@kontextmind/kxm 0.7.86 → 0.7.88

package/plugins/kxm/dist/cli.js

@@ -2987,7 +2987,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve30.call(this, root, ref);
+      let _sch = resolve32.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3014,7 +3014,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve30(root, ref) {
+    function resolve32(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3839,7 +3839,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve30(baseURI, relativeURI, options) {
+    function resolve32(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -4201,7 +4201,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve30,
+      resolve: resolve32,
       resolveComponent,
       equal,
       serialize,
@@ -14779,7 +14779,7 @@ var require_dist = __commonJS({
 });
 
 // plugins/kxm/src/cli.ts
-import { resolve as resolve29 } from "node:path";
+import { resolve as resolve31 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // node_modules/commander/lib/error.js
@@ -19501,7 +19501,7 @@ var HubClient = class {
       if (signal?.aborted) throw new MeshWaitError("aborted", messageId);
       const message = await this.getMessage(messageId);
       if (["replied", "cancelled", "expired", "error"].includes(message.status)) return message;
-      await new Promise((resolve30, reject) => {
+      await new Promise((resolve32, reject) => {
         const onAbort = () => {
           signal?.removeEventListener("abort", onAbort);
           clearTimeout(timer);
@@ -19509,7 +19509,7 @@ var HubClient = class {
         };
         const timer = setTimeout(() => {
           signal?.removeEventListener("abort", onAbort);
-          resolve30();
+          resolve32();
         }, Math.min(500, Math.max(1, deadline - Date.now())));
         signal?.addEventListener("abort", onAbort, { once: true });
         if (signal?.aborted) onAbort();
@@ -19564,7 +19564,7 @@ var HubClient = class {
       } catch (error) {
         if (this.stopped || error instanceof Error && error.name === "AbortError") return;
       }
-      if (!this.stopped) await new Promise((resolve30) => setTimeout(resolve30, this.options.reconnectMs));
+      if (!this.stopped) await new Promise((resolve32) => setTimeout(resolve32, this.options.reconnectMs));
     }
   }
   headers(includeIdentity = true) {
@@ -20436,8 +20436,8 @@ var AGENT_COMMANDS = [
         summary: { type: "string", description: "Promotion summary" },
         authority: {
           type: "string",
-          enum: ["policy", "instruction", "evidence", "hypothesis"],
-          description: "Authority class"
+          enum: ["evidence", "hypothesis"],
+          description: "Authority class; an agent's proposal is peer origin, so evidence at most"
         },
         confidence: {
           type: "string",
@@ -21036,7 +21036,7 @@ function defaultSpawn(command, args, options) {
   if (options.signal?.aborted) {
     return Promise.resolve({ stdout: "", stderr: "", code: null, started: false, observedChildExit: false, error: new Error("process_aborted") });
   }
-  return new Promise((resolve30) => {
+  return new Promise((resolve32) => {
     const stdout = [];
     const stderr = [];
     let outputBytes = 0;
@@ -21067,7 +21067,7 @@ function defaultSpawn(command, args, options) {
       const started = Boolean(child?.pid);
       if (started && !observedChildExit) error ??= new Error("process_exit_unobserved");
       const unverifiedDescendants = stopping || started && !observedChildExit;
-      resolve30({
+      resolve32({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         code,
@@ -23280,13 +23280,13 @@ function planKxmInitialization(start = process.cwd(), options = {}) {
 // plugins/kxm/src/runtime-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash12, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync13, lstatSync as lstatSync6, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync14, lstatSync as lstatSync6, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname9, isAbsolute as isAbsolute6, join as join13 } from "node:path";
 
 // plugins/kxm/src/runtime-store.ts
 import { createHash as createHash10, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync9, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname7, join as join9, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync10, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join9, resolve as resolve7 } from "node:path";
 
 // plugins/kxm/src/bindings.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -23294,7 +23294,7 @@ import { createHash as createHash7, randomUUID as randomUUID3 } from "node:crypt
 import {
   chmodSync as chmodSync2,
   closeSync,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   fsyncSync,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync4,
@@ -23308,7 +23308,10 @@ import {
 import { homedir as homedir3 } from "node:os";
 
 // plugins/kxm/src/sqlite.ts
+import { existsSync as existsSync7 } from "node:fs";
 import { createRequire } from "node:module";
+import { resolve as resolve4 } from "node:path";
+import { pathToFileURL } from "node:url";
 var requireFromHere = createRequire(import.meta.url);
 function loadNative() {
   try {
@@ -23345,9 +23348,15 @@ var DatabaseSync = class {
     this.inner.close();
   }
 };
+function openReadOnlyDatabase(path4) {
+  if (existsSync7(`${path4}-wal`)) return new DatabaseSync(path4, { readOnly: true });
+  const uri = pathToFileURL(resolve4(path4));
+  uri.searchParams.set("immutable", "1");
+  return new DatabaseSync(uri.href, { readOnly: true });
+}
 
 // plugins/kxm/src/bindings.ts
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join7, parse, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join7, parse, relative as relative2, resolve as resolve5, sep as sep2 } from "node:path";
 var MAX_BINDING_RECORD_BYTES = 256 * 1024;
 var BINDING_LABEL = "Runtime-local repository bindings";
 var activeLocks = /* @__PURE__ */ new WeakSet();
@@ -23358,7 +23367,7 @@ function bindingError(phase, code, message) {
   throw new KxmConfigError([bindingIssue(phase, code, message)]);
 }
 function canonicalHostPath2(path4) {
-  const absolute = resolve4(path4);
+  const absolute = resolve5(path4);
   try {
     return realpathSync2.native(absolute);
   } catch {
@@ -23377,17 +23386,17 @@ function kxmUserStateRoot(options = {}) {
   const explicit = options.stateRoot ?? env.KXM_STATE_HOME?.trim();
   if (explicit) {
     if (!isAbsolute3(explicit)) bindingError("path", "local_state_root_not_absolute", "KXM_STATE_HOME must be an absolute host-local path");
-    return resolve4(explicit);
+    return resolve5(explicit);
   }
   if (platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
     const base2 = localAppData && isAbsolute3(localAppData) ? localAppData : join7(home, "AppData", "Local");
-    return resolve4(base2, "KXM");
+    return resolve5(base2, "KXM");
   }
-  if (platform === "darwin") return resolve4(home, "Library", "Application Support", "KXM");
+  if (platform === "darwin") return resolve5(home, "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
   const base = xdgState && isAbsolute3(xdgState) ? xdgState : join7(home, ".local", "state");
-  return resolve4(base, "kxm");
+  return resolve5(base, "kxm");
 }
 function projectBindingKey(projectRoot, platform = process.platform) {
   const canonical2 = canonicalHostPath2(projectRoot);
@@ -23399,7 +23408,7 @@ function kxmLocalBindingFile(projectRoot, options = {}) {
   return join7(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
 }
 function checkedDirectory(path4, description) {
-  if (!existsSync7(path4)) return false;
+  if (!existsSync8(path4)) return false;
   const stat = lstatSync2(path4);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     bindingError("path", "local_binding_directory_invalid", `${description} must be a regular directory, not a link or file`);
@@ -23431,10 +23440,10 @@ function asRecord2(value, file, projectRoot, schemasDir) {
   };
 }
 function readKxmLocalBindings(projectRoot, options = {}) {
-  const root = resolve4(projectRoot);
+  const root = resolve5(projectRoot);
   const stateRoot = kxmUserStateRoot(options);
   const file = kxmLocalBindingFile(root, options);
-  if (!existingBindingDirectory(file, stateRoot) || !existsSync7(file)) return void 0;
+  if (!existingBindingDirectory(file, stateRoot) || !existsSync8(file)) return void 0;
   const stat = lstatSync2(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     bindingError("path", "local_binding_file_invalid", "binding record must be a regular file, not a link or directory");
@@ -23482,7 +23491,7 @@ function syncDirectory(path4) {
   }
 }
 function createDirectoryIfMissing(path4) {
-  if (existsSync7(path4)) return;
+  if (existsSync8(path4)) return;
   try {
     mkdirSync4(path4, { mode: 448 });
     syncDirectory(dirname5(path4));
@@ -23492,8 +23501,8 @@ function createDirectoryIfMissing(path4) {
 }
 function ensureDurableDirectory(path4, description) {
   const missing = [];
-  let current = resolve4(path4);
-  while (!existsSync7(current)) {
+  let current = resolve5(path4);
+  while (!existsSync8(current)) {
     missing.push(current);
     const parent = dirname5(current);
     if (parent === current) bindingError("path", "local_binding_directory_invalid", `${description} has no existing filesystem ancestor`);
@@ -23518,7 +23527,7 @@ function ensureBindingDirectory(file, stateRoot) {
   checkedDirectory(project, "local project binding directory");
 }
 function assertNoLinkedDirectoryComponents(path4, description) {
-  const absolute = resolve4(path4);
+  const absolute = resolve5(path4);
   const filesystemRoot = parse(absolute).root;
   let current = filesystemRoot;
   const remainder = relative2(filesystemRoot, absolute);
@@ -23544,14 +23553,14 @@ function projectOperationLockFile(projectRoot) {
   if (result.status !== 0 || result.error || !result.stdout.trim()) {
     bindingError("discovery", "project_operation_lock_unavailable", "cannot resolve the authoritative Git metadata path for project locking");
   }
-  const gitDirectory = resolve4(result.stdout.trim());
+  const gitDirectory = resolve5(result.stdout.trim());
   assertNoLinkedDirectoryComponents(gitDirectory, "authoritative Git metadata path");
   const gitStat = lstatSync2(gitDirectory);
   if (gitStat.isSymbolicLink() || !gitStat.isDirectory()) {
     bindingError("path", "project_operation_lock_parent_invalid", "authoritative Git metadata must resolve to a regular directory");
   }
   const lockDirectory = join7(gitDirectory, "kxm");
-  if (existsSync7(lockDirectory)) {
+  if (existsSync8(lockDirectory)) {
     const stat = lstatSync2(lockDirectory);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", "Git-local KXM lock directory must be regular, not a link or file");
@@ -23563,9 +23572,9 @@ function projectOperationLockFile(projectRoot) {
   return join7(lockDirectory, "project-operation-lock.sqlite");
 }
 function withKxmLocalBindingLock(projectRoot, options, callback) {
-  const root = resolve4(projectRoot);
+  const root = resolve5(projectRoot);
   const file = projectOperationLockFile(root);
-  if (existsSync7(file)) {
+  if (existsSync8(file)) {
     const stat = lstatSync2(file);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       bindingError("path", "local_binding_lock_invalid", "project-operation lock must be a regular file, not a link or directory");
@@ -23598,7 +23607,7 @@ function withKxmLocalBindingLock(projectRoot, options, callback) {
   }
 }
 function planKxmLocalBindings(projectRoot, projectId, repositories, options = {}) {
-  const root = resolve4(projectRoot);
+  const root = resolve5(projectRoot);
   const file = kxmLocalBindingFile(root, options);
   const record = normalizedRecord(root, projectId, repositories, options.schemasDir);
   const existing = readKxmLocalBindings(root, options);
@@ -23608,7 +23617,7 @@ function planKxmLocalBindings(projectRoot, projectId, repositories, options = {}
   return { file, written: !existing || !recordsEqual(existing, record), record };
 }
 function writeKxmLocalBindings(projectRoot, projectId, repositories, options = {}, lock) {
-  const root = resolve4(projectRoot);
+  const root = resolve5(projectRoot);
   if (!lock) {
     return withKxmLocalBindingLock(root, options, (acquired) => writeKxmLocalBindings(root, projectId, repositories, options, acquired));
   }
@@ -23726,7 +23735,7 @@ import { createHash as createHash9, randomBytes } from "node:crypto";
 import {
   chmodSync as chmodSync3,
   copyFileSync,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
@@ -23734,14 +23743,14 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync5
 } from "node:fs";
-import { basename as basename3, dirname as dirname6, join as join8, resolve as resolve5 } from "node:path";
+import { basename as basename3, dirname as dirname6, join as join8, resolve as resolve6 } from "node:path";
 function databaseError(code, file, message) {
   const issue3 = { phase: "semantic", code, file, message };
   return new KxmConfigError([issue3]);
 }
 function checkedParent(path4, description) {
   const parent = dirname6(path4);
-  if (!existsSync8(parent)) mkdirSync5(parent, { recursive: true, mode: 448 });
+  if (!existsSync9(parent)) mkdirSync5(parent, { recursive: true, mode: 448 });
   const stat = lstatSync3(parent, { throwIfNoEntry: false });
   if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
     throw databaseError("runtime_path_invalid", description, `${description} parent must be a regular directory, not a link`);
@@ -23878,14 +23887,14 @@ function fileSha256(filePath) {
   return `sha256:${createHash9("sha256").update(bytes).digest("hex")}`;
 }
 function backupDatabaseFile(sourcePath, targetPath, storeId) {
-  const resolvedSource = resolve5(sourcePath);
-  const resolvedTarget = resolve5(targetPath);
+  const resolvedSource = resolve6(sourcePath);
+  const resolvedTarget = resolve6(targetPath);
   const sourceStat = lstatSync3(resolvedSource, { throwIfNoEntry: false });
   if (!sourceStat || !sourceStat.isFile() || sourceStat.isSymbolicLink()) {
     throw databaseError("runtime_path_invalid", resolvedSource, `source database ${resolvedSource} must be a regular file, not a link or directory`);
   }
   checkedParent(resolvedTarget, "backup target");
-  if (existsSync8(resolvedTarget)) {
+  if (existsSync9(resolvedTarget)) {
     unlinkSync2(resolvedTarget);
   }
   const sourceDb = new DatabaseSync(resolvedSource);
@@ -23929,8 +23938,8 @@ function backupDatabaseFile(sourcePath, targetPath, storeId) {
   };
 }
 function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVersion, maxSupportedVersion) {
-  const resolvedBackup = resolve5(backupPath);
-  const resolvedTarget = resolve5(targetPath);
+  const resolvedBackup = resolve6(backupPath);
+  const resolvedTarget = resolve6(targetPath);
   const backupStat = lstatSync3(resolvedBackup, { throwIfNoEntry: false });
   if (!backupStat || !backupStat.isFile() || backupStat.isSymbolicLink()) {
     throw databaseError("runtime_path_invalid", resolvedBackup, `backup database ${resolvedBackup} must be a regular file, not a link or directory`);
@@ -23963,7 +23972,7 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   }
   checkedParent(resolvedTarget, "restore target");
   for (const file of [resolvedTarget, `${resolvedTarget}-wal`, `${resolvedTarget}-shm`]) {
-    if (existsSync8(file)) {
+    if (existsSync9(file)) {
       try {
         unlinkSync2(file);
       } catch {
@@ -24003,22 +24012,22 @@ function kxmBackupCeiling(storeId) {
   return KXM_BACKUP_CEILINGS[storeId] ?? KXM_BACKUP_CEILINGS["hub-store"];
 }
 function discoverProjectStores(projectRoot, options = {}) {
-  const root = resolve5(projectRoot);
+  const root = resolve6(projectRoot);
   const stores = [];
-  const hubPath = options.hubDataPath ? resolve5(options.hubDataPath) : join8(root, ".kxm", "state", "kxm.db");
-  if (existsSync8(hubPath)) {
+  const hubPath = options.hubDataPath ? resolve6(options.hubDataPath) : join8(root, ".kxm", "state", "kxm.db");
+  if (existsSync9(hubPath)) {
     stores.push({ storeId: "hub-store", sourcePath: hubPath, maxSupportedVersion: kxmBackupCeiling("hub-store") });
   }
   const registryPath = join8(root, ".kxm", "runtime", "registry.db");
-  if (existsSync8(registryPath)) {
+  if (existsSync9(registryPath)) {
     stores.push({ storeId: "registry", sourcePath: registryPath, maxSupportedVersion: kxmBackupCeiling("registry") });
   }
   const bindingsPath = join8(root, ".kxm", "runtime", "bindings.db");
-  if (existsSync8(bindingsPath)) {
+  if (existsSync9(bindingsPath)) {
     stores.push({ storeId: "binding-store", sourcePath: bindingsPath, maxSupportedVersion: kxmBackupCeiling("binding-store") });
   }
   const eventsDir = join8(root, ".kxm", "runtime", "events");
-  if (existsSync8(eventsDir)) {
+  if (existsSync9(eventsDir)) {
     const entries = readdirSync2(eventsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".db")) {
@@ -24033,38 +24042,43 @@ function discoverProjectStores(projectRoot, options = {}) {
   }
   return stores;
 }
-function createBackup(options = {}) {
-  const projectRoot = options.projectRoot ? resolve5(options.projectRoot) : process.cwd();
+function planBackup(options = {}) {
+  const projectRoot = options.projectRoot ? resolve6(options.projectRoot) : process.cwd();
   const stores = discoverProjectStores(projectRoot, {
     ...options.hubDataPath !== void 0 ? { hubDataPath: options.hubDataPath } : {}
   });
   if (stores.length === 0) {
     throw databaseError("backup_no_stores", projectRoot, "no existing SQLite stores found to backup");
   }
-  const now = /* @__PURE__ */ new Date();
-  const timestamp = now.toISOString().replace(/[:.]/g, "-");
-  const backupId = `bk_${randomBytes(8).toString("hex")}`;
-  const outDir = options.outDir ? resolve5(options.outDir) : join8(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
-  if (!existsSync8(outDir)) {
-    mkdirSync5(outDir, { recursive: true, mode: 448 });
-  }
-  const backedUpStores = [];
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  const timestamp = createdAt.replace(/[:.]/g, "-");
+  const outDir = options.outDir ? resolve6(options.outDir) : join8(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
   const usedFilenames = /* @__PURE__ */ new Set();
-  for (const store of stores) {
+  const planned = stores.map((store) => {
     let filename = basename3(store.sourcePath);
     if (usedFilenames.has(filename)) {
       const sanitizedId = store.storeId.replace(/[^a-zA-Z0-9_.-]/g, "_");
       filename = `${sanitizedId}-${filename}`;
     }
     usedFilenames.add(filename);
-    const targetFile2 = join8(outDir, filename);
-    const record = backupDatabaseFile(store.sourcePath, targetFile2, store.storeId);
-    backedUpStores.push(record);
+    return { storeId: store.storeId, sourcePath: store.sourcePath, backupFile: filename };
+  });
+  return { projectRoot, outDir, createdAt, stores: planned };
+}
+function createBackup(options = {}) {
+  const { projectRoot, outDir, createdAt, stores } = planBackup(options);
+  const backupId = `bk_${randomBytes(8).toString("hex")}`;
+  if (!existsSync9(outDir)) {
+    mkdirSync5(outDir, { recursive: true, mode: 448 });
+  }
+  const backedUpStores = [];
+  for (const store of stores) {
+    backedUpStores.push(backupDatabaseFile(store.sourcePath, join8(outDir, store.backupFile), store.storeId));
   }
   const manifest = {
     schema: "kxm.backup-manifest.v1",
     backupId,
-    createdAt: now.toISOString(),
+    createdAt,
     projectRoot,
     stores: backedUpStores
   };
@@ -24076,8 +24090,8 @@ function createBackup(options = {}) {
   writeFileSync5(manifestPath, finalJson, "utf8");
   return { manifest, outDir };
 }
-function restoreBackup(manifestPathOrDir, options = {}) {
-  let manifestPath = resolve5(manifestPathOrDir);
+function planRestore(manifestPathOrDir, options = {}) {
+  let manifestPath = resolve6(manifestPathOrDir);
   const stat = lstatSync3(manifestPath, { throwIfNoEntry: false });
   if (!stat) {
     throw databaseError("runtime_path_invalid", manifestPath, `manifest path ${manifestPath} does not exist`);
@@ -24085,7 +24099,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
   if (stat.isDirectory()) {
     manifestPath = join8(manifestPath, "manifest.json");
   }
-  if (!existsSync8(manifestPath)) {
+  if (!existsSync9(manifestPath)) {
     throw databaseError("runtime_path_invalid", manifestPath, `backup manifest ${manifestPath} not found`);
   }
   const manifestDir = dirname6(manifestPath);
@@ -24099,10 +24113,10 @@ function restoreBackup(manifestPathOrDir, options = {}) {
   if (manifest.schema !== "kxm.backup-manifest.v1" || !Array.isArray(manifest.stores) || manifest.stores.length === 0) {
     throw databaseError("restore_manifest_invalid", manifestPath, "manifest is not a valid kxm.backup-manifest.v1 document");
   }
-  const restoredStores = [];
+  const stores = [];
   for (const store of manifest.stores) {
     const backupFilePath = join8(manifestDir, store.backupFile);
-    if (!existsSync8(backupFilePath)) {
+    if (!existsSync9(backupFilePath)) {
       throw databaseError("restore_file_missing", backupFilePath, `backup file ${store.backupFile} missing from ${manifestDir}`);
     }
     const actualSha256 = fileSha256(backupFilePath);
@@ -24113,31 +24127,42 @@ function restoreBackup(manifestPathOrDir, options = {}) {
         `backup file ${store.backupFile} sha256 ${actualSha256} does not match manifest hash ${store.sha256}`
       );
     }
-    const maxSupported = kxmBackupCeiling(store.storeId);
+    const maxSupportedVersion = kxmBackupCeiling(store.storeId);
+    if (store.schemaVersion > maxSupportedVersion) {
+      throw databaseError(
+        "runtime_schema_newer",
+        backupFilePath,
+        `backup store ${store.storeId} schema version ${store.schemaVersion} is newer than supported maximum ${maxSupportedVersion}`
+      );
+    }
     let targetPath = store.sourcePath;
     if (options.projectRoot && manifest.projectRoot && targetPath.startsWith(manifest.projectRoot)) {
       const rel = targetPath.slice(manifest.projectRoot.length).replace(/^[\\/]+/, "");
-      targetPath = join8(resolve5(options.projectRoot), rel);
-    }
-    const result = restoreDatabaseFile(
-      backupFilePath,
-      targetPath,
-      store.storeId,
-      store.schemaVersion,
-      maxSupported
-    );
-    restoredStores.push(result);
+      targetPath = join8(resolve6(options.projectRoot), rel);
+    }
+    stores.push({ storeId: store.storeId, backupFilePath, targetPath, schemaVersion: store.schemaVersion, maxSupportedVersion });
   }
+  return { manifestPath, backupId: manifest.backupId, stores };
+}
+function restoreBackup(manifestPathOrDir, options = {}) {
+  const plan = planRestore(manifestPathOrDir, options);
+  const restoredStores = plan.stores.map((store) => restoreDatabaseFile(
+    store.backupFilePath,
+    store.targetPath,
+    store.storeId,
+    store.schemaVersion,
+    store.maxSupportedVersion
+  ));
   return {
-    manifestPath,
-    backupId: manifest.backupId,
+    manifestPath: plan.manifestPath,
+    backupId: plan.backupId,
     restoredStores
   };
 }
 
