@massu/core 2.5.2 → 2.5.4

package/dist/cli.js

@@ -743,6 +743,42 @@ var init_memory_path = __esm({
   }
 });
 
+// src/lib/corrections-md.ts
+function formatCorrectionEntry(e2) {
+  const one = (s) => s.replace(/\s*\n+\s*/g, " ").trim();
+  const lines = [`### ${e2.date} - ${one(e2.title)}`];
+  if (e2.wrong) lines.push(`- **Wrong**: ${one(e2.wrong)}`);
+  if (e2.correction) lines.push(`- **Correction**: ${one(e2.correction)}`);
+  lines.push(`- **Rule**: ${one(e2.rule)}`);
+  for (const [k3, v3] of Object.entries(e2.extra ?? {})) {
+    lines.push(`- ${k3}: ${one(String(v3))}`);
+  }
+  return `
+${lines.join("\n")}
+`;
+}
+function correctionsPath(memoryDir) {
+  return memoryDir.endsWith("/") ? `${memoryDir}${CORRECTIONS_FILENAME}` : `${memoryDir}/${CORRECTIONS_FILENAME}`;
+}
+function insertCorrectionEntry(existing, entry) {
+  const rendered = formatCorrectionEntry(entry);
+  const base = existing.length > 0 ? existing : CORRECTIONS_HEADER;
+  const archiveIdx = base.indexOf(ARCHIVE_MARKER);
+  if (archiveIdx > 0) {
+    return base.slice(0, archiveIdx) + rendered + base.slice(archiveIdx);
+  }
+  return base + rendered;
+}
+var CORRECTIONS_FILENAME, CORRECTIONS_HEADER, ARCHIVE_MARKER;
+var init_corrections_md = __esm({
+  "src/lib/corrections-md.ts"() {
+    "use strict";
+    CORRECTIONS_FILENAME = "corrections.md";
+    CORRECTIONS_HEADER = "# Corrections\n";
+    ARCHIVE_MARKER = "## Archived";
+  }
+});
+
 // src/config-memory-schema.ts
 import { z } from "zod";
 var MemoryConfigSchema;
@@ -776,7 +812,7 @@ var init_config_memory_schema = __esm({
           message: "memory.recall.embedEndpoint must be an http(s) URL"
         }).optional(),
         embedModel: z.string().min(1).optional()
-      }).default({}),
+      }).prefault({}),
       // --- Contradiction / supersede gate (plan-living-memory-slice-2-temporal-model, P5-001) ---
       // When a new high-value memory (decision/correction) is written, find
       // semantically-related existing records and, if the new one contradicts an
@@ -805,7 +841,7 @@ var init_config_memory_schema = __esm({
         annotateSuperseded: z.boolean().default(false),
         // Time budget (ms) for the contradiction check; exceeded → fail-open (ADD).
         budgetMs: z.number().int().positive().default(800)
-      }).default({}),
+      }).prefault({}),
       // --- Background consolidation, the "sleep-time" pass
       //     (plan-living-memory-slice-3-consolidation) ---
       // Keeps memory sharp over years: dedupes, distills dying sessions into
@@ -851,7 +887,7 @@ var init_config_memory_schema = __esm({
         // Surface optional upgrades (e.g. "a local model was detected") in chat.
         suggestUpgrades: z.boolean().default(true),
         suggestIntervalDays: z.number().int().positive().default(30)
-      }).default({}),
+      }).prefault({}),
       // A-20 (Slice 4) — memory FILES: the mirror, and the one switch that decides whether
       // Massu may ever WRITE into the user's memory directory.
       //
@@ -876,7 +912,7 @@ var init_config_memory_schema = __esm({
         // turn of EVERY session, so an unbounded index is a permanent context tax — and the
         // per-session cap bounds only the RATE, never the total.
