()) ?? null;
     if (targetIds && targetIds.includes("all"))
@@ -2081,7 +2676,7 @@ async function uninstall(flags) {
   if (!manifest) {
     if (scope === "project") {
       const globalFile = manifestPath({ scope: "global", projectDir, home });
-      if (existsSync12(globalFile)) {
+      if (existsSync15(globalFile)) {
         console.log(`No project manifest found, but a global install exists. Try:
   mugiwara uninstall --global`);
         return;
@@ -2118,13 +2713,13 @@ async function uninstall(flags) {
         console.log(`   note: ${n}`);
     }
     rmSync3(file);
-    const mugiDir = join15(scope === "global" ? home : projectDir, ".mugiwara");
-    if (existsSync12(mugiDir) && readdirSync9(mugiDir).length === 0) {
+    const mugiDir = join20(scope === "global" ? home : projectDir, ".mugiwara");
+    if (existsSync15(mugiDir) && readdirSync10(mugiDir).length === 0) {
       rmSync3(mugiDir, { recursive: true, force: true });
     }
     if (manifest.targets.includes("opencode")) {
-      const opencodeCache = join15(home, ".cache", "opencode", "packages", "@ionivetech");
-      if (existsSync12(opencodeCache)) {
+      const opencodeCache = join20(home, ".cache", "opencode", "packages", "@ionivetech");
+      if (existsSync15(opencodeCache)) {
         rmSync3(opencodeCache, { recursive: true, force: true });
         console.log("   cleared opencode npm cache (stale plugin versions)");
       }
@@ -2145,7 +2740,7 @@ function list(flags) {
       continue;
     found = true;
     if (flag(flags.check)) {
-      const missing = m.files.filter((f) => !existsSync12(f));
+      const missing = m.files.filter((f) => !existsSync15(f));
       console.log(`${label}: v${m.version} targets=${m.targets.join(",")} files=${m.files.length} missing=${missing.length} installed=${m.installedAt}`);
     } else {
       console.log(`${label}: v${m.version} targets=${m.targets.join(",")} files=${m.files.length} installed=${m.installedAt}`);
@@ -2215,6 +2810,58 @@ function statusCmd(flags) {
       console.log(`  evidence: ${s.evidence.join(", ")}`);
   }
 }
+function costCmd(flags, positionals) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const mission = str(flags.mission) ?? positionals[1] ?? (() => {
+    const states2 = readState(projectDir);
+    if (states2.length === 1)
+      return states2[0].mission;
+    if (states2.length > 1) {
+      console.error("multiple missions in flight — specify --mission <id>");
+      process.exit(1);
+    }
+    return null;
+  })();
+  if (!mission) {
+    console.error("usage: mugiwara cost [--mission <id>] [--json] [--ledger] [--project <dir>]");
+    process.exit(1);
+  }
+  const missionDir = join20(projectDir, ".mugiwara", "missions", mission);
+  if (!existsSync15(missionDir)) {
+    console.error(`No cost ledger found for mission "${mission}"`);
+    process.exit(1);
+  }
+  const states = readState(projectDir).filter((s) => s.mission === mission);
+  const envelope = states.length ? costEnvelope({ lane: states[0].lane, budget: states[0].budget, tokens_est: states[0].tokens_est }) : costEnvelope({ lane: "full", tokens_est: 0 });
+  const state0 = states[0];
+  let repeatedReads = 0;
+  try {
+    const reg = loadRegistry(missionDir);
+    repeatedReads = reg.reduce((s, e) => s + Math.max(e.reads - 1, 0), 0);
+  } catch {
+    repeatedReads = 0;
+  }
+  const liveSlop = computeLiveSlop({ heal_cycle: state0?.heal_cycle ?? 0, repeated_reads: repeatedReads });
+  const ledger = buildCostLedger({ missionDir, envelope, slopSummary: { interventions: liveSlop.interventions } });
+  if (flag(flags.json)) {
+    console.log(toCostJSON(ledger));
+    return;
+  }
+  console.log(`Cost envelope: ${ledger.envelope.status} ${ledger.envelope.pct}% (${ledger.envelope.used}/${ledger.envelope.planned})`);
+  console.log(`Avoided: ${ledger.avoided.stages_avoided} stages, ${ledger.avoided.contexts_avoided} contexts, ~${ledger.avoided.tokens_avoided_est} tokens`);
+  console.log(`Efficiency: reuse ${ledger.efficiency.reuse_rate}, dup ${ledger.efficiency.duplicate_avoidance_chars} chars, budget ${ledger.efficiency.budget_efficiency_pct}%`);
