@massu/core 1.15.6 → 1.16.0

package/dist/cli.js

@@ -1082,6 +1082,142 @@ var init_db_backup = __esm({
   }
 });
 
+// src/rule-delivery.ts
+function tableExists(db, table) {
+  const row = db.prepare("SELECT 1 AS ok FROM sqlite_master WHERE type='table' AND name=?").get(table);
+  return row !== void 0;
+}
+function columns(db, table) {
+  const rows = db.prepare(`PRAGMA table_info(${table})`).all();
+  return new Set(rows.map((r2) => r2.name));
+}
+function migrateRuleDelivery(db) {
+  const ADDITIONS = [
+    { name: "attempts", decl: "INTEGER NOT NULL DEFAULT 0" },
+    { name: "lease_token", decl: "TEXT" },
+    { name: "leased_at_ms", decl: "INTEGER" },
+    { name: "last_error", decl: "TEXT" }
+  ];
+  for (const table of ALL_OUTBOUND_TABLES) {
+    if (!tableExists(db, table)) continue;
+    const cols = columns(db, table);
+    for (const add of ADDITIONS) {
+      if (cols.has(add.name)) continue;
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${add.name} ${add.decl}`);
+    }
+  }
+}
+function undeliveredSnapshot(db) {
+  const count = (t2) => {
+    if (!tableExists(db, t2)) return 0;
+    const r2 = db.prepare(`SELECT COUNT(*) AS n FROM ${t2}`).get();
+    return r2.n;
+  };
+  const promotions = count("team_promotion_outbound");
+  const revocations = count("team_revocation_outbound");
+  const events = count(TELEMETRY_OUTBOUND_TABLE);
+  let maxAttempts = 0;
+  let oldest = null;
+  for (const t2 of RULE_OUTBOUND_TABLES) {
+    if (!tableExists(db, t2)) continue;
+    if (!columns(db, t2).has("attempts")) continue;
+    const r2 = db.prepare(`SELECT MAX(attempts) AS a, MIN(created_at) AS c FROM ${t2}`).get();
+    if (r2.a !== null && r2.a > maxAttempts) maxAttempts = r2.a;
+    if (r2.c !== null && (oldest === null || r2.c < oldest)) oldest = r2.c;
+  }
+  return {
+    promotions,
+    revocations,
+    events,
+    max_rule_attempts: maxAttempts,
+    oldest_rule_created_at: oldest,
+    stalled: promotions + revocations > 0 && maxAttempts >= STALL_ATTEMPTS
+  };
+}
+function capTelemetry(db, cap = TELEMETRY_OUTBOX_CAP) {
+  if (!tableExists(db, TELEMETRY_OUTBOUND_TABLE)) return 0;
+  const before = db.prepare(`SELECT COUNT(*) AS n FROM ${TELEMETRY_OUTBOUND_TABLE}`).get();
+  if (before.n <= cap) return 0;
+  const info = db.prepare(
+    `DELETE FROM ${TELEMETRY_OUTBOUND_TABLE}
+        WHERE id NOT IN (SELECT id FROM ${TELEMETRY_OUTBOUND_TABLE} ORDER BY id DESC LIMIT ?)`
+  ).run(cap);
+  const dropped = info.changes;
+  if (dropped > 0) {
+    process.stderr.write(
+      `[massu] NOTE: dropped ${dropped} oldest promotion-funnel telemetry row(s) at the ${cap}-row cap. No learned rules were affected (rules are never dropped).
+`
+    );
+    recordAnalytics(db, EVENT_TELEMETRY_CAPPED, { dropped, cap });
+  }
+  return dropped;
+}
+function recordAnalytics(db, eventType, data) {
+  try {
+    db.prepare(
+      `INSERT INTO analytics_events (event_type, event_data, created_at)
+       VALUES (?, ?, datetime('now'))`
+    ).run(eventType, JSON.stringify(data));
+  } catch (err) {
+    process.stderr.write(
+      `[massu] WARNING: could not record '${eventType}' telemetry: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+var RULE_OUTBOUND_TABLES, TELEMETRY_OUTBOUND_TABLE, ALL_OUTBOUND_TABLES, TELEMETRY_OUTBOX_CAP, LEASE_TTL_MS, STALL_ATTEMPTS, EVENT_TELEMETRY_CAPPED;
+var init_rule_delivery = __esm({
+  "src/rule-delivery.ts"() {
+    "use strict";
+    RULE_OUTBOUND_TABLES = [
+      "team_promotion_outbound",
+      "team_revocation_outbound"
+    ];
+    TELEMETRY_OUTBOUND_TABLE = "rule_promotion_events_outbound";
+    ALL_OUTBOUND_TABLES = [
+      ...RULE_OUTBOUND_TABLES,
+      TELEMETRY_OUTBOUND_TABLE
+    ];
+    TELEMETRY_OUTBOX_CAP = 2e4;
+    LEASE_TTL_MS = 15 * 60 * 1e3;
+    STALL_ATTEMPTS = 5;
+    EVENT_TELEMETRY_CAPPED = "rule_telemetry_capped";
+  }
+});
+
+// src/rule-candidate-store.ts
+function ensureRuleCandidatesTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS rule_candidates (
+      prompt_hash  TEXT PRIMARY KEY,
+      status       TEXT NOT NULL DEFAULT 'proposed'
+                     CHECK (status IN ('proposed','shown','promoted','dismissed')),
+      origin       TEXT NOT NULL DEFAULT 'local'
+                     CHECK (origin IN ('local','team','pack')),
+      score        REAL,
+      destination  TEXT,
+      payload_json TEXT NOT NULL DEFAULT '{}',
+      created_at   TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at   TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_rule_candidates_status ON rule_candidates(status);
+    CREATE INDEX IF NOT EXISTS idx_rule_candidates_created ON rule_candidates(created_at);
+  `);
+}
+function setCandidateStatus(db, promptHash, status, destination) {
+  ensureRuleCandidatesTable(db);
+  db.prepare(`
+    UPDATE rule_candidates
+       SET status = ?, destination = COALESCE(?, destination), updated_at = datetime('now')
+     WHERE prompt_hash = ?
+  `).run(status, destination ?? null, promptHash);
+}
+var init_rule_candidate_store = __esm({
+  "src/rule-candidate-store.ts"() {
+    "use strict";
+  }
+});
+
 // src/hooks/lib/hook-failure-signal.ts
 import { appendFileSync, mkdirSync as mkdirSync3, existsSync as existsSync4 } from "fs";
 import { join as join2, dirname as dirname3 } from "path";
@@ -1650,9 +1786,6 @@ __export(memory_db_exports, {
   createSession: () => createSession,
   deduplicateFailedAttempt: () => deduplicateFailedAttempt,
   dequeuePendingSync: () => dequeuePendingSync,
-  drainRulePromotionEvents: () => drainRulePromotionEvents,
-  drainTeamPromotions: () => drainTeamPromotions,
-  drainTeamRevocations: () => drainTeamRevocations,
   embedMissingObservations: () => embedMissingObservations,
   endSession: () => endSession,
   enqueueRulePromotionEvent: () => enqueueRulePromotionEvent,
@@ -2559,6 +2692,8 @@ function initMemorySchema(db) {
   `);
   migrateObservationEmbeddingChunks(db);
   migrateMemoryFilesFor4B(db);
+  ensureRuleCandidatesTable(db);
+  migrateRuleDelivery(db);
 }
 function enqueueSyncPayload(db, payload) {
   db.prepare("INSERT INTO pending_sync (payload) VALUES (?)").run(payload);
@@ -2633,38 +2768,12 @@ function enqueueTeamPromotion(db, promo) {
     promo.review_attestation !== void 0 ? JSON.stringify(promo.review_attestation) : null
   );
 }
-function drainTeamPromotions(db) {
-  const rows = db.prepare(`
-    SELECT prompt_hash, destination, draft_text, score, signals_json, content_hash, hardened, review_attestation_json
-    FROM team_promotion_outbound ORDER BY created_at ASC LIMIT 1000
-  `).all();
-  if (rows.length === 0) return [];
-  db.prepare("DELETE FROM team_promotion_outbound").run();
-  return rows.map((r2) => ({
-    prompt_hash: r2.prompt_hash,
-    destination: r2.destination,
-    draft_text: r2.draft_text,
-    score: r2.score ?? void 0,
-    signals: safeJsonArray(r2.signals_json),
-    content_hash: r2.content_hash,
-    hardened: r2.hardened === 1,
-    review_attestation: r2.review_attestation_json ? safeJsonParse(r2.review_attestation_json) : void 0
-  }));
-}
 function enqueueTeamRevocation(db, promptHash) {
   db.prepare(`
     INSERT OR REPLACE INTO team_revocation_outbound (prompt_hash, created_at)
     VALUES (?, datetime('now'))
   `).run(promptHash);
 }
-function drainTeamRevocations(db) {
-  const rows = db.prepare(
-    `SELECT prompt_hash FROM team_revocation_outbound ORDER BY created_at ASC LIMIT 1000`
-  ).all();
-  if (rows.length === 0) return [];
-  db.prepare("DELETE FROM team_revocation_outbound").run();
-  return rows.map((r2) => r2.prompt_hash);
-}
 function getRecurrenceCountForPromptHash(db, promptHash) {
   try {
     const row = db.prepare(`
@@ -2692,30 +2801,14 @@ function enqueueRulePromotionEvent(db, ev) {
       JSON.stringify(ev.metadata ?? {}),
       ev.created_at
     );
-    db.prepare(`
-      DELETE FROM rule_promotion_events_outbound
-      WHERE id NOT IN (
-        SELECT id FROM rule_promotion_events_outbound ORDER BY id DESC LIMIT ?
-      )
-    `).run(FUNNEL_EVENT_OUTBOX_CAP);
-  } catch {
+    capTelemetry(db, FUNNEL_EVENT_OUTBOX_CAP);
+  } catch (err) {
+    process.stderr.write(
+      `[massu] WARNING: failed to record promotion-funnel event (${ev.event_type} / ${ev.prompt_hash}): ${err instanceof Error ? err.message : String(err)}
+`
+    );
   }
 }
-function drainRulePromotionEvents(db) {
-  const rows = db.prepare(`
-    SELECT id, prompt_hash, event_type, metadata_json, created_at
-    FROM rule_promotion_events_outbound ORDER BY id ASC LIMIT ?
-  `).all(FUNNEL_EVENT_DRAIN_LIMIT);
-  if (rows.length === 0) return [];
-  const maxId = rows[rows.length - 1].id;
-  db.prepare("DELETE FROM rule_promotion_events_outbound WHERE id <= ?").run(maxId);
-  return rows.map((r2) => ({
-    prompt_hash: r2.prompt_hash,
-    event_type: r2.event_type,
-    created_at: r2.created_at,
-    metadata: safeJsonParse(r2.metadata_json) ?? {}
-  }));
-}
 function recordTelemetry(db, eventType, data) {
   try {
     db.prepare(`
@@ -2725,28 +2818,55 @@ function recordTelemetry(db, eventType, data) {
   } catch {
   }
 }
-function safeJsonArray(json) {
-  try {
-    const v3 = JSON.parse(json);
-    return Array.isArray(v3) ? v3 : [];
-  } catch {
-    return [];
-  }
-}
-function safeJsonParse(json) {
-  try {
-    return JSON.parse(json);
-  } catch {
-    return void 0;
+function rescueLearningFromStalePayloads(db, stale) {
+  let rescued = 0;
+  for (const item of stale) {
+    let payload;
+    try {
+      payload = JSON.parse(item.payload);
+    } catch {
+      continue;
+    }
+    try {
+      const promotions = Array.isArray(payload.rule_promotions) ? payload.rule_promotions : [];
+      for (const p19 of promotions) {
+        enqueueTeamPromotion(db, p19);
+        rescued++;
+      }
+      const revocations = Array.isArray(payload.rule_revocations) ? payload.rule_revocations : [];
+      for (const r2 of revocations) {
+        if (typeof r2?.prompt_hash === "string") {
+          enqueueTeamRevocation(db, r2.prompt_hash);
+          rescued++;
+        }
+      }
+      const events = Array.isArray(payload.rule_promotion_events) ? payload.rule_promotion_events : [];
+      for (const e2 of events) {
+        enqueueRulePromotionEvent(db, e2);
+      }
+    } catch (err) {
+      process.stderr.write(
+        `[massu] WARNING: failed to rescue learned rules from give-up payload ${item.id}: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+    }
   }
+  return rescued;
 }
 function dequeuePendingSync(db, limit = 10) {
   const stale = db.prepare(
-    "SELECT id, retry_count, last_error FROM pending_sync WHERE retry_count >= 10 LIMIT 10000"
+    "SELECT id, retry_count, last_error, payload FROM pending_sync WHERE retry_count >= 10 LIMIT 10000"
   ).all();
   if (stale.length > 0) {
+    const rescued = rescueLearningFromStalePayloads(db, stale);
     const ids = stale.map((s) => s.id);
     db.prepare(`DELETE FROM pending_sync WHERE id IN (${ids.map(() => "?").join(",")})`).run(...ids);
+    if (rescued > 0) {
+      process.stderr.write(
+        `[massu] RESCUED ${rescued} learned rule(s) from ${stale.length} give-up payload(s) \u2014 they were re-queued for delivery, NOT discarded.
+`
+      );
+    }
     const lastErrors = [...new Set(stale.map((s) => s.last_error).filter(Boolean))];
     process.stderr.write(
       `[massu] WARNING: ${stale.length} cloud-sync queue item(s) discarded after 10+ retries. Likely cause: invalid API key or unreachable endpoint. Recent errors: ${lastErrors.slice(0, 3).join("; ") || "(none recorded)"}
@@ -3438,19 +3558,20 @@ function scoreFailureClasses(db, matchText, filePath, promptContext, weights) {
   }
   return bestMatch;
 }
-var MEMORY_SCHEMA_VERSION, TOOL_COST_EVENTS_RETENTION_DAYS, MAX_DRAFT_TEXT_LEN, FUNNEL_EVENT_DRAIN_LIMIT, FUNNEL_EVENT_OUTBOX_CAP, _temporalColCache, CONSOLIDATION_LESSON_EVIDENCE, MEMORY_FILE_TITLE_PREFIX, MEMORY_FILE_TITLE_LIKE, USAGE_COUNTER_ARMED_KEY;
+var MEMORY_SCHEMA_VERSION, TOOL_COST_EVENTS_RETENTION_DAYS, MAX_DRAFT_TEXT_LEN, FUNNEL_EVENT_OUTBOX_CAP, _temporalColCache, CONSOLIDATION_LESSON_EVIDENCE, MEMORY_FILE_TITLE_PREFIX, MEMORY_FILE_TITLE_LIKE, USAGE_COUNTER_ARMED_KEY;
 var init_memory_db = __esm({
   "src/memory-db.ts"() {
     "use strict";
     init_config();
     init_memory_vector();
     init_db_backup();
+    init_rule_delivery();
+    init_rule_candidate_store();
     init_hook_failure_signal();
     init_memory_embed_sweep();
     MEMORY_SCHEMA_VERSION = 1;
     TOOL_COST_EVENTS_RETENTION_DAYS = 90;
     MAX_DRAFT_TEXT_LEN = 16384;
-    FUNNEL_EVENT_DRAIN_LIMIT = 5e3;
     FUNNEL_EVENT_OUTBOX_CAP = 2e4;
     _temporalColCache = /* @__PURE__ */ new WeakMap();
     CONSOLIDATION_LESSON_EVIDENCE = "consolidation:session-summary";
@@ -4132,11 +4253,15 @@ var init_permissions = __esm({
 // src/commands/install-commands.ts
 var install_commands_exports = {};
 __export(install_commands_exports, {
+  MASSU_OWNED_PATHS: () => MASSU_OWNED_PATHS,
   buildTemplateVars: () => buildTemplateVars,
+  canonicalizeOwned: () => canonicalizeOwned,
   hashContent: () => hashContent,
   installAll: () => installAll,
   installCommands: () => installCommands,
+  isMassuOwned: () => isMassuOwned,
   loadManifest: () => loadManifest,
+  massuOwnedSourceIsValid: () => massuOwnedSourceIsValid,
   pickVariant: () => pickVariant,
   resolveAssetDir: () => resolveAssetDir,
   resolveCommandsDir: () => resolveCommandsDir,
@@ -4155,25 +4280,51 @@ import {
 import { resolve as resolve6, dirname as dirname7, join as join6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createHash as createHash3 } from "crypto";
+function dirHoldsAssets(dir) {
+  if (!existsSync9(dir)) return false;
+  try {
+    return readdirSync3(dir).some(
+      (e2) => e2.endsWith(".md") || statSync2(resolve6(dir, e2)).isDirectory()
+    );
+  } catch {
+    return false;
+  }
+}
 function resolveAssetDir(assetName) {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve6(cwd, "node_modules/@massu/core", assetName);
-  if (existsSync9(nodeModulesPath)) {
-    return nodeModulesPath;
-  }
-  const distRelPath = resolve6(__dirname, "..", assetName);
-  if (existsSync9(distRelPath)) {
-    return distRelPath;
-  }
-  const srcRelPath = resolve6(__dirname, "../..", assetName);
-  if (existsSync9(srcRelPath)) {
-    return srcRelPath;
+  const candidates = [
+    // 1. npm-installed: node_modules/@massu/core/{assetName}
+    resolve6(cwd, "node_modules/@massu/core", assetName),
+    // 2. Relative to compiled dist/cli.js → ../{assetName}
+    resolve6(__dirname, "..", assetName),
+    // 3. Relative to source src/commands/ → ../../{assetName}
+    resolve6(__dirname, "../..", assetName)
+  ];
+  for (const c2 of candidates) {
+    if (dirHoldsAssets(c2)) return c2;
   }
   return null;
 }
 function resolveCommandsDir() {
   return resolveAssetDir("commands");
 }
+function isMassuOwned(manifestKey) {
+  return MASSU_OWNED_PATHS.includes(manifestKey);
+}
+function canonicalizeOwned(content) {
+  return content.replace(/\r\n/g, "\n").split("\n").map((l2) => l2.replace(/\s+$/, "")).join("\n").trim();
+}
+function massuOwnedSourceIsValid(resolvedSourcePath, content) {
+  const sidecar = `${resolvedSourcePath}.sha256`;
+  if (!existsSync9(sidecar)) return false;
+  let expected;
+  try {
+    expected = readFileSync6(sidecar, "utf-8").trim();
+  } catch {
+    return false;
+  }
+  return hashContent(canonicalizeOwned(content)) === expected;
+}
 function hashContent(content) {
   return createHash3("sha256").update(content, "utf-8").digest("hex");
 }
@@ -4349,13 +4500,38 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
     const manifestKey = manifestKeyPrefix === "" ? targetFilename : `${manifestKeyPrefix}/${targetFilename}`;
     const lastInstalledHash = manifest.entries[manifestKey];
     if (existsSync9(targetPath)) {
-      const existingContent = readFileSync6(targetPath, "utf-8");
+      let existingContent;
+      try {
+        if (!statSync2(targetPath).isFile()) throw new Error("not a regular file");
+        existingContent = readFileSync6(targetPath, "utf-8");
+      } catch (err) {
+        process.stderr.write(
+          `massu: skipping ${manifestKey}: target is not a readable file (${err instanceof Error ? err.message : String(err)}). Remove it and re-install.
+`
+        );
+        stats.skipped++;
+        continue;
+      }
       const existingHash = hashContent(existingContent);
       if (existingHash === sourceHash) {
         manifest.entries[manifestKey] = sourceHash;
         stats.skipped++;
         continue;
       }
+      if (isMassuOwned(manifestKey)) {
+        if (!massuOwnedSourceIsValid(resolvedSourcePath, sourceContent)) {
+          process.stderr.write(
+            `massu: REFUSING to overwrite massu-owned ${manifestKey} \u2014 the source failed its integrity hash (${resolvedSourcePath}.sha256 missing or mismatched). Your installed @massu/core may be stale or tampered; run \`npm i @massu/core@latest\` and re-install. Kept the existing file.
+`
+          );
+          stats.kept++;
+          continue;
+        }
+        atomicWriteFile(targetPath, sourceContent);
+        manifest.entries[manifestKey] = sourceHash;
+        stats.updated++;
+        continue;
+      }
       if (lastInstalledHash === void 0) {
         process.stderr.write(
           `First-install: keeping existing ${targetPath} (differs from upstream, and massu has no record of writing it).
@@ -4531,7 +4707,7 @@ async function runInstallCommands() {
   console.log("  Restart your Claude Code session to use them.");
   console.log("");
 }
-var __filename, __dirname, ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, PASSTHROUGH_LANG_KEYS;
+var __filename, __dirname, ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, MASSU_OWNED_PATHS, PASSTHROUGH_LANG_KEYS;
 var init_install_commands = __esm({
   "src/commands/install-commands.ts"() {
     "use strict";
@@ -4550,6 +4726,7 @@ var init_install_commands = __esm({
     ];
     MANIFEST_VERSION = 1;
     MANIFEST_RELPATH = join6(".massu", "install-manifest.json");
+    MASSU_OWNED_PATHS = ["commands/_verification-laws.md"];
     PASSTHROUGH_LANG_KEYS = [
       "typescript",
       "javascript",
@@ -9103,21 +9280,21 @@ var require_pattern = __commonJS({
     exports.removeDuplicateSlashes = removeDuplicateSlashes;
     function partitionAbsoluteAndRelative(patterns) {
       const absolute = [];
-      const relative14 = [];
+      const relative15 = [];
       for (const pattern of patterns) {
-        if (isAbsolute4(pattern)) {
+        if (isAbsolute5(pattern)) {
           absolute.push(pattern);
         } else {
-          relative14.push(pattern);
+          relative15.push(pattern);
         }
       }
-      return [absolute, relative14];
+      return [absolute, relative15];
     }
     exports.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
-    function isAbsolute4(pattern) {
+    function isAbsolute5(pattern) {
       return path.isAbsolute(pattern);
     }
-    exports.isAbsolute = isAbsolute4;
+    exports.isAbsolute = isAbsolute5;
   }
 });
 
@@ -17919,6 +18096,28 @@ function autoLearningUpgradeMessage(currentTier) {
 function entitledForTeamSharedPromotion(tier) {
   return tierLevel(tier) >= tierLevel(TEAM_SHARED_PROMOTION_MIN_TIER);
 }
+function teamSharedPromotionUpgradeMessage(currentTier) {
+  return `Team-shared rule promotion (your team learns as one \u2014 a promoted rule propagates to your org as a reviewable proposal) is a Team feature. Your tier: ${currentTier.toUpperCase()}. Upgrade at https://massu.ai/pricing`;
+}
+async function assertAutoLearningEntitled() {
+  try {
+    const currentTier = await getCurrentTier();
+    if (entitledForAutoLearning(currentTier)) {
+      return { entitled: true, currentTier };
+    }
+    return {
+      entitled: false,
+      currentTier,
+      message: autoLearningUpgradeMessage(currentTier)
+    };
+  } catch {
+    return {
+      entitled: false,
+      currentTier: "free",
+      message: autoLearningUpgradeMessage("free")
+    };
+  }
+}
 var AUTO_LEARNING_MIN_TIER, TEAM_SHARED_PROMOTION_MIN_TIER;
 var init_auto_learning_entitlement = __esm({
   "src/auto-learning-entitlement.ts"() {
@@ -19284,6 +19483,12 @@ function assertOutsideRegionUnchanged(pre, post) {
     );
   }
 }
+function readRegionLines(content) {
+  const state = parseRegion(content);
+  if (state.kind !== "valid") return [];
+  const inner = content.slice(state.beginIdx + BEGIN_SENTINEL.length, state.endIdx);
+  return inner.split("\n").filter((l2) => l2.trim().length > 0);
+}
 function memoryIndexLockPath(memoryDir) {
   return join16(dirname15(memoryDir), ".massu-memory-index.lock");
 }
@@ -19308,7 +19513,7 @@ function writeMemoryIndex(indexPath, pre, post) {
   assertOutsideRegionUnchanged(pre, post);
   atomicWriteFileSync(indexPath, post);
 }
-var BEGIN_SENTINEL, END_SENTINEL, RegionRefused, LOCK_BLOCK_MS, LOCK_STALE_MS, MemoryIndexLockBusy;
+var BEGIN_SENTINEL, END_SENTINEL, DEFAULT_MAX_REGION_LINES, RegionRefused, MemoryIndexMissing, LOCK_BLOCK_MS, LOCK_STALE_MS, MemoryIndexLockBusy;
 var init_memory_index_region = __esm({
   "src/memory-index-region.ts"() {
     "use strict";
@@ -19316,6 +19521,7 @@ var init_memory_index_region = __esm({
     init_safe_write();
     BEGIN_SENTINEL = "<!-- massu:learned:begin -->";
     END_SENTINEL = "<!-- massu:learned:end -->";
+    DEFAULT_MAX_REGION_LINES = 50;
     RegionRefused = class extends Error {
       constructor(message, reason) {
         super(message);
@@ -19324,6 +19530,12 @@ var init_memory_index_region = __esm({
       }
       reason;
     };
+    MemoryIndexMissing = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "MemoryIndexMissing";
+      }
+    };
     LOCK_BLOCK_MS = 2e3;
     LOCK_STALE_MS = 3e4;
     MemoryIndexLockBusy = class extends Error {
@@ -20008,6 +20220,1149 @@ var init_memory_render_cli_entry = __esm({
   }
 });
 