 // plugins/kxm/src/runtime-store.ts
 function kxmRuntimePaths(options = {}) {
-  const stateRoot = options.stateRoot ? resolve6(options.stateRoot) : kxmUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
+  const stateRoot = options.stateRoot ? resolve7(options.stateRoot) : kxmUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
   const runtimeDir = join9(stateRoot, "runtime");
   return {
     stateRoot,
@@ -24155,9 +24180,9 @@ function runtimeError(code, file, message) {
 function projectRuntimeKey(projectRoot) {
   let canonical2;
   try {
-    canonical2 = realpathSync3.native(resolve6(projectRoot));
+    canonical2 = realpathSync3.native(resolve7(projectRoot));
   } catch {
-    canonical2 = resolve6(projectRoot);
+    canonical2 = resolve7(projectRoot);
   }
   const folded = process.platform === "win32" ? canonical2.toLocaleLowerCase("en-US") : canonical2;
   return createHash10("sha256").update(folded, "utf8").digest("hex").slice(0, 24);
@@ -24191,7 +24216,7 @@ var KxmRuntimeRegistry = class {
   path;
   database;
   constructor(path4) {
-    this.path = resolve6(path4);
+    this.path = resolve7(path4);
     this.database = openDatabase(this.path, "runtime registry", {
       schema: REGISTRY_SCHEMA,
       version: KXM_REGISTRY_SCHEMA_VERSION,
@@ -24290,7 +24315,7 @@ var KxmRuntimeRegistry = class {
     return rows.map((row) => ({ projectRoot: row.project_root, projectId: row.project_id }));
   }
   registerProject(registration) {
-    const projectRoot = resolve6(registration.projectRoot);
+    const projectRoot = resolve7(registration.projectRoot);
     const projectKey = projectRuntimeKey(projectRoot);
     this.database.exec("BEGIN IMMEDIATE");
     try {
@@ -24994,7 +25019,7 @@ var RECORD_LIMIT = 16 * 1024 * 1024;
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync9, statSync } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, statSync } from "node:fs";
 import { join as join10 } from "node:path";
 
 // plugins/kxm/src/price-calc.ts
@@ -25147,8 +25172,8 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync10(join10(rootOrPath, ".kxm", "prices.yaml")) ? join10(rootOrPath, ".kxm", "prices.yaml") : existsSync10(join10(rootOrPath, "prices.yaml")) ? join10(rootOrPath, "prices.yaml") : existsSync10(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
-  if (!candidatePath || !existsSync10(candidatePath)) {
+  const candidatePath = existsSync11(join10(rootOrPath, ".kxm", "prices.yaml")) ? join10(rootOrPath, ".kxm", "prices.yaml") : existsSync11(join10(rootOrPath, "prices.yaml")) ? join10(rootOrPath, "prices.yaml") : existsSync11(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  if (!candidatePath || !existsSync11(candidatePath)) {
     return void 0;
   }
   const content = readFileSync9(candidatePath, "utf8");
@@ -25172,14 +25197,14 @@ var import_yaml5 = __toESM(require_dist(), 1);
 
 // plugins/kxm/src/routes.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { existsSync as existsSync11, readFileSync as readFileSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, readdirSync as readdirSync3 } from "node:fs";
 import { join as join11 } from "node:path";
 var RETIRED_POLICY = ".kxm/producers.yaml";
 var empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [], roles: {} });
 function loadRoutePolicy(root) {
-  if (existsSync11(join11(root, RETIRED_POLICY))) throw new Error(`retired ${RETIRED_POLICY} present; use .kxm/routes.yaml (kxm.routes.v2)`);
+  if (existsSync12(join11(root, RETIRED_POLICY))) throw new Error(`retired ${RETIRED_POLICY} present; use .kxm/routes.yaml (kxm.routes.v2)`);
   const path4 = join11(root, ".kxm", "routes.yaml");
-  if (!existsSync11(path4)) return empty();
+  if (!existsSync12(path4)) return empty();
   const value = (0, import_yaml4.parse)(readFileSync10(path4, "utf8"));
   if (value?.schema !== "kxm.routes.v2" || !Array.isArray(value.admitted)) throw new Error("invalid .kxm/routes.yaml");
   return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x2) => typeof x2 === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k, v2]) => [k, v2.filter((x2) => typeof x2 === "string")])) : {} };
@@ -25197,7 +25222,7 @@ function setRouteState(root, model, state, role, removeRole2 = false) {
     if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
     const rolePath = join11(root, ".kxm", "roles", `${role}.yaml`);
     let roleFile = {};
-    if (existsSync11(rolePath)) {
+    if (existsSync12(rolePath)) {
       const parsed = (0, import_yaml4.parse)(readFileSync10(rolePath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed;
     }
@@ -25220,7 +25245,7 @@ function setRouteState(root, model, state, role, removeRole2 = false) {
 function listRoleBindings(root) {
   const dir = join11(root, ".kxm", "roles");
   const result = {};
-  if (!existsSync11(dir)) return result;
+  if (!existsSync12(dir)) return result;
   for (const file of readdirSync3(dir).filter((name) => name.endsWith(".yaml"))) {
     const role = file.slice(0, -5);
     const value = (0, import_yaml4.parse)(readFileSync10(join11(dir, file), "utf8"));
@@ -25230,21 +25255,21 @@ function listRoleBindings(root) {
 }
 function listInventoryModels(root) {
   const path4 = join11(root, ".kxm", "models", "inventory.yaml");
-  if (!existsSync11(path4)) return [];
+  if (!existsSync12(path4)) return [];
   const value = (0, import_yaml4.parse)(readFileSync10(path4, "utf8"));
   return (value.models ?? []).map((m2) => m2.id).filter((id) => typeof id === "string");
 }
 
 // plugins/kxm/src/artifacts-exist.ts
 import { lstatSync as lstatSync5, realpathSync as realpathSync4, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve8 } from "node:path";
 function staysUnder(root, candidate) {
   const child = relative3(root, candidate);
   return child === "" || !isAbsolute4(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 function verifyArtifactExists(rootInput, pathInput) {
-  const lexicalRoot = resolve7(rootInput);
-  const lexicalPath = resolve7(pathInput);
+  const lexicalRoot = resolve8(rootInput);
+  const lexicalPath = resolve8(pathInput);
   if (!staysUnder(lexicalRoot, lexicalPath)) {
     return { ok: false, error: "artifact_outside_workspace_assets", path: lexicalPath };
   }
@@ -25863,9 +25888,9 @@ function formatRoutingReport(report2, options = {}) {
 }
 
 // plugins/kxm/src/hub-binding.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync11, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync11, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12, resolve as resolve9 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HUB_HEALTH_PROBE_MS = 300;
 var HubBindingError = class extends Error {
@@ -25878,17 +25903,17 @@ function resolveUserStateRoot2(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
     if (!isAbsolute5(explicit)) throw new HubBindingError("local_state_root_not_absolute");
-    return resolve8(explicit);
+    return resolve9(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
     const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join12(homedir4(), "AppData", "Local");
-    return resolve8(base2, "KXM");
+    return resolve9(base2, "KXM");
   }
-  if (process.platform === "darwin") return resolve8(homedir4(), "Library", "Application Support", "KXM");
+  if (process.platform === "darwin") return resolve9(homedir4(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
   const base = xdgState && isAbsolute5(xdgState) ? xdgState : join12(homedir4(), ".local", "state");
-  return resolve8(base, "kxm");
+  return resolve9(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
   return join12(resolveUserStateRoot2(env), "hub-binding.json");
@@ -25927,7 +25952,7 @@ function isAbortError(error) {
 }
 function readHubBinding(env = process.env) {
   const file = hubBindingFile(env);
-  if (!existsSync12(file)) return void 0;
+  if (!existsSync13(file)) return void 0;
   let parsed;
   try {
     parsed = JSON.parse(readFileSync11(file, "utf8"));
@@ -26029,7 +26054,7 @@ function supervisorErrorFile(paths) {
 }
 function clearSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
-  if (existsSync13(file)) rmSync4(file, { force: true });
+  if (existsSync14(file)) rmSync4(file, { force: true });
 }
 function readRecentSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
@@ -26044,7 +26069,7 @@ function readRecentSupervisorError(paths) {
   }
 }
 function kxmSupervisorStatus(paths) {
-  if (!existsSync13(paths.registryDb)) return { running: false };
+  if (!existsSync14(paths.registryDb)) return { running: false };
   const registry = new KxmRuntimeRegistry(paths.registryDb);
   try {
     const record = registry.supervisor();
@@ -26168,7 +26193,7 @@ async function kxmRuntimeRequest(handle, method, path4, body) {
 
 // plugins/kxm/src/cli/types.ts
 import { spawn as spawn3 } from "node:child_process";
-import { join as join15, resolve as resolve9 } from "node:path";
+import { join as join15, resolve as resolve10 } from "node:path";
 
 // plugins/kxm/src/telemetry.ts
 import { appendFileSync, mkdirSync as mkdirSync10, readFileSync as readFileSync13 } from "node:fs";
@@ -26314,6 +26339,17 @@ function print(io, jsonMode, payload, text) {
   if (tagged.ok === false) io.stderr(line);
   else io.stdout(line);
 }
+function printPlan(runtime, payload, planned, text) {
+  print(runtime.io, runtime.json, { ok: true, ...payload, dryRun: true, planned }, [
+    `dry run: ${text}`,
+    ...planned.length === 0 ? ["  no changes"] : planned.map((change) => `  would ${change.action} ${change.target}`)
+  ].join("\n"));
+}
+var DRY_RUN_UNSUPPORTED = "dry_run_unsupported";
+function refuseDryRun(io, jsonMode, command, reason) {
+  print(io, jsonMode, { ok: false, command, dryRun: true, error: DRY_RUN_UNSUPPORTED, detail: reason }, `kxm ${command} --dry-run refused: ${reason}`);
+  return 2;
+}
 function printWorker(runtime, worker, payload, text, outcome) {
   const sessionId = runtime.env.KXM_SESSION_ID?.trim();
   const envelope = workerResult(worker, {
@@ -26365,16 +26401,16 @@ function redactCliValue(value, field = "") {
   return value;
 }
 function workspaceDirs(cwd, workspaceFlag, env) {
-  const workdir = resolve9(env.KXM_WORKDIR?.trim() || cwd);
-  const workspace = resolve9(workdir, workspaceFlag || env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
+  const workdir = resolve10(env.KXM_WORKDIR?.trim() || cwd);
+  const workspace = resolve10(workdir, workspaceFlag || env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
   const derive = workspaceFlag !== void 0;
   return {
     workdir,
     workspace,
-    config: derive ? join15(workspace, "config") : resolve9(workdir, env.KXM_CONFIG_DIR?.trim() || join15(workspace, "config")),
-    logs: derive ? join15(workspace, "logs") : resolve9(workdir, env.KXM_LOGS_DIR?.trim() || join15(workspace, "logs")),
-    assets: derive ? join15(workspace, "assets") : resolve9(workdir, env.KXM_ASSETS_DIR?.trim() || join15(workspace, "assets")),
-    state: derive ? join15(workspace, "state") : resolve9(workdir, env.KXM_STATE_DIR?.trim() || join15(workspace, "state"))
+    config: derive ? join15(workspace, "config") : resolve10(workdir, env.KXM_CONFIG_DIR?.trim() || join15(workspace, "config")),
+    logs: derive ? join15(workspace, "logs") : resolve10(workdir, env.KXM_LOGS_DIR?.trim() || join15(workspace, "logs")),
+    assets: derive ? join15(workspace, "assets") : resolve10(workdir, env.KXM_ASSETS_DIR?.trim() || join15(workspace, "assets")),
+    state: derive ? join15(workspace, "state") : resolve10(workdir, env.KXM_STATE_DIR?.trim() || join15(workspace, "state"))
   };
 }
 function maskEnvName(name) {
@@ -26442,20 +26478,20 @@ function workspaceEnv(runtime) {
 // plugins/kxm/src/cli/roles.ts
 var import_yaml8 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
-import { join as join18, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
+import { join as join18, resolve as resolve13 } from "node:path";
 import { createInterface } from "node:readline";
 
 // plugins/kxm/src/role.ts
 var import_yaml7 = __toESM(require_dist(), 1);
-import { existsSync as existsSync15, mkdirSync as mkdirSync12, readdirSync as readdirSync4, readFileSync as readFileSync15, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync12, readdirSync as readdirSync4, readFileSync as readFileSync15, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join17 } from "node:path";
 
 // plugins/kxm/src/config.ts
 var import_yaml6 = __toESM(require_dist(), 1);
-import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname11, join as join16, resolve as resolve10 } from "node:path";
+import { dirname as dirname11, join as join16, resolve as resolve11 } from "node:path";
 var KXM_CONFIG_SCHEMA = "kxm.config.v1";
 var DEFAULT_KXM_CONFIG = {
   schema: KXM_CONFIG_SCHEMA,
@@ -26508,11 +26544,11 @@ var DEFAULT_KXM_CONFIG = {
   }
 };
 function userConfigDirectory(overrideDir) {
-  if (overrideDir) return resolve10(overrideDir);
-  return resolve10(process.env.KXM_USER_CONFIG_DIR?.trim() || join16(homedir5(), ".config", "kxm"));
+  if (overrideDir) return resolve11(overrideDir);
+  return resolve11(process.env.KXM_USER_CONFIG_DIR?.trim() || join16(homedir5(), ".config", "kxm"));
 }
 function repoConfigDirectory(repoRoot) {
-  return resolve10(repoRoot, ".kxm");
+  return resolve11(repoRoot, ".kxm");
 }
 function deepMerge(target, source) {
   const result = { ...target };
@@ -26537,7 +26573,7 @@ function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   const repoConfigFile = join16(repoDir, "config.yaml");
   let userRaw = {};
   let userLoadedPath;
-  if (existsSync14(userConfigFile)) {
+  if (existsSync15(userConfigFile)) {
     try {
       const text = readFileSync14(userConfigFile, "utf8");
       userRaw = (0, import_yaml6.parse)(text) ?? {};
@@ -26548,7 +26584,7 @@ function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   }
   let repoRaw = {};
   let repoLoadedPath;
-  if (existsSync14(repoConfigFile)) {
+  if (existsSync15(repoConfigFile)) {
     try {
       const text = readFileSync14(repoConfigFile, "utf8");
       repoRaw = (0, import_yaml6.parse)(text) ?? {};
@@ -26597,7 +26633,7 @@ function configKeyParts(keyPath) {
 }
 function readConfigFile(targetFile2) {
   let existing = {};
-  if (existsSync14(targetFile2)) {
+  if (existsSync15(targetFile2)) {
     try {
       existing = (0, import_yaml6.parse)(readFileSync14(targetFile2, "utf8")) ?? {};
     } catch {
@@ -26623,7 +26659,8 @@ function setKxmConfigValue(repoRoot, keyPath, value, options = {}) {
     cursor2 = cursor2[p];
   }
   cursor2[parts[parts.length - 1]] = value;
-  writeConfigFile(targetFile2, existing);
+  if (!options.dryRun) writeConfigFile(targetFile2, existing);
+  return { file: targetFile2 };
 }
 function formatKxmConfig(config) {
   const display = {
@@ -26722,13 +26759,13 @@ function rolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
 }
 function ensureRolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = rolesDirectory(scope, repoRoot, userConfigDir);
-  if (!existsSync15(dir)) {
+  if (!existsSync16(dir)) {
     mkdirSync12(dir, { recursive: true });
   }
   return dir;
 }
 function parseRoleFile(filePath) {
-  if (!existsSync15(filePath)) return void 0;
+  if (!existsSync16(filePath)) return void 0;
   try {
     const raw = readFileSync15(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
@@ -26757,7 +26794,7 @@ function listRoles(options = {}) {
   const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
   const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
   const localRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync15(localDir)) {
+  if (scopeFilter !== "global" && existsSync16(localDir)) {
     for (const entry of readdirSync4(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
         const filePath = join17(localDir, entry);
@@ -26769,7 +26806,7 @@ function listRoles(options = {}) {
     }
   }
   const globalRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync15(globalDir)) {
+  if (scopeFilter !== "local" && existsSync16(globalDir)) {
     for (const entry of readdirSync4(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
         const filePath = join17(globalDir, entry);
@@ -26835,12 +26872,12 @@ function getRole(roleId, options = {}) {
 function addRole(role, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
-  const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
+  const dir = options.dryRun ? rolesDirectory(scope, repoRoot, options.userConfigDir) : ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
   const filePath = join17(dir, `${role.id}.yaml`);
-  if (existsSync15(filePath) && !options.overwrite) {
+  if (existsSync16(filePath) && !options.overwrite) {
     throw new Error(`role_already_exists: role '${role.id}' already exists at ${filePath}`);
   }
-  writeFileSync11(filePath, (0, import_yaml7.stringify)(role), "utf8");
+  if (!options.dryRun) writeFileSync11(filePath, (0, import_yaml7.stringify)(role), "utf8");
   return { id: role.id, filePath, scope };
 }
 function removeRole(roleId, options = {}) {
@@ -26848,9 +26885,10 @@ function removeRole(roleId, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = rolesDirectory(scope, repoRoot, options.userConfigDir);
   const filePath = join17(dir, `${roleId}.yaml`);
-  if (!existsSync15(filePath)) {
+  if (!existsSync16(filePath)) {
     throw new Error(`role_not_found: role '${roleId}' not found in ${scope} directory (${filePath})`);
   }
+  if (options.dryRun) return { id: roleId, removed: false, filePath, scope };
   rmSync5(filePath);
   return { id: roleId, removed: true, filePath, scope };
 }
@@ -26868,9 +26906,9 @@ function modifyRole(roleId, updates, options = {}) {
   };
   const scope = options.scope ?? target.scope;
   const repoRoot = options.repoRoot ?? process.cwd();
-  const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
+  const dir = options.dryRun ? rolesDirectory(scope, repoRoot, options.userConfigDir) : ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
   const filePath = join17(dir, `${roleId}.yaml`);
-  writeFileSync11(filePath, (0, import_yaml7.stringify)(updated), "utf8");
+  if (!options.dryRun) writeFileSync11(filePath, (0, import_yaml7.stringify)(updated), "utf8");
   return { id: roleId, role: updated, filePath, scope };
 }
 var KXM_ROLE_HOSTS_SCHEMA = "kxm.role-hosts.v1";
@@ -26921,13 +26959,13 @@ function findExistingRoleHostsFile(scope, repoRoot = process.cwd(), userConfigDi
   const yamlPath = join17(dir, "role-hosts.yaml");
   const ymlPath = join17(dir, "role-hosts.yml");
   const jsonPath = join17(dir, "role-hosts.json");
-  if (existsSync15(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
-  if (existsSync15(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
-  if (existsSync15(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
+  if (existsSync16(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
+  if (existsSync16(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
+  if (existsSync16(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
   return { filePath: yamlPath, exists: false, format: "yaml" };
 }
 function parseRoleHostsFile(filePath) {
-  if (!existsSync15(filePath)) return void 0;
+  if (!existsSync16(filePath)) return void 0;
   try {
     const raw = readFileSync15(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
@@ -27001,11 +27039,12 @@ function saveRoleHostsConfig(config, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot);
-  if (!existsSync15(dir)) {
-    mkdirSync12(dir, { recursive: true });
-  }
   const format = options.format ?? "yaml";
   const filePath = join17(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
+  if (options.dryRun) return { filePath, scope };
+  if (!existsSync16(dir)) {
+    mkdirSync12(dir, { recursive: true });
+  }
   const payload = {
     schema: KXM_ROLE_HOSTS_SCHEMA,
     seats: config.seats ?? {},
@@ -27040,7 +27079,8 @@ function setRoleSeatHost(seatId, host, options = {}) {
     scope,
     repoRoot: options.repoRoot,
     userConfigDir: options.userConfigDir,
-    format: options.format
+    format: options.format,
+    dryRun: options.dryRun
   });
   return { filePath: saved.filePath, seatId, binding, scope };
 }
@@ -27226,8 +27266,13 @@ async function cmdRoleAdd(runtime, roleId, options) {
             scope,
             repoRoot: runtime.cwd,
             userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
-            overwrite: options.overwrite
+            overwrite: options.overwrite,
+            dryRun: runtime.dryRun
           });
+          if (runtime.dryRun) {
+            printPlan(runtime, { command: "role add", roleId, ...res }, [{ action: "write", target: res.filePath }], `add role '${roleId}' to ${res.scope}`);
+            return 0;
+          }
           print(
             runtime.io,
             runtime.json,
@@ -27246,7 +27291,7 @@ async function cmdRoleAdd(runtime, roleId, options) {
   }
   let roleDef;
   if (options.file) {
-    const filePath = resolve12(runtime.cwd, options.file);
+    const filePath = resolve13(runtime.cwd, options.file);
     const content = readFileSync16(filePath, "utf8");
     roleDef = (0, import_yaml8.parse)(content);
     roleDef.id = roleId;
@@ -27266,8 +27311,13 @@ async function cmdRoleAdd(runtime, roleId, options) {
       scope,
       repoRoot: runtime.cwd,
       userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
-      overwrite: options.overwrite
+      overwrite: options.overwrite,
+      dryRun: runtime.dryRun
     });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "role add", roleId, ...res }, [{ action: "write", target: res.filePath }], `add role '${roleId}' to ${res.scope}`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -27314,8 +27364,13 @@ async function cmdRoleRemove(runtime, roleId, options) {
     const res = removeRole(roleId, {
       scope,
       repoRoot: runtime.cwd,
-      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR
+      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
+      dryRun: runtime.dryRun
     });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "role remove", roleId, ...res }, [{ action: "delete", target: res.filePath }], `remove role '${roleId}' from ${res.scope}`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -27393,8 +27448,13 @@ async function cmdRoleModify(runtime, roleId, options) {
     const res = modifyRole(roleId, updates, {
       scope: options.scope,
       repoRoot: runtime.cwd,
-      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR
+      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
+      dryRun: runtime.dryRun
     });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "role modify", roleId, ...res }, [{ action: "write", target: res.filePath }], `modify role '${roleId}' in ${res.scope}`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -27482,8 +27542,18 @@ async function cmdRoleSetHost(runtime, seatId, host, options = {}) {
       effort: options.effort,
       scope: options.scope ?? "local",
       repoRoot: runtime.cwd,
-      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR
+      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
+      dryRun: runtime.dryRun
     });
+    if (runtime.dryRun) {
+      printPlan(
+        runtime,
+        { command: "role set-host", seatId, host, binding: result.binding, filePath: result.filePath, scope: result.scope },
+        [{ action: "write", target: result.filePath }],
+        `bind seat '${seatId}' to host '${host}'`
+      );
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -27515,7 +27585,12 @@ async function cmdRoleResume(runtime, runId, ruling) {
   const projectRoot = discoverKxmProjectRoot(runtime.cwd);
   if (projectRoot && /^run_[a-f0-9]{32}$/i.test(runId)) {
     if (runtime.dryRun) {
-      print(runtime.io, runtime.json, { ok: true, command: "role resume", runId, ruling: effectiveRuling }, `would resume KXM run ${runId}`);
+      printPlan(
+        runtime,
+        { command: "role resume", runId, ruling: effectiveRuling },
+        [{ action: "request", target: `POST kxm-runtime /v1/runs/${runId}/signal (audit_escalation unblock)` }],
+        `resume KXM run ${runId}`
+      );
       return 0;
     }
     try {
@@ -27547,9 +27622,9 @@ async function cmdRoleResume(runtime, runId, ruling) {
     }
   }
   const dbPath = join18(runtime.cwd, ".kxm", "state", "kxm.db");
-  if (existsSync16(dbPath)) {
+  if (existsSync17(dbPath)) {
     try {
-      const database = new DatabaseSync(dbPath);
+      const database = runtime.dryRun ? openReadOnlyDatabase(dbPath) : new DatabaseSync(dbPath);
       try {
         const row = database.prepare("SELECT record FROM workflow_runs WHERE id = ?").get(runId);
         if (!row) {
@@ -27560,6 +27635,15 @@ async function cmdRoleResume(runtime, runId, ruling) {
         const run = JSON.parse(row.record);
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const resumeResult = resumeWorkflowFromRuling(run, effectiveRuling, now);
+        if (runtime.dryRun) {
+          printPlan(
+            runtime,
+            { command: "role resume", runId, stageId: resumeResult.stageId, ruling: effectiveRuling, status: resumeResult.run.status },
+            [{ action: "write", target: `${dbPath} (workflow_runs ${runId}, one workflow_journal decision)` }],
+            `resume workflow run ${runId} (stage: ${resumeResult.stageId})`
+          );
+          return 0;
+        }
         database.prepare("UPDATE workflow_runs SET record = ? WHERE id = ?").run(
           JSON.stringify(resumeResult.run),
           runId
@@ -27609,12 +27693,12 @@ async function cmdRoleResume(runtime, runId, ruling) {
 