         indexMaxLines: z.number().int().min(1).default(50)
-      }).default({}),
+      }).prefault({}),
       // --- Cross-repo memory surfacing (plan-living-memory-slice-5-cross-repo-surfacing) ---
       // A decision made in one of your repos can surface in another — opt-in per
       // decision AND opt-in per repo, signed, verified, and materialized ONLY on
@@ -901,8 +937,8 @@ var init_config_memory_schema = __esm({
           enabled: z.boolean().default(true),
           maxCrossRepoItems: z.number().int().min(0).default(1),
           minScore: z.number().optional()
-        }).default({})
-      }).default({})
+        }).prefault({})
+      }).prefault({})
     }).optional();
   }
 });
@@ -911,7 +947,11 @@ var init_config_memory_schema = __esm({
 var config_exports = {};
 __export(config_exports, {
   AdapterLocalPathSchema: () => AdapterLocalPathSchema,
+  AutoLearningConfigSchema: () => AutoLearningConfigSchema,
+  DEFAULT_KNOWLEDGE_SOURCE_FILES: () => DEFAULT_KNOWLEDGE_SOURCE_FILES,
   LSPConfigSchema: () => LSPConfigSchema,
+  RawConfigSchema: () => RawConfigSchema,
+  VerificationEntrySchema: () => VerificationEntrySchema,
   getConfig: () => getConfig,
   getProjectRoot: () => getProjectRoot,
   getResolvedApiKeySource: () => getResolvedApiKeySource,
@@ -1101,13 +1141,19 @@ function resetConfig() {
   _projectRoot = null;
   _resolvedApiKeySource = "none";
 }
-var DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
+var DEFAULT_KNOWLEDGE_SOURCE_FILES, DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_memory_path();
+    init_corrections_md();
     init_credentials();
     init_config_memory_schema();
+    DEFAULT_KNOWLEDGE_SOURCE_FILES = [
+      "CLAUDE.md",
+      "MEMORY.md",
+      CORRECTIONS_FILENAME
+    ];
     DomainConfigSchema = z2.object({
       name: z2.string().default("Unknown"),
       routers: z2.array(z2.string()).default([]),
@@ -1236,34 +1282,40 @@ var init_config = __esm({
       fixDetection: z2.object({
         enabled: z2.boolean().default(true),
         lookbackDays: z2.number().default(7),
-        signals: z2.array(z2.string()).default([
-          "removed_broken_code",
-          "added_error_handling",
-          "method_name_correction",
-          "auth_fix",
-          "nil_handling_fix",
-          "concurrency_fix",
-          "async_pattern_fix",
-          "added_missing_import"
-        ])
-      }).default({}),
+        // ⛔ NO DEFAULT LIST HERE, DELIBERATELY — the heuristics are the SSOT.
+        //
+        // This carried a hand-typed copy of all eight signal names while
+        // `fix-detector.ts` already read `config…signals ?? FIX_HEURISTICS.map(h => h.name)`.
+        // Because zod ALWAYS materialised the default, that fallback — the correct expression
+        // — was unreachable, and the duplicate was the only thing in effect. Two authoring
+        // sites for one vocabulary, and the drift is SILENT: a name listed here that no longer
+        // exists simply never matches `enabledSignals.has(...)`, so a retired heuristic lingers
+        // as a dead entry with no error. Retiring `method_name_correction` would have landed at
+        // one site of two (CR-74).
+        //
+        // Optional, so an ABSENT value reaches the `??` and the heuristic list defines itself
+        // (Rule 25). An explicit list in massu.config.yaml still overrides, which is the only
+        // behaviour anyone actually configured — measured: `fix-detector.ts:267` is the sole
+        // consumer and no config file in the repo sets it.
+        signals: z2.array(z2.string()).optional()
+      }).prefault({}),
       failureClassification: z2.object({
         enabled: z2.boolean().default(true),
         thresholds: z2.object({
           known: z2.number().default(5),
           similar: z2.number().default(3)
-        }).default({}),
+        }).prefault({}),
         scoring: z2.object({
           diffPatternWeight: z2.number().default(3),
           filePatternWeight: z2.number().default(2),
           promptKeywordWeight: z2.number().default(2)
-        }).default({})
-      }).default({}),
+        }).prefault({})
+      }).prefault({}),
       pipeline: z2.object({
         requireIncidentReport: z2.boolean().default(true),
         requirePreventionRule: z2.boolean().default(true),
         requireEnforcement: z2.boolean().default(true)
-      }).default({}),
+      }).prefault({}),
       // plan-v0.2-interactive-rule-approval P-D-008 / P-D-009: project-configured
       // custom destinations for the rule-candidate funnel. The classifier matches
       // a candidate to one of these entries when none of the framework
@@ -1296,7 +1348,7 @@ var init_config = __esm({
         memory: z2.boolean().default(true),
         analytics: z2.boolean().default(true),
         audit: z2.boolean().default(true)
-      }).default({ memory: true, analytics: true, audit: true })
+      }).prefault({ memory: true, analytics: true, audit: true })
     }).optional();
     ConventionsConfigSchema = z2.object({
       claudeDirName: z2.string().default(".claude").refine(
@@ -1327,7 +1379,7 @@ var init_config = __esm({
         "session-state",
         "agents"
       ]),
-      knowledgeSourceFiles: z2.array(z2.string()).default(["CLAUDE.md", "MEMORY.md", "corrections.md"]),
+      knowledgeSourceFiles: z2.array(z2.string()).default([...DEFAULT_KNOWLEDGE_SOURCE_FILES]),
       excludePatterns: z2.array(z2.string()).default(["/ARCHIVE/", "/SESSION-HISTORY/"])
     }).optional();
     PythonDomainConfigSchema = z2.object({
@@ -1343,6 +1395,23 @@ var init_config = __esm({
     }).optional();
     PathsConfigSchema = z2.object({
       source: z2.string().default("src"),
+      /**
+       * Where this stack's tests live, relative to the project root.