+// src/lib/corrections-md.ts
+function formatCorrectionEntry(e2) {
+  const one = (s) => s.replace(/\s*\n+\s*/g, " ").trim();
+  const lines = [`### ${e2.date} - ${one(e2.title)}`];
+  if (e2.wrong) lines.push(`- **Wrong**: ${one(e2.wrong)}`);
+  if (e2.correction) lines.push(`- **Correction**: ${one(e2.correction)}`);
+  lines.push(`- **Rule**: ${one(e2.rule)}`);
+  for (const [k3, v3] of Object.entries(e2.extra ?? {})) {
+    lines.push(`- ${k3}: ${one(String(v3))}`);
+  }
+  return `
+${lines.join("\n")}
+`;
+}
+var init_corrections_md = __esm({
+  "src/lib/corrections-md.ts"() {
+    "use strict";
+  }
+});
+
+// src/audit-trail.ts
+function p2(baseName) {
+  return `${getConfig().toolPrefix}_${baseName}`;
+}
+function getAuditFormats() {
+  return getConfig().governance?.audit?.formats ?? DEFAULT_FORMATS;
+}
+function logAuditEntry(db, entry) {
+  db.prepare(`
+    INSERT INTO audit_log (session_id, event_type, actor, model_id, file_path, change_type, rules_in_effect, approval_status, evidence, metadata)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(
+    entry.sessionId ?? null,
+    entry.eventType,
+    entry.actor,
+    entry.modelId ?? null,
+    entry.filePath ?? null,
+    entry.changeType ?? null,
+    entry.rulesInEffect ?? null,
+    entry.approvalStatus ?? null,
+    entry.evidence ?? null,
+    entry.metadata ? JSON.stringify(entry.metadata) : null
+  );
+}
+function queryAuditLog(db, options) {
+  let sql = "SELECT * FROM audit_log WHERE 1=1";
+  const params = [];
+  if (options.eventType) {
+    sql += " AND event_type = ?";
+    params.push(options.eventType);
+  }
+  if (options.actor) {
+    sql += " AND actor = ?";
+    params.push(options.actor);
+  }
+  if (options.days) {
+    sql += " AND timestamp >= datetime('now', ?)";
+    params.push(`-${options.days} days`);
+  }
+  if (options.filePath) {
+    sql += " AND file_path = ?";
+    params.push(options.filePath);
+  }
+  if (options.changeType) {
+    sql += " AND change_type = ?";
+    params.push(options.changeType);
+  }
+  sql += " ORDER BY timestamp DESC";
+  if (options.limit) {
+    sql += " LIMIT ?";
+    params.push(options.limit);
+  }
+  return db.prepare(sql).all(...params);
+}
+function getFileChain(db, filePath) {
+  return db.prepare(
+    "SELECT * FROM audit_log WHERE file_path = ? ORDER BY timestamp ASC LIMIT 10000"
+  ).all(filePath);
+}
+function getAuditToolDefinitions() {
+  return [
+    {
+      name: p2("audit_log"),
+      description: "Query the audit log. Filter by event type, actor, file, or time range.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          event_type: { type: "string", description: "Filter by event type: code_change, rule_enforced, approval, review, commit, compaction" },
+          actor: { type: "string", description: "Filter by actor: ai, human, hook, agent" },
+          file_path: { type: "string", description: "Filter by file path" },
+          change_type: { type: "string", description: "Filter by change type: create, edit, delete" },
+          days: { type: "number", description: "Days to look back (default: 30)" },
+          limit: { type: "number", description: "Max results (default: 50)" }
+        },
+        required: []
+      }
+    },
+    {
+      name: p2("audit_report"),
+      description: "Generate an audit report in a specified format (summary, detailed, soc2).",
+      inputSchema: {
+        type: "object",
+        properties: {
+          format: { type: "string", description: "Report format: summary, detailed, soc2 (default: summary)" },
+          days: { type: "number", description: "Days to cover (default: 30)" }
+        },
+        required: []
+      }
+    },
+    {
+      name: p2("audit_chain"),
+      description: "Get the complete audit trail for a specific file. Shows all changes, reviews, and decisions chronologically.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          file: { type: "string", description: "File path to trace" }
+        },
+        required: ["file"]
+      }
+    }
+  ];
+}
+function isAuditTool(name) {
+  const pfx = getConfig().toolPrefix + "_";
+  const baseName = name.startsWith(pfx) ? name.slice(pfx.length) : name;
+  return AUDIT_BASE_NAMES.has(baseName);
+}
+function handleAuditToolCall(name, args2, memoryDb) {
+  try {
+    const pfx = getConfig().toolPrefix + "_";
+    const baseName = name.startsWith(pfx) ? name.slice(pfx.length) : name;
+    switch (baseName) {
+      case "audit_log":
+        return handleAuditLog(args2, memoryDb);
+      case "audit_report":
+        return handleAuditReport(args2, memoryDb);
+      case "audit_chain":
+        return handleAuditChain(args2, memoryDb);
+      default:
+        return text(`Unknown audit tool: ${name}`);
+    }
+  } catch (error) {
+    return text(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
+
+Usage: ${p2("audit_log")} { severity: "critical" }, ${p2("audit_report")} { format: "soc2" }`);
+  }
+}
+function handleAuditLog(args2, db) {
+  const entries = queryAuditLog(db, {
+    eventType: args2.event_type,
+    actor: args2.actor,
+    filePath: args2.file_path,
+    changeType: args2.change_type,
+    days: args2.days ?? 30,
+    limit: args2.limit ?? 50
+  });
+  if (entries.length === 0) {
+    return text(`No audit log entries found matching the filters. Audit entries are recorded automatically during code changes, rule checks, and commits. Try broadening your search: ${p2("audit_log")} { days: 90 } for a longer time range, or ${p2("audit_log")} {} with no filters.`);
+  }
+  const lines = [
+    `## Audit Log (${entries.length} entries)`,
+    "",
+    "| Timestamp | Event | Actor | Change | File | Evidence |",
+    "|-----------|-------|-------|--------|------|----------|"
+  ];
+  for (const entry of entries) {
+    const file = entry.file_path ? entry.file_path.split("/").pop() : "-";
+    const evidence = entry.evidence ? entry.evidence.slice(0, 50) : "-";
+    lines.push(
+      `| ${entry.timestamp.slice(0, 16)} | ${entry.event_type} | ${entry.actor} | ${entry.change_type ?? "-"} | ${file} | ${evidence} |`
+    );
+  }
+  return text(lines.join("\n"));
+}
+function handleAuditReport(args2, db) {
+  const format = args2.format ?? "summary";
+  const days = args2.days ?? 30;
+  const availableFormats = getAuditFormats();
+  if (!availableFormats.includes(format)) {
+    return text(`Unknown report format: "${format}". Available formats: ${availableFormats.join(", ")}. Example: ${p2("audit_report")} { format: "soc2", days: 30 }. Configure additional formats via the governance.audit.formats config key.`);
+  }
+  const entries = queryAuditLog(db, { days });
+  if (entries.length === 0) {
+    return text(`No audit entries found in the last ${days} days. Audit entries are recorded automatically during code changes, reviews, and commits. Try: ${p2("audit_log")} { days: 90 } for a longer time range.`);
+  }
+  const byEventType = {};
+  const byActor = {};
+  for (const e2 of entries) {
+    const et = e2.event_type;
+    byEventType[et] = (byEventType[et] ?? 0) + 1;
+    const actor = e2.actor;
+    byActor[actor] = (byActor[actor] ?? 0) + 1;
+  }
+  if (format === "soc2") {
+    return generateSoc2Report(entries, byEventType, byActor, days);
+  }
+  if (format === "detailed") {
+    return generateDetailedReport(entries, byEventType, byActor, days);
+  }
+  const lines = [
+    `## Audit Summary Report (${days} days)`,
+    `Generated: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)}`,
+    "",
+    "### By Event Type",
+    `| Event Type | Count |`,
+    `|------------|-------|`
+  ];
+  for (const [et, count] of Object.entries(byEventType).sort((a2, b2) => b2[1] - a2[1])) {
+    lines.push(`| ${et} | ${count} |`);
+  }
+  lines.push(`| **Total** | **${entries.length}** |`);
+  lines.push("");
+  lines.push("### By Actor");
+  lines.push(`| Actor | Count |`);
+  lines.push(`|-------|-------|`);
+  for (const [actor, count] of Object.entries(byActor).sort((a2, b2) => b2[1] - a2[1])) {
+    lines.push(`| ${actor} | ${count} |`);
+  }
+  return text(lines.join("\n"));
+}
+function generateSoc2Report(entries, byEventType, byActor, days) {
+  const lines = [
+    `# SOC 2 Compliance Report`,
+    `Period: Last ${days} days`,
+    `Generated: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    "",
+    "## 1. Control Environment",
+    `Total audit events: ${entries.length}`,
+    `Human-initiated: ${byActor["human"] ?? 0}`,
+    `AI-initiated: ${byActor["ai"] ?? 0}`,
+    `Hook-triggered: ${byActor["hook"] ?? 0}`,
+    "",
+    "## 2. Change Management",
+    `Code changes logged: ${byEventType["code_change"] ?? 0}`,
+    `Rule enforcements: ${byEventType["rule_enforced"] ?? 0}`,
+    `Approvals recorded: ${byEventType["approval"] ?? 0}`,
+    `Reviews: ${byEventType["review"] ?? 0}`,
+    `Commits: ${byEventType["commit"] ?? 0}`,
+    "",
+    "## 3. Approval Status"
+  ];
+  const pendingApprovals = entries.filter((e2) => e2.approval_status === "pending");
+  const deniedApprovals = entries.filter((e2) => e2.approval_status === "denied");
+  lines.push(`Pending approvals: ${pendingApprovals.length}`);
+  lines.push(`Denied approvals: ${deniedApprovals.length}`);
+  lines.push("");
+  lines.push("## 4. Events Requiring Review");
+  const reviewEntries = entries.filter((e2) => e2.approval_status === "denied" || e2.event_type === "rule_enforced");
+  if (reviewEntries.length > 0) {
+    for (const e2 of reviewEntries.slice(0, 20)) {
+      lines.push(`- [${e2.timestamp.slice(0, 16)}] ${e2.event_type}: ${(e2.evidence ?? "").slice(0, 100)}`);
+    }
+  } else {
+    lines.push("No events requiring review in this period.");
+  }
+  return text(lines.join("\n"));
+}
+function generateDetailedReport(entries, byEventType, byActor, days) {
+  const lines = [
+    `## Detailed Audit Report (${days} days)`,
+    `Total events: ${entries.length}`,
+    "",
+    "### Event Type Distribution"
+  ];
+  for (const [et, count] of Object.entries(byEventType).sort((a2, b2) => b2[1] - a2[1])) {
+    lines.push(`- ${et}: ${count}`);
+  }
+  lines.push("");
+  lines.push("### Actor Distribution");
+  for (const [actor, count] of Object.entries(byActor).sort((a2, b2) => b2[1] - a2[1])) {
+    lines.push(`- ${actor}: ${count}`);
+  }
+  lines.push("");
+  lines.push("### All Events");
+  for (const e2 of entries.slice(0, 100)) {
+    lines.push(`#### ${e2.timestamp.slice(0, 16)} [${e2.event_type}]`);
+    lines.push(`Actor: ${e2.actor} | Change: ${e2.change_type ?? "-"} | Approval: ${e2.approval_status ?? "-"}`);
+    if (e2.file_path) lines.push(`File: ${e2.file_path}`);
+    if (e2.evidence) lines.push(`Evidence: ${e2.evidence}`);
+    lines.push("");
+  }
+  if (entries.length > 100) {
+    lines.push(`... and ${entries.length - 100} more entries`);
+  }
+  return text(lines.join("\n"));
+}
+function handleAuditChain(args2, db) {
+  const filePath = args2.file;
+  if (!filePath) return text(`Usage: ${p2("audit_chain")} { file: "src/path/to/file.ts" } - Get complete audit history for a file.`);
+  const chain = getFileChain(db, filePath);
+  if (chain.length === 0) {
+    return text(`No audit entries found for "${filePath}". Audit entries are recorded automatically when files are modified, reviewed, or validated. Try: ${p2("audit_log")} {} to see all recent audit entries across all files.`);
+  }
+  const lines = [
+    `## Audit Chain: ${filePath}`,
+    `Total events: ${chain.length}`,
+    ""
+  ];
+  for (const entry of chain) {
+    lines.push(`### ${entry.timestamp.slice(0, 16)} [${entry.event_type}]`);
+    lines.push(`**${entry.actor}** (${entry.change_type ?? "unknown"})`);
+    if (entry.evidence) lines.push(entry.evidence);
+    lines.push("");
+  }
+  return text(lines.join("\n"));
+}
+function text(content) {
+  return { content: [{ type: "text", text: content }] };
+}
+var DEFAULT_FORMATS, AUDIT_BASE_NAMES;
+var init_audit_trail = __esm({
+  "src/audit-trail.ts"() {
+    "use strict";
+    init_config();
+    DEFAULT_FORMATS = ["summary", "detailed", "soc2"];
+    AUDIT_BASE_NAMES = /* @__PURE__ */ new Set(["audit_log", "audit_report", "audit_chain"]);
+  }
+});
+
+// src/template-renderer.ts
+function renderTemplate2(template, vars) {
+  return template.replace(INTERPOLATION_TOKEN, (_2, raw) => {
+    const key = raw.trim();
+    if (!IDENTIFIER_SHAPE.test(key)) {
+      throw new TemplateAllowlistError(key, [...ALLOWED_VARS]);
+    }
+    if (!ALLOWED_VARS.has(key)) {
+      throw new TemplateAllowlistError(key, [...ALLOWED_VARS]);
+    }
+    const v3 = vars[key];
+    if (v3 === void 0) {
+      throw new TemplateMissingValueError(key);
+    }
+    return String(v3);
+  });
+}
+var ALLOWED_VARS, TemplateAllowlistError, TemplateMissingValueError, IDENTIFIER_SHAPE, INTERPOLATION_TOKEN;
+var init_template_renderer = __esm({
+  "src/template-renderer.ts"() {
+    "use strict";
+    ALLOWED_VARS = /* @__PURE__ */ new Set([
+      "date",
+      "slug",
+      "score",
+      "signals_csv",
+      "prompt_preview",
+      "destination_name"
+    ]);
+    TemplateAllowlistError = class extends Error {
+      constructor(key, allowedVars) {
+        super(`template variable "${key}" is not in the allowlist [${allowedVars.join(", ")}]`);
+        this.key = key;
+        this.allowedVars = allowedVars;
+        this.name = "TemplateAllowlistError";
+      }
+      key;
+      allowedVars;
+    };
+    TemplateMissingValueError = class extends Error {
+      constructor(key) {
+        super(`template variable "${key}" is allowed but no value was supplied`);
+        this.key = key;
+        this.name = "TemplateMissingValueError";
+      }
+      key;
+    };
+    IDENTIFIER_SHAPE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+    INTERPOLATION_TOKEN = /\$\{([^}]*)\}/g;
+  }
+});
+
+// src/rule-candidate-funnel.ts
+function recordApprovalFunnelEvent(db, promptHash, destination, score, entitledTeam) {
+  if (!entitledTeam) return;
+  enqueueRulePromotionEvent(db, {
+    prompt_hash: promptHash,
+    event_type: "approved",
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    metadata: { destination, score }
+  });
+}
+function recordDismissalFunnelEvent(db, promptHash, score) {
+  try {
+    if (entitledForTeamSharedPromotion(getCachedTierReadOnly(db))) {
+      enqueueRulePromotionEvent(db, {
+        prompt_hash: promptHash,
+        event_type: "dismissed",
+        created_at: (/* @__PURE__ */ new Date()).toISOString(),
+        metadata: { score }
+      });
+    }
+  } catch {
+  }
+}
+var init_rule_candidate_funnel = __esm({
+  "src/rule-candidate-funnel.ts"() {
+    "use strict";
+    init_memory_db();
+    init_license();
+    init_auto_learning_entitlement();
+  }
+});
+
+// src/rule-candidate-hardened.ts
+function isHardenedShareableDestination(destination) {
+  return TEAM_HARDENED_SHAREABLE_DESTINATIONS.includes(destination);
+}
+function roleRank(role) {
+  switch (role) {
+    case "owner":
+      return 4;
+    case "admin":
+      return 3;
+    case "developer":
+      return 2;
+    case "auditor":
+      return 1;
+    default:
+      return 0;
+  }
+}
+function validateGovernanceGate(policy, approvals, ctx) {
+  if (policy.min_promoter_role != null && ctx?.promoterRole !== void 0) {
+    if (roleRank(ctx.promoterRole) < roleRank(policy.min_promoter_role)) {
+      return `promoter role '${ctx.promoterRole}' is below the org minimum '${policy.min_promoter_role}' \u2014 refusing to apply`;
+    }
+  }
+  if (ctx?.destination !== void 0 && !policy.allowed_destinations.includes(ctx.destination)) {
+    return `destination '${ctx.destination}' is not in the org's allowed destinations \u2014 refusing to apply`;
+  }
+  if (policy.require_hardened_review === true && (ctx?.destination === "pattern-scanner" || ctx?.destination === "custom-destination")) {
+    if (!(ctx.hardened === true && ctx.hasAttestation === true)) {
+      return "org policy requires hardened review for executable destinations \u2014 refusing to apply";
+    }
+  }
+  const distinct = new Set(
+    approvals.approver_user_ids.filter((id) => typeof id === "string" && id.length > 0 && id !== approvals.promoted_by)
+  );
+  if (distinct.size < policy.approvals_required) {
+    return `needs ${policy.approvals_required} approval(s); ${distinct.size} recorded \u2014 refusing to apply`;
+  }
+  return null;
+}
+function validateHardenedApplyGate(prov) {
+  if (prov.hardened !== true) {
+    return "team-origin hardened-destination candidate missing hardened provenance flag \u2014 refusing to apply";
+  }
+  const att = prov.review_attestation;
+  if (!att || typeof att !== "object") {
+    return "team-origin hardened candidate missing review_attestation \u2014 refusing to apply";
+  }
+  if (typeof att.second_operator_id !== "string" || att.second_operator_id.length === 0) {
+    return "team-origin hardened candidate review_attestation missing second_operator_id \u2014 refusing to apply";
+  }
+  const govErr = validateGovernanceGate(
+    { approvals_required: 1, allowed_destinations: [] },
+    { approver_user_ids: [att.second_operator_id], promoted_by: prov.promoted_by }
+  );
+  if (govErr) {
+    return "team-origin hardened candidate second_operator_id equals the promoter \u2014 two-operator review not satisfied";
+  }
+  const ack = att.dry_run_ack;
+  if (!ack || typeof ack !== "object" || ack.ack !== true || typeof ack.ran_at !== "string") {
+    return "team-origin hardened candidate missing render-only dry_run_ack \u2014 refusing to apply";
+  }
+  return null;
+}
+var TEAM_HARDENED_SHAREABLE_DESTINATIONS;
+var init_rule_candidate_hardened = __esm({
+  "src/rule-candidate-hardened.ts"() {
+    "use strict";
+    TEAM_HARDENED_SHAREABLE_DESTINATIONS = [
+      "pattern-scanner",
+      "custom-destination"
+    ];
+  }
+});
+
+// src/rule-candidate-applier.ts
+import { readFileSync as readFileSync26, writeFileSync as writeFileSync9, existsSync as existsSync32, unlinkSync as unlinkSync5, mkdirSync as mkdirSync14 } from "fs";
+import { join as join20, dirname as dirname17, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir12 } from "os";
+import { createHash as createHash9 } from "crypto";
+function isRuleDestination(value) {
+  return typeof value === "string" && ALL_RULE_DESTINATIONS.includes(value);
+}
+function isTeamShareableDestination(destination) {
+  return TEAM_SHAREABLE_DESTINATIONS.includes(destination);
+}
+function resolveMemoryDir(projectRoot = getProjectRoot(), home = homedir12()) {
+  return join20(home, ".claude", "projects", encodeMemoryDirName(projectRoot), "memory");
+}
+function resolveMemoryIndexPath(projectRoot = getProjectRoot(), home = homedir12()) {
+  return join20(resolveMemoryDir(projectRoot, home), "MEMORY.md");
+}
+function deriveSlug2(prompt) {
+  return deriveSlug(prompt);
+}
+function writeIndexLineInRegion(indexPath, line) {
+  const pre = readMemoryIndex(indexPath);
+  if (pre === void 0) {
+    throw new MemoryIndexMissing("MEMORY.md does not exist \u2014 index line skipped (file still written)");
+  }
+  const existing = readRegionLines(pre);
+  if (existing.includes(line)) return;
+  const next = [...existing, line].slice(-DEFAULT_MAX_REGION_LINES);
+  const post = renderRegion(pre, next);
+  if (post !== pre) writeMemoryIndex(indexPath, pre, post);
+}
+function correctionsMdTargets(slug, projectRoot, home) {
+  const dir = resolveMemoryDir(projectRoot, home);
+  return {
+    correctionsMd: join20(dir, "corrections.md"),
+    feedbackMd: join20(dir, `feedback_${slug}.md`),
+    memoryIndex: join20(dir, "MEMORY.md")
+  };
+}
+function readCandidate(candidateId, projectRoot = getProjectRoot()) {
+  if (!CANDIDATE_ID_PATTERN.test(candidateId)) {
+    throw new InvalidCandidateIdError(candidateId);
+  }
+  const path = join20(projectRoot, ".massu", "rule-candidates", `${candidateId}.json`);
+  if (!existsSync32(path)) throw new CandidateNotFoundError(path);
+  const raw = readFileSync26(path, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new CandidatePayloadValidationError(`JSON parse: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return validateCandidatePayload(parsed);
+}
+function validateCandidatePayload(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new CandidatePayloadValidationError("payload is not an object");
+  }
+  const r2 = raw;
+  if (typeof r2.prompt !== "string" || r2.prompt.length === 0) {
+    throw new CandidatePayloadValidationError("prompt must be a non-empty string");
+  }
+  if (typeof r2.prompt_hash !== "string" || !/^[a-f0-9]{16}$/.test(r2.prompt_hash)) {
+    throw new CandidatePayloadValidationError("prompt_hash must be 16 hex chars");
+  }
+  if (typeof r2.score !== "number" || r2.score < -200 || r2.score > 200 || !Number.isFinite(r2.score)) {
+    throw new CandidatePayloadValidationError("score must be a finite number in [-200, 200]");
+  }
+  if (!Array.isArray(r2.signals)) {
+    throw new CandidatePayloadValidationError("signals must be an array");
+  }
+  for (const s of r2.signals) {
+    if (!s || typeof s !== "object") throw new CandidatePayloadValidationError("signal entry not an object");
+    const sig = s;
+    if (typeof sig.name !== "string") throw new CandidatePayloadValidationError("signal.name must be a string");
+    if (typeof sig.baseWeight !== "number") throw new CandidatePayloadValidationError("signal.baseWeight must be a number");
+    if (typeof sig.applied !== "number") throw new CandidatePayloadValidationError("signal.applied must be a number");
+  }
+  if (!Array.isArray(r2.prior_turn_files)) {
+    throw new CandidatePayloadValidationError("prior_turn_files must be an array");
+  }
+  if (typeof r2.timestamp !== "string") {
+    throw new CandidatePayloadValidationError("timestamp must be a string");
+  }
+  if (typeof r2.session_id !== "string") {
+    throw new CandidatePayloadValidationError("session_id must be a string");
+  }
+  if (r2.provenance !== void 0) {
+    if (!r2.provenance || typeof r2.provenance !== "object") {
+      throw new CandidatePayloadValidationError("provenance must be an object when present");
+    }
+    const p19 = r2.provenance;
+    if (p19.origin !== "team" && p19.origin !== "pack") {
+      throw new CandidatePayloadValidationError("provenance.origin must be 'team' or 'pack'");
+    }
+    if (typeof p19.org_id !== "string" || p19.org_id.length === 0) {
+      throw new CandidatePayloadValidationError("provenance.org_id must be a non-empty string");
+    }
+    if (typeof p19.promoted_by !== "string" || p19.promoted_by.length === 0) {
+      throw new CandidatePayloadValidationError("provenance.promoted_by must be a non-empty string");
+    }
+    if (typeof p19.promoted_at !== "string") {
+      throw new CandidatePayloadValidationError("provenance.promoted_at must be a string");
+    }
+    if (typeof p19.signature_verified !== "boolean") {
+      throw new CandidatePayloadValidationError("provenance.signature_verified must be a boolean");
+    }
+    if (!isRuleDestination(r2.destination)) {
+      throw new CandidatePayloadValidationError("provenance-bearing candidate must declare a valid destination");
+    }
+    if (r2.draft_text !== void 0 && typeof r2.draft_text !== "string") {
+      throw new CandidatePayloadValidationError("draft_text must be a string when present");
+    }