 // plugins/kxm/src/cli/workflows.ts
 import { createHmac as createHmac3, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
-import { join as join20, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync18 } from "node:fs";
+import { join as join20, resolve as resolve16 } from "node:path";
 
 // plugins/kxm/src/retrospective.ts
 import { mkdirSync as mkdirSync13, renameSync as renameSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 var MAX_RETROSPECTIVE_ENTRIES = 500;
 var SAFE_RUN_ID = /^run_[A-Za-z0-9_-]{1,120}$/;
 function durationMs(startedAt, completedAt) {
@@ -27827,9 +27911,9 @@ function renderRetrospectiveMarkdown(doc) {
 function writeRetrospective(outDir, doc) {
   if (!SAFE_RUN_ID.test(doc.runId)) throw new Error("invalid retrospective run id");
   mkdirSync13(outDir, { recursive: true });
-  const root = resolve13(outDir);
-  const jsonPath = resolve13(root, `${doc.runId}.json`);
-  const mdPath = resolve13(root, `${doc.runId}.md`);
+  const root = resolve14(outDir);
+  const jsonPath = resolve14(root, `${doc.runId}.json`);
+  const mdPath = resolve14(root, `${doc.runId}.md`);
   const prefix = `${root}${process.platform === "win32" ? "\\" : "/"}`;
   if (!jsonPath.startsWith(prefix) || !mdPath.startsWith(prefix)) throw new Error("retrospective path escaped output directory");
   const jsonTmp = `${jsonPath}.tmp`;
@@ -27929,7 +28013,7 @@ async function watchGithubChecks(input) {
   }
   const fetchImpl = input.fetchImpl ?? fetch;
   const now = input.now ?? Date.now;
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve30) => setTimeout(resolve30, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve32) => setTimeout(resolve32, ms)));
   const deadline = now() + input.timeoutMs;
   const headers = {
     authorization: `Bearer ${token}`,
@@ -28028,7 +28112,7 @@ async function watchGithubChecks(input) {
 
 // plugins/kxm/src/workflow-manager.ts
 var import_yaml9 = __toESM(require_dist(), 1);
-import { existsSync as existsSync17, mkdirSync as mkdirSync14, readdirSync as readdirSync5, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync14, readdirSync as readdirSync5, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join19 } from "node:path";
 var WORKFLOW_TEMPLATES = {
   "implement-and-verify": {
@@ -28186,13 +28270,13 @@ function workflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
 }
 function ensureWorkflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = workflowsDirectory(scope, repoRoot, userConfigDir);
-  if (!existsSync17(dir)) {
+  if (!existsSync18(dir)) {
     mkdirSync14(dir, { recursive: true });
   }
   return dir;
 }
 function parseWorkflowFile(filePath) {
-  if (!existsSync17(filePath)) return void 0;
+  if (!existsSync18(filePath)) return void 0;
   try {
     const raw = readFileSync17(filePath, "utf8");
     const parsed = (0, import_yaml9.parse)(raw);
@@ -28208,7 +28292,7 @@ function listWorkflowDefinitions(options = {}) {
   const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
   const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
   const localDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync17(localDir)) {
+  if (scopeFilter !== "global" && existsSync18(localDir)) {
     for (const entry of readdirSync5(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
         const filePath = join19(localDir, entry);
@@ -28221,7 +28305,7 @@ function listWorkflowDefinitions(options = {}) {
     }
   }
   const globalDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync17(globalDir)) {
+  if (scopeFilter !== "local" && existsSync18(globalDir)) {
     for (const entry of readdirSync5(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
         const filePath = join19(globalDir, entry);
@@ -28295,13 +28379,13 @@ function getWorkflowDefinition(workflowId, options = {}) {
 function addWorkflowDefinition(workflowId, content = DEFAULT_WORKFLOW_TEMPLATE, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
-  const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const dir = options.dryRun ? workflowsDirectory(scope, repoRoot, options.userConfigDir) : ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
   const filePath = join19(dir, `${workflowId}.yaml`);
-  if (existsSync17(filePath) && !options.overwrite) {
+  if (existsSync18(filePath) && !options.overwrite) {
     throw new Error(`workflow_already_exists: workflow '${workflowId}' already exists at ${filePath}`);
   }
   const payload = typeof content === "string" ? content : (0, import_yaml9.stringify)(content);
-  writeFileSync13(filePath, payload, "utf8");
+  if (!options.dryRun) writeFileSync13(filePath, payload, "utf8");
   return { id: workflowId, filePath, scope };
 }
 function removeWorkflowDefinition(workflowId, options = {}) {
@@ -28309,9 +28393,10 @@ function removeWorkflowDefinition(workflowId, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = workflowsDirectory(scope, repoRoot, options.userConfigDir);
   const filePath = join19(dir, `${workflowId}.yaml`);
-  if (!existsSync17(filePath)) {
+  if (!existsSync18(filePath)) {
     throw new Error(`workflow_not_found: workflow '${workflowId}' not found in ${scope} directory (${filePath})`);
   }
+  if (options.dryRun) return { id: workflowId, removed: false, filePath, scope };
   rmSync6(filePath);
   return { id: workflowId, removed: true, filePath, scope };
 }
@@ -28326,17 +28411,17 @@ function modifyWorkflowDefinition(workflowId, updates, options = {}) {
   };
   const scope = options.scope ?? target.scope;
   const repoRoot = options.repoRoot ?? process.cwd();
-  const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const dir = options.dryRun ? workflowsDirectory(scope, repoRoot, options.userConfigDir) : ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
   const filePath = join19(dir, `${workflowId}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml9.stringify)(updated), "utf8");
+  if (!options.dryRun) writeFileSync13(filePath, (0, import_yaml9.stringify)(updated), "utf8");
   return { id: workflowId, workflow: updated, filePath, scope };
 }
 
 // plugins/kxm/src/cli/workflows.ts
 var CLI_NAME = "kxm";
 function localWorkflowSnapshot(dataPath, runId) {
-  if (!existsSync18(dataPath)) throw new Error("state_database_not_found");
-  const database = new DatabaseSync(dataPath, { readOnly: true });
+  if (!existsSync19(dataPath)) throw new Error("state_database_not_found");
+  const database = openReadOnlyDatabase(dataPath);
   try {
     const rows = runId ? database.prepare("SELECT record FROM workflow_runs WHERE id = ?").all(runId) : database.prepare("SELECT record FROM workflow_runs ORDER BY rowid DESC LIMIT 200").all();
     const runs = rows.map((row) => JSON.parse(row.record));
@@ -28412,7 +28497,7 @@ function activeWorkflowDefinition(runtime, definitionId) {
   let raw;
   if (file) {
     try {
-      raw = readFileSync18(resolve15(runtime.cwd, file), "utf8");
+      raw = readFileSync18(resolve16(runtime.cwd, file), "utf8");
     } catch {
       throw new Error("workflow definition file is unavailable");
     }
@@ -28493,7 +28578,7 @@ async function cmdWorkflowAdd(runtime, workflowId, options) {
     }
   }
   if (options.file) {
-    const filePath = resolve15(runtime.cwd, options.file);
+    const filePath = resolve16(runtime.cwd, options.file);
     content = readFileSync18(filePath, "utf8");
   } else if (!content) {
     content = {
@@ -28517,8 +28602,13 @@ async function cmdWorkflowAdd(runtime, workflowId, options) {
       scope,
       repoRoot: runtime.cwd,
       userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
-      overwrite: options.overwrite
+      overwrite: options.overwrite,
+      dryRun: runtime.dryRun
     });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "workflow add", workflowId, ...res }, [{ action: "write", target: res.filePath }], `add workflow '${workflowId}' to ${res.scope}`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -28565,8 +28655,13 @@ async function cmdWorkflowRemove(runtime, workflowId, options) {
     const res = removeWorkflowDefinition(workflowId, {
       scope,
       repoRoot: runtime.cwd,
-      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR
+      userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
+      dryRun: runtime.dryRun
     });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "workflow remove", workflowId, ...res }, [{ action: "delete", target: res.filePath }], `remove workflow '${workflowId}' from ${res.scope}`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -28614,9 +28709,14 @@ async function cmdWorkflowModify(runtime, workflowId, options) {
       {
         scope: options.scope,
         repoRoot: runtime.cwd,
-        userConfigDir: runtime.env.KXM_USER_CONFIG_DIR
+        userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
+        dryRun: runtime.dryRun
       }
     );
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "workflow modify", workflowId, ...res }, [{ action: "write", target: res.filePath }], `modify workflow '${workflowId}' in ${res.scope}`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -28652,7 +28752,7 @@ async function cmdWorkflowStart(runtime, definitionIdArg, options) {
   }
   let payload;
   try {
-    const raw = payloadFlag.startsWith("@") ? readFileSync18(resolve15(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
+    const raw = payloadFlag.startsWith("@") ? readFileSync18(resolve16(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
     const value = JSON.parse(raw);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("object required");
     payload = value;
@@ -28719,7 +28819,7 @@ async function cmdWorkflowDegrade(runtime, runId, stageId, options) {
   }
 }
 async function cmdWorkflowInspect(runtime, action, runId) {
-  const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve16(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
   if (action === "get" && !runId) {
     runtime.io.stderr(`Usage: ${CLI_NAME} workflow get <runId>
 `);
@@ -28761,7 +28861,7 @@ async function cmdSignal(runtime, runId, signalKey, status, summary, evidenceArg
   const projectRoot = discoverKxmProjectRoot(runtime.cwd);
   if (projectRoot && /^run_[a-f0-9]{32}$/i.test(runId)) {
     if (runtime.dryRun) {
-      printWorker(runtime, worker, { ok: true, command: "signal", runId, signalKey, status, summary, evidence }, "would post signal to KXM run");
+      printWorker(runtime, worker, { ok: true, command: "signal", dryRun: true, runId, signalKey, status, summary, evidence }, "would post signal to KXM run");
       return 0;
     }
     const deliveryId2 = String(deliveryIdFlag || `cli-signal:${randomUUID7()}`);
@@ -28797,7 +28897,7 @@ async function cmdSignal(runtime, runId, signalKey, status, summary, evidenceArg
     return 2;
   }
   if (runtime.dryRun) {
-    printWorker(runtime, worker, { ok: true, command: "signal", runId, signalKey, status, summary, evidence }, "would post signed signal");
+    printWorker(runtime, worker, { ok: true, command: "signal", dryRun: true, runId, signalKey, status, summary, evidence }, "would post signed signal");
     return 0;
   }
   const deliveryId = String(deliveryIdFlag || `cli-signal:${randomUUID7()}`);
@@ -28888,14 +28988,14 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 2;
   }
   const snapshotFlag = String(options.input || "");
-  const snapshotPath = snapshotFlag ? resolve15(runtime.cwd, snapshotFlag) : "";
+  const snapshotPath = snapshotFlag ? resolve16(runtime.cwd, snapshotFlag) : "";
   let snapshot;
   try {
     if (snapshotPath) {
-      if (!existsSync18(snapshotPath)) throw new Error("snapshot_missing");
+      if (!existsSync19(snapshotPath)) throw new Error("snapshot_missing");
       snapshot = JSON.parse(readFileSync18(snapshotPath, "utf8"));
     } else {
-      const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
+      const dataPath = resolve16(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
       const local = localWorkflowSnapshot(dataPath, runId);
       if (!local.runs[0]) throw new Error("workflow_not_found");
       snapshot = { run: local.runs[0], journal: local.journal };
@@ -28907,8 +29007,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 1;
   }
   const doc = buildRetrospective(snapshot.run, snapshot.journal);
-  const outDir = resolve15(runtime.cwd, String(options.outDir || join20(runtime.dirs.assets, "retrospectives")));
-  const assetsRoot = resolve15(runtime.dirs.assets);
+  const outDir = resolve16(runtime.cwd, String(options.outDir || join20(runtime.dirs.assets, "retrospectives")));
+  const assetsRoot = resolve16(runtime.dirs.assets);
   const assetsPrefix = `${assetsRoot}${process.platform === "win32" ? "\\" : "/"}`;
   if (outDir !== assetsRoot && !outDir.startsWith(assetsPrefix)) {
     print(runtime.io, runtime.json, { ok: false, command: "retrospective export", error: "output_outside_workspace_assets" }, "retrospectives must stay under the workspace assets directory");
@@ -28925,8 +29025,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
 
 // plugins/kxm/src/cli/tasks.ts
 var import_yaml12 = __toESM(require_dist(), 1);
-import { existsSync as existsSync23, readFileSync as readFileSync22, readdirSync as readdirSync8 } from "node:fs";
-import { basename as basename6, join as join27, resolve as resolve20 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync23, readdirSync as readdirSync8 } from "node:fs";
+import { basename as basename6, join as join27, resolve as resolve21 } from "node:path";
 
 // plugins/kxm/src/suggest.ts
 var WORKFLOW_PATTERNS = [
@@ -29037,19 +29137,23 @@ function suggestWorkflowAndRoles(prompt, options = {}) {
 // plugins/kxm/src/task-manager.ts
 var import_yaml10 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync15, readFileSync as readFileSync19, readdirSync as readdirSync6, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join21, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync19, readdirSync as readdirSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join21, resolve as resolve17 } from "node:path";
 var GOAL_SCHEMA = "kxm.goal.v1";
 var TASK_SCHEMA = "kxm.task.v1";
 function goalsDirectory(repoRoot) {
-  return resolve16(repoRoot, ".kxm", "goals");
+  return resolve17(repoRoot, ".kxm", "goals");
 }
 function tasksDirectory(repoRoot) {
-  return resolve16(repoRoot, ".kxm", "tasks");
+  return resolve17(repoRoot, ".kxm", "tasks");
 }
-function createGoal(repoRoot, input) {
-  const dir = goalsDirectory(repoRoot);
-  mkdirSync15(dir, { recursive: true });
+function goalFilePath(repoRoot, goalId) {
+  return join21(goalsDirectory(repoRoot), `${goalId}.yaml`);
+}
+function taskFilePath(repoRoot, taskId) {
+  return join21(tasksDirectory(repoRoot), `${taskId}.yaml`);
+}
+function createGoal(repoRoot, input, options = {}) {
   const id = `goal_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
@@ -29063,13 +29167,14 @@ function createGoal(repoRoot, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join21(dir, `${id}.yaml`);
-  writeFileSync14(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
+  if (options.dryRun) return record;
+  mkdirSync15(goalsDirectory(repoRoot), { recursive: true });
+  writeFileSync14(goalFilePath(repoRoot, id), (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
 function listGoals(repoRoot) {
   const dir = goalsDirectory(repoRoot);
-  if (!existsSync19(dir)) return [];
+  if (!existsSync20(dir)) return [];
   const goals = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
@@ -29084,9 +29189,7 @@ function listGoals(repoRoot) {
   }
   return goals.sort((a, b2) => a.createdAt.localeCompare(b2.createdAt));
 }
-function createTask(repoRoot, input) {
-  const dir = tasksDirectory(repoRoot);
-  mkdirSync15(dir, { recursive: true });
+function createTask(repoRoot, input, options = {}) {
   const id = `task_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
@@ -29108,13 +29211,14 @@ function createTask(repoRoot, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join21(dir, `${id}.yaml`);
-  writeFileSync14(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
+  if (options.dryRun) return record;
+  mkdirSync15(tasksDirectory(repoRoot), { recursive: true });
+  writeFileSync14(taskFilePath(repoRoot, id), (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
 function listTasks(repoRoot, options = {}) {
   const dir = tasksDirectory(repoRoot);
-  if (!existsSync19(dir)) return [];
+  if (!existsSync20(dir)) return [];
   const tasks = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
@@ -29136,7 +29240,7 @@ function listTasks(repoRoot, options = {}) {
 function getTask(repoRoot, taskId) {
   const dir = tasksDirectory(repoRoot);
   const filePath = join21(dir, `${taskId}.yaml`);
-  if (!existsSync19(filePath)) return void 0;
+  if (!existsSync20(filePath)) return void 0;
   try {
     const text = readFileSync19(filePath, "utf8");
     const doc = (0, import_yaml10.parse)(text);
@@ -29153,8 +29257,7 @@ function updateTaskStatus(repoRoot, taskId, status, options = {}) {
   task.status = status;
   if (options.workflowRunId) task.workflowRunId = options.workflowRunId;
   task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const filePath = join21(tasksDirectory(repoRoot), `${taskId}.yaml`);
-  writeFileSync14(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
+  if (!options.dryRun) writeFileSync14(taskFilePath(repoRoot, taskId), (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
 function syncTaskWithTracker(repoRoot, taskId, options = {}) {
@@ -29169,8 +29272,7 @@ function syncTaskWithTracker(repoRoot, taskId, options = {}) {
   task.trackerSync.syncStatus = "synced";
   task.trackerSync.lastSyncedAt = now;
   task.updatedAt = now;
-  const filePath = join21(tasksDirectory(repoRoot), `${taskId}.yaml`);
-  writeFileSync14(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
+  if (!options.dryRun) writeFileSync14(taskFilePath(repoRoot, taskId), (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
 