+       *
+       * Added 2026-09-20 for P4.3 of docs/plans/2026-09-20-stack-conformant-asset-rendering.md.
+       * ~25 shipped assets told every customer their tests belong in
+       * `packages/core/src/__tests__/` — massu's OWN layout — and no vocabulary could express
+       * the alternative because none existed. A test directory is a first-class property of
+       * every stack (`tests/` on FastAPI, `test/` on Rails, `src/test/java` on Spring,
+       * `Tests/` on SwiftPM, and Go keeps `_test.go` beside the source), so it belongs here
+       * rather than in prose.
+       *
+       * OPTIONAL, so every config written before this key existed keeps loading unchanged; an
+       * asset that needs it uses `{{paths.tests | default("...")}}`. All 13 shipped templates
+       * declare it, each with the convention it follows recorded at the site (G32 option 2),
+       * and `stack-template-conformance.test.ts` asserts that.
+       */
+      tests: z2.string().optional(),
       aliases: z2.record(z2.string(), z2.string()).default({ "@": "src" }),
       monorepo_roots: z2.array(z2.string()).optional(),
       routers: z2.string().optional(),
@@ -1452,14 +1521,14 @@ var init_config = __esm({
       project: z2.object({
         name: z2.string().default("my-project"),
         root: z2.string().default("auto")
-      }).default({ name: "my-project", root: "auto" }),
-      framework: FrameworkConfigSchema.default({
+      }).prefault({ name: "my-project", root: "auto" }),
+      framework: FrameworkConfigSchema.prefault({
         type: "typescript",
         router: "none",
         orm: "none",
         ui: "none"
       }),
-      paths: PathsConfigSchema.default({ source: "src", aliases: { "@": "src" } }),
+      paths: PathsConfigSchema.prefault({ source: "src", aliases: { "@": "src" } }),
       toolPrefix: z2.string().default("massu"),
       dbAccessPattern: z2.string().optional(),
       knownMismatches: z2.record(z2.string(), z2.record(z2.string(), z2.string())).optional(),
@@ -4508,8 +4577,188 @@ var init_memory_file_ingest = __esm({
   }
 });
 
+// src/shipped-template-schema.ts
+import { z as z3 } from "zod";
+function validateShippedTemplate(raw, stack) {
+  const result = ShippedTemplateConfigSchema.safeParse(raw);
+  if (result.success) return { ok: true, stack, issues: [] };
+  return {
+    ok: false,
+    stack,
+    issues: result.error.issues.map((issue) => {
+      const path = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+      return `${stack}: ${path}: ${issue.message}`;
+    })
+  };
+}
+var REQUIRED_TEMPLATE_VERIFY_KEYS, ShippedTemplateConfigSchema;
+var init_shipped_template_schema = __esm({
+  "src/shipped-template-schema.ts"() {
+    "use strict";
+    init_config();
+    REQUIRED_TEMPLATE_VERIFY_KEYS = ["test", "type", "lint"];
+    ShippedTemplateConfigSchema = RawConfigSchema.extend({
+      // Optional for a customer; MANDATORY for anything massu ships.
+      verification: z3.record(z3.string(), VerificationEntrySchema)
+    }).superRefine((cfg, ctx) => {
+      const framework = cfg.framework;
+      const primary = framework?.primary ?? framework?.type;
+      if (typeof primary !== "string" || primary.length === 0) {
+        ctx.addIssue({
+          code: z3.ZodIssueCode.custom,
+          path: ["framework", "primary"],
+          message: "a shipped template must resolve a primary language (framework.primary or framework.type)"
+        });
+        return;
+      }
+      const primaryEntry = cfg.verification?.[primary];
+      if (primaryEntry === void 0) {
+        ctx.addIssue({
+          code: z3.ZodIssueCode.custom,
+          path: ["verification", primary],
+          message: `a shipped template must declare verification commands for its primary language '${primary}'`
+        });
+        return;
+      }
+      for (const required of REQUIRED_TEMPLATE_VERIFY_KEYS) {
+        const value = primaryEntry[required];
+        if (typeof value !== "string" || value.length === 0) {
+          ctx.addIssue({
+            code: z3.ZodIssueCode.custom,
+            path: ["verification", primary, required],
+            message: `a shipped template must declare a non-empty '${required}' command for '${primary}'`
+          });
+        }
+      }
+    });
+  }
+});
+
+// src/commands/asset-resolution.ts