+  } else if (r2.destination !== void 0 && !isRuleDestination(r2.destination)) {
+    throw new CandidatePayloadValidationError("destination, when present, must be a valid RuleDestination");
+  }
+  return r2;
+}
+async function applyRuleCandidate(db, opts) {
+  const ent = await assertAutoLearningEntitled();
+  if (!ent.entitled) {
+    return { ok: false, error: ent.message, tier_refused: true };
+  }
+  if (!CANDIDATE_ID_PATTERN.test(opts.candidateId)) {
+    throw new InvalidCandidateIdError(opts.candidateId);
+  }
+  const projectRoot = opts.projectRoot ?? getProjectRoot();
+  const home = opts.home ?? homedir12();
+  const candidate = readCandidate(opts.candidateId, projectRoot);
+  if (candidate.provenance?.origin === "team" || candidate.provenance?.origin === "pack") {
+    const provOrigin = candidate.provenance.origin;
+    if (candidate.destination !== void 0 && opts.destination !== candidate.destination) {
+      return {
+        ok: false,
+        error: "destination mismatch: provenance-bearing candidate must apply to its authored destination"
+      };
+    }
+    if (!entitledForTeamSharedPromotion(ent.currentTier)) {
+      return { ok: false, error: teamSharedPromotionUpgradeMessage(ent.currentTier), tier_refused: true };
+    }
+    if (candidate.provenance.signature_verified !== true) {
+      return { ok: false, error: `${provOrigin}-origin rule candidate has unverified provenance \u2014 refusing to apply` };
+    }
+    if (isTeamShareableDestination(opts.destination)) {
+    } else if (isHardenedShareableDestination(opts.destination)) {
+      const gateErr = validateHardenedApplyGate(candidate.provenance);
+      if (gateErr) return { ok: false, error: gateErr };
+    } else {
+      return { ok: false, error: `${provOrigin}-origin candidate has a non-shareable destination \u2014 refusing to apply` };
+    }
+  }
+  const slug = opts.slug ? deriveSlug2(opts.slug) : deriveSlug2(candidate.prompt);
+  if (!SLUG_ALLOWED2.test(slug)) {
+    throw new InvalidSlugError(slug);
+  }
+  const memoryIndex = resolveMemoryIndexPath(projectRoot, home);
+  if (!existsSync32(memoryIndex)) {
+    throw new MemoryIndexMissingError(memoryIndex);
+  }
+  let destTargets;
+  try {
+    destTargets = computeDestinationTargets(opts, candidate, slug, projectRoot, home);
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+  const candidatePath = join20(projectRoot, ".massu", "rule-candidates", `${opts.candidateId}.json`);
+  const snapshot = takeSnapshots([
+    ...destTargets.paths,
+    memoryIndex
+  ]);
+  db.exec("BEGIN");
+  let auditRowId;
+  let indexLineSkipped;
+  try {
+    const auditEntry = {
+      eventType: "rule_promoted",
+      actor: "human",
+      sessionId: candidate.session_id,
+      filePath: destTargets.primary,
+      metadata: {
+        candidate_id: opts.candidateId,
+        prompt_hash: candidate.prompt_hash,
+        score: candidate.score,
+        classification: opts.destination,
+        cr_assigned: opts.claudeMdCrNumber ?? null,
+        recurrence_count: 0
+      }
+    };
+    try {
+      logAuditEntry(db, auditEntry);
+      auditRowId = db.prepare("SELECT last_insert_rowid() AS id").get().id;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/UNIQUE constraint failed/i.test(msg)) {
+        db.exec("ROLLBACK");
+        return { ok: true, idempotent_noop: true };
+      }
+      throw err;
+    }
+    writeDestination(opts, candidate, slug, destTargets, auditRowId);
+    const indexLine = assertSingleLine(
+      `- [${slug}](feedback_${slug}.md) \u2014 ${candidate.prompt.replace(/\n+/g, " ").slice(0, 100)}`
+    );
+    try {
+      writeIndexLineInRegion(memoryIndex, indexLine);
+    } catch (err) {
+      if (err instanceof RegionRefused || err instanceof MemoryIndexMissing) {
+        indexLineSkipped = err.message;
+      } else {
+        throw err;
+      }
+    }
+    if (existsSync32(candidatePath)) unlinkSync5(candidatePath);
+    let teamShared = false;
+    const localOrigin = candidate.provenance?.origin !== "team" && candidate.provenance?.origin !== "pack";
+    const entitledTeam = entitledForTeamSharedPromotion(ent.currentTier);
+    const nonHardenedShare = isTeamShareableDestination(opts.destination);
+    const hardenedShare = isHardenedShareableDestination(opts.destination) && opts.reviewAttestation != null;
+    if (localOrigin && entitledTeam && (nonHardenedShare || hardenedShare)) {
+      enqueueTeamPromotion(db, {
+        prompt_hash: candidate.prompt_hash,
+        destination: opts.destination,
+        draft_text: opts.draftText,
+        score: candidate.score,
+        signals: candidate.signals,
+        content_hash: createHash9("sha256").update(`${opts.destination}
+${opts.draftText}`).digest("hex"),
+        ...hardenedShare ? { hardened: true, review_attestation: opts.reviewAttestation } : {}
+      });
+      teamShared = true;
+    }
+    setCandidateStatus(db, candidate.prompt_hash, "promoted", opts.destination);
+    db.exec("COMMIT");
+    if (localOrigin) recordApprovalFunnelEvent(db, candidate.prompt_hash, opts.destination, candidate.score, entitledTeam);
+    return { ok: true, audit_log_id: auditRowId, team_shared: teamShared };
+  } catch (err) {
+    db.exec("ROLLBACK");
+    restoreSnapshots(snapshot);
+    const msg = err instanceof Error ? err.message : String(err);
+    appendFailureLog(projectRoot, {
+      candidate_id: opts.candidateId,
+      destination: opts.destination,
+      error: msg,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return { ok: false, error: msg };
+  }
+}
+function computeDestinationTargets(opts, candidate, slug, projectRoot, home) {
+  if (opts.destination === "corrections-md") {
+    const t2 = correctionsMdTargets(slug, projectRoot, home);
+    return { primary: t2.feedbackMd, paths: [t2.correctionsMd, t2.feedbackMd] };
+  }
+  if (opts.destination === "pattern-scanner") {
+    if (opts.patternScannerCheckNumber == null) {
+      throw new DestinationConfigError("pattern-scanner destination requires patternScannerCheckNumber");
+    }
+    const scannerPath = join20(projectRoot, "scripts", "massu-pattern-scanner.sh");
+    const driftGuardPath = join20(projectRoot, "packages", "core", "src", "__tests__", `${slug}-drift-guard.test.ts`);
+    return { primary: scannerPath, paths: [scannerPath, driftGuardPath] };
+  }
+  if (opts.destination === "claude-md-cr") {
+    if (opts.claudeMdCrNumber == null) {
+      throw new DestinationConfigError("claude-md-cr destination requires claudeMdCrNumber");
+    }
+    const claudePath = join20(projectRoot, ".claude", "CLAUDE.md");
+    return { primary: claudePath, paths: [claudePath] };
+  }
+  if (opts.destination === "custom-destination") {
+    if (!opts.customDestination) {
+      throw new DestinationConfigError("custom-destination requires customDestination config entry");
+    }
+    const raw = opts.customDestination.path;
+    const absolute = isAbsolute2(raw) ? raw : join20(projectRoot, raw);
+    try {
+      assertContainedIn(projectRoot, absolute, { allowNested: true });
+    } catch (err) {
+      throw new DestinationConfigError(
+        `custom destination path escapes project root: ${raw} (${err.message})`
+      );
+    }
+    return { primary: absolute, paths: [absolute] };
+  }
+  throw new DestinationConfigError(`unknown destination "${opts.destination}"`);
+}
+function writeDestination(opts, candidate, slug, targets, auditRowId) {
+  if (opts.destination === "corrections-md") {
+    return writeCorrectionsMd(opts, candidate, slug, targets, auditRowId);
+  }
+  if (opts.destination === "pattern-scanner") {
+    return writePatternScanner(opts, candidate, slug, targets);
+  }
+  if (opts.destination === "claude-md-cr") {
+    return writeClaudeMdCr(opts, candidate, slug, targets);
+  }
+  if (opts.destination === "custom-destination") {
+    return writeCustomDestination(opts, candidate, slug, targets);
+  }
+  throw new DestinationConfigError(`unknown destination "${opts.destination}"`);
+}
+function writeCorrectionsMd(opts, candidate, slug, targets, auditRowId) {
+  const [correctionsMd, feedbackMd] = targets.paths;
+  const dateIso = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const correctionsEntry = formatCorrectionEntry({
+    date: dateIso,
+    title: slug,
+    rule: opts.draftText,
+    extra: {
+      prompt_hash: candidate.prompt_hash,
+      score: candidate.score,
+      audit_log_id: auditRowId
+    }
+  });
+  if (!existsSync32(dirname17(correctionsMd))) mkdirSync14(dirname17(correctionsMd), { recursive: true });
+  const correctionsPre = existsSync32(correctionsMd) ? readFileSync26(correctionsMd, "utf-8") : "# Corrections\n";
+  writeFileSync9(correctionsMd, correctionsPre + correctionsEntry, "utf-8");
+  const body = `${opts.draftText}
+`;
+  const mac = mintAuthorship(body);
+  const feedbackBody = [
+    "---",
+    `name: ${slug}`,
+    `description: ${candidate.prompt.replace(/\n+/g, " ").slice(0, 200)}`,
+    "type: feedback",
+    "metadata:",
+    `  source: interactive`,
+    `  prompt_hash: ${candidate.prompt_hash}`,
+    `  audit_log_id: ${auditRowId}`,
+    `  score: ${candidate.score}`,
+    // Display-only; never read for trust (drift-guarded). The MAC is the credential.
+    ...mac ? ["massu_authored: true", `${RENDER_MAC_KEY}: ${mac}`] : [],
+    "---",
+    "",
+    body
+  ].join("\n");
+  atomicWriteFileSync(feedbackMd, feedbackBody);
+}
+function writePatternScanner(opts, candidate, slug, targets) {
+  const [scannerPath, driftGuardPath] = targets.paths;
+  const checkNumber = opts.patternScannerCheckNumber;
+  const scannerPre = existsSync32(scannerPath) ? readFileSync26(scannerPath, "utf-8") : "";
+  if (scannerPre.includes(`${SCANNER_AUTOGEN_MARKER_PREFIX} ${candidate.prompt_hash}`)) {
+    throw new DestinationConfigError(
+      `scanner already contains a check auto-generated for prompt_hash ${candidate.prompt_hash}`
+    );
+  }
+  const checkBlock = [
+    "",
+    `${SCANNER_AUTOGEN_MARKER_PREFIX} ${candidate.prompt_hash} (slug=${slug})`,
+    `# Check ${checkNumber}: ${slug}`,
+    'echo ""',
+    `echo "Check ${checkNumber}: ${slug}"`,
+    opts.draftText.trim(),
+    ""
+  ].join("\n");
+  writeFileSync9(scannerPath, scannerPre + checkBlock, "utf-8");
+  const driftGuard = [
+    "// Copyright (c) 2026 Massu. All rights reserved.",
+    "// Licensed under BSL 1.1 - see LICENSE file for details.",
+    "",
+    `// Drift-guard mirror for pattern-scanner Check ${checkNumber} (${slug}).`,
+    `// Auto-generated by /massu-rule approve for prompt_hash ${candidate.prompt_hash}.`,
+    "",
+    "import { describe, it, expect } from 'vitest';",
+    "import { readFileSync } from 'fs';",
+    "import { join } from 'path';",
+    "",
+    `describe('${slug} drift-guard', () => {`,
+    `  it('pattern-scanner Check ${checkNumber} is present', () => {`,
+    `    const scanner = readFileSync(join(process.cwd(), 'scripts', 'massu-pattern-scanner.sh'), 'utf-8');`,
+    `    expect(scanner).toContain('Check ${checkNumber}: ${slug}');`,
+    `    expect(scanner).toContain('${candidate.prompt_hash}');`,
+    `  });`,
+    `});`,
+    ""
+  ].join("\n");
+  if (!existsSync32(dirname17(driftGuardPath))) mkdirSync14(dirname17(driftGuardPath), { recursive: true });
+  writeFileSync9(driftGuardPath, driftGuard, "utf-8");
+}
+function writeClaudeMdCr(opts, candidate, slug, targets) {
+  const [claudePath] = targets.paths;
+  const crNumber = opts.claudeMdCrNumber;
+  const pre = existsSync32(claudePath) ? readFileSync26(claudePath, "utf-8") : "";
+  if (new RegExp(`\\bCR-${crNumber}\\b`).test(pre)) {
+    throw new DestinationConfigError(`CLAUDE.md already contains a CR-${crNumber} entry`);
+  }
+  const tableHeaderRe = /(\| ID \| Rule \| Verification Type \|\s*\n\|[-| ]+\|\s*\n)((?:\| CR-\d+ \|[^\n]*\n)+)/;
+  const tableMatch = pre.match(tableHeaderRe);
+  if (!tableMatch) {
+    throw new DestinationConfigError(
+      "CLAUDE.md does not contain a recognizable Canonical Rules table \u2014 refusing to write CR row"
+    );
+  }
+  const tableHeader = tableMatch[1];
+  const existingRows = tableMatch[2];
+  const newRow = `| CR-${crNumber} | ${opts.draftText.replace(/\n+/g, " ").trim().slice(0, 400)} | VR-NEW-${slug.toUpperCase()} |
+`;
+  const updatedTable = tableHeader + existingRows + newRow;
+  const afterTable = pre.replace(tableHeaderRe, updatedTable);
+  const block = [
+    "",
+    "---",
+    "",
+    `### CR-${crNumber}: ${slug}`,
+    "",
+    `Auto-promoted from rule-candidate ${candidate.prompt_hash} (score=${candidate.score}).`,
+    "",
+    opts.draftText,
+    ""
+  ].join("\n");
+  writeFileSync9(claudePath, afterTable + block, "utf-8");
+}
+function writeCustomDestination(opts, candidate, slug, targets) {
+  const [destPath] = targets.paths;
+  const entry = opts.customDestination;
+  const vars = {
+    date: (/* @__PURE__ */ new Date()).toISOString(),
+    slug,
+    score: candidate.score,
+    signals_csv: candidate.signals.map((s) => s.name).join(","),
+    prompt_preview: candidate.prompt.replace(/\n+/g, " ").slice(0, 120),
+    destination_name: entry.name
+  };
+  const rendered = renderTemplate2(entry.template, vars);
+  if (!existsSync32(dirname17(destPath))) mkdirSync14(dirname17(destPath), { recursive: true });
+  const pre = existsSync32(destPath) ? readFileSync26(destPath, "utf-8") : "";
+  const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
+  writeFileSync9(destPath, pre + sep3 + rendered + (rendered.endsWith("\n") ? "" : "\n"), "utf-8");
+}
+function dismissRuleCandidate(db, opts) {
+  if (!CANDIDATE_ID_PATTERN.test(opts.candidateId)) {
+    throw new InvalidCandidateIdError(opts.candidateId);
+  }
+  const projectRoot = opts.projectRoot ?? getProjectRoot();
+  const candidate = readCandidate(opts.candidateId, projectRoot);
+  const candidatePath = join20(projectRoot, ".massu", "rule-candidates", `${opts.candidateId}.json`);
+  db.exec("BEGIN");
+  let auditRowId;
+  let blacklistUpdates = 0;
+  try {
+    const upsert = db.prepare(`
+      INSERT INTO prompt_outcomes_signal_blacklist (signal, dismissal_count, last_dismissed_at)
+      VALUES (?, 1, datetime('now'))
+      ON CONFLICT(signal) DO UPDATE SET
+        dismissal_count = dismissal_count + 1,
+        last_dismissed_at = datetime('now')
+    `);
+    for (const sig of candidate.signals) {
+      if (sig.baseWeight <= 0) continue;
+      const r2 = upsert.run(sig.name);
+      blacklistUpdates += r2.changes;
+    }
+    const entry = {
+      eventType: "rule_dismissed",
+      actor: "human",
+      sessionId: candidate.session_id,
+      metadata: {
+        candidate_id: opts.candidateId,
+        prompt_hash: candidate.prompt_hash,
+        score: candidate.score,
+        reason: opts.reason,
+        signals_fired: candidate.signals.map((s) => s.name)
+      }
+    };
+    logAuditEntry(db, entry);
+    auditRowId = db.prepare("SELECT last_insert_rowid() AS id").get().id;
+    setCandidateStatus(db, candidate.prompt_hash, "dismissed");
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    return {
+      ok: false,
+      signals_blacklisted_or_incremented: 0,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    const dismissedLog = join20(projectRoot, ".massu", "rule-candidates", ".dismissed.jsonl");
+    if (!existsSync32(dirname17(dismissedLog))) mkdirSync14(dirname17(dismissedLog), { recursive: true });
+    const pre = existsSync32(dismissedLog) ? readFileSync26(dismissedLog, "utf-8") : "";
+    const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
+    writeFileSync9(dismissedLog, pre + sep3 + JSON.stringify({
+      id: opts.candidateId,
+      prompt_hash: candidate.prompt_hash,
+      score: candidate.score,
+      signals_fired: candidate.signals.map((s) => s.name),
+      reason: opts.reason,
+      audit_log_id: auditRowId,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    }) + "\n", "utf-8");
+    if (existsSync32(candidatePath)) unlinkSync5(candidatePath);
+  } catch (err) {
+    appendFailureLog(projectRoot, {
+      candidate_id: opts.candidateId,
+      destination: "dismiss-postcommit",
+      error: err instanceof Error ? err.message : String(err),
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  recordDismissalFunnelEvent(db, candidate.prompt_hash, candidate.score);
+  return {
+    ok: true,
+    audit_log_id: auditRowId,
+    signals_blacklisted_or_incremented: blacklistUpdates
+  };
+}
+function appendFailureLog(projectRoot, entry) {
+  try {
+    const dir = join20(projectRoot, ".massu", "rule-candidates");
+    if (!existsSync32(dir)) mkdirSync14(dir, { recursive: true });
+    const logPath = join20(dir, ".failures.jsonl");
+    const pre = existsSync32(logPath) ? readFileSync26(logPath, "utf-8") : "";
+    const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
+    writeFileSync9(logPath, pre + sep3 + JSON.stringify(entry) + "\n", "utf-8");
+  } catch {
+  }
+}
+var CANDIDATE_ID_PATTERN, SLUG_ALLOWED2, SCANNER_AUTOGEN_MARKER_PREFIX, InvalidCandidateIdError, InvalidSlugError, CandidatePayloadValidationError, ALL_RULE_DESTINATIONS, TEAM_SHAREABLE_DESTINATIONS, MemoryIndexMissingError, CandidateNotFoundError, DestinationConfigError;
+var init_rule_candidate_applier = __esm({
+  "src/rule-candidate-applier.ts"() {
+    "use strict";
+    init_safe_write();
+    init_corrections_md();
+    init_memory_authorship();
+    init_memory_index_region();
+    init_config();
+    init_memory_path();
+    init_audit_trail();
+    init_template_renderer();
+    init_auto_learning_entitlement();
+    init_memory_db();
+    init_rule_candidate_funnel();
+    init_rule_candidate_store();
+    init_rule_candidate_hardened();
+    init_rule_candidate_hardened();
+    init_rule_candidate_snapshot();
+    CANDIDATE_ID_PATTERN = /^[a-f0-9]{16}$/;
+    SLUG_ALLOWED2 = /^[a-z0-9_]+$/;
+    SCANNER_AUTOGEN_MARKER_PREFIX = "# auto-generated by /massu-rule approve";
+    InvalidCandidateIdError = class extends Error {
+      constructor(id) {
+        super(`candidate id "${id}" is not a 16-hex-char sha-keyed identifier`);
+        this.id = id;
+        this.name = "InvalidCandidateIdError";
+      }
+      id;
+    };
+    InvalidSlugError = class extends Error {
+      constructor(slug) {
+        super(`slug "${slug}" contains characters outside [a-z0-9_]`);
+        this.slug = slug;
+        this.name = "InvalidSlugError";
+      }
+      slug;
+    };
+    CandidatePayloadValidationError = class extends Error {
+      constructor(issue) {
+        super(`candidate payload validation failed: ${issue}`);
+        this.issue = issue;
+        this.name = "CandidatePayloadValidationError";
+      }
+      issue;
+    };
+    ALL_RULE_DESTINATIONS = ["corrections-md", "pattern-scanner", "claude-md-cr", "custom-destination"];
+    TEAM_SHAREABLE_DESTINATIONS = [
+      "corrections-md",
+      "claude-md-cr"
+    ];
+    MemoryIndexMissingError = class extends Error {
+      constructor(path) {
+        super(`MEMORY.md missing at ${path} \u2014 v0.2 requires the canonical memory index. Create it via \`mkdir -p ${dirname17(path)} && echo '# Memory Index' > ${path}\` or run \`/massu-bearings\``);
+        this.path = path;
+        this.name = "MemoryIndexMissingError";
+      }
+      path;
+    };
+    CandidateNotFoundError = class extends Error {
+      constructor(path) {
+        super(`candidate sidecar not found: ${path}`);
+        this.path = path;
+        this.name = "CandidateNotFoundError";
+      }
+      path;
+    };
+    DestinationConfigError = class extends Error {
+      constructor(msg) {
+        super(msg);
+        this.name = "DestinationConfigError";
+      }
+    };
+  }
+});
+
+// src/rule-candidate-preview.ts
+import { readFileSync as readFileSync27, writeFileSync as writeFileSync10, existsSync as existsSync33 } from "node:fs";
+function renderHardenedPreview(destination, body) {
+  const rendered = String(body ?? "");
+  const riskFindings = RISK_PATTERNS.filter((p19) => p19.re.test(rendered)).map((p19) => p19.label);
+  return { destination, rendered, riskFindings };
+}
+function validateReviewAttestation(att) {
+  if (!att || typeof att !== "object") {
+    throw new InvalidReviewAttestationError("must be an object");
+  }
+  const a2 = att;
+  if (typeof a2.second_operator_id !== "string" || a2.second_operator_id.length === 0) {
+    throw new InvalidReviewAttestationError("second_operator_id must be a non-empty string");
+  }
+  const ack = a2.dry_run_ack;
+  if (!ack || typeof ack !== "object" || ack.ack !== true || typeof ack.ran_at !== "string") {
+    throw new InvalidReviewAttestationError("dry_run_ack must be { ran_at: string, ack: true }");
+  }
+  return {
+    second_operator_id: a2.second_operator_id,
+    dry_run_ack: {
+      ran_at: ack.ran_at,
+      ...typeof ack.exit_code === "number" ? { exit_code: ack.exit_code } : {},
+      ack: true
+    }
+  };
+}
+function recordHardenedReviewAttestation(sidecarPath2, attestation) {
+  if (!existsSync33(sidecarPath2)) {
+    throw new Error(`candidate sidecar not found: ${sidecarPath2}`);
+  }
+  const validated = validateReviewAttestation(attestation);
+  const raw = readFileSync27(sidecarPath2, "utf-8");
+  const sidecar = JSON.parse(raw);
+  const prov = sidecar.provenance;
+  if (!prov || prov.origin !== "team" || prov.hardened !== true) {
+    throw new Error("sidecar is not a hardened team-origin candidate \u2014 refusing to attach an attestation");
+  }
+  if (validated.second_operator_id === prov.promoted_by) {
+    throw new InvalidReviewAttestationError(
+      "second_operator_id equals the promoter \u2014 two-operator review requires a distinct operator"
+    );
+  }
+  prov.review_attestation = validated;
+  writeFileSync10(sidecarPath2, JSON.stringify(sidecar, null, 2), "utf-8");
+}
+var RISK_PATTERNS, InvalidReviewAttestationError;
+var init_rule_candidate_preview = __esm({
+  "src/rule-candidate-preview.ts"() {
+    "use strict";
+    RISK_PATTERNS = [
+      { re: /\brm\s+-[a-z]*r[a-z]*f?\b|\brm\s+-[a-z]*f[a-z]*r\b/i, label: "rm -rf (recursive/forced delete)" },
+      { re: /\|\s*(sh|bash|zsh|dash)\b/i, label: "pipe-to-shell (| sh)" },
+      { re: /\b(curl|wget|nc|ncat|telnet|ssh|scp)\b/i, label: "network tool (curl/wget/nc/ssh/...)" },
+      { re: /\beval\b/i, label: "eval" },
+      { re: /\$\([^)]*\)|`[^`]*`/, label: "command substitution $(...) / backticks" },
+      { re: />\s*(\/|~|\$HOME|\.\.)/i, label: "redirect to absolute / home / parent path" },
+      { re: /\bsudo\b/i, label: "sudo (privilege escalation)" },
+      { re: /\b(chmod|chown)\b/i, label: "permission change (chmod/chown)" },
+      { re: /\bdd\b\s|\bmkfs\b|\b:\(\)\s*\{/i, label: "destructive/forkbomb pattern" },
+      { re: /\b(base64|xxd)\b.*\|/i, label: "encoded payload piped" }
+    ];
+    InvalidReviewAttestationError = class extends Error {
+      constructor(issue) {
+        super(`invalid review attestation: ${issue}`);
+        this.name = "InvalidReviewAttestationError";
+      }
+    };
+  }
+});
+
 // src/security/promotion-pubkey.generated.ts
 var PROMOTION_PUBKEY_ED25519, PROMOTION_PUBKEY_FINGERPRINT_HEX, KNOWN_PROMOTION_PUBKEY_FINGERPRINTS;
 var init_promotion_pubkey_generated = __esm({
@@ -20041,20 +21396,8 @@ var init_promotion_envelope_verifier = __esm({
   }
 });
 