@@ -29936,7 +30038,8 @@ function createStudioServer(options = {}) {
 }
 
 // plugins/kxm/src/cli/project.ts
-import { join as join26, resolve as resolve19 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { join as join26, resolve as resolve20 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 
 // plugins/kxm/src/model-inventory.ts
@@ -30035,7 +30138,7 @@ async function refreshModelInventory(options) {
 
 // plugins/kxm/src/init.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
-import { existsSync as existsSync22 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 import { basename as basename5, join as join25 } from "node:path";
 
 // plugins/kxm/src/repair.ts
@@ -30043,7 +30146,7 @@ import { randomUUID as randomUUID10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   closeSync as closeSync2,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync as lstatSync7,
@@ -30055,14 +30158,14 @@ import {
   rmSync as rmSync8,
   writeFileSync as writeFileSync17
 } from "node:fs";
-import { dirname as dirname15, isAbsolute as isAbsolute7, join as join24, relative as relative4, resolve as resolve18 } from "node:path";
+import { dirname as dirname15, isAbsolute as isAbsolute7, join as join24, relative as relative4, resolve as resolve19 } from "node:path";
 
 // plugins/kxm/src/permission.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash13 } from "node:crypto";
-import { existsSync as existsSync20, mkdtempSync, mkdirSync as mkdirSync17, readFileSync as readFileSync20, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync21, mkdtempSync, mkdirSync as mkdirSync17, readFileSync as readFileSync20, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname14, join as join23, resolve as resolve17, sep as sep3 } from "node:path";
+import { dirname as dirname14, join as join23, resolve as resolve18, sep as sep3 } from "node:path";
 var PROSE_FIELDS = {
   project: /* @__PURE__ */ new Set(["name", "description"]),
   repository: /* @__PURE__ */ new Set(["description"]),
@@ -30584,7 +30687,7 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
   const listing = gitBuffer(root, ["ls-tree", "-r", "-z", "--name-only", tree]).toString("utf8");
   const paths = listing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
   const shadow = mkdtempSync(join23(tmpdir(), "kxm-permission-base-"));
-  const shadowResolved = resolve17(shadow);
+  const shadowResolved = resolve18(shadow);
   const shadowMembersDir = `.kxm-shadow-members-${createHash13("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
   try {
     for (const path4 of paths) {
@@ -30598,7 +30701,7 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const absolute = join23(shadowResolved, ...segments);
-      const resolved = resolve17(absolute);
+      const resolved = resolve18(absolute);
       if (!resolved.startsWith(`${shadowResolved}${sep3}`)) {
         throw new KxmConfigError([{
           phase: "path",
@@ -30642,8 +30745,8 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const boundPath = options.repositoryBindings?.[member.repositoryId];
-      const memberWorktree = boundPath ? resolve17(boundPath) : member.pathHint ? resolve17(root, ...member.pathHint.split("/")) : void 0;
-      if (!memberWorktree || !existsSync20(memberWorktree)) {
+      const memberWorktree = boundPath ? resolve18(boundPath) : member.pathHint ? resolve18(root, ...member.pathHint.split("/")) : void 0;
+      if (!memberWorktree || !existsSync21(memberWorktree)) {
         if (member.required === false) continue;
         throw new KxmConfigError([{
           phase: "discovery",
@@ -30691,7 +30794,7 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
       const memberListing = gitBuffer(memberWorktree, ["ls-tree", "-r", "-z", "--name-only", memberTree]).toString("utf8");
       const memberPaths = memberListing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
       const memberShadowRoot = join23(shadowResolved, shadowMembersDir, member.repositoryId);
-      if (!resolve17(memberShadowRoot).startsWith(`${resolve17(shadowResolved, shadowMembersDir)}${sep3}`)) {
+      if (!resolve18(memberShadowRoot).startsWith(`${resolve18(shadowResolved, shadowMembersDir)}${sep3}`)) {
         throw new KxmConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
@@ -30705,8 +30808,8 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
           throw new KxmConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry contains a traversal or non-portable segment" }]);
         }
         const absolute = join23(memberShadowRoot, ...segments);
-        const resolved = resolve17(absolute);
-        if (!resolved.startsWith(`${resolve17(memberShadowRoot)}${sep3}`)) {
+        const resolved = resolve18(absolute);
+        if (!resolved.startsWith(`${resolve18(memberShadowRoot)}${sep3}`)) {
           throw new KxmConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry escapes the shadow root" }]);
         }
         const content = gitBuffer(memberWorktree, ["cat-file", "blob", `${memberTree}:${path4}`]);
@@ -30732,7 +30835,7 @@ function portableMemberPathHint(pathHint) {
   return pathHint !== "." && kxmPortablePath(pathHint);
 }
 function loadBaseProjectDeclarations(projectFile) {
-  if (!existsSync20(projectFile)) return [];
+  if (!existsSync21(projectFile)) return [];
   const value = parseRestrictedYaml2(readFileSync20(projectFile, "utf8"), ".kxm/project.yaml");
   const repositories = Array.isArray(value?.repositories) ? value.repositories : [];
   const members = [];
@@ -30856,12 +30959,12 @@ function writeDurable(file, bytes, mode) {
   syncDirectory2(dirname15(file));
 }
 function sameHostPath3(left, right) {
-  const first = resolve18(left);
-  const second = resolve18(right);
+  const first = resolve19(left);
+  const second = resolve19(right);
   return process.platform === "win32" ? first.toLocaleLowerCase("en-US") === second.toLocaleLowerCase("en-US") : first === second;
 }
 function transactionRoot(projectRoot) {
-  return join24(resolve18(projectRoot), TRANSACTION_NAME);
+  return join24(resolve19(projectRoot), TRANSACTION_NAME);
 }
 function operationFile(projectRoot) {
   return join24(transactionRoot(projectRoot), OPERATION_FILE);
@@ -30886,9 +30989,9 @@ function readRegularBounded(file, label) {
 }
 function readOptionalManaged(projectRoot, path4) {
   const file = join24(projectRoot, ...path4.split("/"));
-  if (!existsSync21(file)) return void 0;
+  if (!existsSync22(file)) return void 0;
   let parent = dirname15(file);
-  const boundary = resolve18(projectRoot);
+  const boundary = resolve19(projectRoot);
   while (parent !== boundary) {
     const stat = lstatSync7(parent);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_parent_invalid", path4, "managed file parents must be regular directories", "path");
@@ -30899,7 +31002,7 @@ function readOptionalManaged(projectRoot, path4) {
 function readProjectAndProvenance(projectRoot, schemasDir) {
   const projectFile = join24(projectRoot, ".kxm", "project.yaml");
   const provenanceFile = join24(projectRoot, ...KXM_TEMPLATE_PROVENANCE_PATH.split("/"));
-  if (!existsSync21(projectFile) || !existsSync21(provenanceFile)) return void 0;
+  if (!existsSync22(projectFile) || !existsSync22(provenanceFile)) return void 0;
   const projectBytes = readOptionalManaged(projectRoot, ".kxm/project.yaml");
   const provenanceBytes = readOptionalManaged(projectRoot, KXM_TEMPLATE_PROVENANCE_PATH);
   if (!projectBytes || !provenanceBytes) return void 0;
@@ -30935,7 +31038,7 @@ function readProjectAndProvenance(projectRoot, schemasDir) {
 }
 function planKxmTemplateRepair(projectRoot, options = {}) {
   assertNoRegisteredGates(options);
-  const root = resolve18(projectRoot);
+  const root = resolve19(projectRoot);
   const source = readProjectAndProvenance(root, options.schemasDir);
   if (!source) return void 0;
   const target = renderKxmTemplate(
@@ -31080,11 +31183,11 @@ function updatePhase(projectRoot, operation, phase) {
 }
 function readOperation(projectRoot, schemasDir) {
   const root = transactionRoot(projectRoot);
-  if (!existsSync21(root)) return void 0;
+  if (!existsSync22(root)) return void 0;
   const stat = lstatSync7(root);
   if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("init_transaction_invalid", TRANSACTION_NAME, "initialization transaction must be a regular directory", "path");
   const file = operationFile(projectRoot);
-  if (!existsSync21(file)) {
+  if (!existsSync22(file)) {
     const entries = readdirSync7(root, { withFileTypes: true });
     const recoverable = entries.every((entry) => entry.isFile() && /^\.operation-op_[a-f0-9]{32}-[a-f0-9-]{36}\.tmp$/.test(entry.name));
     if (recoverable) return void 0;
@@ -31112,7 +31215,7 @@ function readOperation(projectRoot, schemasDir) {
   return operation;
 }
 function hasKxmInitTransaction(projectRoot) {
-  return existsSync21(transactionRoot(projectRoot));
+  return existsSync22(transactionRoot(projectRoot));
 }
 function readTarget(projectRoot, path4) {
   return readOptionalManaged(join24(transactionRoot(projectRoot), "targets"), path4);
@@ -31189,10 +31292,10 @@ function sourceConfigFiles(projectRoot) {
     ".kxm/repo/repo.yaml",
     ".kxm/repo/env.yaml"
   ];
-  const files = fixed.filter((path4) => existsSync21(join24(projectRoot, ...path4.split("/"))));
+  const files = fixed.filter((path4) => existsSync22(join24(projectRoot, ...path4.split("/"))));
   for (const directory of ["agents", "models", "workflows"]) {
     const absolute = join24(projectRoot, ".kxm", directory);
-    if (!existsSync21(absolute)) continue;
+    if (!existsSync22(absolute)) continue;
     const stat = lstatSync7(absolute);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_directory_invalid", `.kxm/${directory}`, "configuration directory must be regular", "path");
     for (const entry of readdirSync7(absolute, { withFileTypes: true })) {
@@ -31213,8 +31316,8 @@ function absoluteMemberBindings(projectRoot, project, explicit = {}) {
     const repository = candidate;
     if (repository.role !== "member" || typeof repository.id !== "string" || Object.hasOwn(bindings, repository.id)) continue;
     if (typeof repository.pathHint === "string") {
-      const candidate2 = resolve18(projectRoot, ...repository.pathHint.split("/"));
-      if (existsSync21(candidate2)) bindings[repository.id] = candidate2;
+      const candidate2 = resolve19(projectRoot, ...repository.pathHint.split("/"));
+      if (existsSync22(candidate2)) bindings[repository.id] = candidate2;
     }
   }
   return bindings;
@@ -31240,7 +31343,7 @@ function prepareShadow(projectRoot, operation, options) {
     if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
     const destination = join24(shadow, ...entry.path.split("/"));
     mkdirSync18(dirname15(destination), { recursive: true, mode: 448 });
-    const mode = existsSync21(destination) ? lstatSync7(destination).mode & 511 : 420;
+    const mode = existsSync22(destination) ? lstatSync7(destination).mode & 511 : 420;
     writeDurable(destination, bytes, mode);
   }
   const project = parseRestrictedYaml2(readFileSync21(join24(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
@@ -31252,7 +31355,7 @@ function prepareShadow(projectRoot, operation, options) {
   }
 }
 function createOperation(projectRoot, kind, rendered, files, sourceTemplateRevision) {
-  const root = resolve18(projectRoot);
+  const root = resolve19(projectRoot);
   const operationWithoutHash = {
     schema: "kxm.init-operation.v1",
     operationId: `op_${randomUUID10().replaceAll("-", "")}`,
@@ -31281,7 +31384,7 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   const transaction = transactionRoot(projectRoot);
   validateOperationRecord(operation, options.schemasDir);
   validateOperationIntent(projectRoot, operation);
-  if (existsSync21(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
+  if (existsSync22(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
   mkdirSync18(transaction, { mode: 448 });
   syncDirectory2(projectRoot);
   writeOperation(projectRoot, operation);
@@ -31303,19 +31406,19 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   }
 }
 function ensureDestinationParents(projectRoot, path4) {
-  const boundary = resolve18(projectRoot);
+  const boundary = resolve19(projectRoot);
   const segments = path4.split("/").slice(0, -1);
   let current = boundary;
   for (const segment of segments) {
     current = join24(current, segment);
-    if (!existsSync21(current)) mkdirSync18(current, { mode: 448 });
+    if (!existsSync22(current)) mkdirSync18(current, { mode: 448 });
     const stat = lstatSync7(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_destination_parent_invalid", path4, "destination parent must be a regular directory", "path");
   }
 }
 function destinationSha(projectRoot, path4) {
   const file = join24(projectRoot, ...path4.split("/"));
-  if (!existsSync21(file)) return void 0;
+  if (!existsSync22(file)) return void 0;
   return kxmContentSha256(readRegularBounded(file, path4));
 }
 function requireConditionalLinkSupport(directory, operationId, path4) {
@@ -31342,13 +31445,13 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   const temporaryPrefix = `.kxm-repair-${operation.operationId}-`;
   const pathKey = kxmContentSha256(entry.path).slice("sha256:".length, "sha256:".length + 16);
   const displaced = join24(directory, `${temporaryPrefix}${pathKey}.preimage`);
-  if (existsSync21(displaced)) {
+  if (existsSync22(displaced)) {
     const stat = lstatSync7(displaced);
     if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_preimage_temporary_invalid", entry.path, "stale displaced preimage is not a regular file", "path");
     if (entry.observedSha256 === null || kxmContentSha256(readFileSync21(displaced)) !== entry.observedSha256) {
       fail3("repair_preimage_temporary_mismatch", entry.path, "stale displaced preimage does not match the pinned operation");
     }
-    if (!existsSync21(destination)) {
+    if (!existsSync22(destination)) {
       try {
         linkSync(displaced, destination);
       } catch {
@@ -31374,14 +31477,14 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   const bytes = readTarget(projectRoot, entry.path);
   if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
   const temporary = join24(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
-  const mode = existsSync21(destination) ? lstatSync7(destination).mode & 511 : 420;
+  const mode = existsSync22(destination) ? lstatSync7(destination).mode & 511 : 420;
   try {
     writeDurableNew(temporary, bytes, mode);
     if (entry.observedSha256 !== null) {
       renameSync6(destination, displaced);
       syncDirectory2(directory);
       if (kxmContentSha256(readFileSync21(displaced)) !== entry.observedSha256) {
-        if (!existsSync21(destination)) {
+        if (!existsSync22(destination)) {
           try {
             linkSync(displaced, destination);
           } catch {
@@ -31397,7 +31500,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     try {
       linkSync(temporary, destination);
     } catch {
-      if (!existsSync21(destination) && existsSync21(displaced)) {
+      if (!existsSync22(destination) && existsSync22(displaced)) {
         try {
           linkSync(displaced, destination);
         } catch {
@@ -31420,7 +31523,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
 }
 function installedCreateMatches(projectRoot, operation) {
   const configRoot = join24(projectRoot, ".kxm");
-  if (!existsSync21(configRoot)) return false;
+  if (!existsSync22(configRoot)) return false;
   const actual = [];
   const visit2 = (directory) => {
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
@@ -31437,10 +31540,10 @@ function installedCreateMatches(projectRoot, operation) {
   return actual.length === expected.length && actual.every((path4, index) => path4 === expected[index]) && operation.files.every((entry) => destinationSha(projectRoot, entry.path) === entry.targetSha256);
 }
 function relativeConfigPath(projectRoot, file) {
-  return relative4(resolve18(projectRoot), file).replaceAll("\\", "/");
+  return relative4(resolve19(projectRoot), file).replaceAll("\\", "/");
 }
 function syncTreeDirectories(root) {
-  if (!existsSync21(root)) return;
+  if (!existsSync22(root)) return;
   const directories = [];
   const visit2 = (directory) => {
     directories.push(directory);
@@ -31470,7 +31573,7 @@ function applyOperation(projectRoot, original, options, resumed) {
   operation = updatePhase(projectRoot, operation, "applying");
   if (operation.kind === "create") {
     const destination = join24(projectRoot, ".kxm");
-    if (!existsSync21(destination)) {
+    if (!existsSync22(destination)) {
       rebuildCreateShadow(projectRoot, operation, effectiveOptions);
       renameSync6(join24(shadowRoot(projectRoot), ".kxm"), destination);
       syncDirectory2(projectRoot);
@@ -31633,7 +31736,7 @@ function resumeKxmInitTransaction(projectRoot, options = {}) {
   let operation = readOperation(projectRoot, options.schemasDir);
   if (!operation) {
     const root = transactionRoot(projectRoot);
-    if (existsSync21(root)) {
+    if (existsSync22(root)) {
       rmSync8(root, { recursive: true, force: true });
       syncDirectory2(projectRoot);
     }
@@ -31758,7 +31861,7 @@ function validateBindingIdentities(bundle, persisted, explicit) {
 }
 function initializeKxmProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const storeOptions = bindingStoreOptions(options);
-  const persisted = existsSync22(join25(gitRoot, ".kxm", "project.yaml")) ? readKxmLocalBindings(gitRoot, storeOptions) : void 0;
+  const persisted = existsSync23(join25(gitRoot, ".kxm", "project.yaml")) ? readKxmLocalBindings(gitRoot, storeOptions) : void 0;
   const repositoryBindings = Object.fromEntries([
     ...Object.entries(persisted?.repositories ?? {}),
     ...Object.entries(options.repositoryBindings ?? {})
@@ -31946,7 +32049,7 @@ function initializeKxmProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const files = [...rendered.files.keys()];
   if (options.dryRun) return { action: "planned", plan, projectRoot: gitRoot, files };
   if (!mutationLock) throw new Error("project mutation lock is required to create configuration");
-  if (existsSync22(join25(gitRoot, ".kxm"))) {
+  if (existsSync23(join25(gitRoot, ".kxm"))) {
     throw new KxmConfigError([initIssue("workspace_changed", ".kxm", "workspace changed after planning; existing .kxm state was not overwritten")]);
   }
   const created = prepareAndApplyKxmCreate(gitRoot, rendered, transactionOptions);
@@ -32264,10 +32367,24 @@ async function cmdKxmInit(runtime, options, postHooks) {
 }
 async function cmdBackup(runtime, options) {
   try {
-    const { manifest, outDir } = createBackup({
+    const backupOptions = {
       projectRoot: runtime.cwd,
-      ...options.out ? { outDir: resolve19(runtime.cwd, options.out) } : {}
-    });
+      ...options.out ? { outDir: resolve20(runtime.cwd, options.out) } : {}
+    };
+    if (runtime.dryRun) {
+      const plan = planBackup(backupOptions);
+      printPlan(
+        runtime,
+        { command: "backup", outDir: plan.outDir, stores: plan.stores },
+        [
+          ...plan.stores.map((store) => ({ action: "write", target: join26(plan.outDir, store.backupFile) })),
+          { action: "write", target: join26(plan.outDir, "manifest.json") }
+        ],
+        `back up ${plan.stores.length} store(s) to ${plan.outDir} (sources are not opened, so their WAL is not checkpointed)`
+      );
+      return 0;
+    }
+    const { manifest, outDir } = createBackup(backupOptions);
     const payload = {
       ok: true,
       command: "backup",
@@ -32293,7 +32410,25 @@ async function cmdBackup(runtime, options) {
 }
 async function cmdRestore(runtime, manifestArg) {
   try {
-    const result = restoreBackup(resolve19(runtime.cwd, manifestArg), {
+    if (runtime.dryRun) {
+      const plan = planRestore(resolve20(runtime.cwd, manifestArg), { projectRoot: runtime.cwd });
+      printPlan(
+        runtime,
+        {
+          command: "restore",
+          backupId: plan.backupId,
+          manifestPath: plan.manifestPath,
+          stores: plan.stores.map(({ storeId, targetPath, schemaVersion }) => ({ storeId, targetPath, schemaVersion }))
+        },
+        plan.stores.flatMap((store) => [
+          { action: "write", target: store.targetPath },
+          ...[`${store.targetPath}-wal`, `${store.targetPath}-shm`].filter((file) => existsSync24(file)).map((file) => ({ action: "delete", target: file }))
+        ]),
+        `restore ${plan.stores.length} store(s) from ${plan.manifestPath}; digests verified against the manifest`
+      );
+      return 0;
+    }
+    const result = restoreBackup(resolve20(runtime.cwd, manifestArg), {
       projectRoot: runtime.cwd
     });
     const payload = {
@@ -32362,9 +32497,14 @@ trust check failed: review every expansion above before merging`);
     return 1;
   }
 }
+async function readSupervisor(runtime, command) {
+  if (!runtime.dryRun) return await (kxmDriveCliSeams.ensureSupervisor ?? ensureKxmSupervisor)({ env: runtime.env });
+  const attached = await attachKxmSupervisor({ env: runtime.env });
+  return attached ?? refuseDryRun(runtime.io, runtime.json, command, "the Runtime supervisor is not running and --dry-run will not start it");
+}
 var RUN_ENGINE_PHASE = "pre-3a";
 var RUN_ENGINE_NOTICE = "runs remain created until the run engine lands; no steps execute yet";
-async function cmdKxmRun(runtime, workflow, promptParts) {
+function resolveKxmRunTarget(runtime, workflow) {
   if (runtime.workspaceFlag !== void 0) {
     print(runtime.io, runtime.json, {
       ok: false,
@@ -32377,33 +32517,37 @@ async function cmdKxmRun(runtime, workflow, promptParts) {
     print(runtime.io, runtime.json, { ok: false, command: "run", error: "workflow_required" }, "usage: kxm run <workflow> [prompt]");
     return 2;
   }
+  const projectRoot = discoverKxmProjectRoot(runtime.cwd);
+  if (!projectRoot) {
+    print(runtime.io, runtime.json, { ok: false, command: "run", error: "project_required" }, "kxm run requires a KXM project (run kxm init first)");
+    return 1;
+  }
+  const bundle = loadKxmProject(projectRoot, {});
+  if (!bundle.workflows.has(workflow)) {
+    print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_workflow_unknown", workflow }, `workflow ${workflow} does not exist in this project`);
+    return 1;
+  }
+  return { projectRoot, workflowId: workflow, configRevision: bundle.configRevision };
+}
+async function cmdKxmRun(runtime, workflow, promptParts) {
   try {
-    const projectRoot = discoverKxmProjectRoot(runtime.cwd);
-    if (!projectRoot) {
-      print(runtime.io, runtime.json, { ok: false, command: "run", error: "project_required" }, "kxm run requires a KXM project (run kxm init first)");
-      return 1;
-    }
-    const bundle = loadKxmProject(projectRoot, {});
-    if (!bundle.workflows.has(workflow)) {
-      print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_workflow_unknown", workflow }, `workflow ${workflow} does not exist in this project`);
-      return 1;
-    }
+    const target = resolveKxmRunTarget(runtime, workflow);
+    if (typeof target === "number") return target;
+    const { projectRoot } = target;
     if (runtime.dryRun) {
       print(runtime.io, runtime.json, {
         ok: true,
         command: "run",
         dryRun: true,
-        projectRoot,
-        workflowId: workflow,
-        configRevision: bundle.configRevision
-      }, `run plan: workflow ${workflow} at ${bundle.configRevision.slice(0, 19)}\u2026 (no run created)`);
+        ...target
+      }, `run plan: workflow ${target.workflowId} at ${target.configRevision.slice(0, 19)}\u2026 (no run created)`);
       return 0;
     }
     const supervisor = await ensureKxmSupervisor({ env: runtime.env });
     const prompt = promptParts.join(" ").trim();
     const acceptance = await kxmRuntimeRequest(supervisor, "POST", "/v1/runs", {
       projectRoot,
-      workflowId: workflow,
+      workflowId: target.workflowId,
       prompt
     });
     const run = acceptance.run;
@@ -32467,7 +32611,8 @@ async function cmdKxmRunStatus(runtime, runId) {
       print(runtime.io, runtime.json, { ok: false, command: "runs status", error: "project_required" }, "kxm runs status requires a KXM project (run kxm init first)");
       return 1;
     }
-    const supervisor = await (kxmDriveCliSeams.ensureSupervisor ?? ensureKxmSupervisor)({ env: runtime.env });
+    const supervisor = await readSupervisor(runtime, "runs status");
+    if (typeof supervisor === "number") return supervisor;
     const result = await (kxmDriveCliSeams.runtimeRequest ?? kxmRuntimeRequest)(supervisor, "GET", `/v1/runs/${encodeURIComponent(runId)}?projectRoot=${encodeURIComponent(projectRoot)}`);
     const run = result.run;
     const drive = result.drive;
@@ -32498,7 +32643,7 @@ function parseDriveWaitTimeoutMs(raw) {
   return value;
 }
 function sleepMs(ms) {
-  return new Promise((resolve30) => setTimeout(resolve30, ms));
+  return new Promise((resolve32) => setTimeout(resolve32, ms));
 }
 function driveWaitCompleted(drive) {
   return drive?.verified === true && drive.receipt?.settlement?.kind === "terminal" && drive.receipt.settlement.status === "completed";
@@ -32613,7 +32758,8 @@ async function cmdKxmRunList(runtime) {
     }
     const bundle = loadKxmProject(projectRoot, {});
     const projectId = String(bundle.project.value.id);
-    const supervisor = await ensureKxmSupervisor({ env: runtime.env });
+    const supervisor = await readSupervisor(runtime, "runs list");
+    if (typeof supervisor === "number") return supervisor;
     const result = await kxmRuntimeRequest(supervisor, "GET", `/v1/projects/${encodeURIComponent(projectId)}/runs?projectRoot=${encodeURIComponent(projectRoot)}`);
     const runs = result.runs ?? [];
     print(
@@ -32704,7 +32850,7 @@ async function selectInventoryModel(runtime, requested) {
   if (runtime.json || !process.stdin.isTTY || models.length === 0) return void 0;
   runtime.io.stdout(models.slice(0, 100).map((model, index2) => `${index2 + 1}. ${model}`).join("\n") + "\nSelect model number: ");
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve30) => rl.once("line", resolve30));
+  const answer = await new Promise((resolve32) => rl.once("line", resolve32));
   rl.close();
   const index = Number.parseInt(answer.trim(), 10) - 1;
   return Number.isInteger(index) && index >= 0 && index < models.length ? models[index] : void 0;
@@ -32730,7 +32876,7 @@ async function cmdModelsScreen(runtime) {
     return 2;
   }
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const ask = (q2) => new Promise((resolve30) => rl.question(q2, resolve30));
+  const ask = (q2) => new Promise((resolve32) => rl.question(q2, resolve32));
   try {
     while (true) {
       const policy = loadRoutePolicy(runtime.dirs.workdir);
@@ -32872,7 +33018,8 @@ async function cmdKxmRunReceipt(runtime, runId, options = {}) {
       print(runtime.io, runtime.json, { ok: false, command: "runs receipt", error: "project_required" }, "kxm runs receipt requires a KXM project (run kxm init first)");
       return 1;
     }
-    const supervisor = await (kxmDriveCliSeams.ensureSupervisor ?? ensureKxmSupervisor)({ env: runtime.env });
+    const supervisor = await readSupervisor(runtime, "runs receipt");
+    if (typeof supervisor === "number") return supervisor;
     const result = await (kxmDriveCliSeams.runtimeRequest ?? kxmRuntimeRequest)(
       supervisor,
       "GET",
@@ -32949,7 +33096,11 @@ async function cmdGoalCreate(runtime, title, options) {
       area: options.area,
       successMetrics: options.metric,
       targetDate: options.targetDate
-    });
+    }, { dryRun: runtime.dryRun });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "goal create", goal }, [{ action: "write", target: goalFilePath(runtime.cwd, goal.id) }], `create goal ${goal.title} (the id is assigned when it is created)`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -32985,7 +33136,11 @@ async function cmdTaskCreate(runtime, title, options) {
       objective: options.objective ?? title,
       assignedWorkflow: options.workflow,
       trackerSync: options.tracker && options.issue ? { tracker: options.tracker, issueKey: options.issue } : void 0
-    });
+    }, { dryRun: runtime.dryRun });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "task create", task }, [{ action: "write", target: taskFilePath(runtime.cwd, task.id) }], `create task ${task.title} [${task.status}] (the id is assigned when it is created)`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -33051,6 +33206,21 @@ async function cmdTaskRun(runtime, taskId) {
       return 1;
     }
     const workflow = task.assignedWorkflow ?? "default";
+    if (runtime.dryRun) {
+      const target = resolveKxmRunTarget(runtime, workflow);
+      if (typeof target === "number") return target;
+      const started = updateTaskStatus(runtime.cwd, taskId, "in_progress", { dryRun: true });
+      printPlan(
+        runtime,
+        { command: "task run", taskId, ...target, status: started.status },
+        [
+          { action: "request", target: "POST kxm-runtime /v1/runs (starts the Runtime supervisor if it is not running)" },
+          { action: "write", target: taskFilePath(runtime.cwd, taskId) }
+        ],
+        `run workflow ${workflow} for task ${taskId}, then mark it ${started.status}`
+      );
+      return 0;
+    }
     const exitCode = await cmdKxmRun(runtime, workflow, [task.objective]);
     if (exitCode === 0) {
       updateTaskStatus(runtime.cwd, taskId, "in_progress");
@@ -33065,7 +33235,11 @@ async function cmdTaskRun(runtime, taskId) {
 }
 async function cmdTaskSync(runtime, taskId) {
   try {
-    const synced = syncTaskWithTracker(runtime.cwd, taskId);
+    const synced = syncTaskWithTracker(runtime.cwd, taskId, { dryRun: runtime.dryRun });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "task sync", task: synced }, [{ action: "write", target: taskFilePath(runtime.cwd, taskId) }], `mark task ${taskId} synced with ${synced.trackerSync?.tracker} #${synced.trackerSync?.issueKey}`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -33085,12 +33259,12 @@ async function cmdStudioLayout(runtime, workflowPath) {
     const projectRoot = discoverKxmProjectRoot(runtime.cwd) ?? runtime.cwd;
     let filePath = workflowPath;
     if (!filePath) {
-      filePath = resolve20(projectRoot, ".kxm", "workflows", "default.yaml");
+      filePath = resolve21(projectRoot, ".kxm", "workflows", "default.yaml");
     }
     let yamlContent;
     let workflowId = "default";
-    if (existsSync23(filePath)) {
-      yamlContent = readFileSync22(filePath, "utf8");
+    if (existsSync25(filePath)) {
+      yamlContent = readFileSync23(filePath, "utf8");
     } else {
       yamlContent = `schema: kxm.workflow.v1
 description: Feature implementation workflow
@@ -33165,13 +33339,13 @@ async function cmdStudioServe(runtime, options) {
         try {
           const wfDir = join27(runtime.cwd, ".kxm", "workflows");
           const defaultPath = join27(wfDir, "default.yaml");
-          let targetPath = existsSync23(defaultPath) ? defaultPath : void 0;
-          if (!targetPath && existsSync23(wfDir)) {
+          let targetPath = existsSync25(defaultPath) ? defaultPath : void 0;
+          if (!targetPath && existsSync25(wfDir)) {
             const yml = readdirSync8(wfDir).find((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
             if (yml) targetPath = join27(wfDir, yml);
           }
-          if (targetPath && existsSync23(targetPath)) {
-            const raw = readFileSync22(targetPath, "utf8");
+          if (targetPath && existsSync25(targetPath)) {
+            const raw = readFileSync23(targetPath, "utf8");
             const parsed = (0, import_yaml12.parse)(raw);
             const wfId = basename6(targetPath).replace(/\.(yaml|yml)$/, "");
             return compileKxmWorkflow({ id: wfId, value: parsed });
@@ -33221,14 +33395,14 @@ Press Ctrl+C to stop.
 }
 