+import { existsSync as existsSync11, readdirSync as readdirSync4, statSync as statSync3 } from "fs";
+import { resolve as resolve5, dirname as dirname8 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function dirHoldsAssets(dir) {
+  if (!existsSync11(dir)) return false;
+  try {
+    return readdirSync4(dir).some(
+      (e2) => e2.endsWith(".md") || statSync3(resolve5(dir, e2)).isDirectory()
+    );
+  } catch {
+    return false;
+  }
+}
+function resolveAssetDir(assetName) {
+  const cwd = process.cwd();
+  const candidates = [
+    // 1. npm-installed: node_modules/@massu/core/{assetName}
+    resolve5(cwd, "node_modules/@massu/core", assetName),
+    // 2. Relative to compiled dist/cli.js → ../{assetName}
+    resolve5(__dirname, "..", assetName),
+    // 3. Relative to source src/commands/ → ../../{assetName}
+    resolve5(__dirname, "../..", assetName)
+  ];
+  for (const c2 of candidates) {
+    if (dirHoldsAssets(c2)) return c2;
+  }
+  return null;
+}
+function pickVariant(baseName, sourceDir, framework) {
+  const candidates = [];
+  const seenLangs = /* @__PURE__ */ new Set();
+  function pushCandidate(lang, sub) {
+    if (seenLangs.has(lang)) return;
+    seenLangs.add(lang);
+    candidates.push({ lang, subFramework: sub && sub.length > 0 ? sub : void 0 });
+  }
+  const primary = framework.primary ?? framework.type;
+  if (primary && primary !== "multi") {
+    let primarySub;
+    if (framework.languages && framework.languages[primary]?.framework) {
+      primarySub = framework.languages[primary].framework;
+    } else {
+      const passthrough2 = framework;
+      const block = passthrough2[primary];
+      if (block && typeof block === "object") {
+        const fw = block.framework;
+        if (typeof fw === "string" && fw.length > 0) primarySub = fw;
+      }
+    }
+    pushCandidate(primary, primarySub);
+  }
+  if (framework.languages) {
+    for (const lang of Object.keys(framework.languages)) {
+      const entry = framework.languages[lang];
+      if (entry && typeof entry.framework === "string" && entry.framework.length > 0) {
+        pushCandidate(lang, entry.framework);
+      }
+    }
+  }
+  const passthrough = framework;
+  for (const lang of PASSTHROUGH_LANG_KEYS) {
+    if (seenLangs.has(lang)) continue;
+    const block = passthrough[lang];
+    if (block && typeof block === "object") {
+      const fw = block.framework;
+      if (typeof fw === "string" && fw.length > 0) {
+        pushCandidate(lang, fw);
+      }
+    }
+  }
+  for (const cand of candidates) {
+    if (cand.subFramework) {
+      const subPath = resolve5(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
+      if (existsSync11(subPath)) {
+        return { kind: "hit", suffix: `.${cand.lang}-${cand.subFramework}` };
+      }
+    }
+    const langPath = resolve5(sourceDir, `${baseName}.${cand.lang}.md`);
+    if (existsSync11(langPath)) {
+      return { kind: "hit", suffix: `.${cand.lang}` };
+    }
+  }
+  const defaultPath = resolve5(sourceDir, `${baseName}.md`);
+  if (existsSync11(defaultPath)) {
+    return { kind: "hit", suffix: "" };
+  }
+  if (framework.type === "multi" && !framework.primary) {
+    process.stderr.write(
+      "massu: warning - framework.type=multi but framework.primary is undefined; falling back to default templates\n"
+    );
+    return { kind: "fallback", reason: "multi-without-primary" };
+  }
+  return { kind: "miss" };
+}
+function isVariantFilename(entry) {
+  return /^[^.]+\.[^.]+\.md$/.test(entry);
+}
+function variantFilename(baseName, choice) {
+  if (choice.kind === "miss") return null;
+  const suffix = choice.kind === "hit" ? choice.suffix : "";
+  return suffix === "" ? `${baseName}.md` : `${baseName}${suffix}.md`;
+}
+var __filename, __dirname, PASSTHROUGH_LANG_KEYS;
+var init_asset_resolution = __esm({
+  "src/commands/asset-resolution.ts"() {
+    "use strict";
+    __filename = fileURLToPath2(import.meta.url);
+    __dirname = dirname8(__filename);
+    PASSTHROUGH_LANG_KEYS = [
+      "typescript",
+      "javascript",
+      "python",
+      "swift",
+      "rust",
+      "go"
+    ];
+  }
+});
+
 // src/commands/template-engine.ts
-function renderTemplate(template, vars) {
+function fragmentDiagnostic(name) {
+  return `<!-- massu: no fragment "${name}" for this stack, and no default -->`;
+}
+function renderTemplate(template, vars, opts = {}) {