-// src/rule-candidate-hardened.ts
-var TEAM_HARDENED_SHAREABLE_DESTINATIONS;
-var init_rule_candidate_hardened = __esm({
-  "src/rule-candidate-hardened.ts"() {
-    "use strict";
-    TEAM_HARDENED_SHAREABLE_DESTINATIONS = [
-      "pattern-scanner",
-      "custom-destination"
-    ];
-  }
-});
-
 // src/rule-pack-schema.ts
-function isRuleDestination(value) {
+function isRuleDestination2(value) {
   return typeof value === "string" && RULE_DESTINATIONS.includes(value);
 }
 function isExecutableDestination(destination) {
@@ -20078,7 +21421,7 @@ function validateRulePackRule(rule) {
   if (!isNonEmptyString(r2.severity)) {
     errors.push("missing required field: severity");
   }
-  const destinationKnown = isRuleDestination(r2.destination);
+  const destinationKnown = isRuleDestination2(r2.destination);
   if (!destinationKnown) {
     errors.push(
       `invalid destination: ${JSON.stringify(r2.destination)} is not a known RuleDestination (one of ${RULE_DESTINATIONS.join(", ")})`
@@ -20132,8 +21475,8 @@ var init_rule_pack_schema = __esm({
 });
 
 // src/rule-pack-sync.ts
-import { existsSync as existsSync32, writeFileSync as writeFileSync9, mkdirSync as mkdirSync14 } from "fs";
-import { join as join20, dirname as dirname17 } from "path";
+import { existsSync as existsSync34, writeFileSync as writeFileSync11, mkdirSync as mkdirSync15 } from "fs";
+import { join as join21, dirname as dirname18 } from "path";
 async function pullInstalledPackRules(db, opts = {}) {
   const config = getConfig();
   const cloud = config.cloud;
@@ -20195,7 +21538,7 @@ async function pullInstalledPackRules(db, opts = {}) {
       result.pulled += 1;
       const promptHash = packRulePromptHash(pack.slug, rule);
       const candidatePath = sidecarPath(projectRoot, promptHash);
-      if (existsSync32(candidatePath) || alreadyApplied(db, promptHash)) {
+      if (existsSync34(candidatePath) || alreadyApplied(db, promptHash)) {
         result.skipped += 1;
         continue;
       }
@@ -20228,12 +21571,12 @@ function isValidInstalledPack(p19) {
   return typeof r2.slug === "string" && r2.slug.length > 0 && Array.isArray(r2.rules);
 }
 function packRulePromptHash(slug, rule) {
-  const { createHash: createHash14 } = __require("node:crypto");
+  const { createHash: createHash15 } = __require("node:crypto");
   const body = `${slug}\0${rule.destination}\0${rule.title}\0${rule.pattern ?? rule.check ?? rule.description}`;
-  return createHash14("sha256").update(body, "utf-8").digest("hex").slice(0, 16);
+  return createHash15("sha256").update(body, "utf-8").digest("hex").slice(0, 16);
 }
 function sidecarPath(projectRoot, promptHash) {
-  return join20(projectRoot, ".massu", "rule-candidates", `${promptHash}.json`);
+  return join21(projectRoot, ".massu", "rule-candidates", `${promptHash}.json`);
 }
 function alreadyApplied(db, promptHash) {
   try {
@@ -20282,9 +21625,9 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
     destination: rule.destination,
     draft_text: draftText
   };
-  const dir = dirname17(candidatePath);
-  if (!existsSync32(dir)) mkdirSync14(dir, { recursive: true });
-  writeFileSync9(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
+  const dir = dirname18(candidatePath);
+  if (!existsSync34(dir)) mkdirSync15(dir, { recursive: true });
+  writeFileSync11(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
 }
 function emitDropTelemetry(db, eventType, data) {
   recordTelemetry(db, eventType, data);
@@ -20318,6 +21661,12 @@ var rule_exports = {};
 __export(rule_exports, {
   handleRuleSubcommand: () => handleRuleSubcommand
 });
+import { join as join22 } from "node:path";
+function flagValue2(args2, flag) {
+  const i = args2.indexOf(flag);
+  if (i === -1 || i === args2.length - 1) return void 0;
+  return args2[i + 1];
+}
 async function handleRuleSubcommand(args2) {
   const sub = args2[0];
   switch (sub) {
@@ -20366,11 +21715,179 @@ async function handleRuleSubcommand(args2) {
       }
       return { exitCode: 0 };
     }
+    case "review": {
+      const candidateId = args2[1];
+      if (!candidateId) {
+        process.stderr.write(
+          "Usage: massu rule review <candidate_id> --destination <dest> --draft <text>\n                        [--attest-operator <id> --attest-note <text>]\n"
+        );
+        return { exitCode: 2 };
+      }
+      const destination = flagValue2(args2, "--destination");
+      const draft = flagValue2(args2, "--draft");
+      if (!destination || !isRuleDestination(destination) || draft === void 0) {
+        process.stderr.write("massu: review requires --destination <dest> and --draft <text>\n");
+        return { exitCode: 2 };
+      }
+      const preview = renderHardenedPreview(destination, draft);
+      process.stdout.write(
+        `Hardened promotion review \u2014 ${preview.destination}
+
+This is EXACTLY what would be applied (it is displayed, never run):
+${"-".repeat(60)}
+${preview.rendered}
+${"-".repeat(60)}
+
+`
+      );
+      if (preview.riskFindings.length > 0) {
+        process.stdout.write(
+          `RISK FINDINGS \u2014 ${preview.riskFindings.length} pattern(s) a second operator must weigh:
+` + preview.riskFindings.map((f2) => `  - ${f2}
+`).join("") + "\nThese are advisory, not auto-rejections. A human decides.\n\n"
+        );
+      } else {
+        process.stdout.write("No static risk patterns matched.\n\n");
+      }
+      const operator = flagValue2(args2, "--attest-operator");
+      if (!operator) {
+        process.stdout.write(
+          `To attest (required before a hardened rule can be shared with your team):
+  massu rule review ${candidateId} --destination ${destination} --draft '<text>' \\
+    --attest-operator <your-id> --attest-note '<why this is safe>'
+`
+        );
+        return { exitCode: 0 };
+      }
+      try {
+        const attestation = validateReviewAttestation({
+          second_operator_id: operator,
+          reviewed_at: (/* @__PURE__ */ new Date()).toISOString(),
+          note: flagValue2(args2, "--attest-note") ?? ""
+        });
+        const sidecar = join22(getProjectRoot(), ".massu", "rule-candidates", `${candidateId}.json`);
+        recordHardenedReviewAttestation(sidecar, attestation);
+        process.stdout.write(`Attestation recorded by '${operator}'. This candidate may now be approved.
+`);
+        return { exitCode: 0 };
+      } catch (err) {
+        process.stderr.write(
+          `massu: attestation refused: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+        return { exitCode: 1 };
+      }
+    }
+    case "approve": {
+      const candidateId = args2[1];
+      if (!candidateId) {
+        process.stderr.write(
+          "Usage: massu rule approve <candidate_id> --destination <dest> --draft <text> [--slug <s>]\n"
+        );
+        return { exitCode: 2 };
+      }
+      const destination = flagValue2(args2, "--destination");
+      const draftText = flagValue2(args2, "--draft");
+      if (!destination || !isRuleDestination(destination)) {
+        process.stderr.write(
+          `massu: --destination must be one of: ${RULE_DESTINATIONS2.join(", ")}
+`
+        );
+        return { exitCode: 2 };
+      }
+      if (draftText === void 0) {
+        process.stderr.write("massu: approve requires --draft <text>\n");
+        return { exitCode: 2 };
+      }
+      const db = getMemoryDb();
+      try {
+        const result = await applyRuleCandidate(db, {
+          candidateId,
+          destination,
+          draftText,
+          ...flagValue2(args2, "--slug") ? { slug: flagValue2(args2, "--slug") } : {}
+        });
+        if (!result.ok) {
+          process.stderr.write(`massu: promotion refused: ${result.error}
+`);
+          return { exitCode: result.tier_refused ? 3 : 1 };
+        }
+        process.stdout.write(
+          `Rule promoted to ${destination}.
+` + (result.team_shared ? "  Queued to share with your team. It will be delivered on the next sync \u2014 and it will NOT be deleted until your team's server confirms receipt.\n" : "  Local only (team sharing needs a Team seat and a shareable destination).\n")
+        );
+        return { exitCode: 0 };
+      } finally {
+        db.close();
+      }
+    }
+    case "dismiss": {
+      const candidateId = args2[1];
+      if (!candidateId) {
+        process.stderr.write('Usage: massu rule dismiss <candidate_id> [--reason "..."]\n');
+        return { exitCode: 2 };
+      }
+      const db = getMemoryDb();
+      try {
+        const result = dismissRuleCandidate(db, {
+          candidateId,
+          reason: flagValue2(args2, "--reason") ?? ""
+        });
+        if (!result.ok) {
+          process.stderr.write(`massu: dismiss failed: ${result.error}
+`);
+          return { exitCode: 1 };
+        }
+        process.stdout.write("Candidate dismissed.\n");
+        return { exitCode: 0 };
+      } finally {
+        db.close();
+      }
+    }
+    case "delivery-status": {
+      const db = getMemoryDb();
+      try {
+        const snap = undeliveredSnapshot(db);
+        const rules = snap.promotions + snap.revocations;
+        const giveups = db.prepare(
+          `SELECT COUNT(*) AS n, MAX(created_at) AS last
+               FROM analytics_events WHERE event_type = 'cloud_sync_giveup'`
+        ).get();
+        const lastErr = db.prepare(
+          `SELECT last_error FROM team_promotion_outbound
+              WHERE last_error IS NOT NULL ORDER BY attempts DESC LIMIT 1`
+        ).get();
+        if (rules === 0 && snap.events === 0) {
+          process.stdout.write("Rule delivery: everything has reached your team. Nothing queued.\n");
+        } else {
+          process.stdout.write(
+            `Rule delivery: ${rules} learned rule(s) and ${snap.events} funnel event(s) have NOT yet reached your team.
+  They are SAFE \u2014 nothing is ever deleted until the server confirms it.
+` + (snap.oldest_rule_created_at ? `  Oldest waiting since: ${snap.oldest_rule_created_at}
+` : "") + `  Delivery attempts so far: ${snap.max_rule_attempts}
+` + (lastErr?.last_error ? `  Last error: ${lastErr.last_error}
+` : "") + (snap.stalled ? `  STALLED \u2014 this is not retrying its way out. Check your API key and endpoint (\`massu doctor\`).
+` : "")
+          );
+        }
+        if (giveups.n > 0) {
+          process.stdout.write(
+            `
+Cloud sync has given up ${giveups.n} time(s) (most recent: ${giveups.last}).
+  Session/observation data from those attempts was dropped; learned rules were not.
+`
+          );
+        }
+        return { exitCode: snap.stalled ? 1 : 0 };
+      } finally {
+        db.close();
+      }
+    }
     case "--help":
     case "-h":
     case void 0: {
       process.stdout.write(
-        "massu rule <subcommand>\n\nSubcommands:\n  record-shown <prompt_hash>  Record a `shown` promotion-funnel event (Team-gated, best-effort).\n  packs                       Pull installed rule-pack rules as reviewable candidates (Team-gated).\n"
+        "massu rule <subcommand>\n\nSubcommands:\n  approve <id> --destination <d> --draft <text>\n                              Promote a candidate to a rule (Pro+). Shares to your team at Team+.\n  dismiss <id> [--reason ...] Dismiss a candidate and downweight its signals.\n  review <id> --destination <d> --draft <text>\n                              Preview a HARDENED (executable) promotion + its risk findings;\n                              add --attest-operator/--attest-note to record a 2nd-operator review.\n  record-shown <prompt_hash>  Record a `shown` promotion-funnel event (Team-gated, best-effort).\n  packs                       Pull installed rule-pack rules as reviewable candidates (Team-gated).\n  delivery-status             Show which learned rules have not yet reached your team, and why.\n"
       );
       return { exitCode: 0 };
     }
@@ -20381,14 +21898,24 @@ async function handleRuleSubcommand(args2) {
     }
   }
 }
-var PROMPT_HASH_RE;
+var RULE_DESTINATIONS2, PROMPT_HASH_RE;
 var init_rule = __esm({
   "src/commands/rule.ts"() {
     "use strict";
     init_memory_db();
+    init_config();
+    init_rule_delivery();
+    init_rule_candidate_applier();
+    init_rule_candidate_preview();
     init_license();
     init_auto_learning_entitlement();
     init_rule_pack_sync();
+    RULE_DESTINATIONS2 = [
+      "corrections-md",
+      "claude-md-cr",
+      "pattern-scanner",
+      "custom-destination"
+    ];
     PROMPT_HASH_RE = /^[0-9a-f]{16}$/;
   }
 });
@@ -20882,9 +22409,9 @@ var init_memory_supersede = __esm({
 });
 
 // src/memory-consolidate.ts
-import { createHash as createHash9 } from "crypto";
-import { existsSync as existsSync33, mkdirSync as mkdirSync15, writeFileSync as writeFileSync10 } from "fs";
-import { join as join21 } from "path";
+import { createHash as createHash10 } from "crypto";
+import { existsSync as existsSync35, mkdirSync as mkdirSync16, writeFileSync as writeFileSync12 } from "fs";
+import { join as join23 } from "path";
 function emptyResult() {
   return {
     deduped: 0,
@@ -21046,7 +22573,7 @@ ${r2.detail ?? ""}`.trim());
     }
     clusters.push(cluster);
   }
-  const candidateDir = join21(projectRoot, ".massu", "rule-candidates");
+  const candidateDir = join23(projectRoot, ".massu", "rule-candidates");
   let promoted = 0;
   for (const cluster of clusters) {
     const occurrences = cluster.reduce((n, c2) => n + (c2.recurrence_count || 1), 0);
@@ -21058,15 +22585,15 @@ ${r2.detail ?? ""}`.trim());
     const promptText = `${representative.title}${representative.detail ? `
 ${representative.detail}` : ""}`;
     const clusterKey = cluster.map((c2) => c2.title.toLowerCase().replace(/\s+/g, " ").trim()).sort().join("|");
-    const promptHash = createHash9("sha256").update(clusterKey).digest("hex").slice(0, 16);
-    const candidatePath = join21(candidateDir, `${promptHash}.json`);
-    if (existsSync33(candidatePath)) continue;
+    const promptHash = createHash10("sha256").update(clusterKey).digest("hex").slice(0, 16);
+    const candidatePath = join23(candidateDir, `${promptHash}.json`);
+    if (existsSync35(candidatePath)) continue;
     if (dryRun) {
       promoted++;
       continue;
     }
-    mkdirSync15(candidateDir, { recursive: true });
-    writeFileSync10(
+    mkdirSync16(candidateDir, { recursive: true });
+    writeFileSync12(
       candidatePath,
       JSON.stringify(
         {
@@ -21336,7 +22863,7 @@ var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync34, readFileSync as readFileSync26 } from "fs";
+import { existsSync as existsSync36, readFileSync as readFileSync28 } from "fs";
 import { resolve as resolve17 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
@@ -21366,13 +22893,13 @@ async function runShowTemplate(args2) {
   }
   const suffix = choice.kind === "hit" ? choice.suffix : "";
   const file = suffix === "" ? resolve17(sourceDir, `${baseName}.md`) : resolve17(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync34(file)) {
+  if (!existsSync36(file)) {
     process.stderr.write(`massu: resolved template "${file}" no longer exists
 `);
     process.exit(1);
     return;
   }
-  process.stdout.write(readFileSync26(file, "utf-8"));
+  process.stdout.write(readFileSync28(file, "utf-8"));
 }
 var init_show_template = __esm({
   "src/commands/show-template.ts"() {
@@ -21467,7 +22994,7 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync35, readFileSync as readFileSync27, rmSync as rmSync8 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync29, rmSync as rmSync8 } from "fs";
 import { resolve as resolve19 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
@@ -21599,14 +23126,14 @@ async function runConfigRefresh(opts = {}) {
   const configPath = resolve19(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync35(configPath)) {
+  if (!existsSync37(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
   }
   let existing;
   try {
-    const content = readFileSync27(configPath, "utf-8");
+    const content = readFileSync29(configPath, "utf-8");
     const parsed = parseYaml5(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -21680,7 +23207,7 @@ async function runConfigRefresh(opts = {}) {
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
         const placeholderPath = resolve19(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync35(placeholderPath)) {
+        if (existsSync37(placeholderPath)) {
           try {
             rmSync8(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
@@ -21789,12 +23316,12 @@ var init_gitToplevel = __esm({
 });
 
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync36, statSync as statSync14 } from "fs";
+import { existsSync as existsSync38, statSync as statSync14 } from "fs";
 import { resolve as resolve20 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
     const p19 = resolve20(projectRoot, lf);
-    if (!existsSync36(p19)) continue;
+    if (!existsSync38(p19)) continue;
     try {
       const stat = statSync14(p19);
       const delta = now - stat.mtimeMs;
@@ -21807,7 +23334,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync36(resolve20(projectRoot, ".git", s))) return true;
+    if (existsSync38(resolve20(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -22006,8 +23533,8 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync4, existsSync as existsSync37, fsyncSync as fsyncSync4, mkdirSync as mkdirSync16, openSync as openSync4, readFileSync as readFileSync28, renameSync as renameSync5, rmSync as rmSync9, writeFileSync as writeFileSync11, writeSync as writeSync3 } from "fs";
-import { dirname as dirname18, resolve as resolve21 } from "path";
+import { closeSync as closeSync4, existsSync as existsSync39, fsyncSync as fsyncSync4, mkdirSync as mkdirSync17, openSync as openSync4, readFileSync as readFileSync30, renameSync as renameSync5, rmSync as rmSync9, writeFileSync as writeFileSync13, writeSync as writeSync3 } from "fs";
+import { dirname as dirname19, resolve as resolve21 } from "path";
 function watchStatePath(projectRoot) {
   return resolve21(projectRoot, ".massu", "watch-state.json");
 }
@@ -22016,8 +23543,8 @@ function backupStatePath(projectRoot) {
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync37(path)) return { ...DEFAULT_STATE };
-  const content = readFileSync28(path, "utf-8");
+  if (!existsSync39(path)) return { ...DEFAULT_STATE };
+  const content = readFileSync30(path, "utf-8");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -22059,14 +23586,14 @@ function readState(projectRoot) {
 }
 function archiveCorrupt(projectRoot, content) {
   const bak = backupStatePath(projectRoot);
-  mkdirSync16(dirname18(bak), { recursive: true });
-  writeFileSync11(bak, content, "utf-8");
+  mkdirSync17(dirname19(bak), { recursive: true });
+  writeFileSync13(bak, content, "utf-8");
 }
 function writeStateAtomic(projectRoot, state) {
   const path = watchStatePath(projectRoot);
   writeStateAtomicCounter = writeStateAtomicCounter + 1 >>> 0;
   const tmp = `${path}.${process.pid}.${writeStateAtomicCounter}.tmp`;
-  mkdirSync16(dirname18(path), { recursive: true });
+  mkdirSync17(dirname19(path), { recursive: true });
   let renamed = false;
   try {
     const fd = openSync4(tmp, "w");
@@ -22080,7 +23607,7 @@ function writeStateAtomic(projectRoot, state) {
     renameSync5(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync37(tmp)) {
+    if (!renamed && existsSync39(tmp)) {
       try {
         rmSync9(tmp, { force: true });
       } catch {
@@ -22362,8 +23889,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync3 } from "child_process";
-import { basename as basename8, dirname as dirname19, resolve as resolve22 } from "path";
-import { appendFileSync as appendFileSync3, existsSync as existsSync38, mkdirSync as mkdirSync17, readFileSync as readFileSync29 } from "fs";
+import { basename as basename8, dirname as dirname20, resolve as resolve22 } from "path";
+import { appendFileSync as appendFileSync3, existsSync as existsSync40, mkdirSync as mkdirSync18, readFileSync as readFileSync31 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -22389,7 +23916,7 @@ function parseFlags(args2) {
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
   const fixed = home ? resolve22(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync38(fixed)) return fixed;
+  if (fixed && existsSync40(fixed)) return fixed;
   const which = spawnSync3("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
@@ -22450,7 +23977,7 @@ async function runWatch(args2) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync38(path)) {
+  if (!existsSync40(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -22608,18 +24135,18 @@ function refreshLogPath(projectRoot) {
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
   try {
-    mkdirSync17(dirname19(path), { recursive: true });
+    mkdirSync18(dirname20(path), { recursive: true });
     appendFileSync3(path, JSON.stringify(event) + "\n", "utf-8");
   } catch {
   }
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync38(path)) return [];
+  if (!existsSync40(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
-  const lines = readFileSync29(path, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync31(path, "utf-8").split("\n").filter(Boolean);
   const tail = lines.slice(-limit);
   const out = [];
   let corrupt = 0;
@@ -22692,26 +24219,26 @@ var init_refresh_log = __esm({
 import {
   chmodSync as chmodSync6,
   closeSync as closeSync5,
-  existsSync as existsSync39,
+  existsSync as existsSync41,
   fsyncSync as fsyncSync5,
-  mkdirSync as mkdirSync18,
+  mkdirSync as mkdirSync19,
   openSync as openSync5,
   renameSync as renameSync6,
   rmSync as rmSync10,
   statSync as statSync15,
   writeSync as writeSync4
 } from "node:fs";
-import { dirname as dirname20 } from "node:path";
+import { dirname as dirname21 } from "node:path";
 function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
-  const parentDir = dirname20(path);
+  const parentDir = dirname21(path);
   try {
-    if (!existsSync39(parentDir)) {
+    if (!existsSync41(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
       }
-      mkdirSync18(parentDir, mkdirOpts);
+      mkdirSync19(parentDir, mkdirOpts);
     }
     const buf = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
     const openMode = opts.mode ?? 420;
@@ -22728,7 +24255,7 @@ function atomicWrite(path, content, opts = {}) {
     renameSync6(tmpPath, path);
     return { written: true };
   } catch (err) {
-    if (existsSync39(tmpPath)) {
+    if (existsSync41(tmpPath)) {
       try {
         rmSync10(tmpPath, { force: true });
       } catch {
@@ -22808,10 +24335,10 @@ var init_registry_pubkey_generated = __esm({
 });
 