 // plugins/kxm/src/cli/context-skills.ts
-import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join31, relative as relative5 } from "node:path";
+import { readFileSync as readFileSync26 } from "node:fs";
+import { join as join31, relative as relative5, resolve as resolve23 } from "node:path";
 
 // plugins/kxm/src/memory.ts
 var import_yaml13 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync19, readdirSync as readdirSync9, readFileSync as readFileSync23, writeFileSync as writeFileSync18 } from "node:fs";
-import { extname as extname2, join as join28, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync20, readdirSync as readdirSync9, readFileSync as readFileSync24, writeFileSync as writeFileSync18 } from "node:fs";
+import { extname as extname2, join as join28, resolve as resolve22 } from "node:path";
 var MEMORY_SCHEMA = "kxm.memory.v1";
 var MEMORY_BRIEF_SCHEMA = "kxm.memory-brief.v1";
 var MEMORY_MARKER_START = "<!-- kxm:memory:start -->";
@@ -33354,21 +33528,21 @@ ${yamlText}
 `;
 }
 function memoryDirectories(repoRoot) {
-  const root = resolve21(repoRoot);
+  const root = resolve22(repoRoot);
   const memoryDir = join28(root, ".kxm", "memory");
   const candidatesDir = join28(memoryDir, "candidates");
   return { memoryDir, candidatesDir };
 }
 function loadAuthoredMemory(repoRoot) {
   const { memoryDir } = memoryDirectories(repoRoot);
-  if (!existsSync24(memoryDir)) return [];
+  if (!existsSync26(memoryDir)) return [];
   const records = [];
   const entries = readdirSync9(memoryDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && extname2(entry.name) === ".md") {
       const fullPath = join28(memoryDir, entry.name);
       try {
-        const text = readFileSync23(fullPath, "utf8");
+        const text = readFileSync24(fullPath, "utf8");
         const record = parseMemoryRecord(text, entry.name);
         if (record.lifecycle === "active") {
           records.push(record);
@@ -33382,7 +33556,6 @@ function loadAuthoredMemory(repoRoot) {
 }
 function createMemoryNote(repoRoot, summary, options = {}) {
   const { candidatesDir } = memoryDirectories(repoRoot);
-  mkdirSync19(candidatesDir, { recursive: true });
   const scope = options.scope ?? "project";
   if (!VALID_SCOPES.has(scope)) {
     throw new Error(`invalid memory note scope: ${scope}; must be one of agent, project, run, operator`);
@@ -33408,6 +33581,8 @@ function createMemoryNote(repoRoot, summary, options = {}) {
     ...options.body ? { body: options.body.trim() } : {}
   };
   const targetPath = join28(candidatesDir, `${id}.md`);
+  if (options.dryRun) return { record, path: targetPath };
+  mkdirSync20(candidatesDir, { recursive: true });
   writeFileSync18(targetPath, formatMemoryRecord(record), "utf8");
   return { record, path: targetPath };
 }
@@ -33442,10 +33617,10 @@ function formatHarnessMemoryBlock(records) {
   contentLines.push(MEMORY_MARKER_END);
   return contentLines.join("\n");
 }
-function updateHarnessDocument(filePath, block, defaultHeader) {
+function updateHarnessDocument(filePath, block, defaultHeader, dryRun = false) {
   let original = "";
-  if (existsSync24(filePath)) {
-    original = readFileSync23(filePath, "utf8");
+  if (existsSync26(filePath)) {
+    original = readFileSync24(filePath, "utf8");
   }
   let updated = "";
   if (original.includes(MEMORY_MARKER_START) && original.includes(MEMORY_MARKER_END)) {
@@ -33473,21 +33648,21 @@ ${block}
 `;
   }
   if (updated !== original) {
-    writeFileSync18(filePath, updated, "utf8");
+    if (!dryRun) writeFileSync18(filePath, updated, "utf8");
     return true;
   }
   return false;
 }
-function syncHarnessMemory(repoRoot) {
-  const root = resolve21(repoRoot);
+function syncHarnessMemory(repoRoot, options = {}) {
+  const root = resolve22(repoRoot);
   const records = loadAuthoredMemory(root);
   const block = formatHarnessMemoryBlock(records);
   const updated = [];
   const created = [];
   const agentsPath = join28(root, "AGENTS.md");
   const agentsHeader = "# AGENTS\n\nFollow project instructions.\n";
-  const agentsExisted = existsSync24(agentsPath);
-  if (updateHarnessDocument(agentsPath, block, agentsHeader)) {
+  const agentsExisted = existsSync26(agentsPath);
+  if (updateHarnessDocument(agentsPath, block, agentsHeader, options.dryRun)) {
     if (agentsExisted) updated.push("AGENTS.md");
     else created.push("AGENTS.md");
   }
@@ -33503,8 +33678,8 @@ rotation, not a sole writer. If \`grok\` is logged out, never bill Grok through
 use a relief route Tracking **admits**, or stop and name the limits hit. Your reviews are
 artifacts, not hub \`peer-reply\` evidence.
 `;
-  const claudeExisted = existsSync24(claudePath);
-  if (updateHarnessDocument(claudePath, block, claudeHeader)) {
+  const claudeExisted = existsSync26(claudePath);
+  if (updateHarnessDocument(claudePath, block, claudeHeader, options.dryRun)) {
     if (claudeExisted) updated.push("CLAUDE.md");
     else created.push("CLAUDE.md");
   }
@@ -33519,8 +33694,8 @@ Google goes through the \`antigravity\` **Pi provider** (Tracking \u2192 Decided
 Current admissions come from Tracking and \`kxm harness list\`. Starting rotation
 remains Grok.
 `;
-  const geminiExisted = existsSync24(geminiPath);
-  if (updateHarnessDocument(geminiPath, block, geminiHeader)) {
+  const geminiExisted = existsSync26(geminiPath);
+  if (updateHarnessDocument(geminiPath, block, geminiHeader, options.dryRun)) {
     if (geminiExisted) updated.push("GEMINI.md");
     else created.push("GEMINI.md");
   }
@@ -33530,8 +33705,8 @@ remains Grok.
 // plugins/kxm/src/skills.ts
 var import_yaml14 = __toESM(require_dist(), 1);
 import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync20, readdirSync as readdirSync10, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync9, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync21, readdirSync as readdirSync10, readFileSync as readFileSync25, renameSync as renameSync7, rmSync as rmSync10, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
+import { dirname as dirname17, join as join29 } from "node:path";
 var SKILL_CANDIDATE_SCHEMA = "kxm.skill-candidate.v1";
 var SKILL_EVALUATION_SCHEMA = "kxm.skill-evaluation.v1";
 var SKILL_DECISION_SCHEMA = "kxm.skill-decision.v1";
@@ -33619,10 +33794,22 @@ var SkillLifecycle = class {
   root;
   now;
   allowOptimizationEvals;
+  dryRun;
+  /** What a `dryRun` lifecycle would have written or moved, in order. */
+  planned = [];
   constructor(root, options = {}) {
     this.root = root;
     this.now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
     this.allowOptimizationEvals = options.allowOptimizationEvals === true;
+    this.dryRun = options.dryRun === true;
+  }
+  write(file, content) {
+    if (this.dryRun) {
+      this.planned.push({ action: "write", target: file });
+      return;
+    }
+    mkdirSync21(dirname17(file), { recursive: true });
+    writeFileSync19(file, content);
   }
   dir(state) {
     return join29(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
@@ -33635,37 +33822,40 @@ var SkillLifecycle = class {
     return { dir, metadata: join29(dir, "metadata.json"), skill: join29(dir, "SKILL.md") };
   }
   appendHistory(id, record) {
-    mkdirSync20(join29(this.root, "history"), { recursive: true });
     const line = `${JSON.stringify(record)}
 `;
-    if (existsSync25(this.historyFile(id))) {
-      const existing = readFileSync24(this.historyFile(id), "utf8");
+    if (existsSync27(this.historyFile(id))) {
+      const existing = readFileSync25(this.historyFile(id), "utf8");
       const lines = existing.split("\n").filter((entry) => entry.trim());
-      writeFileSync19(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
+      this.write(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
     } else {
-      writeFileSync19(this.historyFile(id), line);
+      this.write(this.historyFile(id), line);
     }
   }
   history(id) {
     const file = this.historyFile(id);
-    if (!existsSync25(file)) return [];
-    return readFileSync24(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+    if (!existsSync27(file)) return [];
+    return readFileSync25(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
   }
   readMetadata(state, id) {
     const { metadata } = this.paths(state, id);
-    if (!existsSync25(metadata)) {
+    if (!existsSync27(metadata)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${state}`);
     }
-    return JSON.parse(readFileSync24(metadata, "utf8"));
+    return JSON.parse(readFileSync25(metadata, "utf8"));
   }
   move(from, to, id) {
     const fromDir = join29(this.dir(from), id);
     const toDir = join29(this.dir(to), id);
-    if (!existsSync25(fromDir)) {
+    if (!existsSync27(fromDir)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${from}`);
     }
-    mkdirSync20(this.dir(to), { recursive: true });
-    if (existsSync25(toDir)) rmSync9(toDir, { recursive: true, force: true });
+    if (this.dryRun) {
+      this.planned.push({ action: "move", target: `${fromDir} -> ${toDir}` });
+      return;
+    }
+    mkdirSync21(this.dir(to), { recursive: true });
+    if (existsSync27(toDir)) rmSync10(toDir, { recursive: true, force: true });
     renameSync7(fromDir, toDir);
   }
   /** Submit a new skill candidate. Content is redacted of secret material at
@@ -33707,8 +33897,8 @@ var SkillLifecycle = class {
     if (!harness) throw new SkillLifecycleError("invalid_skill_compatibility", "compatibility.harness is required");
     const contentSha256 = skillContentSha256(content);
     const id = skillIdFor(name, contentSha256);
-    const { dir, metadata, skill } = this.paths("candidate", id);
-    if (existsSync25(metadata)) {
+    const { metadata, skill } = this.paths("candidate", id);
+    if (existsSync27(metadata)) {
       throw new SkillLifecycleError(
         "skill_candidate_exists",
         `identical candidate ${id} already exists; changed behavior requires changed content`
@@ -33727,9 +33917,8 @@ var SkillLifecycle = class {
       createdAt: this.now(),
       ...input.supersedes ? { supersedes: input.supersedes } : {}
     };
-    mkdirSync20(dir, { recursive: true });
-    writeFileSync19(skill, content);
-    writeFileSync19(metadata, `${JSON.stringify(record, null, 2)}
+    this.write(skill, content);
+    this.write(metadata, `${JSON.stringify(record, null, 2)}
 `);
     this.appendHistory(id, { schema: "kxm.skill-history-event.v1", event: "candidate_created", by: createdBy, supersedes: input.supersedes, at: record.createdAt });
     return record;
@@ -33818,18 +34007,15 @@ var SkillLifecycle = class {
     };
     const candidatePaths = this.paths("candidate", candidateId);
     const promotedPaths = this.paths("promoted", candidateId);
-    mkdirSync20(promotedPaths.dir, { recursive: true });
-    const skillContent = readFileSync24(candidatePaths.skill, "utf8");
-    const metadataContent = readFileSync24(candidatePaths.metadata, "utf8");
-    writeFileSync19(promotedPaths.skill, skillContent);
-    writeFileSync19(promotedPaths.metadata, metadataContent);
-    const patchesDir = join29(this.root, "patches");
-    mkdirSync20(patchesDir, { recursive: true });
-    const patchPath = join29(patchesDir, `${candidateId}.patch`);
+    const skillContent = readFileSync25(candidatePaths.skill, "utf8");
+    const metadataContent = readFileSync25(candidatePaths.metadata, "utf8");
+    this.write(promotedPaths.skill, skillContent);
+    this.write(promotedPaths.metadata, metadataContent);
+    const patchPath = join29(this.root, "patches", `${candidateId}.patch`);
     const relSkillPath = `.kxm/skills/promoted/${candidateId}/SKILL.md`;
     const relMetaPath = `.kxm/skills/promoted/${candidateId}/metadata.json`;
     const patch = `${createUnifiedPatch(relSkillPath, skillContent)}${createUnifiedPatch(relMetaPath, metadataContent)}`;
-    writeFileSync19(patchPath, patch, "utf8");
+    this.write(patchPath, patch);
     this.appendHistory(candidateId, record);
     return { ...metadata, patch, patchPath };
   }
@@ -33853,7 +34039,7 @@ var SkillLifecycle = class {
   verify(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    const content = readFileSync24(skill, "utf8");
+    const content = readFileSync25(skill, "utf8");
     if (skillContentSha256(content) !== metadata.contentSha256) {
       throw new SkillLifecycleError(
         "skill_integrity_violation",
@@ -33871,7 +34057,7 @@ var SkillLifecycle = class {
   }
   list(state) {
     const dir = this.dir(state);
-    if (!existsSync25(dir)) return [];
+    if (!existsSync27(dir)) return [];
     const ids = readdirSorted(dir);
     return ids.map((id) => {
       try {
@@ -33884,7 +34070,7 @@ var SkillLifecycle = class {
   read(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    return { metadata, content: readFileSync24(skill, "utf8") };
+    return { metadata, content: readFileSync25(skill, "utf8") };
   }
 };
 function boundedList(value, field) {
@@ -33903,13 +34089,13 @@ function readdirSorted(dir) {
 }
 