   const out = [];
   const len = template.length;
   let i = 0;
@@ -4527,6 +4776,18 @@ function renderTemplate(template, vars) {
         throw new TemplateParseError("unclosed `{{` (no matching `}}`)", tokenStart);
       }
       const inner = template.slice(i + 2, closeIdx);
+      const fragmentName = matchFragmentToken(inner);
+      if (fragmentName !== null) {
+        const body = opts.resolveFragment ? opts.resolveFragment(fragmentName) : null;
+        if (body === null) {
+          out.push(fragmentDiagnostic(fragmentName));
+        } else {
+          if (matchFragmentAnywhere(body)) throw new FragmentNestingError(fragmentName);
+          out.push(renderTemplate(body, vars, {}));
+        }
+        i = closeIdx + 2;
+        continue;
+      }
       if (isJsxPassThrough(inner)) {
         out.push("{{");
         out.push(inner);
@@ -4663,7 +4924,14 @@ function stringify(value) {
   if (typeof value === "string") return value;
   return String(value);
 }
-var MissingVariableError, TemplateParseError;
+function matchFragmentToken(inner) {
+  const m3 = /^>\s*([A-Za-z0-9][A-Za-z0-9_-]*)\s*$/.exec(inner);
+  return m3 ? m3[1] : null;
+}
+function matchFragmentAnywhere(body) {
+  return /\{\{\s*>\s*[A-Za-z0-9]/.test(body);
+}
+var MissingVariableError, TemplateParseError, FragmentNestingError;
 var init_template_engine = __esm({
   "src/commands/template-engine.ts"() {
     "use strict";
@@ -4683,22 +4951,264 @@ var init_template_engine = __esm({
         this.position = position;
       }
     };
+    FragmentNestingError = class extends Error {
+      constructor(fragmentName) {
+        super(
+          `fragment "${fragmentName}" contains a nested {{> \u2026 }}. Fragments may not include other fragments: one level keeps resolution total and removes cycles by construction.`
+        );
+        this.fragmentName = fragmentName;
+        this.name = "FragmentNestingError";
+      }
+      fragmentName;
+    };
+  }
+});
+
+// src/commands/fragments.ts
+import { existsSync as existsSync12, readFileSync as readFileSync7 } from "fs";
+import { resolve as resolve6 } from "path";
+function makeFragmentResolver(framework, stats) {
+  const fragmentsDir = resolveAssetDir("fragments");
+  return (name) => {
+    if (!fragmentsDir) {
+      stats.missing++;
+      return null;
+    }
+    const choice = pickVariant(name, fragmentsDir, framework);
+    if (choice.kind !== "hit") {
+      stats.missing++;
+      return null;
+    }
+    const file = resolve6(fragmentsDir, `${name}${choice.suffix}.md`);
+    if (!existsSync12(file)) {
+      stats.missing++;
+      return null;
+    }
+    if (choice.suffix === "") stats.defaulted++;
+    else stats.resolved++;
+    return readFileSync7(file, "utf-8");
+  };
+}
+var init_fragments = __esm({
+  "src/commands/fragments.ts"() {
+    "use strict";
+    init_asset_resolution();
+  }
+});
+
+// src/stack-capabilities.ts
+function stackLabel(config) {
+  const name = config.project?.name;
+  if (typeof name === "string" && name.length > 0 && name !== "{{PROJECT_NAME}}") return name;
+  return config.framework?.primary ?? config.framework?.type ?? "<unnamed stack>";
+}
+function isVerifyKey(candidate) {
+  return ALL_VERIFY_KEYS.includes(candidate);
+}
+function resolveStackCapabilities(config) {
+  const label = stackLabel(config);
+  const primaryLanguage = config.framework?.primary ?? config.framework?.type;
+  if (typeof primaryLanguage !== "string" || primaryLanguage.length === 0) {
+    throw new StackContractError(
+      label,
+      `${label}: cannot resolve a primary language \u2014 neither framework.primary nor framework.type is set.`
+    );
+  }
+  const verification = config.verification;
+  if (verification === void 0 || verification === null) {
+    throw new StackContractError(
+      label,
+      `${label}: no top-level 'verification:' block. Every stack must declare ${REQUIRED_VERIFY_KEYS.join("/")} for its primary language (${primaryLanguage}).`
+    );
+  }
+  const roster = /* @__PURE__ */ new Set([primaryLanguage]);
+  for (const lang of Object.keys(config.framework?.languages ?? {})) roster.add(lang);
+  for (const lang of Object.keys(verification)) roster.add(lang);
+  const verifyByLang = {};
+  for (const lang of roster) {
+    const entry = verification[lang];