 // src/security/adapter-verifier.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 import nacl from "tweetnacl";
 function sha256Hex2(bytes) {
-  return createHash10("sha256").update(bytes).digest("hex");
+  return createHash11("sha256").update(bytes).digest("hex");
 }
 function reviver(key, value) {
   if (key === "__proto__" || key === "constructor" || key === "prototype") {
@@ -23077,24 +24604,24 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync40, readFileSync as readFileSync30, statSync as statSync16 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { existsSync as existsSync42, readFileSync as readFileSync32, statSync as statSync16 } from "node:fs";
+import { homedir as homedir13 } from "node:os";
 import { resolve as resolve23 } from "node:path";
 import { z as z5 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve23(homedir12(), ".massu");
+  const dir = resolve23(homedir13(), ".massu");
   return {
     cachePath: resolve23(dir, "adapter-manifest.json"),
     lockPath: resolve23(dir, ".adapter-manifest.lock")
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync40(paths.cachePath)) {
+  if (!existsSync42(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
   try {
-    const content = readFileSync30(paths.cachePath, "utf-8");
+    const content = readFileSync32(paths.cachePath, "utf-8");
     raw = JSON.parse(content);
   } catch (err) {
     return {
@@ -23283,15 +24810,15 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync41, readFileSync as readFileSync31, lstatSync as lstatSync5 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { resolve as resolve24, isAbsolute as isAbsolute2 } from "node:path";
-import { createHash as createHash11 } from "node:crypto";
+import { existsSync as existsSync43, readFileSync as readFileSync33, lstatSync as lstatSync5 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
+import { resolve as resolve24, isAbsolute as isAbsolute3 } from "node:path";
+import { createHash as createHash12 } from "node:crypto";
 import { z as z6 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
   for (const p19 of localPaths) {
-    const abs = isAbsolute2(p19) ? p19 : resolve24(projectRoot, p19);
+    const abs = isAbsolute3(p19) ? p19 : resolve24(projectRoot, p19);
     let contentTag;
     try {
       const lst = lstatSync5(abs);
@@ -23300,7 +24827,7 @@ function computeLocalFingerprint(localPaths, projectRoot) {
       } else if (!lst.isFile()) {
         contentTag = "<not-a-file>";
       } else {
-        contentTag = createHash11("sha256").update(readFileSync31(abs)).digest("hex");
+        contentTag = createHash12("sha256").update(readFileSync33(abs)).digest("hex");
       }
     } catch {
       contentTag = "<missing>";
@@ -23309,13 +24836,13 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   }
   tuples.sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
   const canonical = JSON.stringify(tuples);
-  return createHash11("sha256").update(canonical).digest("hex");
+  return createHash12("sha256").update(canonical).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync41(path)) return null;
+  if (!existsSync43(path)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync31(path, "utf-8"));
+    raw = JSON.parse(readFileSync33(path, "utf-8"));
   } catch {
     return null;
   }
@@ -23363,7 +24890,7 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve24(homedir13(), ".massu", "adapters-local-fingerprint.json");
+    FINGERPRINT_PATH = resolve24(homedir14(), ".massu", "adapters-local-fingerprint.json");
     FingerprintSentinelSchema = z6.object({
       fingerprint: z6.string().regex(/^[0-9a-f]{64}$/),
       source: z6.enum(["cli", "cli-resync"]),
@@ -23379,15 +24906,15 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync16, lstatSync as lstatSync6, existsSync as existsSync42 } from "node:fs";
-import { join as join22, relative as relative6, sep as sep2 } from "node:path";
-import { homedir as homedir14 } from "node:os";
+import { readFileSync as readFileSync34, readdirSync as readdirSync16, lstatSync as lstatSync6, existsSync as existsSync44 } from "node:fs";
+import { join as join24, relative as relative7, sep as sep2 } from "node:path";
+import { homedir as homedir15 } from "node:os";
 import { resolve as resolve25 } from "node:path";
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import { z as z7 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync42(`${packageDir}/${hidden}`)) {
+    if (existsSync44(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -23404,7 +24931,7 @@ function sha256OfDir(dir, opts = {}) {
       return;
     }
     for (const entry of entries.sort()) {
-      const absPath = join22(currentDir, entry);
+      const absPath = join24(currentDir, entry);
       let lst;
       try {
         lst = lstatSync6(absPath);
@@ -23425,15 +24952,15 @@ function sha256OfDir(dir, opts = {}) {
           `sha256OfDir: file ${absPath} exceeds maxFileBytes (${lst.size} > ${maxFileBytes}); adapter packages should not ship files this large.`
         );
       }
-      const rel = relative6(dir, absPath).split(sep2).join("/");
+      const rel = relative7(dir, absPath).split(sep2).join("/");
       files.push({ relativePath: rel, absPath });
     }
   }
   walk(dir);
   files.sort((a2, b2) => a2.relativePath < b2.relativePath ? -1 : a2.relativePath > b2.relativePath ? 1 : 0);
-  const top = createHash12("sha256");
+  const top = createHash13("sha256");
   for (const f2 of files) {
-    const fileHash = createHash12("sha256").update(readFileSync32(f2.absPath)).digest("hex");
+    const fileHash = createHash13("sha256").update(readFileSync34(f2.absPath)).digest("hex");
     top.update(f2.relativePath, "utf-8");
     top.update("\0", "utf-8");
     top.update(fileHash, "utf-8");
@@ -23442,10 +24969,10 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync42(path)) return {};
+  if (!existsSync44(path)) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync32(path, "utf-8"));
+    raw = JSON.parse(readFileSync34(path, "utf-8"));
   } catch {
     return {};
   }
@@ -23509,7 +25036,7 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve25(homedir14(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve25(homedir15(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
     InstallEntrySchema = z7.object({
@@ -23532,12 +25059,12 @@ var init_install_tracking = __esm({
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync43, readdirSync as readdirSync17, readFileSync as readFileSync33, lstatSync as lstatSync7 } from "node:fs";
-import { resolve as resolve26, isAbsolute as isAbsolute3 } from "node:path";
+import { existsSync as existsSync45, readdirSync as readdirSync17, readFileSync as readFileSync35, lstatSync as lstatSync7 } from "node:fs";
+import { resolve as resolve26, isAbsolute as isAbsolute4 } from "node:path";
 import { z as z8 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
   const nodeModulesDir = resolve26(projectRoot, "node_modules");
-  if (!existsSync43(nodeModulesDir)) {
+  if (!existsSync45(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
@@ -23592,10 +25119,10 @@ function walkNodeModules(projectRoot, warnings) {
 }
 function tryReadAdapterPackage(packageDir, warnings) {
   const pkgJsonPath = resolve26(packageDir, "package.json");
-  if (!existsSync43(pkgJsonPath)) return null;
+  if (!existsSync45(pkgJsonPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync33(pkgJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync35(pkgJsonPath, "utf-8"));
   } catch (err) {
     warnings.push(
       `skipping ${packageDir}: package.json parse failed (${err instanceof Error ? err.message : String(err)})`
@@ -23729,8 +25256,8 @@ function discoverAdapters(opts) {
   const localSet = new Set(opts.configLocalPaths);
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
-    const absPath = isAbsolute3(localPath) ? localPath : resolve26(opts.projectRoot, localPath);
-    if (!existsSync43(absPath)) {
+    const absPath = isAbsolute4(localPath) ? localPath : resolve26(opts.projectRoot, localPath);
+    if (!existsSync45(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -23812,7 +25339,7 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync44, readFileSync as readFileSync34 } from "node:fs";
+import { existsSync as existsSync46, readFileSync as readFileSync36 } from "node:fs";
 import { resolve as resolve27 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
@@ -24081,7 +25608,7 @@ function mutateLocalArray(mutator, command) {
     return { exitCode: 2 };
   }
   const yamlPath = resolve27(projectRoot, "massu.config.yaml");
-  if (!existsSync44(yamlPath)) {
+  if (!existsSync46(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -24090,7 +25617,7 @@ function mutateLocalArray(mutator, command) {
   }
   let yamlText;
   try {
-    yamlText = readFileSync34(yamlPath, "utf-8");
+    yamlText = readFileSync36(yamlPath, "utf-8");
   } catch (err) {
     process.stderr.write(`${command}: failed to read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -24181,7 +25708,7 @@ async function runAdaptersInstall(args2) {
     return { exitCode: 1 };
   }
   const packageDir = resolve27(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync44(packageDir)) {
+  if (!existsSync46(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
@@ -24189,14 +25716,14 @@ async function runAdaptersInstall(args2) {
     return { exitCode: 1 };
   }
   const pkgJsonPath = resolve27(packageDir, "package.json");
-  if (!existsSync44(pkgJsonPath)) {
+  if (!existsSync46(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync34(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(readFileSync36(pkgJsonPath, "utf-8"));
   } catch (err) {
     process.stderr.write(`install: ${packageName} has malformed package.json: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -24316,7 +25843,7 @@ async function runAdaptersResign(_args) {
       continue;
     }
     const packageDir = resolve27(projectRoot, "node_modules", ...name.split("/"));
-    if (!existsSync44(packageDir)) {
+    if (!existsSync46(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name);
@@ -24403,10 +25930,10 @@ var init_adapters2 = __esm({
 
 // src/preflight.ts
 import Database4 from "better-sqlite3";
-import { existsSync as existsSync45 } from "fs";
+import { existsSync as existsSync47 } from "fs";
 function assertCodegraphUsable(dbPath) {
   const path = dbPath ?? getResolvedPaths().codegraphDbPath;
-  if (!existsSync45(path)) {
+  if (!existsSync47(path)) {
     throw new CodegraphDbUnusableError(path, "missing");
   }
   let db = null;
@@ -24495,8 +26022,8 @@ var init_sql_table_names = __esm({
 
 // src/db.ts
 import Database5 from "better-sqlite3";
-import { dirname as dirname21, join as join23 } from "path";
-import { existsSync as existsSync46, mkdirSync as mkdirSync19, readdirSync as readdirSync18, statSync as statSync17 } from "fs";
+import { dirname as dirname22, join as join25 } from "path";
+import { existsSync as existsSync48, mkdirSync as mkdirSync20, readdirSync as readdirSync18, statSync as statSync17 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
   assertCodegraphUsable(dbPath);
@@ -24506,9 +26033,9 @@ function getCodeGraphDb() {
 }
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
-  const dir = dirname21(dbPath);
-  if (!existsSync46(dir)) {
-    mkdirSync19(dir, { recursive: true });
+  const dir = dirname22(dbPath);
+  if (!existsSync48(dir)) {
+    mkdirSync20(dir, { recursive: true });
   }
   const db = new Database5(dbPath);
   db.pragma("journal_mode = WAL");
@@ -24780,7 +26307,7 @@ function isPythonDataStale(dataDb, pythonRoot) {
     try {
       const entries = readdirSync18(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = join23(dir, entry.name);
+        const fullPath = join25(dir, entry.name);
         if (entry.isDirectory()) {
           if (["__pycache__", ".venv", "venv", "node_modules", ".mypy_cache", ".pytest_cache"].includes(entry.name)) continue;
           if (checkDir(fullPath)) return true;
@@ -24884,8 +26411,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync35, existsSync as existsSync47, statSync as statSync18 } from "fs";
-import { resolve as resolve29, dirname as dirname22, join as join24 } from "path";
+import { readFileSync as readFileSync37, existsSync as existsSync49, statSync as statSync18 } from "fs";
+import { resolve as resolve29, dirname as dirname23, join as join26 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -24943,21 +26470,21 @@ function resolveImportPath(specifier, fromFile) {
     const paths = getResolvedPaths();
     basePath = resolve29(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve29(dirname22(fromFile), specifier);
+    basePath = resolve29(dirname23(fromFile), specifier);
   }
-  if (existsSync47(basePath) && !isDirectory(basePath)) {
+  if (existsSync49(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync47(withExt)) {
+    if (existsSync49(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
-    const indexPath = join24(basePath, indexFile);
-    if (existsSync47(indexPath)) {
+    const indexPath = join26(basePath, indexFile);
+    if (existsSync49(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -24994,10 +26521,10 @@ function buildImportIndex(dataDb, codegraphDb) {
   let batch = [];
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve29(projectRoot, file.path), projectRoot);
-    if (!existsSync47(absPath)) continue;
+    if (!existsSync49(absPath)) continue;
     let source;
     try {
-      source = readFileSync35(absPath, "utf-8");
+      source = readFileSync37(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -25034,15 +26561,15 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync36, existsSync as existsSync48, readdirSync as readdirSync19 } from "fs";
-import { resolve as resolve30, join as join25 } from "path";
+import { readFileSync as readFileSync38, existsSync as existsSync50, readdirSync as readdirSync19 } from "fs";
+import { resolve as resolve30, join as join27 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync48(rootPath)) {
+  if (!existsSync50(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
-  const source = readFileSync36(rootPath, "utf-8");
+  const source = readFileSync38(rootPath, "utf-8");
   const mappings = [];
   const importMap = /* @__PURE__ */ new Map();
   const importRegex = /import\s+\{[^}]*?(\w+Router)[^}]*\}\s+from\s+['"]\.\/routers\/([^'"]+)['"]/g;
@@ -25054,12 +26581,12 @@ function parseRootRouter() {
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync48(candidate)) {
+      if (existsSync50(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
-      const indexCandidate = join25(fullPath, "index.ts");
-      if (existsSync48(indexCandidate)) {
+      const indexCandidate = join27(fullPath, "index.ts");
+      if (existsSync50(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -25079,8 +26606,8 @@ function parseRootRouter() {
 }
 function extractProcedures(routerFilePath) {
   const absPath = resolve30(getProjectRoot(), routerFilePath);
-  if (!existsSync48(absPath)) return [];
-  const source = readFileSync36(absPath, "utf-8");
+  if (!existsSync50(absPath)) return [];
+  const source = readFileSync38(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
   const procRegex = /(\w+)\s*:\s*(protected|public)Procedure/g;
@@ -25109,7 +26636,7 @@ function findUICallSites(routerKey, procedureName) {
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync48(dir)) continue;
+    if (!existsSync50(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
@@ -25117,13 +26644,13 @@ function findUICallSites(routerKey, procedureName) {
 function searchDirectory(dir, pattern, results) {
   const entries = readdirSync19(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join25(dir, entry.name);
+    const fullPath = join27(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".next") continue;
       searchDirectory(fullPath, pattern, results);
     } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
       try {
-        const source = readFileSync36(fullPath, "utf-8");
+        const source = readFileSync38(fullPath, "utf-8");
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (lines[i].includes(pattern)) {
@@ -25187,7 +26714,7 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync37, existsSync as existsSync49 } from "fs";
+import { readFileSync as readFileSync39, existsSync as existsSync51 } from "fs";
 import { resolve as resolve31 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
@@ -25227,9 +26754,9 @@ function findRouterCalls(files) {
   const projectRoot = getProjectRoot();
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve31(projectRoot, file), projectRoot);
-    if (!existsSync49(absPath)) continue;
+    if (!existsSync51(absPath)) continue;
     try {
-      const source = readFileSync37(absPath, "utf-8");
+      const source = readFileSync39(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
       let match;
       while ((match = apiCallRegex.exec(source)) !== null) {
@@ -25248,9 +26775,9 @@ function findTablesFromRouters(routerNames, dataDb) {
     ).all(routerName);
     for (const proc of procs) {
       const absPath = ensureWithinRoot(resolve31(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync49(absPath)) continue;
+      if (!existsSync51(absPath)) continue;
       try {
-        const source = readFileSync37(absPath, "utf-8");
+        const source = readFileSync39(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
         const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
         const tableRegex = new RegExp(regexStr + "\\.", "g");
@@ -25522,14 +27049,14 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync38, existsSync as existsSync50, readdirSync as readdirSync20 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync40, existsSync as existsSync52, readdirSync as readdirSync20 } from "fs";
+import { join as join28 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync50(schemaPath)) {
+  if (!existsSync52(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
-  const source = readFileSync38(schemaPath, "utf-8");
+  const source = readFileSync40(schemaPath, "utf-8");
   const models = [];
   const sourceLines = source.split("\n");
   let i = 0;
@@ -25587,14 +27114,14 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage2 = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync50(routersDir)) return usage2;
+  if (!existsSync52(routersDir)) return usage2;
   scanDirectory(routersDir, tableName, usage2);
   return usage2;
 }
 function scanDirectory(dir, tableName, usage2) {
   const entries = readdirSync20(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join26(dir, entry.name);
+    const fullPath = join28(dir, entry.name);
     if (entry.isDirectory()) {
       scanDirectory(fullPath, tableName, usage2);
     } else if (entry.name.endsWith(".ts")) {
@@ -25604,7 +27131,7 @@ function scanDirectory(dir, tableName, usage2) {
 }
 function scanFile(absPath, tableName, usage2) {
   try {
-    const source = readFileSync38(absPath, "utf-8");
+    const source = readFileSync40(absPath, "utf-8");
     if (!source.includes(tableName)) return;
     const relPath = absPath.slice(getProjectRoot().length + 1);
     const lines = source.split("\n");
@@ -25649,15 +27176,15 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync50(dir)) return result;
+  if (!existsSync52(dir)) return result;
   const entries = readdirSync20(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join26(dir, entry.name);
+    const fullPath = join28(dir, entry.name);
     if (entry.isDirectory()) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
       try {
-        const source = readFileSync38(fullPath, "utf-8");
+        const source = readFileSync40(fullPath, "utf-8");
         if (source.includes(tableName) && source.includes(column)) {
           result.push(fullPath.slice(getProjectRoot().length + 1));
         }
@@ -25802,35 +27329,35 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync39, existsSync as existsSync51, readdirSync as readdirSync21 } from "fs";
-import { resolve as resolve33, join as join27, relative as relative7, dirname as dirname23 } from "path";
+import { readFileSync as readFileSync41, existsSync as existsSync53, readdirSync as readdirSync21 } from "fs";
+import { resolve as resolve33, join as join29, relative as relative8, dirname as dirname24 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname23(resolve33(projectRoot, fromFile));
+    let baseDir = dirname24(resolve33(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
-      baseDir = dirname23(baseDir);
+      baseDir = dirname24(baseDir);
     }
     const modulePart = module.replace(/^\.+/, "");
     if (modulePart) {
       const parts2 = modulePart.split(".");
-      return tryResolvePythonPath(join27(baseDir, ...parts2), projectRoot);
+      return tryResolvePythonPath(join29(baseDir, ...parts2), projectRoot);
     }
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join27(resolve33(projectRoot, pythonRoot), ...parts);
+  const candidate = join29(resolve33(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync51(basePath + ".py")) {
-    return relative7(projectRoot, basePath + ".py");
+  if (existsSync53(basePath + ".py")) {
+    return relative8(projectRoot, basePath + ".py");
   }
-  if (existsSync51(join27(basePath, "__init__.py"))) {
-    return relative7(projectRoot, join27(basePath, "__init__.py"));
+  if (existsSync53(join29(basePath, "__init__.py"))) {
+    return relative8(projectRoot, join29(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync51(basePath)) {
-    return relative7(projectRoot, basePath);
+  if (basePath.endsWith(".py") && existsSync53(basePath)) {
+    return relative8(projectRoot, basePath);
   }
   return null;
 }
@@ -25841,9 +27368,9 @@ function walkPythonFiles(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPythonFiles(join27(dir, entry.name), excludeDirs));
+        files.push(...walkPythonFiles(join29(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join27(dir, entry.name));
+        files.push(join29(dir, entry.name));
       }
     }
   } catch {
@@ -25866,10 +27393,10 @@ function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__"
   });
   const batch = [];
   for (const absFile of files) {
-    const relFile = relative7(projectRoot, absFile);
+    const relFile = relative8(projectRoot, absFile);
     let source;
     try {
-      source = readFileSync39(absFile, "utf-8");
+      source = readFileSync41(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -26136,8 +27663,8 @@ var init_route_parser = __esm({
 });
 
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync40, readdirSync as readdirSync22 } from "fs";
-import { join as join28, relative as relative8 } from "path";
+import { readFileSync as readFileSync42, readdirSync as readdirSync22 } from "fs";
+import { join as join30, relative as relative9 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
@@ -26145,9 +27672,9 @@ function walkPyFiles(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles(join28(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles(join30(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join28(dir, entry.name));
+        files.push(join30(dir, entry.name));
       }
     }
   } catch {
@@ -26156,7 +27683,7 @@ function walkPyFiles(dir, excludeDirs) {
 }
 function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join28(projectRoot, pythonRoot);
+  const absRoot = join30(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_routes")}`);
   dataDb.exec(`DELETE FROM ${t("py_route_callers")}`);
   const insertStmt = dataDb.prepare(
@@ -26166,10 +27693,10 @@ function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
   let count = 0;
   dataDb.transaction(() => {
     for (const absFile of files) {
-      const relFile = relative8(projectRoot, absFile);
+      const relFile = relative9(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync40(absFile, "utf-8");
+        source = readFileSync42(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -26276,7 +27803,7 @@ function parsePythonModels(source) {
     const bases = classMatch[2];
     const classLine = i + 1;
     let isModel = isModelClass(bases);
-    const columns = [];
+    const columns2 = [];
     const relationships = [];
     const foreignKeys = [];
     let tableName = null;
@@ -26319,7 +27846,7 @@ function parsePythonModels(source) {
           const colType = extractColumnType(argsStr);
           const nullable = extractNullable(argsStr);
           const primaryKey = extractPrimaryKey(argsStr);
-          columns.push({ name: colName, type: colType, nullable, primaryKey });
+          columns2.push({ name: colName, type: colType, nullable, primaryKey });
           foreignKeys.push(...extractForeignKeys(colName, argsStr));
         }
         i++;
@@ -26333,7 +27860,7 @@ function parsePythonModels(source) {
         const mappedType = extractMappedType(mappedAnnotation);
         const nullable = mappedType.startsWith("Optional") || extractNullable(argsStr || "");
         const primaryKey = extractPrimaryKey(argsStr || "");
-        columns.push({ name: colName, type: mappedType, nullable, primaryKey });
+        columns2.push({ name: colName, type: mappedType, nullable, primaryKey });
         if (argsStr) {
           foreignKeys.push(...extractForeignKeys(colName, argsStr));
         }
@@ -26363,7 +27890,7 @@ function parsePythonModels(source) {
       models.push({
         className,
         tableName,
-        columns,
+        columns: columns2,
         relationships,
         foreignKeys,
         line: classLine
@@ -26381,8 +27908,8 @@ var init_model_parser = __esm({
 });
 
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync41, readdirSync as readdirSync23 } from "fs";
-import { join as join29, relative as relative9 } from "path";
+import { readFileSync as readFileSync43, readdirSync as readdirSync23 } from "fs";
+import { join as join31, relative as relative10 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
@@ -26390,9 +27917,9 @@ function walkPyFiles2(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles2(join29(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles2(join31(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join29(dir, entry.name));
+        files.push(join31(dir, entry.name));
       }
     }
   } catch {
@@ -26401,7 +27928,7 @@ function walkPyFiles2(dir, excludeDirs) {
 }
 function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join29(projectRoot, pythonRoot);
+  const absRoot = join31(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_models")}`);
   dataDb.exec(`DELETE FROM ${t("py_fk_edges")}`);
   const insertModel = dataDb.prepare(
@@ -26414,10 +27941,10 @@ function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
   let count = 0;
   dataDb.transaction(() => {
     for (const absFile of files) {
-      const relFile = relative9(projectRoot, absFile);
+      const relFile = relative10(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync41(absFile, "utf-8");
+        source = readFileSync43(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -26678,19 +28205,19 @@ var init_migration_parser = __esm({
 });
 