 // plugins/kxm/src/wiki.ts
-import { mkdirSync as mkdirSync21, writeFileSync as writeFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync22, writeFileSync as writeFileSync20 } from "node:fs";
 import { join as join30 } from "node:path";
 function writeCompiledWiki(root, wiki) {
   const written = [];
   for (const [relativePath, content] of [...wiki.pages].sort(([left], [right]) => left.localeCompare(right))) {
     const absolute = join30(root, relativePath);
-    mkdirSync21(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
+    mkdirSync22(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
     writeFileSync20(absolute, content);
     written.push(relativePath);
   }
@@ -34012,6 +34198,15 @@ async function cmdContextPromote(runtime, project, proposalId, options) {
     runtime.io.stderr("context promote --evidence must contain at least one durable evidence reference\n");
     return 2;
   }
+  if (runtime.dryRun) {
+    printPlan(
+      runtime,
+      { command: "context promote", project, proposalId, evidence },
+      [{ action: "request", target: `POST ${runtime.serverUrl.replace(/\/$/, "")}/v1/context/state/promote` }],
+      `promote proposal ${proposalId} in ${project}`
+    );
+    return 0;
+  }
   const response = await hubContextPost({
     serverUrl: runtime.serverUrl,
     path: "/v1/context/state/promote",
@@ -34046,6 +34241,16 @@ async function cmdContextWikiCompile(runtime, project, options) {
     return 1;
   }
   const compiled = response.body;
+  if (options.out && runtime.dryRun) {
+    const outDir = options.out;
+    printPlan(
+      runtime,
+      { command: "context wiki-compile", project, pages: compiled.audit.pages, openContradictions: compiled.audit.contradictions, outDir },
+      compiled.pages.map((page) => ({ action: "write", target: resolve23(outDir, page.path) })),
+      `write ${compiled.pages.length} compiled wiki page(s) to ${outDir}`
+    );
+    return 0;
+  }
   let written = [];
   if (options.out) {
     const pages = new Map(compiled.pages.map((page) => [page.path, page.content]));
@@ -34093,7 +34298,7 @@ async function cmdSkillsCreate(runtime, options) {
     const metadata = lifecycle.create({
       name: options.name,
       description: options.description ?? "",
-      content: readFileSync25(options.file, "utf8"),
+      content: readFileSync26(options.file, "utf8"),
       createdBy: options.createdBy,
       sources: {
         runIds: csv(options.run) ?? [],
@@ -34113,7 +34318,7 @@ async function cmdSkillsCreate(runtime, options) {
   }
 }
 async function cmdSkillsEvaluate(runtime, skillId, options) {
-  const lifecycle = new SkillLifecycle(skillsRoot(runtime));
+  const lifecycle = new SkillLifecycle(skillsRoot(runtime), { dryRun: runtime.dryRun });
   try {
     const outcome = lifecycle.evaluate(skillId, {
       kind: options.kind,
@@ -34122,6 +34327,10 @@ async function cmdSkillsEvaluate(runtime, skillId, options) {
       ...options.score !== void 0 ? { score: Number(options.score) } : {},
       ...options.details ? { details: options.details } : {}
     });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "skills evaluate", skillId, quarantined: outcome.quarantined, evaluation: outcome.evaluation }, lifecycle.planned, `record ${options.kind} evaluation${outcome.quarantined ? " (candidate quarantined)" : ""}`);
+      return 0;
+    }
     print(runtime.io, runtime.json, { ok: true, command: "skills evaluate", skillId, quarantined: outcome.quarantined, evaluation: outcome.evaluation }, `recorded ${options.kind} evaluation${outcome.quarantined ? " (candidate quarantined)" : ""}`);
     return 0;
   } catch (error) {
@@ -34132,13 +34341,17 @@ async function cmdSkillsEvaluate(runtime, skillId, options) {
   }
 }
 async function cmdSkillsPromote(runtime, skillId, options) {
-  const lifecycle = new SkillLifecycle(skillsRoot(runtime));
+  const lifecycle = new SkillLifecycle(skillsRoot(runtime), { dryRun: runtime.dryRun });
   try {
     const promoted = lifecycle.promote(skillId, {
       decidedBy: options.decidedBy,
       reason: options.reason ?? "passed protected evaluation",
       evidenceRefs: csv(options.evidence) ?? []
     });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "skills promote", skillId, metadata: promoted, patchPath: promoted.patchPath }, lifecycle.planned, `promote skill ${skillId}`);
+      return 0;
+    }
     print(runtime.io, runtime.json, { ok: true, command: "skills promote", skillId, metadata: promoted, patchPath: promoted.patchPath }, `promoted skill ${skillId} (patch: ${promoted.patchPath})`);
     return 0;
   } catch (error) {
@@ -34149,9 +34362,13 @@ async function cmdSkillsPromote(runtime, skillId, options) {
   }
 }
 async function cmdSkillsReject(runtime, skillId, options) {
-  const lifecycle = new SkillLifecycle(skillsRoot(runtime));
+  const lifecycle = new SkillLifecycle(skillsRoot(runtime), { dryRun: runtime.dryRun });
   try {
     const metadata = lifecycle.reject(skillId, { decidedBy: options.decidedBy, reason: options.reason ?? "rejected" });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "skills reject", skillId, metadata }, lifecycle.planned, `reject skill ${skillId} (history retained)`);
+      return 0;
+    }
     print(runtime.io, runtime.json, { ok: true, command: "skills reject", skillId, metadata }, `rejected skill ${skillId} (history retained)`);
     return 0;
   } catch (error) {
@@ -34214,9 +34431,14 @@ async function cmdMemoryNote(runtime, fact, options) {
     const { record, path: path4 } = createMemoryNote(runtime.cwd, fact, {
       scope: options.scope ?? "project",
       ...options.kind !== void 0 ? { kind: options.kind } : {},
-      ...options.body !== void 0 ? { body: options.body } : {}
+      ...options.body !== void 0 ? { body: options.body } : {},
+      dryRun: runtime.dryRun
     });
     const relPath = relative5(runtime.cwd, path4);
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "memory note", candidate: record, path: relPath }, [{ action: "write", target: path4 }], `record memory candidate in ${relPath} (the id is assigned when it is recorded)`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -34233,7 +34455,16 @@ async function cmdMemoryNote(runtime, fact, options) {
 }
 async function cmdMemorySync(runtime) {
   try {
-    const result = syncHarnessMemory(runtime.cwd);
+    const result = syncHarnessMemory(runtime.cwd, { dryRun: runtime.dryRun });
+    if (runtime.dryRun) {
+      printPlan(
+        runtime,
+        { command: "memory sync", ...result },
+        [...result.created, ...result.updated].map((file) => ({ action: "write", target: join31(runtime.cwd, file) })),
+        "regenerate project memory blocks in AGENTS.md, CLAUDE.md, and GEMINI.md"
+      );
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -34251,8 +34482,8 @@ async function cmdMemorySync(runtime) {
 
 // plugins/kxm/src/cli/hub.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { existsSync as existsSync31, mkdirSync as mkdirSync25, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync10, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join41, resolve as resolve24 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync26, readFileSync as readFileSync32, readdirSync as readdirSync12, rmSync as rmSync11, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join41, resolve as resolve26 } from "node:path";
 
 // node_modules/marked/lib/marked.esm.js
 function M() {
@@ -38414,10 +38645,10 @@ var TuiBase = class _TuiBase extends Container {
    * @returns Promise containing the parsed RGB color, or undefined if it times out or fails to parse.
    */
   queryTerminalBackgroundColor({ timeoutMs }) {
-    return new Promise((resolve30) => {
+    return new Promise((resolve32) => {
       const query = {
         settled: false,
-        resolve: resolve30,
+        resolve: resolve32,
         timer: void 0
       };
       query.timer = setTimeout(() => {
@@ -38440,7 +38671,7 @@ var TuiBase = class _TuiBase extends Container {
    * `CSI ? 997 ; 1 n` for dark or `CSI ? 997 ; 2 n` for light.
    */
   queryTerminalColorScheme({ timeoutMs }) {
-    return new Promise((resolve30) => {
+    return new Promise((resolve32) => {
       let settled = false;
       let timer;
       let unsubscribe = () => {
@@ -38454,7 +38685,7 @@ var TuiBase = class _TuiBase extends Container {
           timer = void 0;
         }
         unsubscribe();
-        resolve30(scheme);
+        resolve32(scheme);
       };
       unsubscribe = this.onTerminalColorSchemeChange(settle);
       timer = setTimeout(() => settle(void 0), timeoutMs);
@@ -40185,19 +40416,19 @@ import * as path2 from "node:path";
 
 // node_modules/@earendil-works/pi-tui/dist/native-module-path.js
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname17, join as join32 } from "node:path";
+import { dirname as dirname18, join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleRequire = createRequire2(import.meta.url);
 var TUI_PACKAGE_NAME = "@earendil-works/pi-tui";
 function getNativeModuleCandidates(nativePath, options = {}) {
-  const moduleDir = dirname17(fileURLToPath2(options.moduleUrl ?? import.meta.url));
+  const moduleDir = dirname18(fileURLToPath2(options.moduleUrl ?? import.meta.url));
   const candidates = [];
   try {
     const packageEntry = (options.resolvePackage ?? moduleRequire.resolve)(TUI_PACKAGE_NAME);
-    candidates.push(join32(dirname17(packageEntry), "..", nativePath));
+    candidates.push(join32(dirname18(packageEntry), "..", nativePath));
   } catch {
   }
-  candidates.push(join32(moduleDir, "..", nativePath), join32(moduleDir, nativePath), join32(dirname17(options.execPath ?? process.execPath), nativePath));
+  candidates.push(join32(moduleDir, "..", nativePath), join32(moduleDir, nativePath), join32(dirname18(options.execPath ?? process.execPath), nativePath));
   return Array.from(new Set(candidates));
 }
 
@@ -40538,7 +40769,7 @@ var ProcessTerminal = class {
           break;
         if (now - lastDataTime >= idleMs)
           break;
-        await new Promise((resolve30) => setTimeout(resolve30, Math.min(idleMs, timeLeft)));
+        await new Promise((resolve32) => setTimeout(resolve32, Math.min(idleMs, timeLeft)));
       }
     } finally {
       process.stdin.removeListener("data", onData);
@@ -42653,8 +42884,8 @@ var TuiAltScreen = class extends TuiBase {
 var MAX_RENDER_WRITE_CHARS = 1024 * 1024;
 
 // plugins/kxm/src/tui.ts
-import { mkdirSync as mkdirSync22 } from "node:fs";
-import { join as join36, resolve as resolve23, dirname as dirname18 } from "node:path";
+import { mkdirSync as mkdirSync23 } from "node:fs";
+import { join as join36, resolve as resolve25, dirname as dirname19 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // packages/core/tui/src/types/surface.ts
@@ -42795,9 +43026,9 @@ var SHARED_EFFECT_KINDS = Object.freeze([
 ]);
 
 // plugins/kxm/src/local-snapshot.ts
-import { existsSync as existsSync26, readdirSync as readdirSync11, readFileSync as readFileSync26 } from "node:fs";
+import { existsSync as existsSync28, readdirSync as readdirSync11, readFileSync as readFileSync27 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { isAbsolute as isAbsolute8, join as join35, resolve as resolve22 } from "node:path";
+import { isAbsolute as isAbsolute8, join as join35, resolve as resolve24 } from "node:path";
 function processExists2(pid) {
   try {
     process.kill(pid, 0);
@@ -42919,34 +43150,34 @@ function readOpenMessageMetadata(database) {
 function resolveKxmSnapshotPaths(cwd, env = process.env) {
   const stateDir = env.KXM_STATE_DIR?.trim() || join35(cwd, ".kxm", "state");
   const configured = env.KXM_DATA_PATH?.trim();
-  const dataPath = configured ? resolve22(cwd, configured) : join35(stateDir, "kxm.db");
+  const dataPath = configured ? resolve24(cwd, configured) : join35(stateDir, "kxm.db");
   return { dataPath, stateDir };
 }
 function resolveKxmStateRoot(stateDir, options) {
-  if (options?.kxmStateRoot && existsSync26(options.kxmStateRoot)) {
-    return resolve22(options.kxmStateRoot);
+  if (options?.kxmStateRoot && existsSync28(options.kxmStateRoot)) {
+    return resolve24(options.kxmStateRoot);
   }
-  if (existsSync26(join35(stateDir, "runtime", "registry.db")) || existsSync26(join35(stateDir, "runtime", "projects"))) {
+  if (existsSync28(join35(stateDir, "runtime", "registry.db")) || existsSync28(join35(stateDir, "runtime", "projects"))) {
     return stateDir;
   }
   const env = options?.env ?? process.env;
   const explicit = env.KXM_STATE_HOME?.trim() || env.KXM_USER_STATE_DIR?.trim() || env.KXM_STATE_ROOT?.trim();
-  if (explicit && isAbsolute8(explicit) && existsSync26(resolve22(explicit))) {
-    return resolve22(explicit);
+  if (explicit && isAbsolute8(explicit) && existsSync28(resolve24(explicit))) {
+    return resolve24(explicit);
   }
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
     base = localAppData && isAbsolute8(localAppData) ? localAppData : join35(homedir6(), "AppData", "Local");
-    base = resolve22(base, "KXM");
+    base = resolve24(base, "KXM");
   } else if (process.platform === "darwin") {
-    base = resolve22(homedir6(), "Library", "Application Support", "KXM");
+    base = resolve24(homedir6(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
     base = xdgState && isAbsolute8(xdgState) ? xdgState : join35(homedir6(), ".local", "state");
-    base = resolve22(base, "kxm");
+    base = resolve24(base, "kxm");
   }
-  if (existsSync26(base)) return base;
+  if (existsSync28(base)) return base;
   return void 0;
 }
 function loadLocalMeshSnapshot(dataPath, stateDir, options) {
@@ -42957,9 +43188,9 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let legacyRuns = [];
   let legacyRunTotal = 0;
   let plans = [];
-  if (existsSync26(dataPath)) {
+  if (existsSync28(dataPath)) {
     hasLegacy = true;
-    const database = new DatabaseSync(dataPath, { readOnly: true });
+    const database = openReadOnlyDatabase(dataPath);
     try {
       database.exec("PRAGMA busy_timeout = 5000");
       agents = readJsonRows(database, "SELECT record FROM agents");
@@ -42981,10 +43212,10 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     const registryDbPath = join35(runtimeDir, "registry.db");
     const projectsDir = join35(runtimeDir, "projects");
     const projectKeys = /* @__PURE__ */ new Set();
-    if (existsSync26(registryDbPath)) {
+    if (existsSync28(registryDbPath)) {
       hasKxm = true;
       try {
-        const regDb = new DatabaseSync(registryDbPath, { readOnly: true });
+        const regDb = openReadOnlyDatabase(registryDbPath);
         try {
           regDb.exec("PRAGMA busy_timeout = 5000");
           const pRows = regDb.prepare("SELECT project_key FROM projects").all();
@@ -42997,7 +43228,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       } catch {
       }
     }
-    if (existsSync26(projectsDir)) {
+    if (existsSync28(projectsDir)) {
       try {
         for (const entry of readdirSync11(projectsDir, { withFileTypes: true })) {
           if (entry.isDirectory()) {
@@ -43009,10 +43240,10 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
     for (const key of projectKeys) {
       const eventDbPath = join35(projectsDir, key, "run-events.db");
-      if (existsSync26(eventDbPath)) {
+      if (existsSync28(eventDbPath)) {
         hasKxm = true;
         try {
-          const eventDb = new DatabaseSync(eventDbPath, { readOnly: true });
+          const eventDb = openReadOnlyDatabase(eventDbPath);
           try {
             eventDb.exec("PRAGMA busy_timeout = 5000");
             const runRows = eventDb.prepare(`
@@ -43039,10 +43270,10 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
   }
   const pids = [];
-  if (existsSync26(stateDir)) {
+  if (existsSync28(stateDir)) {
     for (const file of readdirSync11(stateDir).filter((name) => name.endsWith(".pid"))) {
       try {
-        const record = JSON.parse(readFileSync26(join35(stateDir, file), "utf8"));
+        const record = JSON.parse(readFileSync27(join35(stateDir, file), "utf8"));
         pids.push({
           file,
           ...record.role ? { role: record.role } : {},
@@ -43082,7 +43313,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     source = "legacy";
   }
   const telemetryFile = join35(stateDir, "telemetry.jsonl");
-  const spend = existsSync26(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
+  const spend = existsSync28(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
   return {
     source,
     agents: agents.sort((a, b2) => Number(b2.online) - Number(a.online) || a.name.localeCompare(b2.name)),
@@ -43217,10 +43448,10 @@ function spawnDegradeWorktree(repoRoot, runId, options) {
   const desc = options?.description ? slugifyBranchPart(options.description, 30) : "degrade";
   const branchName = `kxm/run-${cleanRunId}-${desc}`;
   const relativeWtPath = join36(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
-  const absoluteWtPath = resolve23(repoRoot, relativeWtPath);
+  const absoluteWtPath = resolve25(repoRoot, relativeWtPath);
   const jumpCommand = `cd "${absoluteWtPath}"`;
   try {
-    mkdirSync22(dirname18(absoluteWtPath), { recursive: true });
+    mkdirSync23(dirname19(absoluteWtPath), { recursive: true });
     const branchCheck = runner("git", ["rev-parse", "--verify", `refs/heads/${branchName}`]);
     let wtRes;
     if (branchCheck.status === 0) {
@@ -43618,11 +43849,11 @@ async function readJson(response) {
 }
 async function waitForReconnect(signal, milliseconds = 1e3) {
   if (signal.aborted) return;
-  await new Promise((resolve30) => {
+  await new Promise((resolve32) => {
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve30();
+      resolve32();
     };
     const timer = setTimeout(done, milliseconds);
     timer.unref();
@@ -43985,7 +44216,7 @@ async function runMeshTui(input) {
 // plugins/kxm/src/session-work.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync23, readFileSync as readFileSync27, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync24, readFileSync as readFileSync28, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
 import { join as join37 } from "node:path";
 var MAX_SESSION_BRIEF_TASKS = 5;
 var MAX_SESSION_BRIEF_PLANS = 5;
@@ -44145,8 +44376,8 @@ function buildSessionBrief(snapshot, current, hub, ship, updateLatest, cost, ses
 function readCachedSessionBrief(stateDir) {
   const file = join37(stateDir, "session-brief.json");
   try {
-    if (!existsSync27(file)) return void 0;
-    const raw = readFileSync27(file, "utf8");
+    if (!existsSync29(file)) return void 0;
+    const raw = readFileSync28(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && parsed.schema === "kxm.session-brief.v1" && typeof parsed.generatedAt === "string") {
       const ageMs = Date.now() - Date.parse(parsed.generatedAt);
@@ -44161,7 +44392,7 @@ function readCachedSessionBrief(stateDir) {
 }
 function writeCachedSessionBrief(stateDir, brief) {
   try {
-    mkdirSync23(stateDir, { recursive: true, mode: 448 });
+    mkdirSync24(stateDir, { recursive: true, mode: 448 });
     const file = join37(stateDir, "session-brief.json");
     const tmp = `${file}.tmp.${randomUUID13().slice(0, 8)}`;
     writeFileSync21(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
@@ -44172,7 +44403,7 @@ function writeCachedSessionBrief(stateDir, brief) {
 function estimateSessionCost(stateDir) {
   try {
     const telemetryFile = join37(stateDir, "telemetry.jsonl");
-    if (!existsSync27(telemetryFile)) return void 0;
+    if (!existsSync29(telemetryFile)) return void 0;
     const records = readRoutingRecords(telemetryFile);
     if (records.length === 0) return void 0;
     let totalCost = 0;
@@ -44276,7 +44507,7 @@ function loadSessionBrief(cwd, env = process.env, current, hub, options = {}) {
       options.sessionToken
     );
   }
-  writeCachedSessionBrief(paths.stateDir, brief);
+  if (options.writeCache !== false) writeCachedSessionBrief(paths.stateDir, brief);
   return brief;
 }
 async function loadSessionBriefAsync(cwd, env = process.env, current, hub, options = {}) {
@@ -44340,11 +44571,11 @@ function formatSessionBriefText(brief) {
 }
 