+    if (!entry) continue;
+    const resolved = {};
+    for (const [candidate, value] of Object.entries(entry)) {
+      if (!isVerifyKey(candidate)) continue;
+      if (typeof value === "string" && value.length > 0) resolved[candidate] = value;
+    }
+    if (Object.keys(resolved).length > 0) verifyByLang[lang] = resolved;
+  }
+  const primaryEntry = verifyByLang[primaryLanguage];
+  if (primaryEntry === void 0) {
+    throw new StackContractError(
+      label,
+      `${label}: 'verification:' declares no commands for the primary language '${primaryLanguage}'. Declared languages: ${Object.keys(verifyByLang).join(", ") || "(none)"}.`
+    );
+  }
+  for (const required of REQUIRED_VERIFY_KEYS) {
+    if (primaryEntry[required] === void 0) {
+      throw new StackContractError(
+        label,
+        `${label}: required verification key '${required}' is not declared for the primary language '${primaryLanguage}'. Required: ${REQUIRED_VERIFY_KEYS.join(", ")}.`,
+        required
+      );
+    }
+  }
+  const verify = {};
+  for (const declaredKey of ALL_VERIFY_KEYS) verify[declaredKey] = primaryEntry[declaredKey];
+  const declared = new Set(
+    ALL_VERIFY_KEYS.filter((candidate) => primaryEntry[candidate] !== void 0)
+  );
+  const languages = [
+    primaryLanguage,
+    ...[...roster].filter((lang) => lang !== primaryLanguage).sort()
+  ];
+  return {
+    contractVersion: STACK_CONTRACT_VERSION,
+    primaryLanguage,
+    languages,
+    verify,
+    verifyByLang,
+    paths: config.paths,
+    declared
+  };
+}
+var STACK_CONTRACT_VERSION, REQUIRED_VERIFY_KEYS, OPTIONAL_VERIFY_KEYS, ALL_VERIFY_KEYS, StackContractError;
+var init_stack_capabilities = __esm({
+  "src/stack-capabilities.ts"() {
+    "use strict";
+    STACK_CONTRACT_VERSION = 1;
+    REQUIRED_VERIFY_KEYS = ["test", "type", "lint"];
+    OPTIONAL_VERIFY_KEYS = ["build", "syntax"];
+    ALL_VERIFY_KEYS = [
+      ...REQUIRED_VERIFY_KEYS,
+      ...OPTIONAL_VERIFY_KEYS
+    ];
+    StackContractError = class extends Error {
+      stackName;
+      verifyKey;
+      constructor(stackName, message, verifyKey) {
+        super(message);
+        this.name = "StackContractError";
+        this.stackName = stackName;
+        this.verifyKey = verifyKey;
+      }
+    };
+  }
+});
+
+// src/commands/asset-render.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve7 } from "path";
+function buildTemplateVars() {
+  const config = getConfig();
+  let stack;
+  let verifyVars;
+  try {
+    const caps = resolveStackCapabilities(config);
+    stack = caps;
+    verifyVars = { verify: caps.verify, verifyByLang: caps.verifyByLang };
+  } catch (err) {
+    if (!(err instanceof StackContractError)) throw err;
+    stack = {
+      contractVersion: STACK_CONTRACT_VERSION,
+      satisfied: false,
+      reason: err.message,
+      stackName: err.stackName,
+      unsatisfiedKey: err.verifyKey
+    };
+    process.stderr.write(
+      `massu: stack capability contract UNSATISFIED \u2014 ${err.message}
+massu:   assets that need a verification command will be reported by \`massu doctor\`; add a \`verification:\` block to massu.config.yaml to resolve them.
+`
+    );
+    verifyVars = {};
+  }
+  return {
+    framework: config.framework,
+    paths: config.paths,
+    detected: config.detected ?? {},
+    config,
+    /**
+     * Present only when the contract is satisfied. Absent is deliberate: an asset that
+     * needs a command it cannot get must fail ITS OWN file loudly rather than render an
+     * empty string, which is a check that runs nothing and exits 0.
+     */
+    ...verifyVars,
+    /** Always present, satisfied or not, so a consumer can ask WHICH state it is in. */
+    stack,
+    // P-H006 (plan-stage-c-high-batch): RESERVED CLAUDE CODE PLACEHOLDER.
+    // Claude Code reads `{{ARGUMENTS}}` as a runtime placeholder inside
+    // slash-command files. The Massu template engine has no native concept
+    // of reserved literals; we model the placeholder as a variable whose
+    // value IS the literal `{{ARGUMENTS}}` string. Because the engine never
+    // re-renders output, this passes through verbatim. Closes the bug class
+    // where `/massu-article-review`, `/massu-autoresearch`, etc. silently
+    // failed to install because the engine threw MissingVariableError on
+    // their {{ARGUMENTS}} usage.