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync42, readdirSync as readdirSync24 } from "fs";
-import { join as join30, relative as relative10 } from "path";
+import { readFileSync as readFileSync44, readdirSync as readdirSync24 } from "fs";
+import { join as join32, relative as relative11 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
-  const absDir = join30(projectRoot, alembicDir);
+  const absDir = join32(projectRoot, alembicDir);
   dataDb.exec(`DELETE FROM ${t("py_migrations")}`);
-  const versionsDir = join30(absDir, "versions");
+  const versionsDir = join32(absDir, "versions");
   let files = [];
   try {
-    files = readdirSync24(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join30(versionsDir, f2));
+    files = readdirSync24(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join32(versionsDir, f2));
   } catch {
     try {
-      files = readdirSync24(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join30(absDir, f2));
+      files = readdirSync24(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join32(absDir, f2));
     } catch {
     }
   }
@@ -26704,7 +28231,7 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
   for (const absFile of files) {
     let source;
     try {
-      source = readFileSync42(absFile, "utf-8");
+      source = readFileSync44(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -26715,7 +28242,7 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
     rows.push({
       revision: parsed.revision,
       downRevision: parsed.downRevision,
-      file: relative10(projectRoot, absFile),
+      file: relative11(projectRoot, absFile),
       description: parsed.description,
       operations: JSON.stringify(parsed.operations)
     });
@@ -26739,12 +28266,12 @@ var init_migration_indexer = __esm({
 });
 
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync43, readdirSync as readdirSync25 } from "fs";
-import { join as join31, relative as relative11 } from "path";
+import { readFileSync as readFileSync45, readdirSync as readdirSync25 } from "fs";
+import { join as join33, relative as relative12 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
   const config = getConfig();
-  const srcDir = join31(projectRoot, config.paths.source);
+  const srcDir = join33(projectRoot, config.paths.source);
   const routes = dataDb.prepare(`SELECT id, method, path FROM ${t("py_routes")}`).all();
   if (routes.length === 0) return 0;
   dataDb.exec(`DELETE FROM ${t("py_route_callers")}`);
@@ -26773,10 +28300,10 @@ function buildPythonCouplingIndex(dataDb) {
   ];
   dataDb.transaction(() => {
     for (const absFile of frontendFiles) {
-      const relFile = relative11(projectRoot, absFile);
+      const relFile = relative12(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync43(absFile, "utf-8");
+        source = readFileSync45(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -26808,9 +28335,9 @@ function walkFrontendFiles(dir) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (exclude.includes(entry.name)) continue;
-        files.push(...walkFrontendFiles(join31(dir, entry.name)));
+        files.push(...walkFrontendFiles(join33(dir, entry.name)));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
-        files.push(join31(dir, entry.name));
+        files.push(join33(dir, entry.name));
       }
     }
   } catch {
@@ -26840,14 +28367,14 @@ var init_coupling_detector = __esm({
 });
 
 // src/memory-tools.ts
-function p2(baseName) {
+function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
 function getMemoryToolDefinitions() {
   return [
     // P4-001: memory_search
     {
-      name: p2("memory_search"),
+      name: p3("memory_search"),
       description: "Search past session observations and decisions using full-text search. Returns compact index of matching observations.",
       inputSchema: {
         type: "object",
@@ -26863,7 +28390,7 @@ function getMemoryToolDefinitions() {
     },
     // P4-002: memory_timeline
     {
-      name: p2("memory_timeline"),
+      name: p3("memory_timeline"),
       description: "Retrieve episodic memory - chronological context around a specific event. Shows observations before and after the anchor point to reconstruct what happened and why.",
       inputSchema: {
         type: "object",
@@ -26877,7 +28404,7 @@ function getMemoryToolDefinitions() {
     },
     // P4-003: memory_detail
     {
-      name: p2("memory_detail"),
+      name: p3("memory_detail"),
       description: "Get full observation details by IDs (batch). Includes evidence, files, plan items.",
       inputSchema: {
         type: "object",
@@ -26893,7 +28420,7 @@ function getMemoryToolDefinitions() {
     },
     // P4-004: memory_sessions
     {
-      name: p2("memory_sessions"),
+      name: p3("memory_sessions"),
       description: "List recent sessions with summaries.",
       inputSchema: {
         type: "object",
@@ -26906,7 +28433,7 @@ function getMemoryToolDefinitions() {
     },
     // P4-005: memory_failures
     {
-      name: p2("memory_failures"),
+      name: p3("memory_failures"),
       description: "Get all failed attempts (DON'T RETRY warnings). Check before attempting a fix to see if it was already tried.",
       inputSchema: {
         type: "object",
@@ -26919,7 +28446,7 @@ function getMemoryToolDefinitions() {
     },
     // P4-007: memory_backfill
     {
-      name: p2("memory_backfill"),
+      name: p3("memory_backfill"),
       description: "Scan all memory/*.md files and ingest into database. Run after massu init or to recover from DB loss. Parses YAML frontmatter and deduplicates by title.",
       inputSchema: {
         type: "object",
@@ -26929,7 +28456,7 @@ function getMemoryToolDefinitions() {
     },
     // P4-006: memory_ingest
     {
-      name: p2("memory_ingest"),
+      name: p3("memory_ingest"),
       description: "Manually record an observation that hooks cannot auto-detect. Use for significant decisions, discoveries, or failed attempts mid-session.",
       inputSchema: {
         type: "object",
@@ -26974,15 +28501,15 @@ function handleMemoryToolCall(name, args2, memoryDb) {
       case "memory_backfill":
         return handleBackfill(memoryDb);
       default:
-        return text(`Unknown memory tool: ${name}`);
+        return text2(`Unknown memory tool: ${name}`);
     }
   } catch (error) {
-    return text(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}`);
+    return text2(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
 function handleSearch(args2, db) {
   const query = args2.query;
-  if (!query) return text("Error: query is required");
+  if (!query) return text2("Error: query is required");
   const results = searchObservations(db, query, {
     type: args2.type,
     crRule: args2.cr_rule,
@@ -26990,7 +28517,7 @@ function handleSearch(args2, db) {
     limit: args2.limit
   });
   if (results.length === 0) {
-    return text(`No observations found for "${query}".`);
+    return text2(`No observations found for "${query}".`);
   }
   const lines = [`## Search Results for "${query}" (${results.length} matches)`, ""];
   lines.push("| ID | Type | Title | Date | Importance |");
@@ -26999,17 +28526,17 @@ function handleSearch(args2, db) {
     lines.push(`| ${r2.id} | ${r2.type} | ${r2.title.slice(0, 80)} | ${r2.created_at.split("T")[0]} | ${r2.importance} |`);
   }
   lines.push("");
-  lines.push(`Use ${p2("memory_detail")} with IDs for full details.`);
-  lines.push(`Use ${p2("memory_timeline")} with an ID for chronological context.`);
-  return text(lines.join("\n"));
+  lines.push(`Use ${p3("memory_detail")} with IDs for full details.`);
+  lines.push(`Use ${p3("memory_timeline")} with an ID for chronological context.`);
+  return text2(lines.join("\n"));
 }
 function handleTimeline(args2, db) {
   const observationId = args2.observation_id;
-  if (!observationId) return text("Error: observation_id is required");
+  if (!observationId) return text2("Error: observation_id is required");
   const depthBefore = args2.depth_before ?? 5;
   const depthAfter = args2.depth_after ?? 5;
   const anchor = db.prepare("SELECT * FROM observations WHERE id = ?").get(observationId);
-  if (!anchor) return text(`Observation ${observationId} not found.`);
+  if (!anchor) return text2(`Observation ${observationId} not found.`);
   const before = db.prepare(
     "SELECT id, type, title, created_at, importance FROM observations WHERE session_id = ? AND created_at_epoch < ? ORDER BY created_at_epoch DESC LIMIT ?"
   ).all(anchor.session_id, anchor.created_at_epoch, depthBefore);
@@ -27024,17 +28551,17 @@ function handleTimeline(args2, db) {
   for (const o of after) {
     lines.push(`  ${o.id} | ${o.type} | ${o.title.slice(0, 60)} | ${o.created_at.split("T")[0]}`);
   }
-  return text(lines.join("\n"));
+  return text2(lines.join("\n"));
 }
 function handleDetail(args2, db) {
   const ids = args2.ids;
-  if (!ids || ids.length === 0) return text("Error: ids array is required");
+  if (!ids || ids.length === 0) return text2("Error: ids array is required");
   const placeholders = ids.map(() => "?").join(",");
   const observations = db.prepare(
     `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch ASC LIMIT 10000`
   ).all(...ids);
   if (observations.length === 0) {
-    return text("No observations found for the given IDs.");
+    return text2("No observations found for the given IDs.");
   }
   const lines = [];
   for (const o of observations) {
@@ -27054,7 +28581,7 @@ function handleDetail(args2, db) {
     if (o.recurrence_count > 1) lines.push(`**Recurrence**: ${o.recurrence_count}x`);
     lines.push("");
   }
-  return text(lines.join("\n"));
+  return text2(lines.join("\n"));
 }
 function handleSessions(args2, db) {
   const limit = args2.limit ?? 10;
@@ -27069,7 +28596,7 @@ function handleSessions(args2, db) {
   params.push(limit);
   const sessions = db.prepare(sql).all(...params);
   if (sessions.length === 0) {
-    return text("No sessions found.");
+    return text2("No sessions found.");
   }
   const lines = ["## Recent Sessions", ""];
   lines.push("| Session ID | Status | Branch | Started | Plan |");
@@ -27089,14 +28616,14 @@ function handleSessions(args2, db) {
       if (summary.completed) lines.push(`**Completed**: ${summary.completed.slice(0, 200)}`);
     }
   }
-  return text(lines.join("\n"));
+  return text2(lines.join("\n"));
 }
 function handleFailures(args2, db) {
   const query = args2.query;
   const limit = args2.limit ?? 20;
   const failures = getFailedAttempts(db, query, limit);
   if (failures.length === 0) {
-    return text(query ? `No failed attempts found for "${query}".` : "No failed attempts recorded.");
+    return text2(query ? `No failed attempts found for "${query}".` : "No failed attempts recorded.");
   }
   const lines = ["## Failed Attempts (DO NOT RETRY)", ""];
   for (const f2 of failures) {
@@ -27106,12 +28633,12 @@ function handleFailures(args2, db) {
     lines.push(`Session: ${f2.session_id.slice(0, 8)}... | Date: ${f2.created_at.split("T")[0]}`);
     lines.push("");
   }
-  return text(lines.join("\n"));
+  return text2(lines.join("\n"));
 }
 function handleIngest(args2, db) {
   const type = args2.type;
   const title = args2.title;
-  if (!type || !title) return text("Error: type and title are required");
+  if (!type || !title) return text2("Error: type and title are required");
   const validTypes = [
     "decision",
     "bugfix",
@@ -27126,13 +28653,13 @@ function handleIngest(args2, db) {
     "incident_near_miss"
   ];
   if (!validTypes.includes(type)) {
-    return text(`Error: invalid type "${type}". Valid types: ${validTypes.join(", ")}`);
+    return text2(`Error: invalid type "${type}". Valid types: ${validTypes.join(", ")}`);
   }
   const activeSession = db.prepare(
     "SELECT session_id FROM sessions WHERE status = 'active' ORDER BY started_at_epoch DESC LIMIT 1"
   ).get();
   if (!activeSession) {
-    return text("Error: no active session found. Start a session first.");
+    return text2("Error: no active session found. Start a session first.");
   }
   const importance = args2.importance ?? assignImportance(type);
   const id = addObservation(db, activeSession.session_id, type, title, args2.detail ?? null, {
@@ -27141,7 +28668,7 @@ function handleIngest(args2, db) {
     planItem: args2.plan_item,
     filesInvolved: args2.files
   });
-  return text(`Observation #${id} recorded successfully.
+  return text2(`Observation #${id} recorded successfully.
 Type: ${type}
 Title: ${title}
 Importance: ${importance}
@@ -27160,9 +28687,9 @@ function handleBackfill(db) {
     "",
     stats.total === 0 ? "No memory files found in memory directory." : `Successfully processed ${stats.inserted + stats.updated} of ${stats.total} memory files.`
   ];
-  return text(lines.join("\n"));
+  return text2(lines.join("\n"));
 }
-function text(content) {
+function text2(content) {
   return { content: [{ type: "text", text: content }] };
 }
 function safeParseJson(json, fallback) {
@@ -27182,15 +28709,15 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync44, existsSync as existsSync52 } from "fs";
+import { readFileSync as readFileSync46, existsSync as existsSync54 } from "fs";
 import { resolve as resolve34, basename as basename9 } from "path";
-function p3(baseName) {
+function p4(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
 function getDocsToolDefinitions() {
   return [
     {
-      name: p3("docs_audit"),
+      name: p4("docs_audit"),
       description: "Audit which help site pages need updating based on changed files. Maps code changes to affected documentation pages using docs-map.json.",
       inputSchema: {
         type: "object",
@@ -27209,7 +28736,7 @@ function getDocsToolDefinitions() {
       }
     },
     {
-      name: p3("docs_coverage"),
+      name: p4("docs_coverage"),
       description: "Report docs coverage: which help pages exist, have content, and are up-to-date. Identifies documentation gaps.",
       inputSchema: {
         type: "object",
@@ -27233,15 +28760,15 @@ function handleDocsToolCall(name, args2) {
     case "docs_coverage":
       return handleDocsCoverage(args2);
     default:
-      return text2(`Unknown docs tool: ${name}`);
+      return text3(`Unknown docs tool: ${name}`);
   }
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync52(mapPath)) {
+  if (!existsSync54(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
-  return JSON.parse(readFileSync44(mapPath, "utf-8"));
+  return JSON.parse(readFileSync46(mapPath, "utf-8"));
 }
 function matchesPattern(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -27312,12 +28839,12 @@ function extractFrontmatter(content) {
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
   const absPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync52(absPath)) {
+  if (!existsSync54(absPath)) {
     const altPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
-    if (!existsSync52(altPath)) return [];
-    return extractProcedureNamesFromContent(readFileSync44(altPath, "utf-8"));
+    if (!existsSync54(altPath)) return [];
+    return extractProcedureNamesFromContent(readFileSync46(altPath, "utf-8"));
   }
-  return extractProcedureNamesFromContent(readFileSync44(absPath, "utf-8"));
+  return extractProcedureNamesFromContent(readFileSync46(absPath, "utf-8"));
 }
 function extractProcedureNamesFromContent(content) {
   const procRegex = /\.(?:query|mutation)\s*\(/g;
@@ -27343,12 +28870,12 @@ function handleDocsAudit(args2) {
   const changedFiles = args2.changed_files;
   const commitMessage = args2.commit_message || "";
   if (!changedFiles || changedFiles.length === 0) {
-    return text2(JSON.stringify({ affectedPages: [], summary: "No changed files provided." }));
+    return text3(JSON.stringify({ affectedPages: [], summary: "No changed files provided." }));
   }
   const docsMap = loadDocsMap();
   const affectedMappings = findAffectedMappings(docsMap, changedFiles);
   if (affectedMappings.size === 0) {
-    return text2(JSON.stringify({
+    return text3(JSON.stringify({
       affectedPages: [],
       summary: `0 help pages affected by ${changedFiles.length} changed files. No docs update needed.`
     }));
@@ -27358,7 +28885,7 @@ function handleDocsAudit(args2) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
     const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync52(helpPagePath)) {
+    if (!existsSync54(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -27370,7 +28897,7 @@ function handleDocsAudit(args2) {
       });
       continue;
     }
-    const content = readFileSync44(helpPagePath, "utf-8");
+    const content = readFileSync46(helpPagePath, "utf-8");
     const sections = extractSections(content);
     const frontmatter = extractFrontmatter(content);
     const staleReasons = [];
@@ -27411,8 +28938,8 @@ function handleDocsAudit(args2) {
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
         const guidePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync52(guidePath)) {
-          const guideContent = readFileSync44(guidePath, "utf-8");
+        if (existsSync54(guidePath)) {
+          const guideContent = readFileSync46(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
             results.push({
@@ -27436,7 +28963,7 @@ function handleDocsAudit(args2) {
     affectedPages: results,
     summary: `${results.length} pages checked: ${staleCount} STALE, ${newCount} NEW, ${okCount} OK. ${staleCount + newCount > 0 ? `${staleCount + newCount} pages need updates.` : "All docs are current."}`
   };
-  return text2(JSON.stringify(report, null, 2));
+  return text3(JSON.stringify(report, null, 2));
 }
 function handleDocsCoverage(args2) {
   const filterDomain = args2.domain;
@@ -27446,13 +28973,13 @@ function handleDocsCoverage(args2) {
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
     const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync52(helpPagePath);
+    const exists = existsSync54(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
     let status = null;
     if (exists) {
-      const content = readFileSync44(helpPagePath, "utf-8");
+      const content = readFileSync46(helpPagePath, "utf-8");
       lineCount = content.split("\n").length;
       hasContent = lineCount > 10;
       const frontmatter = extractFrontmatter(content);
@@ -27503,9 +29030,9 @@ function handleDocsCoverage(args2) {
     const icon = entry.hasContent ? "OK" : entry.exists ? "THIN" : "MISSING";
     lines.push(`- [${icon}] ${entry.id}: ${entry.helpPage}${verified}${pageStatus} (${entry.lineCount} lines)`);
   }
-  return text2(lines.join("\n"));
+  return text3(lines.join("\n"));
 }
-function text2(content) {
+function text3(content) {
   return { content: [{ type: "text", text: content }] };
 }
 var init_docs_tools = __esm({
@@ -27517,7 +29044,7 @@ var init_docs_tools = __esm({
 });
 
 // src/observability-tools.ts
-function p4(baseName) {
+function p5(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
 function isObservabilityTool(name) {
@@ -27529,7 +29056,7 @@ function getObservabilityToolDefinitions() {
   return [
     // P3-001: session_replay
     {
-      name: p4("session_replay"),
+      name: p5("session_replay"),
       description: "Replay a past session as a chronological conversation with user prompts, assistant responses, and optional tool call details. Requires conversation data captured by the session-end hook.",
       inputSchema: {
         type: "object",
@@ -27544,7 +29071,7 @@ function getObservabilityToolDefinitions() {
     },
     // P3-002: prompt_analysis
     {
-      name: p4("prompt_analysis"),
+      name: p5("prompt_analysis"),
       description: "Search and analyze prompts across sessions using FTS5 full-text search on conversation_turns_fts. Find prompts by keyword, filter by date range or complexity (tool call count).",
       inputSchema: {
         type: "object",
@@ -27561,7 +29088,7 @@ function getObservabilityToolDefinitions() {
     },
     // P3-003: tool_patterns
     {
-      name: p4("tool_patterns"),
+      name: p5("tool_patterns"),
       description: "Analyze tool usage patterns across sessions. Shows counts, success rates, average I/O sizes per tool. Can group by tool name, session, or day.",
       inputSchema: {
         type: "object",
@@ -27576,7 +29103,7 @@ function getObservabilityToolDefinitions() {
     },
     // P3-004: session_stats
     {
-      name: p4("session_stats"),
+      name: p5("session_stats"),
       description: "Get per-session statistics: turn count, tool call breakdown, token usage, duration. Includes database size monitoring for observability data.",
       inputSchema: {
         type: "object",
@@ -27603,15 +29130,15 @@ function handleObservabilityToolCall(name, args2, memoryDb) {
       case "session_stats":
         return handleSessionStats(args2, memoryDb);
       default:
-        return text3(`Unknown observability tool: ${name}`);
+        return text4(`Unknown observability tool: ${name}`);
     }
   } catch (error) {
-    return text3(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}`);
+    return text4(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
 function handleSessionReplay(args2, db) {
   const sessionId = args2.session_id;
-  if (!sessionId) return text3("Error: session_id is required");
+  if (!sessionId) return text4("Error: session_id is required");
   const includeToolCalls = args2.include_tool_calls ?? false;
   const turns = getConversationTurns(db, sessionId, {
     turnFrom: args2.turn_from,
@@ -27619,7 +29146,7 @@ function handleSessionReplay(args2, db) {
     includeToolCalls
   });
   if (turns.length === 0) {
-    return text3(`No conversation turns found for session ${sessionId.slice(0, 8)}...
+    return text4(`No conversation turns found for session ${sessionId.slice(0, 8)}...
 Note: Conversation data is captured by the session-end hook. Only sessions that have ended will have replay data.`);
   }
   const lines = [`## Session Replay: ${sessionId.slice(0, 12)}...`, `Turns: ${turns.length}`, ""];
@@ -27651,7 +29178,7 @@ Note: Conversation data is captured by the session-end hook. Only sessions that
     lines.push("---");
     lines.push("");
   }
-  return text3(lines.join("\n"));
+  return text4(lines.join("\n"));
 }
 function handlePromptAnalysis(args2, db) {
   const query = args2.query;
@@ -27660,7 +29187,7 @@ function handlePromptAnalysis(args2, db) {
       "SELECT ct.session_id, ct.turn_number, ct.user_prompt, ct.tool_call_count, ct.response_tokens, ct.created_at FROM conversation_turns ct ORDER BY ct.created_at_epoch DESC LIMIT ?"
     ).all(args2.limit ?? 20);
     if (recentTurns.length === 0) {
-      return text3("No conversation turns recorded yet.");
+      return text4("No conversation turns recorded yet.");
     }
     const lines2 = ["## Recent Prompts", ""];
     lines2.push("| Session | Turn | Prompt (truncated) | Tools | Response Tokens | Date |");
@@ -27668,7 +29195,7 @@ function handlePromptAnalysis(args2, db) {
     for (const t2 of recentTurns) {
       lines2.push(`| ${t2.session_id.slice(0, 8)}... | ${t2.turn_number} | ${t2.user_prompt.slice(0, 60).replace(/\|/g, "\\|")} | ${t2.tool_call_count} | ${t2.response_tokens ?? "-"} | ${t2.created_at.split("T")[0]} |`);
     }
-    return text3(lines2.join("\n"));
+    return text4(lines2.join("\n"));
   }
   const results = searchConversationTurns(db, query, {
     sessionId: args2.session_id,
@@ -27678,7 +29205,7 @@ function handlePromptAnalysis(args2, db) {
     limit: args2.limit
   });
   if (results.length === 0) {
-    return text3(`No prompts found matching "${query}".`);
+    return text4(`No prompts found matching "${query}".`);
   }
   const lines = [`## Prompt Search: "${query}" (${results.length} results)`, ""];
   lines.push("| Session | Turn | Prompt (truncated) | Tools | Response Tokens | Date |");
@@ -27686,7 +29213,7 @@ function handlePromptAnalysis(args2, db) {
   for (const r2 of results) {
     lines.push(`| ${r2.session_id.slice(0, 8)}... | ${r2.turn_number} | ${r2.user_prompt.slice(0, 60).replace(/\|/g, "\\|")} | ${r2.tool_call_count} | ${r2.response_tokens ?? "-"} | ${r2.created_at.split("T")[0]} |`);
   }
-  return text3(lines.join("\n"));
+  return text4(lines.join("\n"));
 }
 function handleToolPatterns(args2, db) {
   const groupBy = args2.group_by ?? "tool";
@@ -27697,7 +29224,7 @@ function handleToolPatterns(args2, db) {
     groupBy
   });
   if (patterns.length === 0) {
-    return text3("No tool usage data recorded yet.");
+    return text4("No tool usage data recorded yet.");
   }
   const lines = [`## Tool Usage Patterns (grouped by ${groupBy})`, ""];
   switch (groupBy) {
@@ -27727,7 +29254,7 @@ function handleToolPatterns(args2, db) {
       }
       break;
   }
-  return text3(lines.join("\n"));
+  return text4(lines.join("\n"));
 }
 function handleSessionStats(args2, db) {
   const stats = getSessionStats(db, {
@@ -27735,7 +29262,7 @@ function handleSessionStats(args2, db) {
     limit: args2.limit
   });
   if (stats.length === 0) {
-    return text3("No session stats available.");
+    return text4("No session stats available.");
   }
   const lines = ["## Session Statistics", ""];
   if (args2.session_id) {
@@ -27772,9 +29299,9 @@ function handleSessionStats(args2, db) {
   lines.push(`- Tool call details: ${dbSize.tool_call_details_count}`);
   lines.push(`- Observations: ${dbSize.observations_count}`);
   lines.push(`- Database size: ~${dbSize.estimated_size_mb} MB`);
-  return text3(lines.join("\n"));
+  return text4(lines.join("\n"));
 }
-function text3(content) {
+function text4(content) {
   return { content: [{ type: "text", text: content }] };
 }
 var OBSERVABILITY_BASE_NAMES;
@@ -27793,7 +29320,7 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync53 } from "fs";
+import { existsSync as existsSync55 } from "fs";
 import { resolve as resolve35 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
@@ -28031,22 +29558,22 @@ function validateFeatures(db, domainFilter) {
     const missingPages = [];
     for (const comp of components) {
       const absPath = resolve35(PROJECT_ROOT, comp.component_file);
-      if (!existsSync53(absPath)) {
+      if (!existsSync55(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
       const routerPath = resolve35(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync53(routerPath)) {
+      if (!existsSync55(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
       const absPath = resolve35(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync53(absPath)) {
+      if (page.page_route.startsWith("/") && !existsSync55(absPath)) {
         const altPath = resolve35(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync53(altPath)) {
+        if (!existsSync55(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -28142,17 +29669,17 @@ var init_sentinel_db = __esm({
 });
 