 // plugins/kxm/src/kxm-install-kind.ts
-import { existsSync as existsSync28, readFileSync as readFileSync28 } from "node:fs";
-import { dirname as dirname19, join as join38 } from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync29 } from "node:fs";
+import { dirname as dirname20, join as join38 } from "node:path";
 function packageIsKxm(root) {
   try {
-    const pkg = JSON.parse(readFileSync28(join38(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync29(join38(root, "package.json"), "utf8"));
     return pkg.name === "@kontextmind/kxm";
   } catch {
     return false;
@@ -44398,7 +44629,7 @@ function classifyInstallRoot(probe) {
   const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join38(probe.homeDir, ".claude");
   const pluginsRoot = join38(claudeHome, "plugins");
   if (isUnder(probe.moduleDir, pluginsRoot, probe.platform)) return report("claude-marketplace", probe.moduleDir);
-  const hasGit = existsSync28(join38(probe.repoRoot, ".git"));
+  const hasGit = existsSync30(join38(probe.repoRoot, ".git"));
   if (hasGit && packageIsKxm(probe.repoRoot)) return report("source", probe.repoRoot);
   if (isNpmPackageLayout(probe.repoRoot, probe.platform) && packageIsKxm(probe.repoRoot) && !hasGit) {
     return report("npm-package", probe.repoRoot);
@@ -44412,21 +44643,21 @@ function resolveInstallKind(probe, npmGlobalRoot) {
   if (typeof globalRoot !== "string" || globalRoot.trim() === "") {
     return report("unknown", classified.root);
   }
-  const expected = dirname19(dirname19(classified.root));
+  const expected = dirname20(dirname20(classified.root));
   if (sameHostPath2(globalRoot.trim(), expected, probe.platform)) return report("npm-global", classified.root);
   return report("npm-local", classified.root);
 }
 
 // plugins/kxm/src/kxm-update-config.ts
 var import_yaml15 = __toESM(require_dist(), 1);
-import { existsSync as existsSync29, readFileSync as readFileSync29 } from "node:fs";
+import { existsSync as existsSync31, readFileSync as readFileSync30 } from "node:fs";
 import { join as join39 } from "node:path";
 function loadKxmUpdateConfig(env = process.env) {
   const path4 = join39(kxmUserStateRoot({ env }), "update.yaml");
-  if (!existsSync29(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
+  if (!existsSync31(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
   let parsed;
   try {
-    parsed = (0, import_yaml15.parse)(readFileSync29(path4, "utf8"));
+    parsed = (0, import_yaml15.parse)(readFileSync30(path4, "utf8"));
   } catch {
     throw new KxmUpdateConfigError("update.yaml is not valid YAML");
   }
@@ -44452,7 +44683,7 @@ function loadKxmUpdateConfig(env = process.env) {
 }
 
 // plugins/kxm/src/session.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync24, readFileSync as readFileSync30, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync25, readFileSync as readFileSync31, writeFileSync as writeFileSync22 } from "node:fs";
 import { join as join40 } from "node:path";
 var SESSION_SCHEMA = "kxm.session.v1";
 var SessionConfigError = class extends Error {
@@ -44532,10 +44763,10 @@ function loadRosterMap(configDir) {
   return byName;
 }
 function loadRoster(path4, key) {
-  if (!existsSync30(path4)) return [];
+  if (!existsSync32(path4)) return [];
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync30(path4, "utf8"));
+    parsed = JSON.parse(readFileSync31(path4, "utf8"));
   } catch (error) {
     throw new SessionConfigError(
       `${key} roster at ${path4} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -44576,7 +44807,7 @@ function writeSession(assetsDir, session, dryRun = false) {
   const dir = join40(assetsDir, "sessions", session.id);
   const path4 = join40(dir, "session.json");
   if (!dryRun) {
-    mkdirSync24(dir, { recursive: true });
+    mkdirSync25(dir, { recursive: true });
     writeFileSync22(path4, `${JSON.stringify(session, null, 2)}
 `, { encoding: "utf8" });
   }
@@ -44585,7 +44816,7 @@ function writeSession(assetsDir, session, dryRun = false) {
 
 // plugins/kxm/src/cli/hub.ts
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname20 } from "node:path";
+import { dirname as dirname21 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 async function hubGet(url, fetchImpl) {
   try {
@@ -44603,7 +44834,7 @@ async function hubGet(url, fetchImpl) {
 }
 function installProbeFrom(runtime) {
   const partial = runtime.io.installProbe ?? {};
-  const moduleDir = partial.moduleDir ?? dirname20(fileURLToPath3(import.meta.url));
+  const moduleDir = partial.moduleDir ?? dirname21(fileURLToPath3(import.meta.url));
   return {
     moduleDir,
     // Classify the install that is **running**, never the directory the caller
@@ -44624,12 +44855,12 @@ function moduleInstallRoot() {
   try {
     return findKxmRepoRoot(import.meta.url);
   } catch {
-    return dirname20(fileURLToPath3(import.meta.url));
+    return dirname21(fileURLToPath3(import.meta.url));
   }
 }
 function warnIgnoredProjectUpdateYaml(runtime) {
   const projectFile = join41(runtime.dirs.workspace, "update.yaml");
-  if (!existsSync31(projectFile)) return;
+  if (!existsSync33(projectFile)) return;
   const userFile = join41(kxmUserStateRoot({ env: runtime.env }), "update.yaml");
   runtime.io.stderr(`kxm: ignoring .kxm/update.yaml in ${runtime.dirs.workdir}; update settings are read only from ${userFile}
 `);
@@ -44648,7 +44879,7 @@ async function refreshKxmUpdateNotice(runtime, config, current) {
   }
   const fetched = await fetchLatestKxmVersion(resolved.source, runtime.env, runtime.fetchImpl);
   const notice = noticeFromVersions(installed, fetched.latest, resolved, fetched.error, fetched.asset);
-  writeUpdateCache(runtime.dirs.state, notice);
+  if (!runtime.dryRun) writeUpdateCache(runtime.dirs.state, notice);
   return notice;
 }
 async function cmdStatus(runtime) {
@@ -44678,7 +44909,7 @@ async function cmdDash(runtime, options = {}) {
     return 2;
   }
   const screen = requested;
-  const dataPath = resolve24(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve26(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, {
       ok: true,
@@ -44911,7 +45142,7 @@ async function cmdWorker(runtime, options) {
   return await (runtime.io.spawnWorker ?? ((launchEnv) => spawnScript("kxm-worker.mjs", launchEnv)))(extraEnv);
 }
 async function cmdStop(runtime, waitMsFlag) {
-  const pids = existsSync31(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
+  const pids = existsSync33(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, { ok: true, command: "stop", dryRun: true, pidFiles: pids }, "would signal pid files");
     return 0;
@@ -44926,7 +45157,7 @@ async function cmdStop(runtime, waitMsFlag) {
   const orphans = [];
   for (const file of pids) {
     try {
-      const record = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+      const record = JSON.parse(readFileSync32(join41(runtime.dirs.state, file), "utf8"));
       const expectedControl = file === "hub.pid" ? "hub.stop" : file.startsWith("worker-") ? `${file.slice(0, -4)}.stop` : void 0;
       const expectedRole = file === "hub.pid" ? "hub" : file.startsWith("worker-") ? "worker" : void 0;
       if (record.version !== 1 || !Number.isInteger(record.pid) || record.pid <= 0 || !record.startedAt || !expectedControl || record.controlFile !== expectedControl || record.role !== expectedRole) {
@@ -44964,7 +45195,7 @@ async function cmdStop(runtime, waitMsFlag) {
   while (Date.now() <= deadline && stopped.size < requested.length) {
     for (const [file, record] of records) {
       try {
-        const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync32(join41(runtime.dirs.state, file), "utf8"));
         if (current.pid !== record.pid || current.startedAt !== record.startedAt || current.generation !== record.generation || !processExists(record.pid)) stopped.add(file);
       } catch {
         stopped.add(file);
@@ -44977,7 +45208,7 @@ async function cmdStop(runtime, waitMsFlag) {
   for (const file of orphans) {
     while (Date.now() <= deadlineOrphans) {
       try {
-        const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync32(join41(runtime.dirs.state, file), "utf8"));
         if (!Number.isInteger(current.serverPid) || !processExists(current.serverPid)) break;
       } catch {
         break;
@@ -44985,14 +45216,14 @@ async function cmdStop(runtime, waitMsFlag) {
       await (runtime.io.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms))))(100);
     }
     try {
-      const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+      const current = JSON.parse(readFileSync32(join41(runtime.dirs.state, file), "utf8"));
       if (Number.isInteger(current.serverPid) && processExists(current.serverPid)) {
         try {
           process.kill(current.serverPid, "SIGKILL");
         } catch {
         }
       }
-      rmSync10(join41(runtime.dirs.state, file), { force: true });
+      rmSync11(join41(runtime.dirs.state, file), { force: true });
     } catch {
     }
     stopped.add(file);
@@ -45003,11 +45234,11 @@ async function cmdStop(runtime, waitMsFlag) {
 }
 async function cmdSessionStatus(runtime) {
   const stateDir = runtime.dirs.state;
-  const names3 = existsSync31(stateDir) ? readdirSync12(stateDir) : [];
+  const names3 = existsSync33(stateDir) ? readdirSync12(stateDir) : [];
   const claims = [];
   for (const file of names3.filter((name) => name.endsWith(".pid"))) {
     try {
-      const record = JSON.parse(readFileSync31(join41(stateDir, file), "utf8"));
+      const record = JSON.parse(readFileSync32(join41(stateDir, file), "utf8"));
       claims.push({
         file,
         role: record.role,
@@ -45022,7 +45253,7 @@ async function cmdSessionStatus(runtime) {
   const recoveries = [];
   for (const file of names3.filter((name) => name.startsWith("worker-recovery-") && name.endsWith(".json"))) {
     try {
-      const envelope = JSON.parse(readFileSync31(join41(stateDir, file), "utf8"));
+      const envelope = JSON.parse(readFileSync32(join41(stateDir, file), "utf8"));
       recoveries.push({
         file,
         reason: envelope.reason,
@@ -45046,6 +45277,12 @@ async function cmdSessionStatus(runtime) {
   return 0;
 }
 async function cmdAuthToken(runtime, options = {}) {
+  const tokenFile = sessionTokenPath(runtime.env.KXM_USER_CONFIG_DIR);
+  if (options.clear && runtime.dryRun) {
+    const present = existsSync33(tokenFile);
+    printPlan(runtime, { command: "auth token", cleared: present }, present ? [{ action: "delete", target: tokenFile }] : [], present ? "clear the session token from disk" : "no session token file to clear");
+    return 0;
+  }
   if (options.clear) {
     const cleared = clearSessionTokenFromDisk({ userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
     print(
@@ -45101,33 +45338,37 @@ async function cmdAuthToken(runtime, options = {}) {
     );
     return 1;
   }
+  const existingToken = options.issue ? void 0 : readSessionTokenFromDisk({ userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
+  if (runtime.dryRun && !existingToken) {
+    printPlan(runtime, { command: "auth token" }, [{ action: "write", target: tokenFile }], "issue an operator session token and persist it");
+    return 0;
+  }
   let token;
-  if (options.issue) {
+  if (existingToken) {
+    token = existingToken.token;
+  } else {
     token = mintSessionToken({ preset: "operator" });
     persistSessionTokenToDisk(token, { userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
-  } else {
-    const existing = readSessionTokenFromDisk({ userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
-    if (existing) {
-      token = existing.token;
-    } else {
-      token = mintSessionToken({ preset: "operator" });
-      persistSessionTokenToDisk(token, { userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
-    }
   }
   print(runtime.io, runtime.json, { ok: true, command: "auth token", token }, token);
   return 0;
 }
 async function cmdSessionBrief(runtime, options = {}) {
   const existing = readSessionTokenFromDisk({ userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
-  const sessionToken = existing ? existing.token : mintSessionToken({ preset: "operator" });
-  if (!existing) {
+  const planned = existing ? [] : [{ action: "write", target: sessionTokenPath(runtime.env.KXM_USER_CONFIG_DIR) }];
+  const sessionToken = existing?.token ?? (runtime.dryRun ? void 0 : mintSessionToken({ preset: "operator" }));
+  if (!existing && sessionToken) {
     persistSessionTokenToDisk(sessionToken, { userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
   }
   if (options.token) {
+    if (!sessionToken) {
+      printPlan(runtime, { command: "session brief" }, planned, "issue an operator session token and persist it");
+      return 0;
+    }
     print(runtime.io, runtime.json, { ok: true, command: "session brief", sessionToken }, sessionToken);
     return 0;
   }
-  const dataPath = resolve24(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve26(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
   const env = {
     ...runtime.env,
     KXM_STATE_DIR: runtime.dirs.state,
@@ -45149,8 +45390,17 @@ async function cmdSessionBrief(runtime, options = {}) {
   }
   const brief = await loadSessionBriefAsync(runtime.dirs.workdir, env, void 0, hub, {
     fetchImpl: runtime.fetchImpl,
-    sessionToken
+    ...sessionToken ? { sessionToken } : {},
+    writeCache: !runtime.dryRun
   });
+  if (runtime.dryRun) {
+    if (!readCachedSessionBrief(runtime.dirs.state)) planned.push({ action: "write", target: join41(runtime.dirs.state, "session-brief.json") });
+    print(runtime.io, runtime.json, { ...brief, dryRun: true, planned }, [
+      options.status ? brief.statusLine : formatSessionBriefText(brief),
+      ...planned.map((change) => `dry run: would ${change.action} ${change.target}`)
+    ].join("\n"));
+    return 0;
+  }
   if (options.status) {
     print(runtime.io, runtime.json, brief, brief.statusLine);
     return 0;
@@ -45204,7 +45454,7 @@ async function cmdSessionStart(runtime, options) {
     ...workflowId ? workflowAssetDirs(runtime.dirs.assets, workflowId) : []
   ];
   if (!runtime.dryRun) {
-    for (const directory of created) mkdirSync25(directory, { recursive: true });
+    for (const directory of created) mkdirSync26(directory, { recursive: true });
     writeSession(runtime.dirs.assets, session);
   }
   print(runtime.io, runtime.json, {
@@ -45220,15 +45470,15 @@ async function cmdSessionStart(runtime, options) {
 // plugins/kxm/src/cli/system.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync37, mkdtempSync as mkdtempSync2, readFileSync as readFileSync36, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync39, mkdtempSync as mkdtempSync3, readFileSync as readFileSync37, rmSync as rmSync13 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join47, resolve as resolve28 } from "node:path";
+import { join as join47, resolve as resolve30 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // plugins/kxm/src/improve.ts
 import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join42, relative as relative6, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync27, writeFileSync as writeFileSync24 } from "node:fs";
+import { join as join42, relative as relative6, resolve as resolve27 } from "node:path";
 var CANDIDATE_SCHEMA = "kxm.candidate.v1";
 var IMPROVEMENT_REPORT_SCHEMA = "kxm.improvement-report.v2";
 function classifyCandidateKind(stepId, agentRole) {
@@ -45399,8 +45649,8 @@ function groupRoutingRecords(records, options = {}) {
   });
 }
 function buildImprovementReport(records, options = {}) {
-  const projectRoot = options.projectRoot ? resolve25(options.projectRoot) : process.cwd();
-  const candidatesDir = options.candidatesDir ? resolve25(options.candidatesDir) : join42(projectRoot, ".kxm", "candidates");
+  const projectRoot = options.projectRoot ? resolve27(options.projectRoot) : process.cwd();
+  const candidatesDir = options.candidatesDir ? resolve27(options.candidatesDir) : join42(projectRoot, ".kxm", "candidates");
   const groups = groupRoutingRecords(records, options);
   const candidates = [];
   for (const group of groups) {
@@ -45434,8 +45684,8 @@ function buildImprovementReport(records, options = {}) {
       createdAt: nowIso()
     };
     if (!options.dryRun) {
-      if (!existsSync32(candidatesDir)) {
-        mkdirSync26(candidatesDir, { recursive: true });
+      if (!existsSync34(candidatesDir)) {
+        mkdirSync27(candidatesDir, { recursive: true });
       }
       writeFileSync24(diffFilePath, diff, "utf8");
       const jsonFilePath = join42(candidatesDir, `${group.candidateId}.json`);
@@ -45456,7 +45706,7 @@ function writeImprovementReport(improvementsDir, report2, dryRun = false) {
   const stamp = report2.createdAt.replace(/[:.]/g, "-");
   const path4 = join42(improvementsDir, `${stamp}.json`);
   if (!dryRun) {
-    mkdirSync26(improvementsDir, { recursive: true });
+    mkdirSync27(improvementsDir, { recursive: true });
     writeFileSync24(path4, `${JSON.stringify(report2, null, 2)}
 `, { encoding: "utf8" });
   }
@@ -45497,7 +45747,7 @@ function formatImprovementReport(report2) {
 