+    ARGUMENTS: "{{ARGUMENTS}}"
+  };
+}
+function makeRenderContext(framework) {
+  const fragments = { resolved: 0, defaulted: 0, missing: 0 };
+  return {
+    vars: buildTemplateVars(),
+    resolveFragment: makeFragmentResolver(framework, fragments),
+    fragments
+  };
+}
+function renderResolvedAsset(baseName, sourceDir, framework, ctx) {
+  const choice = pickVariant(baseName, sourceDir, framework);
+  const sourceFilename = variantFilename(baseName, choice);
+  if (sourceFilename === null) return { kind: "miss" };
+  return renderAssetFile(resolve7(sourceDir, sourceFilename), sourceFilename, ctx);
+}
+function renderAssetFile(sourcePath, sourceFilename, ctx) {
+  let rawContent;
+  try {
+    rawContent = readFileSync8(sourcePath, "utf-8");
+  } catch (err) {
+    return {
+      kind: "error",
+      sourcePath,
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    return {
+      kind: "ok",
+      sourcePath,
+      sourceFilename,
+      content: renderTemplate(rawContent, ctx.vars, { resolveFragment: ctx.resolveFragment })
+    };
+  } catch (err) {
+    if (err instanceof MissingVariableError || err instanceof TemplateParseError) {
+      return { kind: "error", sourcePath, message: err.message };
+    }
+    throw err;
+  }
+}
+var init_asset_render = __esm({
+  "src/commands/asset-render.ts"() {
+    "use strict";
+    init_config();
+    init_template_engine();
+    init_fragments();
+    init_asset_resolution();
+    init_stack_capabilities();
   }
 });
 
 // src/lib/settings-local.ts
 import {
   closeSync as closeSync2,
-  existsSync as existsSync11,
+  existsSync as existsSync13,
   fsyncSync as fsyncSync2,
   mkdirSync as mkdirSync7,
   openSync as openSync2,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync9,
   renameSync,
   rmSync as rmSync5,
   writeSync
 } from "fs";
-import { dirname as dirname8, resolve as resolve5 } from "path";
+import { dirname as dirname9, resolve as resolve8 } from "path";
 function atomicWriteFile(targetPath, content, mode = 420) {
   const tmpPath = `${targetPath}.${process.pid}.tmp`;
   try {
@@ -4712,7 +5222,7 @@ function atomicWriteFile(targetPath, content, mode = 420) {
     }
     renameSync(tmpPath, targetPath);
   } catch (err) {
-    if (existsSync11(tmpPath)) {
+    if (existsSync13(tmpPath)) {
       try {
         rmSync5(tmpPath, { force: true });
       } catch {
@@ -4722,11 +5232,11 @@ function atomicWriteFile(targetPath, content, mode = 420) {
   }
 }
 function readSettingsAtPath(absolutePath) {
-  if (!existsSync11(absolutePath)) {
+  if (!existsSync13(absolutePath)) {
     return {};
   }
   try {
-    const raw = readFileSync7(absolutePath, "utf-8");
+    const raw = readFileSync9(absolutePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       return {};
@@ -4737,12 +5247,12 @@ function readSettingsAtPath(absolutePath) {
   }
 }
 function readSettingsLocal(claudeDir) {
-  return readSettingsAtPath(resolve5(claudeDir, "settings.local.json"));
+  return readSettingsAtPath(resolve8(claudeDir, "settings.local.json"));
 }
 function writeSettingsLocalAtomic(claudeDir, settings) {
-  const targetPath = resolve5(claudeDir, "settings.local.json");
-  const dir = dirname8(targetPath);
-  if (!existsSync11(dir)) {
+  const targetPath = resolve8(claudeDir, "settings.local.json");
+  const dir = dirname9(targetPath);
+  if (!existsSync13(dir)) {
     mkdirSync7(dir, { recursive: true });
   }
   const content = JSON.stringify(settings, null, 2) + "\n";
@@ -4967,7 +5477,6 @@ var init_permissions = __esm({
 var install_commands_exports = {};
 __export(install_commands_exports, {
   MASSU_OWNED_PATHS: () => MASSU_OWNED_PATHS,
-  buildTemplateVars: () => buildTemplateVars,
   canonicalizeOwned: () => canonicalizeOwned,
   hashContent: () => hashContent,
   installAll: () => installAll,
@@ -4975,52 +5484,20 @@ __export(install_commands_exports, {
   isMassuOwned: () => isMassuOwned,
   loadManifest: () => loadManifest,
   massuOwnedSourceIsValid: () => massuOwnedSourceIsValid,
-  pickVariant: () => pickVariant,
-  resolveAssetDir: () => resolveAssetDir,
-  resolveCommandsDir: () => resolveCommandsDir,
   runInstallCommands: () => runInstallCommands,
   runWithManifest: () => runWithManifest,
   saveManifest: () => saveManifest,
   syncDirectory: () => syncDirectory
 });
 import {
-  existsSync as existsSync12,
-  readFileSync as readFileSync8,
+  existsSync as existsSync14,
+  readFileSync as readFileSync10,
   mkdirSync as mkdirSync8,
-  readdirSync as readdirSync4,
-  statSync as statSync3
+  readdirSync as readdirSync5,
+  statSync as statSync4
 } from "fs";