 // src/sentinel-tools.ts
-function p5(baseName) {
+function p6(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
-function text4(content) {
+function text5(content) {
   return { content: [{ type: "text", text: content }] };
 }
 function getSentinelToolDefinitions() {
   return [
     // P2-001: sentinel_search
     {
-      name: p5("sentinel_search"),
+      name: p6("sentinel_search"),
       description: "Search and list features in the Sentinel feature registry. Supports FTS5 full-text search and domain/status/portal filters.",
       inputSchema: {
         type: "object",
@@ -28169,7 +29696,7 @@ function getSentinelToolDefinitions() {
     },
     // P2-002: sentinel_detail
     {
-      name: p5("sentinel_detail"),
+      name: p6("sentinel_detail"),
       description: "Get full feature details including all linked components, procedures, pages, dependencies, and changelog.",
       inputSchema: {
         type: "object",
@@ -28182,7 +29709,7 @@ function getSentinelToolDefinitions() {
     },
     // P2-003: sentinel_impact
     {
-      name: p5("sentinel_impact"),
+      name: p6("sentinel_impact"),
       description: "Pre-deletion impact analysis. Shows which features would be orphaned, degraded, or unaffected if specified files are deleted. BLOCKS if critical features would be orphaned.",
       inputSchema: {
         type: "object",
@@ -28198,7 +29725,7 @@ function getSentinelToolDefinitions() {
     },
     // P2-004: sentinel_validate
     {
-      name: p5("sentinel_validate"),
+      name: p6("sentinel_validate"),
       description: "Validate all active features have living implementation files. Reports alive, orphaned, and degraded features.",
       inputSchema: {
         type: "object",
@@ -28211,7 +29738,7 @@ function getSentinelToolDefinitions() {
     },
     // P2-005: sentinel_register
     {
-      name: p5("sentinel_register"),
+      name: p6("sentinel_register"),
       description: "Register or update a feature in the sentinel registry. Links components, procedures, and pages.",
       inputSchema: {
         type: "object",
@@ -28268,7 +29795,7 @@ function getSentinelToolDefinitions() {
     },
     // P2-006: sentinel_parity
     {
-      name: p5("sentinel_parity"),
+      name: p6("sentinel_parity"),
       description: "Compare two sets of files for feature parity. Shows features in old but not new (GAPs), features in both (DONE), and features only in new (NEW).",
       inputSchema: {
         type: "object",
@@ -28306,7 +29833,7 @@ function handleSentinelToolCall(name, args2, dataDb) {
     case "sentinel_parity":
       return handleParityCheck(args2, dataDb);
     default:
-      return text4(`Unknown sentinel tool: ${name}`);
+      return text5(`Unknown sentinel tool: ${name}`);
   }
 }
 function handleSearch2(args2, db) {
@@ -28329,7 +29856,7 @@ function handleSearch2(args2, db) {
   lines.push("");
   if (results.length === 0) {
     lines.push("No features found matching criteria.");
-    return text4(lines.join("\n"));
+    return text5(lines.join("\n"));
   }
   let currentDomain = "";
   for (const f2 of results) {
@@ -28341,17 +29868,17 @@ function handleSearch2(args2, db) {
     const priority = f2.priority === "critical" ? " [CRITICAL]" : "";
     lines.push(`- **${f2.feature_key}** ${sub}${priority}: ${f2.title} (${f2.component_count}C/${f2.procedure_count}P/${f2.page_count}R) [${f2.status}]`);
   }
-  return text4(lines.join("\n"));
+  return text5(lines.join("\n"));
 }
 function handleDetail2(args2, db) {
   const key = args2.feature_key;
   const id = args2.feature_id;
   if (!key && !id) {
-    return text4("Error: Provide either feature_key or feature_id");
+    return text5("Error: Provide either feature_key or feature_id");
   }
   const detail = getFeatureDetail(db, id || key);
   if (!detail) {
-    return text4(`Feature not found: ${key || id}`);
+    return text5(`Feature not found: ${key || id}`);
   }
   const lines = [];
   lines.push(`## Feature: ${detail.feature_key}`);
@@ -28397,12 +29924,12 @@ function handleDetail2(args2, db) {
       lines.push(`- [${c2.created_at}] ${c2.change_type}: ${c2.change_detail || "(no detail)"}${c2.commit_hash ? " @" + c2.commit_hash.substring(0, 8) : ""}`);
     }
   }
-  return text4(lines.join("\n"));
+  return text5(lines.join("\n"));
 }
 function handleImpact(args2, db) {
   const files = args2.files;
   if (!files || files.length === 0) {
-    return text4("Error: Provide files array");
+    return text5("Error: Provide files array");
   }
   const report = getFeatureImpact(db, files);
   const lines = [];
@@ -28438,7 +29965,7 @@ function handleImpact(args2, db) {
     }
     lines.push("");
   }
-  return text4(lines.join("\n"));
+  return text5(lines.join("\n"));
 }
 function handleValidate(args2, db) {
   const domain = args2.domain;
@@ -28483,14 +30010,14 @@ function handleValidate(args2, db) {
   }
   const result = report.orphaned === 0 ? "PASS" : "FAIL";
   lines.push(`### RESULT: ${result}`);
-  return text4(lines.join("\n"));
+  return text5(lines.join("\n"));
 }
 function handleRegister(args2, db) {
   const featureKey = args2.feature_key;
   const domain = args2.domain;
   const title = args2.title;
   if (!featureKey || !domain || !title) {
-    return text4("Error: feature_key, domain, and title are required");
+    return text5("Error: feature_key, domain, and title are required");
   }
   const featureId = upsertFeature(db, {
     feature_key: featureKey,
@@ -28520,15 +30047,15 @@ function handleRegister(args2, db) {
       linkPage(db, featureId, p19.route, p19.portal);
     }
   }
-  logChange(db, featureId, "created", `Registered via ${p5("sentinel_register")}`);
-  return text4(`Feature registered: ${featureKey} (ID: ${featureId})
+  logChange(db, featureId, "created", `Registered via ${p6("sentinel_register")}`);
+  return text5(`Feature registered: ${featureKey} (ID: ${featureId})
 Components: ${components?.length || 0}, Procedures: ${procedures?.length || 0}, Pages: ${pages?.length || 0}`);
 }
 function handleParityCheck(args2, db) {
   const oldFiles = args2.old_files;
   const newFiles = args2.new_files;
   if (!oldFiles || !newFiles) {
-    return text4("Error: Provide both old_files and new_files arrays");
+    return text5("Error: Provide both old_files and new_files arrays");
   }
   const report = checkParity(db, oldFiles, newFiles);
   const lines = [];
@@ -28560,7 +30087,7 @@ function handleParityCheck(args2, db) {
   }
   const result = report.gaps.length === 0 ? "PASS" : `FAIL (${report.gaps.length} gaps)`;
   lines.push(`### RESULT: ${result}`);
-  return text4(lines.join("\n"));
+  return text5(lines.join("\n"));
 }
 var init_sentinel_tools = __esm({
   "src/sentinel-tools.ts"() {
@@ -28572,8 +30099,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync45, existsSync as existsSync54, readdirSync as readdirSync26, statSync as statSync19 } from "fs";
-import { resolve as resolve36, join as join32, basename as basename10, dirname as dirname24, relative as relative12 } from "path";
+import { readFileSync as readFileSync47, existsSync as existsSync56, readdirSync as readdirSync26, statSync as statSync19 } from "fs";
+import { resolve as resolve36, join as join34, basename as basename10, dirname as dirname25, relative as relative13 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -28705,7 +30232,7 @@ function scanComponentExports(dataDb) {
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
   const basePath = resolve36(projectRoot, componentsBase);
-  if (existsSync54(basePath)) {
+  if (existsSync56(basePath)) {
     try {
       const entries = readdirSync26(basePath, { withFileTypes: true });
       for (const entry of entries) {
@@ -28718,11 +30245,11 @@ function scanComponentExports(dataDb) {
   }
   for (const dir of componentDirs) {
     const absDir = resolve36(projectRoot, dir);
-    if (!existsSync54(absDir)) continue;
+    if (!existsSync56(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
-      const relPath = relative12(projectRoot, file);
-      const source = readFileSync45(file, "utf-8");
+      const relPath = relative13(projectRoot, file);
+      const source = readFileSync47(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
         for (const ann of annotations) {
@@ -28748,7 +30275,7 @@ function scanComponentExports(dataDb) {
       if (hasHandlers && exportMatch) {
         const componentName = exportMatch[1];
         const domain = inferDomain(relPath);
-        const subdomain = basename10(dirname24(relPath));
+        const subdomain = basename10(dirname25(relPath));
         const featureKey = `component.${subdomain}.${componentName.replace(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "")}`;
         if (!annotations.some((a2) => a2.featureKey === featureKey)) {
           features.push({
@@ -28773,7 +30300,7 @@ function walkDir2(dir) {
   try {
     const entries = readdirSync26(dir);
     for (const entry of entries) {
-      const fullPath = join32(dir, entry);
+      const fullPath = join34(dir, entry);
       try {
         const stat = statSync19(fullPath);
         if (stat.isDirectory()) {
@@ -28844,7 +30371,7 @@ var init_sentinel_scanner = __esm({
 });
 
 // src/analytics.ts
-function p6(baseName) {
+function p7(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
 function getWeights() {
@@ -28912,7 +30439,7 @@ function backfillQualityScores(db) {
 function getAnalyticsToolDefinitions() {
   return [
     {
-      name: p6("quality_score"),
+      name: p7("quality_score"),
       description: "Calculate and store quality score for a session based on observations. Shows breakdown by category.",
       inputSchema: {
         type: "object",
@@ -28923,7 +30450,7 @@ function getAnalyticsToolDefinitions() {
       }
     },
     {
-      name: p6("quality_trend"),
+      name: p7("quality_trend"),
       description: "Quality trend over recent sessions. Shows score progression and identifies improving/declining areas.",
       inputSchema: {
         type: "object",
@@ -28934,7 +30461,7 @@ function getAnalyticsToolDefinitions() {
       }
     },
     {
-      name: p6("quality_report"),
+      name: p7("quality_report"),
       description: "Comprehensive quality report with averages, trends, and recommendations.",
       inputSchema: {
         type: "object",
@@ -28963,17 +30490,17 @@ function handleAnalyticsToolCall(name, args2, memoryDb) {
       case "quality_report":
         return handleQualityReport(args2, memoryDb);
       default:
-        return text5(`Unknown analytics tool: ${name}`);
+        return text6(`Unknown analytics tool: ${name}`);
     }
   } catch (error) {
-    return text5(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
+    return text6(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
 
-Usage: ${p6("quality_score")} { session_id: "..." }, ${p6("quality_trend")} { days: 30 }`);
+Usage: ${p7("quality_score")} { session_id: "..." }, ${p7("quality_trend")} { days: 30 }`);
   }
 }
 function handleQualityScore(args2, db) {
   const sessionId = args2.session_id;
-  if (!sessionId) return text5(`Usage: ${p6("quality_score")} { session_id: "abc123" } - Calculate quality score for a specific session.`);
+  if (!sessionId) return text6(`Usage: ${p7("quality_score")} { session_id: "abc123" } - Calculate quality score for a specific session.`);
   const { score, breakdown } = calculateQualityScore(db, sessionId);
   storeQualityScore(db, sessionId, score, breakdown);
   const categories = getCategories();
@@ -28989,7 +30516,7 @@ function handleQualityScore(args2, db) {
     const indicator = impact > 0 ? "+" : impact < 0 ? "" : " ";
     lines.push(`| ${category} | ${indicator}${impact} |`);
   }
-  return text5(lines.join("\n"));
+  return text6(lines.join("\n"));
 }
 function handleQualityTrend(args2, db, retried = false) {
   const days = args2.days ?? 30;
@@ -29007,7 +30534,7 @@ function handleQualityTrend(args2, db, retried = false) {
         return handleQualityTrend(args2, db, true);
       }
     }
-    return text5(`No quality scores found in the last ${days} days. Quality scores are calculated automatically from session observations (bugfixes, VR checks, incidents). Try: ${p6("quality_score")} { session_id: "..." } to score a specific session, or try a longer time range with { days: 90 }.`);
+    return text6(`No quality scores found in the last ${days} days. Quality scores are calculated automatically from session observations (bugfixes, VR checks, incidents). Try: ${p7("quality_score")} { session_id: "..." } to score a specific session, or try a longer time range with { days: 90 }.`);
   }
   const avg = scores.reduce((sum, s) => sum + s.score, 0) / scores.length;
   const recent = scores.slice(-5);
@@ -29026,7 +30553,7 @@ function handleQualityTrend(args2, db, retried = false) {
   for (const s of scores.slice(-10)) {
     lines.push(`| ${s.session_id.slice(0, 8)}... | ${s.score} | ${s.created_at} |`);
   }
-  return text5(lines.join("\n"));
+  return text6(lines.join("\n"));
 }
 function handleQualityReport(args2, db, retried = false) {
   const days = args2.days ?? 30;
@@ -29043,7 +30570,7 @@ function handleQualityReport(args2, db, retried = false) {
         return handleQualityReport(args2, db, true);
       }
     }
-    return text5(`No quality data available for the last ${days} days. Quality scores are calculated from session observations (bugfixes, VR checks, incidents). Try: ${p6("quality_score")} { session_id: "..." } to score individual sessions first, or try a longer time range with { days: 90 }.`);
+    return text6(`No quality data available for the last ${days} days. Quality scores are calculated from session observations (bugfixes, VR checks, incidents). Try: ${p7("quality_score")} { session_id: "..." } to score individual sessions first, or try a longer time range with { days: 90 }.`);
   }
   const avg = scores.reduce((sum, s) => sum + s.score, 0) / scores.length;
   const max = Math.max(...scores.map((s) => s.score));
@@ -29100,9 +30627,9 @@ function handleQualityReport(args2, db, retried = false) {
   if (avg >= 70) {
     lines.push("- Quality is good. Maintain current practices and focus on consistency.");
   }
-  return text5(lines.join("\n"));
+  return text6(lines.join("\n"));
 }
-function text5(content) {
+function text6(content) {
   return { content: [{ type: "text", text: content }] };
 }
 var DEFAULT_WEIGHTS, DEFAULT_CATEGORIES, ANALYTICS_BASE_NAMES;
@@ -29125,7 +30652,7 @@ var init_analytics = __esm({
 });
 
 // src/cost-tracker.ts
-function p7(baseName) {
+function p8(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
 function getModelPricing() {
@@ -29134,7 +30661,7 @@ function getModelPricing() {
 function getCostToolDefinitions() {
   return [
     {
-      name: p7("cost_session"),
+      name: p8("cost_session"),
       description: "Show cost breakdown for a session. Includes token counts, model pricing, and cost by category.",
       inputSchema: {
         type: "object",
@@ -29145,7 +30672,7 @@ function getCostToolDefinitions() {
       }
     },
     {
-      name: p7("cost_trend"),
+      name: p8("cost_trend"),
       description: "Cost trend over time. Shows daily/weekly spending and identifies cost drivers.",
       inputSchema: {
         type: "object",
@@ -29157,7 +30684,7 @@ function getCostToolDefinitions() {
       }
     },
     {
-      name: p7("cost_feature"),
+      name: p8("cost_feature"),
       description: "Cost attribution by feature. Shows which features consume the most tokens.",
       inputSchema: {
         type: "object",
@@ -29186,22 +30713,22 @@ function handleCostToolCall(name, args2, memoryDb) {
       case "cost_feature":
         return handleCostFeature(args2, memoryDb);
       default:
-        return text6(`Unknown cost tool: ${name}`);
+        return text7(`Unknown cost tool: ${name}`);
     }
   } catch (error) {
-    return text6(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
+    return text7(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
 
-Usage: ${p7("cost_session")} { session_id: "..." }, ${p7("cost_trend")} { days: 30 }`);
+Usage: ${p8("cost_session")} { session_id: "..." }, ${p8("cost_trend")} { days: 30 }`);
   }
 }
 function handleCostSession(args2, db) {
   const sessionId = args2.session_id;
-  if (!sessionId) return text6(`Usage: ${p7("cost_session")} { session_id: "abc123" } - Show cost breakdown for a specific session.`);
+  if (!sessionId) return text7(`Usage: ${p8("cost_session")} { session_id: "abc123" } - Show cost breakdown for a specific session.`);
   const cost = db.prepare(
     "SELECT * FROM session_costs WHERE session_id = ? ORDER BY created_at DESC LIMIT 1"
   ).get(sessionId);
   if (!cost) {
-    return text6(`No cost data found for session ${sessionId}. Cost data is recorded automatically when sessions end via the session-end hook. If the session is still active, data will appear after it completes. Try: ${p7("cost_trend")} { days: 30 } to see aggregate cost data instead.`);
+    return text7(`No cost data found for session ${sessionId}. Cost data is recorded automatically when sessions end via the session-end hook. If the session is still active, data will appear after it completes. Try: ${p8("cost_trend")} { days: 30 } to see aggregate cost data instead.`);
   }
   const modelPricing = getModelPricing();
   const mp = modelPricing[cost.model] ?? modelPricing["claude-sonnet-4-5"] ?? { input_per_million: 3, output_per_million: 15 };
@@ -29222,13 +30749,13 @@ function handleCostSession(args2, db) {
     `| Cache Write | ${cost.cache_write_tokens.toLocaleString()} | $${cacheWriteCost.toFixed(4)} |`,
     `| **Total** | ${cost.total_tokens.toLocaleString()} | **$${cost.estimated_cost_usd.toFixed(4)}** |`
   ];
-  return text6(lines.join("\n"));
+  return text7(lines.join("\n"));
 }
 function handleCostTrend(args2, db) {
   const days = args2.days ?? 30;
   const groupBy = args2.group_by ?? "day";
   if (!["day", "week"].includes(groupBy)) {
-    return text6(`Invalid group_by value: "${groupBy}". Use "day" or "week". Example: ${p7("cost_trend")} { days: 30, group_by: "week" }`);
+    return text7(`Invalid group_by value: "${groupBy}". Use "day" or "week". Example: ${p8("cost_trend")} { days: 30, group_by: "week" }`);
   }
   const sql = groupBy === "week" ? `SELECT strftime('%Y-W%W', created_at) as period,
              COUNT(*) as sessions,
@@ -29249,7 +30776,7 @@ function handleCostTrend(args2, db) {
        ORDER BY period ASC`;
   const rows = db.prepare(sql).all(`-${days} days`);
   if (rows.length === 0) {
-    return text6(`No cost data found in the last ${days} days. Cost tracking records token usage automatically at session end via hooks. Ensure session-end hooks are configured in your settings. Try: ${p7("cost_session")} { session_id: "..." } to check a specific session.`);
+    return text7(`No cost data found in the last ${days} days. Cost tracking records token usage automatically at session end via hooks. Ensure session-end hooks are configured in your settings. Try: ${p8("cost_session")} { session_id: "..." } to check a specific session.`);
   }
   const totalCost = rows.reduce((sum, r2) => sum + r2.total_cost, 0);
   const totalSessions = rows.reduce((sum, r2) => sum + r2.sessions, 0);
@@ -29267,7 +30794,7 @@ function handleCostTrend(args2, db) {
       `| ${row.period} | ${row.sessions} | $${row.total_cost.toFixed(2)} | $${row.avg_cost.toFixed(4)} |`
     );
   }
-  return text6(lines.join("\n"));
+  return text7(lines.join("\n"));
 }
 function handleCostFeature(args2, db) {
   const days = args2.days ?? 30;
@@ -29279,7 +30806,7 @@ function handleCostFeature(args2, db) {
     ORDER BY total_cost DESC
   `).all(`-${days} days`);
   if (rows.length === 0) {
-    return text6(`No feature cost data found in the last ${days} days. Feature costs are attributed automatically when sessions work on registered features. Ensure features are registered, then costs are tracked per-session. Try: ${p7("cost_trend")} { days: 30 } for session-level cost trends instead.`);
+    return text7(`No feature cost data found in the last ${days} days. Feature costs are attributed automatically when sessions work on registered features. Ensure features are registered, then costs are tracked per-session. Try: ${p8("cost_trend")} { days: 30 } for session-level cost trends instead.`);
   }
   const totalCost = rows.reduce((sum, r2) => sum + r2.total_cost, 0);
   const lines = [
@@ -29295,9 +30822,9 @@ function handleCostFeature(args2, db) {
       `| ${row.feature_key} | $${row.total_cost.toFixed(2)} | ${row.total_tokens.toLocaleString()} | ${row.entries} | ${pct}% |`
     );
   }
-  return text6(lines.join("\n"));
+  return text7(lines.join("\n"));
 }
-function text6(content) {
+function text7(content) {
   return { content: [{ type: "text", text: content }] };
 }
 var DEFAULT_MODEL_PRICING, COST_BASE_NAMES;
@@ -29317,7 +30844,7 @@ var init_cost_tracker = __esm({
 });
 
 // src/prompt-analyzer.ts
-function p8(baseName) {
+function p9(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
 function categorizePrompt(promptText) {
@@ -29332,7 +30859,7 @@ function categorizePrompt(promptText) {
 function getPromptToolDefinitions() {
   return [
     {
-      name: p8("prompt_effectiveness"),
+      name: p9("prompt_effectiveness"),
       description: "Prompt effectiveness statistics by category. Shows success rates, average corrections needed, and best-performing prompt patterns.",
       inputSchema: {
         type: "object",
@@ -29347,7 +30874,7 @@ function getPromptToolDefinitions() {
       }
     },
     {
-      name: p8("prompt_suggestions"),
+      name: p9("prompt_suggestions"),
       description: "Suggest improvements for a prompt based on past outcomes. Finds similar prompts ranked by success rate.",
       inputSchema: {
         type: "object",
@@ -29374,12 +30901,12 @@ function handlePromptToolCall(name, args2, memoryDb) {
       case "prompt_suggestions":
         return handleSuggestions(args2, memoryDb);
       default:
-        return text7(`Unknown prompt tool: ${name}`);
+        return text8(`Unknown prompt tool: ${name}`);
     }
   } catch (error) {
-    return text7(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
+    return text8(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
 
-Usage: ${p8("prompt_effectiveness")} { days: 30 }, ${p8("prompt_suggestions")} { prompt: "..." }`);
+Usage: ${p9("prompt_effectiveness")} { days: 30 }, ${p9("prompt_suggestions")} { prompt: "..." }`);
   }
 }
 function handleEffectiveness(args2, db) {
@@ -29405,7 +30932,7 @@ function handleEffectiveness(args2, db) {
   sql += " GROUP BY prompt_category ORDER BY total DESC";
   const rows = db.prepare(sql).all(...params);
   if (rows.length === 0) {
-    return text7(`No prompt outcomes found in the last ${days} days. Prompt analysis runs automatically at session end. Try a longer time range: ${p8("prompt_effectiveness")} { days: 90 }, or use ${p8("prompt_suggestions")} { prompt: "your text" } to analyze a prompt directly.`);
+    return text8(`No prompt outcomes found in the last ${days} days. Prompt analysis runs automatically at session end. Try a longer time range: ${p9("prompt_effectiveness")} { days: 90 }, or use ${p9("prompt_suggestions")} { prompt: "your text" } to analyze a prompt directly.`);
   }
   const lines = [
     `## Prompt Effectiveness (${days} days)`,
@@ -29420,11 +30947,11 @@ function handleEffectiveness(args2, db) {
       `| ${row.prompt_category} | ${total} | ${successRate}% | ${row.partials} | ${row.failures} | ${row.abandoned} | ${row.avg_corrections.toFixed(1)} | ${Math.round(row.avg_word_count)} |`
     );
   }
-  return text7(lines.join("\n"));
+  return text8(lines.join("\n"));
 }
 function handleSuggestions(args2, db) {
   const prompt = args2.prompt;
-  if (!prompt) return text7(`Usage: ${p8("prompt_suggestions")} { prompt: "your prompt text here" } - Analyzes a prompt and suggests improvements based on past outcomes.`);
+  if (!prompt) return text8(`Usage: ${p9("prompt_suggestions")} { prompt: "your prompt text here" } - Analyzes a prompt and suggests improvements based on past outcomes.`);
   const category = categorizePrompt(prompt);
   const wordCount = prompt.split(/\s+/).length;
   const similar = db.prepare(`
@@ -29467,9 +30994,9 @@ function handleSuggestions(args2, db) {
     lines.push(`- Success rate: ${Math.round(stats.successes / stats.total * 100)}%`);
     lines.push(`- Avg corrections needed: ${stats.avg_corrections.toFixed(1)}`);
   }
-  return text7(lines.join("\n"));
+  return text8(lines.join("\n"));
 }
-function text7(content) {
+function text8(content) {
   return { content: [{ type: "text", text: content }] };
 }
 var PROMPT_BASE_NAMES;
@@ -29482,290 +31009,8 @@ var init_prompt_analyzer = __esm({
   }
 });
 