+  if (ledger.avoided.slop_interventions > 0) {
+    const roles = Object.entries(liveSlop.perRole).map(([r, n]) => `${r}:${n}`).join(", ");
+    console.log(`Slop: ${ledger.avoided.slop_interventions} intervention(s) — ${roles}`);
+  }
+  console.log(`Trail: ${ledger.trail.length} decisions`);
+  if (flag(flags.ledger) && ledger.trail.length) {
+    for (const t of ledger.trail.slice(0, 20))
+      console.log(`- ${t.ts} — ${t.actor}: ${t.decision} — reason: ${t.reason}${t.evidence ? ` — evidence: ${t.evidence}` : ""}`);
+    if (ledger.trail.length > 20)
+      console.log(`… ${ledger.trail.length - 20} more`);
+  }
+}
 function runCmd(flags, positionals) {
   const projectDir = resolve2(str(flags.project) ?? process.cwd());
   const name = positionals[1];
@@ -2300,8 +2947,8 @@ function handoffCmd(flags, positionals) {
   }
   lines.push("", "## Resuming", "", `\`mugiwara continue ${mission}\` prints the exact resume point.`);
   lines.push("Verify `next_action` against plan.md before executing — the table above is computed state, not judgement.");
-  const out = join15(".mugiwara", "missions", mission, "handoff.md");
-  writeFileSync8(resolve2(projectDir, out), lines.join(`
+  const out = join20(".mugiwara", "missions", mission, "handoff.md");
+  writeFileSync10(resolve2(projectDir, out), lines.join(`
 `) + `
 `);
   console.log(lines.join(`
@@ -2311,13 +2958,34 @@ written: ${out}`);
 }
 function signCmd(flags, _) {
   const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  if (flag(flags.genKey)) {
+    const backend = str(flags.backend) ?? "auto";
+    const home = homedir4();
+    if (backend === "minisign") {
+      if (!hasMinisign()) {
+        console.error("✗ minisign not installed — cannot generate keys with this backend");
+        process.exit(1);
+      }
+      try {
+        execFileSync6("minisign", ["-G"], { stdio: "inherit" });
+        console.log("✓ minisign key pair generated in ~/.mugiwara/");
+        return;
+      } catch {
+        console.error("✗ key generation failed");
+        process.exit(1);
+      }
+    }
+    const dir = ensurePureKey(home);
+    console.log(`✓ pure ed25519 key pair ready: ${join20(dir, "mugiwara.key")} / ${join20(dir, "mugiwara.pub")}`);
+    return;
+  }
   const mission = _[1];
   if (!mission) {
-    console.error("usage: mugiwara sign <mission> [--verify] [--project <dir>]");
+    console.error("usage: mugiwara sign <mission> [--verify] [--gen-key [--backend pure|minisign]] [--project <dir>]");
     process.exit(1);
   }
-  const missionDir = join15(projectDir, ".mugiwara", "missions", mission);
-  if (!existsSync12(missionDir)) {
+  const missionDir = join20(projectDir, ".mugiwara", "missions", mission);
+  if (!existsSync15(missionDir)) {
     console.error(`no mission dir: ${missionDir}`);
     process.exit(1);
   }
@@ -2343,11 +3011,15 @@ Usage:
   mugiwara continue <m> [member]
                          print the exact resume point for that mission/member
   mugiwara status        computed mission state: wave, tasks, lane, blockers, budget
+  mugiwara cost [--mission <id>] [--json] [--ledger]
+                         show cost ledger, avoided work, efficiency, trail (human + JSON)
   mugiwara blame <path>  provenance note on the last commit touching <path>
                          (fetch notes first: git fetch origin 'refs/notes/mugiwara:refs/notes/mugiwara')
   mugiwara handoff <m>   write .mugiwara/missions/<m>/handoff.md — a report the next
                          engineer can act on (computed state + staleness check)
-  mugiwara sign <m>      optional attestation: minisign-sign report.md (--verify to check)
+  mugiwara sign <m>      attestation: sign report.md (auto/minisign/pure/off; --verify to check)
+  mugiwara sign --gen-key [--backend pure|minisign]
+                         create signing keys (pure ed25519 default)
   mugiwara run <script> [args...]
                          run a bundled harness script here (${RUNNABLE.join(", ")})
   mugiwara savepoint <mission> [member] [flow] [mode]