 // plugins/kxm/src/modes.ts
 var import_yaml16 = __toESM(require_dist(), 1);
-import { existsSync as existsSync33, readFileSync as readFileSync33 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync34 } from "node:fs";
 import { join as join43 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
@@ -45562,11 +45812,11 @@ function loadModesConfig(projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
   const modesPath = join43(projectRoot, ".kxm", "modes.yaml");
-  if (!existsSync33(modesPath)) {
+  if (!existsSync35(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
   try {
-    const raw = readFileSync33(modesPath, "utf8");
+    const raw = readFileSync34(modesPath, "utf8");
     const parsed = (0, import_yaml16.parse)(raw);
     if (parsed && parsed.schema === "kxm.modes.v1" && parsed.majorModes) {
       return {
@@ -45654,9 +45904,9 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
   for (const relPath of resolved.contextFiles) {
     const fullPath = join43(projectRoot, relPath);
     let chars = 0;
-    if (existsSync33(fullPath)) {
+    if (existsSync35(fullPath)) {
       try {
-        chars = readFileSync33(fullPath, "utf8").length;
+        chars = readFileSync34(fullPath, "utf8").length;
       } catch {
         chars = 0;
       }
@@ -45788,9 +46038,9 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync34, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync13, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync28, readFileSync as readFileSync35, readdirSync as readdirSync13, rmSync as rmSync12, statSync as statSync5 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { join as join44, resolve as resolve26 } from "node:path";
+import { join as join44, resolve as resolve28 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -45817,11 +46067,11 @@ function truncateSshOutput(raw) {
 }
 function parseSshConfig(configPath) {
   const targetPath = configPath ?? join44(homedir8(), ".ssh", "config");
-  if (!existsSync34(targetPath)) {
+  if (!existsSync36(targetPath)) {
     return [];
   }
   try {
-    const content = readFileSync34(targetPath, "utf-8");
+    const content = readFileSync35(targetPath, "utf-8");
     const lines = content.split("\n");
     const hosts = [];
     let currentHosts = [];
@@ -45898,9 +46148,9 @@ function resolveSshHostG(host, execFn = spawnSync7) {
   }
 }
 function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
-  const resolved = resolve26(socketDir);
-  if (!existsSync34(resolved)) {
-    mkdirSync27(resolved, { recursive: true, mode: 448 });
+  const resolved = resolve28(socketDir);
+  if (!existsSync36(resolved)) {
+    mkdirSync28(resolved, { recursive: true, mode: 448 });
   }
   return resolved;
 }
@@ -46388,9 +46638,9 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 }
 
 // plugins/kxm/src/completion-install.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync25 } from "node:fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync29, readFileSync as readFileSync36, writeFileSync as writeFileSync25 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { basename as basename9, delimiter, dirname as dirname22, isAbsolute as isAbsolute9, join as join45, resolve as resolve27 } from "node:path";
+import { basename as basename9, delimiter, dirname as dirname23, isAbsolute as isAbsolute9, join as join45, resolve as resolve29 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -46406,30 +46656,30 @@ function effectiveHome(options) {
   const env = options.env ?? process.env;
   if (options.homeDir) return options.homeDir;
   const envHome = env.HOME?.trim() ?? env.USERPROFILE?.trim();
-  return envHome && envHome.length > 0 ? resolve27(envHome) : homedir9();
+  return envHome && envHome.length > 0 ? resolve29(envHome) : homedir9();
 }
 function completionScriptPath(shell, options = {}) {
   const env = options.env ?? process.env;
   const explicit = options.configDir ?? env.KXM_USER_CONFIG_DIR?.trim();
-  const base = explicit && explicit.length > 0 ? resolve27(explicit) : resolve27(effectiveHome(options), ".config", "kxm");
+  const base = explicit && explicit.length > 0 ? resolve29(explicit) : resolve29(effectiveHome(options), ".config", "kxm");
   return join45(base, "completions", `kxm.${shell}`);
 }
 function bashRcCandidate(options) {
   const home = effectiveHome(options);
   const candidates = [join45(home, ".bashrc"), join45(home, ".bash_profile")];
-  const existing = candidates.find((candidate) => existsSync35(candidate));
+  const existing = candidates.find((candidate) => existsSync37(candidate));
   return existing ?? candidates[0];
 }
 function zshRcCandidate(options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.ZDOTDIR?.trim()) return join45(resolve27(env.ZDOTDIR.trim()), ".zshrc");
+  if (env.ZDOTDIR?.trim()) return join45(resolve29(env.ZDOTDIR.trim()), ".zshrc");
   return join45(home, ".zshrc");
 }
 function fishCompletionTarget(shell, options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.XDG_CONFIG_HOME?.trim()) return join45(resolve27(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
+  if (env.XDG_CONFIG_HOME?.trim()) return join45(resolve29(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
   return join45(home, ".config", "fish", "completions", "kxm.fish");
 }
 function completionRcTarget(shell, options = {}) {
@@ -46462,16 +46712,16 @@ function installShellCompletion(shellInput, options = {}) {
   const scriptPath = completionScriptPath(shell, options);
   const { rcFile } = completionRcTarget(shell, options);
   const script = generateShellCompletion(shell);
-  const existingScript = existsSync35(scriptPath);
-  const existingScriptMatches = existingScript && readFileSync35(scriptPath, "utf8") === script;
+  const existingScript = existsSync37(scriptPath);
+  const existingScriptMatches = existingScript && readFileSync36(scriptPath, "utf8") === script;
   let rcModified = false;
   let alreadyInstalled = false;
   if (shell === "fish") {
     const fishTarget = fishCompletionTarget(shell, options);
-    const fishInstalled = existsSync35(fishTarget) && readFileSync35(fishTarget, "utf8") === script;
+    const fishInstalled = existsSync37(fishTarget) && readFileSync36(fishTarget, "utf8") === script;
     alreadyInstalled = fishInstalled;
     if (!options.dryRun && (!fishInstalled || options.overwrite)) {
-      mkdirSync28(resolve27(fishTarget, ".."), { recursive: true });
+      mkdirSync29(resolve29(fishTarget, ".."), { recursive: true });
       writeFileSync25(fishTarget, script, { encoding: "utf8" });
     }
     return {
@@ -46485,12 +46735,12 @@ function installShellCompletion(shellInput, options = {}) {
   }
   if (rcFile) {
     const line = sourceLine(shell, scriptPath);
-    const rcContent = existsSync35(rcFile) ? readFileSync35(rcFile, "utf8") : "";
+    const rcContent = existsSync37(rcFile) ? readFileSync36(rcFile, "utf8") : "";
     alreadyInstalled = rcContent.includes(line) || rcContent.includes(`${COMPLETION_MARKER}`);
   }
   if (!options.dryRun) {
     if (!existingScriptMatches || options.overwrite) {
-      mkdirSync28(resolve27(scriptPath, ".."), { recursive: true });
+      mkdirSync29(resolve29(scriptPath, ".."), { recursive: true });
       writeFileSync25(scriptPath, script, { encoding: "utf8" });
     }
     if (rcFile && !alreadyInstalled) {
@@ -46500,8 +46750,8 @@ function installShellCompletion(shellInput, options = {}) {
 ${marker}
 ${line}
 `;
-      mkdirSync28(resolve27(rcFile, ".."), { recursive: true });
-      writeFileSync25(rcFile, (existsSync35(rcFile) ? readFileSync35(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
+      mkdirSync29(resolve29(rcFile, ".."), { recursive: true });
+      writeFileSync25(rcFile, (existsSync37(rcFile) ? readFileSync36(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
       rcModified = true;
     }
   }
@@ -46517,14 +46767,14 @@ ${line}
 function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
   if (argv1 && isAbsolute9(argv1)) {
-    const dir = dirname22(argv1);
-    if (existsSync35(join45(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
+    const dir = dirname23(argv1);
+    if (existsSync37(join45(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
   const pathEnv = env.PATH ?? "";
   for (const part of pathEnv.split(delimiter)) {
     if (!part) continue;
-    const candidate = resolve27(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
-    if (existsSync35(candidate)) return resolve27(part);
+    const candidate = resolve29(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
+    if (existsSync37(candidate)) return resolve29(part);
   }
   return void 0;
 }
@@ -46542,10 +46792,10 @@ function installPathEntry(shellInput, options = {}) {
   }
   const { rcFile } = completionRcTarget(shell, options);
   const line = pathLine(binDir);
-  const rcContent = existsSync35(rcFile ?? "") ? readFileSync35(rcFile, "utf8") : "";
+  const rcContent = existsSync37(rcFile ?? "") ? readFileSync36(rcFile, "utf8") : "";
   const alreadyInstalled = rcContent.includes(binDir) || (options.env?.PATH ?? process.env.PATH ?? "").split(delimiter).includes(binDir);
   if (!options.dryRun && rcFile && !alreadyInstalled) {
-    mkdirSync28(dirname22(rcFile), { recursive: true });
+    mkdirSync29(dirname23(rcFile), { recursive: true });
     writeFileSync25(rcFile, rcContent + `
 ${PATH_MARKER}
 ${line}
@@ -46556,8 +46806,8 @@ ${line}
 
 // plugins/kxm/src/init-guide-setup.ts
 var import_yaml17 = __toESM(require_dist(), 1);
-import { existsSync as existsSync36, mkdirSync as mkdirSync29, writeFileSync as writeFileSync26 } from "node:fs";
-import { dirname as dirname23, join as join46 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync30, writeFileSync as writeFileSync26 } from "node:fs";
+import { dirname as dirname24, join as join46 } from "node:path";
 var NATIVE_VENDOR_HARNESS = Object.freeze({
   anthropic: "claude",
   openai: "codex",
@@ -46972,11 +47222,11 @@ function writeGuideSetupFiles(files) {
   const written = [];
   const existed = [];
   for (const file of files) {
-    if (existsSync36(file.path)) {
+    if (existsSync38(file.path)) {
       existed.push(file.path);
       continue;
     }
-    mkdirSync29(dirname23(file.path), { recursive: true });
+    mkdirSync30(dirname24(file.path), { recursive: true });
     writeFileSync26(file.path, file.content, "utf8");
     written.push(file.path);
   }
@@ -47040,7 +47290,7 @@ function applyKxmPackageUpdate(runtime, notice) {
       detail: `release v${notice.latest} has no sha256 digest for ${name}; refusing to install`
     };
   }
-  const releaseDir = mkdtempSync2(join47(tmpdir2(), "kxm-pkg-update-"));
+  const releaseDir = mkdtempSync3(join47(tmpdir2(), "kxm-pkg-update-"));
   try {
     const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset);
     if (runtime.dryRun) {
@@ -47049,7 +47299,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     for (const step of planned) {
       if (step.kind === "verify") {
         if (!verifyReleaseAssetDigest(step.path, step.sha256)) {
-          const actual = existsSync37(step.path) ? createHash16("sha256").update(readFileSync36(step.path)).digest("hex") : "missing";
+          const actual = existsSync39(step.path) ? createHash16("sha256").update(readFileSync37(step.path)).digest("hex") : "missing";
           return {
             ok: false,
             error: "release_digest_mismatch",
@@ -47066,7 +47316,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     }
     return { ok: true, detail: `installed ${notice.latest} from ${notice.source}` };
   } finally {
-    rmSync12(releaseDir, { recursive: true, force: true });
+    rmSync13(releaseDir, { recursive: true, force: true });
   }
 }
 async function cmdExplain(runtime, options) {
@@ -47104,6 +47354,10 @@ async function cmdSshInfo(runtime, host) {
 }
 async function cmdSshRun(runtime, host, commandParts, options) {
   const command = commandParts.join(" ");
+  if (runtime.dryRun) {
+    printPlan(runtime, { command: "ssh run", host, remoteCommand: command, sudo: options.sudo === true }, [{ action: "ssh", target: `${host}: ${options.sudo ? "sudo " : ""}${command}` }], `run a command on ${host}`);
+    return 0;
+  }
   const receipt = executeSshRun({
     action: "command",
     host,
@@ -47122,6 +47376,10 @@ async function cmdSshRun(runtime, host, commandParts, options) {
 }
 async function cmdSshFile(runtime, host, filePath, options) {
   const op = options.read ? "read" : options.append ? "append" : "write";
+  if (runtime.dryRun) {
+    printPlan(runtime, { command: "ssh file", host, path: filePath, op, sudo: options.sudo === true }, [{ action: "ssh", target: `${host}: ${op} ${filePath}` }], `${op} ${filePath} on ${host}`);
+    return 0;
+  }
   const receipt = executeSshRun({
     action: "file",
     host,
@@ -47145,6 +47403,10 @@ async function cmdSshFile(runtime, host, filePath, options) {
   return receipt.ok ? 0 : receipt.exitCode || 1;
 }
 async function cmdSshClose(runtime, host) {
+  if (runtime.dryRun) {
+    printPlan(runtime, { command: "ssh close", host }, [{ action: "ssh", target: `${host}: close the ControlMaster socket` }], `close the ControlMaster socket for ${host}`);
+    return 0;
+  }
   const closed = closeControlSocket(host);
   if (runtime.json) {
     print(runtime.io, runtime.json, { ok: true, closed, command: "ssh close", host }, "");
@@ -47314,13 +47576,13 @@ async function cmdValidate(runtime, fileFlag) {
     return 2;
   }
   const selectedFile = explicitFile || configuredFile;
-  const file = selectedFile ? resolve28(runtime.cwd, selectedFile) : void 0;
-  if (file && !existsSync37(file)) {
+  const file = selectedFile ? resolve30(runtime.cwd, selectedFile) : void 0;
+  if (file && !existsSync39(file)) {
     printWorker(runtime, worker, { ok: false, command: "validate", error: "file_not_found", file }, `workflow file not found: ${file}`);
     return 1;
   }
   try {
-    const raw = file ? readFileSync36(file, "utf8") : inline;
+    const raw = file ? readFileSync37(file, "utf8") : inline;
     const warnings = [];
     const definitions = parseWorkflowDefinitions(raw, runtime.env, (message) => warnings.push(message));
     const secretEnvs = definitions.map((definition) => ({
@@ -47345,7 +47607,7 @@ async function cmdValidate(runtime, fileFlag) {
 }
 async function cmdArtifactsExist(runtime, pathFlag) {
   const worker = gateOf(runtime, "artifacts-exist");
-  const checked = verifyArtifactExists(runtime.dirs.assets, resolve28(runtime.cwd, pathFlag));
+  const checked = verifyArtifactExists(runtime.dirs.assets, resolve30(runtime.cwd, pathFlag));
   if (!checked.ok) {
     printWorker(
       runtime,
@@ -47364,9 +47626,9 @@ async function cmdArtifactsExist(runtime, pathFlag) {
   return 0;
 }
 async function cmdImprove(runtime, options = {}) {
-  const file = options.file ? resolve28(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
-  const routingRecords = existsSync37(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
-  const candidatesDir = options.outDir ? resolve28(runtime.cwd, options.outDir) : join47(runtime.cwd, ".kxm", "candidates");
+  const file = options.file ? resolve30(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
+  const routingRecords = existsSync39(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
+  const candidatesDir = options.outDir ? resolve30(runtime.cwd, options.outDir) : join47(runtime.cwd, ".kxm", "candidates");
   const report2 = buildImprovementReport(routingRecords, {
     candidatesDir,
     projectRoot: runtime.cwd,
@@ -47415,7 +47677,11 @@ async function cmdConfigSet(runtime, key, value, options) {
       parsedVal = JSON.parse(value);
     } catch {
     }
-    setKxmConfigValue(runtime.cwd, key, parsedVal, { scope });
+    const { file } = setKxmConfigValue(runtime.cwd, key, parsedVal, { scope, dryRun: runtime.dryRun });
+    if (runtime.dryRun) {
+      printPlan(runtime, { command: "config set", key, value: parsedVal, scope }, [{ action: "write", target: file }], `set ${key} = ${value} in ${scope} config`);
+      return 0;
+    }
     print(
       runtime.io,
       runtime.json,
@@ -47504,9 +47770,9 @@ async function maybeOfferCompletionInstall(runtime) {
   if (!pathNeeded) {
     const scriptPath = completionScriptPath(shell, { env: runtime.env, configDir: runtime.env.KXM_USER_CONFIG_DIR });
     const { rcFile } = completionRcTarget(shell, { env: runtime.env });
-    if (rcFile && existsSync37(rcFile)) {
+    if (rcFile && existsSync39(rcFile)) {
       try {
-        if (readFileSync36(rcFile, "utf8").includes(scriptPath)) return;
+        if (readFileSync37(rcFile, "utf8").includes(scriptPath)) return;
       } catch {
       }
     }
@@ -47638,7 +47904,7 @@ async function cmdRoutingReport(runtime, options) {
   let catalog;
   if (includeEquivalentListCost) {
     try {
-      const pricesPath = options.prices ? resolve28(runtime.cwd, options.prices) : join47(runtime.dirs.workspace, "prices.yaml");
+      const pricesPath = options.prices ? resolve30(runtime.cwd, options.prices) : join47(runtime.dirs.workspace, "prices.yaml");
       catalog = loadPriceCatalog(pricesPath);
     } catch {
     }
@@ -47735,6 +48001,129 @@ var USAGE_ERROR_CODES = /* @__PURE__ */ new Set([
   "commander.invalidOptionArgument",
   "commander.optionMissingArgument"
 ]);
+var DRY_RUN_COMMANDS = /* @__PURE__ */ new Set([
+  "init",
+  "backup",
+  "restore",
+  "run",
+  "explain",
+  "suggest",
+  "update",
+  "dash",
+  "completion",
+  "completion install",
+  "runs status",
+  "runs drive",
+  "runs receipt",
+  "runs cancel",
+  "runs list",
+  "tenant status",
+  "models inventory-refresh",
+  "harness list",
+  "auth token",
+  "routes list",
+  "routes count",
+  "routes admit",
+  "routes disable",
+  "runtime start",
+  "runtime status",
+  "runtime sync-retry",
+  "runtime stop",
+  "trust diff",
+  "trust check",
+  "agent worker",
+  "session status",
+  "session brief",
+  "session token",
+  "session start",
+  "session stop",
+  "peer list",
+  "peer send",
+  "peer get",
+  "peer await",
+  "peer cancel",
+  "peer fanout",
+  "peer inbox",
+  "peer reply",
+  "workflow list",
+  "workflow get",
+  "workflow checkpoint",
+  "workflow record",
+  "workflow wait",
+  "workflow signal",
+  "workflow start",
+  "workflow export",
+  "workflow definitions",
+  "workflow add",
+  "workflow remove",
+  "workflow modify",
+  "role list",
+  "role get",
+  "role add",
+  "role remove",
+  "role modify",
+  "role hosts",
+  "role set-host",
+  "role resume",
+  "gate validate",
+  "gate artifacts-exist",
+  "gate degrade",
+  "gate signal",
+  "gate github watch",
+  "improve report",
+  "context get",
+  "context recall",
+  "context state",
+  "context episode",
+  "context promote",
+  "context explain",
+  "context wiki-compile",
+  "context wiki-lint",
+  "skills create",
+  "skills evaluate",
+  "skills promote",
+  "skills reject",
+  "skills list",
+  "skills verify",
+  "memory brief",
+  "memory note",
+  "memory sync",
+  "routing report",
+  "routing benchmark",
+  "ssh info",
+  "ssh run",
+  "ssh file",
+  "ssh close",
+  "hub view",
+  "hub start",
+  "hub stop",
+  "hub bind",
+  "hub unbind",
+  "config get",
+  "config set",
+  "config list",
+  "goal create",
+  "goal list",
+  "task create",
+  "task list",
+  "task get",
+  "task run",
+  "task sync",
+  "studio layout",
+  "studio serve"
+]);
+var DryRunRefused = class extends Error {
+  code;
+  constructor(code) {
+    super("dry_run_unsupported");
+    this.code = code;
+  }
+};
+function commandPath(command) {
+  const names3 = [];
+  for (let current = command; current?.parent; current = current.parent) names3.unshift(current.name());
+  return names3.join(" ");
+}
 function addGlobalOptions(command) {
   return command.option("--json", "Print machine-readable JSON").option("--dry-run", "Plan without making changes").option("--workspace <dir>", "Workspace directory");
 }
@@ -47870,6 +48259,13 @@ function createProgram(ctx, result) {
     writeErr: (text) => ctx.io.stderr(text)
   }).helpCommand("help", "Show help");
   addGlobalOptions(program2);
+  program2.hook("preAction", (_program, actionCommand) => {
+    const opts = actionCommand.optsWithGlobals();
+    if (!opts.dryRun) return;
+    const path4 = commandPath(actionCommand);
+    if (DRY_RUN_COMMANDS.has(path4)) return;
+    throw new DryRunRefused(refuseDryRun(ctx.io, Boolean(opts.json), path4, "this command cannot plan without making changes; rerun without --dry-run"));
+  });
   program2.command("init").description("Create, validate, repair, or join a KXM project").option("--json", "Print machine-readable JSON").option("--dry-run", "Plan without making changes").option("--name <name>", "Project display name for a new project").option("--project-id <id>", "Stable project ID for controlled provisioning").option("--repository <id=absolute-path>", "Bind a member repository outside Git configuration", (value, previous) => [...previous, value], []).action(async function initAction(options) {
     result.code = await cmdKxmInit(runtimeFrom(ctx, this), options, {
       maybeOfferCompletionInstall,
@@ -48337,10 +48733,11 @@ async function runCli(argv, env = process.env, io = { stdout: (text) => process.
     return result.code;
   } catch (error) {
     if (error instanceof CommanderError) return mapCommanderError(error);
+    if (error instanceof DryRunRefused) return error.code;
     throw error;
   }
 }
-if (process.argv[1] && resolve29(process.argv[1]) === fileURLToPath4(import.meta.url)) {
+if (process.argv[1] && resolve31(process.argv[1]) === fileURLToPath4(import.meta.url)) {
   const code = await runCli(process.argv.slice(2));
   process.exitCode = code;
 }