-// src/audit-trail.ts
-function p9(baseName) {
-  return `${getConfig().toolPrefix}_${baseName}`;
-}
-function getAuditFormats() {
-  return getConfig().governance?.audit?.formats ?? DEFAULT_FORMATS;
-}
-function queryAuditLog(db, options) {
-  let sql = "SELECT * FROM audit_log WHERE 1=1";
-  const params = [];
-  if (options.eventType) {
-    sql += " AND event_type = ?";
-    params.push(options.eventType);
-  }
-  if (options.actor) {
-    sql += " AND actor = ?";
-    params.push(options.actor);
-  }
-  if (options.days) {
-    sql += " AND timestamp >= datetime('now', ?)";
-    params.push(`-${options.days} days`);
-  }
-  if (options.filePath) {
-    sql += " AND file_path = ?";
-    params.push(options.filePath);
-  }
-  if (options.changeType) {
-    sql += " AND change_type = ?";
-    params.push(options.changeType);
-  }
-  sql += " ORDER BY timestamp DESC";
-  if (options.limit) {
-    sql += " LIMIT ?";
-    params.push(options.limit);
-  }
-  return db.prepare(sql).all(...params);
-}
-function getFileChain(db, filePath) {
-  return db.prepare(
-    "SELECT * FROM audit_log WHERE file_path = ? ORDER BY timestamp ASC LIMIT 10000"
-  ).all(filePath);
-}
-function getAuditToolDefinitions() {
-  return [
-    {
-      name: p9("audit_log"),
-      description: "Query the audit log. Filter by event type, actor, file, or time range.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          event_type: { type: "string", description: "Filter by event type: code_change, rule_enforced, approval, review, commit, compaction" },
-          actor: { type: "string", description: "Filter by actor: ai, human, hook, agent" },
-          file_path: { type: "string", description: "Filter by file path" },
-          change_type: { type: "string", description: "Filter by change type: create, edit, delete" },
-          days: { type: "number", description: "Days to look back (default: 30)" },
-          limit: { type: "number", description: "Max results (default: 50)" }
-        },
-        required: []
-      }
-    },
-    {
-      name: p9("audit_report"),
-      description: "Generate an audit report in a specified format (summary, detailed, soc2).",
-      inputSchema: {
-        type: "object",
-        properties: {
-          format: { type: "string", description: "Report format: summary, detailed, soc2 (default: summary)" },
-          days: { type: "number", description: "Days to cover (default: 30)" }
-        },
-        required: []
-      }
-    },
-    {
-      name: p9("audit_chain"),
-      description: "Get the complete audit trail for a specific file. Shows all changes, reviews, and decisions chronologically.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          file: { type: "string", description: "File path to trace" }
-        },
-        required: ["file"]
-      }
-    }
-  ];
-}
-function isAuditTool(name) {
-  const pfx = getConfig().toolPrefix + "_";
-  const baseName = name.startsWith(pfx) ? name.slice(pfx.length) : name;
-  return AUDIT_BASE_NAMES.has(baseName);
-}
-function handleAuditToolCall(name, args2, memoryDb) {
-  try {
-    const pfx = getConfig().toolPrefix + "_";
-    const baseName = name.startsWith(pfx) ? name.slice(pfx.length) : name;
-    switch (baseName) {
-      case "audit_log":
-        return handleAuditLog(args2, memoryDb);
-      case "audit_report":
-        return handleAuditReport(args2, memoryDb);
-      case "audit_chain":
-        return handleAuditChain(args2, memoryDb);
-      default:
-        return text8(`Unknown audit tool: ${name}`);
-    }
-  } catch (error) {
-    return text8(`Error in ${name}: ${error instanceof Error ? error.message : String(error)}
-
-Usage: ${p9("audit_log")} { severity: "critical" }, ${p9("audit_report")} { format: "soc2" }`);
-  }
-}
-function handleAuditLog(args2, db) {
-  const entries = queryAuditLog(db, {
-    eventType: args2.event_type,
-    actor: args2.actor,
-    filePath: args2.file_path,
-    changeType: args2.change_type,
-    days: args2.days ?? 30,
-    limit: args2.limit ?? 50
-  });
-  if (entries.length === 0) {
-    return text8(`No audit log entries found matching the filters. Audit entries are recorded automatically during code changes, rule checks, and commits. Try broadening your search: ${p9("audit_log")} { days: 90 } for a longer time range, or ${p9("audit_log")} {} with no filters.`);
-  }
-  const lines = [
-    `## Audit Log (${entries.length} entries)`,
-    "",
-    "| Timestamp | Event | Actor | Change | File | Evidence |",
-    "|-----------|-------|-------|--------|------|----------|"
-  ];
-  for (const entry of entries) {
-    const file = entry.file_path ? entry.file_path.split("/").pop() : "-";
-    const evidence = entry.evidence ? entry.evidence.slice(0, 50) : "-";
-    lines.push(
-      `| ${entry.timestamp.slice(0, 16)} | ${entry.event_type} | ${entry.actor} | ${entry.change_type ?? "-"} | ${file} | ${evidence} |`
-    );
-  }
-  return text8(lines.join("\n"));
-}
-function handleAuditReport(args2, db) {
-  const format = args2.format ?? "summary";
-  const days = args2.days ?? 30;
-  const availableFormats = getAuditFormats();
-  if (!availableFormats.includes(format)) {
-    return text8(`Unknown report format: "${format}". Available formats: ${availableFormats.join(", ")}. Example: ${p9("audit_report")} { format: "soc2", days: 30 }. Configure additional formats via the governance.audit.formats config key.`);
-  }
-  const entries = queryAuditLog(db, { days });
-  if (entries.length === 0) {
-    return text8(`No audit entries found in the last ${days} days. Audit entries are recorded automatically during code changes, reviews, and commits. Try: ${p9("audit_log")} { days: 90 } for a longer time range.`);
-  }
-  const byEventType = {};
-  const byActor = {};
-  for (const e2 of entries) {
-    const et = e2.event_type;
-    byEventType[et] = (byEventType[et] ?? 0) + 1;
-    const actor = e2.actor;
-    byActor[actor] = (byActor[actor] ?? 0) + 1;
-  }
-  if (format === "soc2") {
-    return generateSoc2Report(entries, byEventType, byActor, days);
-  }
-  if (format === "detailed") {
-    return generateDetailedReport(entries, byEventType, byActor, days);
-  }
-  const lines = [
-    `## Audit Summary Report (${days} days)`,
-    `Generated: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)}`,
-    "",
-    "### By Event Type",
-    `| Event Type | Count |`,
-    `|------------|-------|`
-  ];
-  for (const [et, count] of Object.entries(byEventType).sort((a2, b2) => b2[1] - a2[1])) {
-    lines.push(`| ${et} | ${count} |`);
-  }
-  lines.push(`| **Total** | **${entries.length}** |`);
-  lines.push("");
-  lines.push("### By Actor");
-  lines.push(`| Actor | Count |`);
-  lines.push(`|-------|-------|`);
-  for (const [actor, count] of Object.entries(byActor).sort((a2, b2) => b2[1] - a2[1])) {
-    lines.push(`| ${actor} | ${count} |`);
-  }
-  return text8(lines.join("\n"));
-}
-function generateSoc2Report(entries, byEventType, byActor, days) {
-  const lines = [
-    `# SOC 2 Compliance Report`,
-    `Period: Last ${days} days`,
-    `Generated: ${(/* @__PURE__ */ new Date()).toISOString()}`,
-    "",
-    "## 1. Control Environment",
-    `Total audit events: ${entries.length}`,
-    `Human-initiated: ${byActor["human"] ?? 0}`,
-    `AI-initiated: ${byActor["ai"] ?? 0}`,
-    `Hook-triggered: ${byActor["hook"] ?? 0}`,
-    "",
-    "## 2. Change Management",
-    `Code changes logged: ${byEventType["code_change"] ?? 0}`,
-    `Rule enforcements: ${byEventType["rule_enforced"] ?? 0}`,
-    `Approvals recorded: ${byEventType["approval"] ?? 0}`,
-    `Reviews: ${byEventType["review"] ?? 0}`,
-    `Commits: ${byEventType["commit"] ?? 0}`,
-    "",
-    "## 3. Approval Status"
-  ];
-  const pendingApprovals = entries.filter((e2) => e2.approval_status === "pending");
-  const deniedApprovals = entries.filter((e2) => e2.approval_status === "denied");
-  lines.push(`Pending approvals: ${pendingApprovals.length}`);
-  lines.push(`Denied approvals: ${deniedApprovals.length}`);
-  lines.push("");
-  lines.push("## 4. Events Requiring Review");
-  const reviewEntries = entries.filter((e2) => e2.approval_status === "denied" || e2.event_type === "rule_enforced");
-  if (reviewEntries.length > 0) {
-    for (const e2 of reviewEntries.slice(0, 20)) {
-      lines.push(`- [${e2.timestamp.slice(0, 16)}] ${e2.event_type}: ${(e2.evidence ?? "").slice(0, 100)}`);
-    }
-  } else {
-    lines.push("No events requiring review in this period.");
-  }
-  return text8(lines.join("\n"));
-}
-function generateDetailedReport(entries, byEventType, byActor, days) {
-  const lines = [
-    `## Detailed Audit Report (${days} days)`,
-    `Total events: ${entries.length}`,
-    "",
-    "### Event Type Distribution"
-  ];
-  for (const [et, count] of Object.entries(byEventType).sort((a2, b2) => b2[1] - a2[1])) {
-    lines.push(`- ${et}: ${count}`);
-  }
-  lines.push("");
-  lines.push("### Actor Distribution");
-  for (const [actor, count] of Object.entries(byActor).sort((a2, b2) => b2[1] - a2[1])) {
-    lines.push(`- ${actor}: ${count}`);
-  }
-  lines.push("");
-  lines.push("### All Events");
-  for (const e2 of entries.slice(0, 100)) {
-    lines.push(`#### ${e2.timestamp.slice(0, 16)} [${e2.event_type}]`);
-    lines.push(`Actor: ${e2.actor} | Change: ${e2.change_type ?? "-"} | Approval: ${e2.approval_status ?? "-"}`);
-    if (e2.file_path) lines.push(`File: ${e2.file_path}`);
-    if (e2.evidence) lines.push(`Evidence: ${e2.evidence}`);
-    lines.push("");
-  }
-  if (entries.length > 100) {
-    lines.push(`... and ${entries.length - 100} more entries`);
-  }
-  return text8(lines.join("\n"));
-}
-function handleAuditChain(args2, db) {
-  const filePath = args2.file;
-  if (!filePath) return text8(`Usage: ${p9("audit_chain")} { file: "src/path/to/file.ts" } - Get complete audit history for a file.`);
-  const chain = getFileChain(db, filePath);
-  if (chain.length === 0) {
-    return text8(`No audit entries found for "${filePath}". Audit entries are recorded automatically when files are modified, reviewed, or validated. Try: ${p9("audit_log")} {} to see all recent audit entries across all files.`);
-  }
-  const lines = [
-    `## Audit Chain: ${filePath}`,
-    `Total events: ${chain.length}`,
-    ""
-  ];
-  for (const entry of chain) {
-    lines.push(`### ${entry.timestamp.slice(0, 16)} [${entry.event_type}]`);
-    lines.push(`**${entry.actor}** (${entry.change_type ?? "unknown"})`);
-    if (entry.evidence) lines.push(entry.evidence);
-    lines.push("");
-  }
-  return text8(lines.join("\n"));
-}
-function text8(content) {
-  return { content: [{ type: "text", text: content }] };
-}
-var DEFAULT_FORMATS, AUDIT_BASE_NAMES;
-var init_audit_trail = __esm({
-  "src/audit-trail.ts"() {
-    "use strict";
-    init_config();
-    DEFAULT_FORMATS = ["summary", "detailed", "soc2"];
-    AUDIT_BASE_NAMES = /* @__PURE__ */ new Set(["audit_log", "audit_report", "audit_chain"]);
-  }
-});
-
 // src/validation-engine.ts
-import { existsSync as existsSync55, readFileSync as readFileSync46 } from "fs";
+import { existsSync as existsSync57, readFileSync as readFileSync48 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -29796,7 +31041,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync55(absPath)) {
+  if (!existsSync57(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -29805,7 +31050,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  const source = readFileSync46(absPath, "utf-8");
+  const source = readFileSync48(absPath, "utf-8");
   const lines = source.split("\n");
   if (activeChecks.rule_compliance !== false) {
     for (const ruleSet of config.rules) {
@@ -30264,7 +31509,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync56, readFileSync as readFileSync47 } from "fs";
+import { existsSync as existsSync58, readFileSync as readFileSync49 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -30288,12 +31533,12 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync56(absPath)) {
+  if (!existsSync58(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
   try {
-    source = readFileSync47(absPath, "utf-8");
+    source = readFileSync49(absPath, "utf-8");
   } catch {
     return { riskScore: 0, findings: [] };
   }
@@ -30583,7 +31828,7 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync57, readFileSync as readFileSync48 } from "fs";
+import { existsSync as existsSync59, readFileSync as readFileSync50 } from "fs";
 import { resolve as resolve37 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -30617,9 +31862,9 @@ function calculateDepRisk(factors) {
 }
 function getInstalledPackages(projectRoot) {
   const pkgPath = resolve37(projectRoot, "package.json");
-  if (!existsSync57(pkgPath)) return /* @__PURE__ */ new Map();
+  if (!existsSync59(pkgPath)) return /* @__PURE__ */ new Map();
   try {
-    const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
     for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
       packages.set(name, version);
@@ -31223,30 +32468,10 @@ var init_regression_detector = __esm({
   }
 });
 
-// src/lib/corrections-md.ts
-function formatCorrectionEntry(e2) {
-  const one = (s) => s.replace(/\s*\n+\s*/g, " ").trim();
-  const lines = [`### ${e2.date} - ${one(e2.title)}`];
-  if (e2.wrong) lines.push(`- **Wrong**: ${one(e2.wrong)}`);
-  if (e2.correction) lines.push(`- **Correction**: ${one(e2.correction)}`);
-  lines.push(`- **Rule**: ${one(e2.rule)}`);
-  for (const [k3, v3] of Object.entries(e2.extra ?? {})) {
-    lines.push(`- ${k3}: ${one(String(v3))}`);
-  }
-  return `
-${lines.join("\n")}
-`;
-}
-var init_corrections_md = __esm({
-  "src/lib/corrections-md.ts"() {
-    "use strict";
-  }
-});
-
 // src/knowledge-indexer.ts
-import { createHash as createHash13 } from "crypto";
-import { readFileSync as readFileSync49, readdirSync as readdirSync27, statSync as statSync20, existsSync as existsSync58 } from "fs";
-import { resolve as resolve38, relative as relative13, basename as basename11, extname as extname2 } from "path";
+import { createHash as createHash14 } from "crypto";
+import { readFileSync as readFileSync51, readdirSync as readdirSync27, statSync as statSync20, existsSync as existsSync60 } from "fs";
+import { resolve as resolve38, relative as relative14, basename as basename11, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
   const config = getConfig();
@@ -31294,7 +32519,7 @@ function categorizeFile(filePath) {
   const paths = getKnowledgePaths();
   if (filePath.startsWith(paths.plansDir)) return "plan";
   if (filePath.startsWith(paths.docsDir)) {
-    const relFromDocs = relative13(paths.docsDir, filePath).replace(/\\/g, "/").toLowerCase();
+    const relFromDocs = relative14(paths.docsDir, filePath).replace(/\\/g, "/").toLowerCase();
     if (relFromDocs.startsWith("plans/")) return "plan";
     if (relFromDocs.includes("architecture")) return "architecture";
     if (relFromDocs.includes("security")) return "security";
@@ -31310,7 +32535,7 @@ function categorizeFile(filePath) {
   }
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
   if (filePath.includes(`${claudeDirName}/projects/`) && filePath.includes("/memory/")) return "memory";
-  const rel = relative13(paths.claudeDir, filePath).replace(/\\/g, "/");
+  const rel = relative14(paths.claudeDir, filePath).replace(/\\/g, "/");
   const firstDir = rel.split("/")[0];
   const knownCategories = getConfig().conventions?.knowledgeCategories ?? [
     "patterns",
@@ -31332,7 +32557,7 @@ function categorizeFile(filePath) {
   return "root";
 }
 function hashContent2(content) {
-  return createHash13("sha256").update(content).digest("hex");
+  return createHash14("sha256").update(content).digest("hex");
 }
 function parseCRTable(content) {
   const rules = [];
@@ -31553,11 +32778,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync58(paths.plansDir)) {
+  if (existsSync60(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync58(paths.docsDir)) {
+  if (existsSync60(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -31600,10 +32825,10 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync58(filePath)) continue;
-      const content = readFileSync49(filePath, "utf-8");
+      if (!existsSync60(filePath)) continue;
+      const content = readFileSync51(filePath, "utf-8");
       const hash = hashContent2(content);
-      const relPath = filePath.startsWith(paths.claudeDir) ? relative13(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative13(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative13(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative13(paths.memoryDir, filePath)}` : basename11(filePath);
+      const relPath = filePath.startsWith(paths.claudeDir) ? relative14(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative14(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative14(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative14(paths.memoryDir, filePath)}` : basename11(filePath);
       const category = categorizeFile(filePath);
       const title = extractTitle(content, filePath);
       const description = extractDescription2(content);
@@ -31736,10 +32961,10 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync58(paths.plansDir)) {
+  if (existsSync60(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync58(paths.docsDir)) {
+  if (existsSync60(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -31768,7 +32993,7 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync50, writeFileSync as writeFileSync12, appendFileSync as appendFileSync4, readdirSync as readdirSync28 } from "fs";
+import { readFileSync as readFileSync52, writeFileSync as writeFileSync14, appendFileSync as appendFileSync4, readdirSync as readdirSync28 } from "fs";
 import { resolve as resolve39, basename as basename12 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -32521,14 +33746,14 @@ function handleCorrect(db, args2) {
   });
   let existing = "";
   try {
-    existing = readFileSync50(correctionsPath, "utf-8");
+    existing = readFileSync52(correctionsPath, "utf-8");
   } catch {
   }
   const archiveIdx = existing.indexOf("## Archived");
   if (archiveIdx > 0) {
     const before = existing.slice(0, archiveIdx);
     const after = existing.slice(archiveIdx);
-    writeFileSync12(correctionsPath, before + entry + after);
+    writeFileSync14(correctionsPath, before + entry + after);
   } else {
     appendFileSync4(correctionsPath, entry);
   }
@@ -33477,7 +34702,7 @@ var init_framework_supports = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync51, existsSync as existsSync60 } from "fs";
+import { readFileSync as readFileSync53, existsSync as existsSync62 } from "fs";
 import { resolve as resolve40, basename as basename13 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
@@ -33897,8 +35122,8 @@ function handleContext(file, dataDb, codegraphDb) {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
           const absFilePath = ensureWithinRoot(resolve40(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync60(absFilePath)) {
-            const fileContent = readFileSync51(absFilePath, "utf-8").slice(0, 3e3);
+          if (existsSync62(absFilePath)) {
+            const fileContent = readFileSync53(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
             if (fileContent.includes("BigInt") || fileContent.includes("Decimal")) keywords.push("BigInt", "serialization");
@@ -34336,10 +35561,10 @@ function handleSchema(args2) {
     lines.push("");
     const projectRoot = getProjectRoot();
     const absPath = ensureWithinRoot(resolve40(projectRoot, file), projectRoot);
-    if (!existsSync60(absPath)) {
+    if (!existsSync62(absPath)) {
       return text17(`File not found: ${file}`);
     }
-    const source = readFileSync51(absPath, "utf-8");
+    const source = readFileSync53(absPath, "utf-8");
     const config = getConfig();
     const dbPattern = config.dbAccessPattern ?? "ctx.db.{table}";
     const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
@@ -34744,8 +35969,8 @@ var init_server_dispatch = __esm({
 
 // src/server.ts
 var server_exports = {};
-import { readFileSync as readFileSync52 } from "fs";
-import { resolve as resolve41, dirname as dirname25 } from "path";
+import { readFileSync as readFileSync54 } from "fs";
+import { resolve as resolve41, dirname as dirname26 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function pruneMemoryOnStartup() {
   try {
@@ -34787,10 +36012,10 @@ var init_server = __esm({
     init_consolidation_config();
     init_license();
     init_server_dispatch();
-    __dirname5 = dirname25(fileURLToPath6(import.meta.url));
+    __dirname5 = dirname26(fileURLToPath6(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync52(resolve41(__dirname5, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync54(resolve41(__dirname5, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -35076,7 +36301,7 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync61, readFileSync as readFileSync53, writeFileSync as writeFileSync13, copyFileSync as copyFileSync3, unlinkSync as unlinkSync5 } from "fs";
+import { existsSync as existsSync63, readFileSync as readFileSync55, writeFileSync as writeFileSync15, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
 import { resolve as resolve42 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
@@ -35088,14 +36313,14 @@ async function runConfigUpgrade(opts = {}) {
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync61(bakPath)) {
+    if (!existsSync63(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err(message + "\n");
       return { exitCode: 1, action: "none", message };
     }
     try {
       copyFileSync3(bakPath, configPath);
-      unlinkSync5(bakPath);
+      unlinkSync6(bakPath);
       log("Config restored from backup.\n");
       return { exitCode: 0, action: "rolled-back" };
     } catch (e2) {
@@ -35104,14 +36329,14 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync61(configPath)) {
+  if (!existsSync63(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return { exitCode: 1, action: "none", message };
   }
   let existing;
   try {
-    const content = readFileSync53(configPath, "utf-8");
+    const content = readFileSync55(configPath, "utf-8");
     const parsed = parseYaml6(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -35134,8 +36359,8 @@ async function runConfigUpgrade(opts = {}) {
     fingerprint: computeFingerprint(detection)
   };
   try {
-    const original = readFileSync53(configPath, "utf-8");
-    writeFileSync13(bakPath, original, "utf-8");
+    const original = readFileSync55(configPath, "utf-8");
+    writeFileSync15(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
     err(message + "\n");
@@ -35168,7 +36393,7 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync62, readFileSync as readFileSync54 } from "fs";
+import { existsSync as existsSync64, readFileSync as readFileSync56 } from "fs";
 import { resolve as resolve43 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
@@ -35182,7 +36407,7 @@ async function runConfigCheckDrift(opts = {}) {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync62(configPath)) {
+  if (!existsSync64(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return {
@@ -35196,7 +36421,7 @@ async function runConfigCheckDrift(opts = {}) {
   }
   let config;
   try {
-    const content = readFileSync54(configPath, "utf-8");
+    const content = readFileSync56(configPath, "utf-8");
     const parsed = parseYaml7(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -35263,11 +36488,11 @@ var init_config_check_drift = __esm({
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync55 } from "fs";
-import { resolve as resolve44, dirname as dirname26 } from "path";
+import { readFileSync as readFileSync57 } from "fs";
+import { resolve as resolve44, dirname as dirname27 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 var __filename5 = fileURLToPath7(import.meta.url);
-var __dirname6 = dirname26(__filename5);
+var __dirname6 = dirname27(__filename5);
 var args = process.argv.slice(2);
 var subcommand = args[0];
 async function main() {
@@ -35545,7 +36770,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync55(resolve44(__dirname6, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync57(resolve44(__dirname6, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");