-import { resolve as resolve6, dirname as dirname9, join as join8 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { resolve as resolve9, join as join8 } from "path";
 import { createHash as createHash3 } from "crypto";
-function dirHoldsAssets(dir) {
-  if (!existsSync12(dir)) return false;
-  try {
-    return readdirSync4(dir).some(
-      (e2) => e2.endsWith(".md") || statSync3(resolve6(dir, e2)).isDirectory()
-    );
-  } catch {
-    return false;
-  }
-}
-function resolveAssetDir(assetName) {
-  const cwd = process.cwd();
-  const candidates = [
-    // 1. npm-installed: node_modules/@massu/core/{assetName}
-    resolve6(cwd, "node_modules/@massu/core", assetName),
-    // 2. Relative to compiled dist/cli.js → ../{assetName}
-    resolve6(__dirname, "..", assetName),
-    // 3. Relative to source src/commands/ → ../../{assetName}
-    resolve6(__dirname, "../..", assetName)
-  ];
-  for (const c2 of candidates) {
-    if (dirHoldsAssets(c2)) return c2;
-  }
-  return null;
-}
-function resolveCommandsDir() {
-  return resolveAssetDir("commands");
-}
 function isMassuOwned(manifestKey) {
   return MASSU_OWNED_PATHS.includes(manifestKey);
 }
@@ -5029,10 +5506,10 @@ function canonicalizeOwned(content) {
 }
 function massuOwnedSourceIsValid(resolvedSourcePath, content) {
   const sidecar = `${resolvedSourcePath}.sha256`;
-  if (!existsSync12(sidecar)) return false;
+  if (!existsSync14(sidecar)) return false;
   let expected;
   try {
-    expected = readFileSync8(sidecar, "utf-8").trim();
+    expected = readFileSync10(sidecar, "utf-8").trim();
   } catch {
     return false;
   }
@@ -5042,12 +5519,12 @@ function hashContent(content) {
   return createHash3("sha256").update(content, "utf-8").digest("hex");
 }
 function loadManifest(claudeDir) {
-  const path = resolve6(claudeDir, MANIFEST_RELPATH);
-  if (!existsSync12(path)) {
+  const path = resolve9(claudeDir, MANIFEST_RELPATH);
+  if (!existsSync14(path)) {
     return emptyManifest();
   }
   try {
-    const raw = readFileSync8(path, "utf-8");
+    const raw = readFileSync10(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.entries) {
       return emptyManifest();
@@ -5058,11 +5535,11 @@ function loadManifest(claudeDir) {
   }
 }
 function saveManifest(claudeDir, manifest) {
-  const dir = resolve6(claudeDir, ".massu");
-  if (!existsSync12(dir)) {
+  const dir = resolve9(claudeDir, ".massu");
+  if (!existsSync14(dir)) {
     mkdirSync8(dir, { recursive: true });
   }
-  const finalPath = resolve6(dir, "install-manifest.json");
+  const finalPath = resolve9(dir, "install-manifest.json");
   manifest.generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   atomicWriteFile(finalPath, JSON.stringify(manifest, null, 2));
 }
@@ -5080,86 +5557,17 @@ function runWithManifest(claudeDir, fn) {
   saveManifest(claudeDir, manifest);
   return result;
 }
-function pickVariant(baseName, sourceDir, framework) {
-  const candidates = [];
-  const seenLangs = /* @__PURE__ */ new Set();
-  function pushCandidate(lang, sub) {
-    if (seenLangs.has(lang)) return;
-    seenLangs.add(lang);
-    candidates.push({ lang, subFramework: sub && sub.length > 0 ? sub : void 0 });
-  }
-  const primary = framework.primary ?? framework.type;
-  if (primary && primary !== "multi") {
-    let primarySub;
-    if (framework.languages && framework.languages[primary]?.framework) {
-      primarySub = framework.languages[primary].framework;
-    } else {
-      const passthrough2 = framework;
-      const block = passthrough2[primary];
-      if (block && typeof block === "object") {
-        const fw = block.framework;
-        if (typeof fw === "string" && fw.length > 0) primarySub = fw;
-      }
-    }
-    pushCandidate(primary, primarySub);
-  }
-  if (framework.languages) {
-    for (const lang of Object.keys(framework.languages)) {
-      const entry = framework.languages[lang];
-      if (entry && typeof entry.framework === "string" && entry.framework.length > 0) {
-        pushCandidate(lang, entry.framework);
-      }
-    }
-  }
-  const passthrough = framework;
-  for (const lang of PASSTHROUGH_LANG_KEYS) {
-    if (seenLangs.has(lang)) continue;
-    const block = passthrough[lang];
-    if (block && typeof block === "object") {
-      const fw = block.framework;
-      if (typeof fw === "string" && fw.length > 0) {
-        pushCandidate(lang, fw);
-      }
-    }
-  }
-  for (const cand of candidates) {
-    if (cand.subFramework) {
-      const subPath = resolve6(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
-      if (existsSync12(subPath)) {
-        return { kind: "hit", suffix: `.${cand.lang}-${cand.subFramework}` };
-      }
-    }
-    const langPath = resolve6(sourceDir, `${baseName}.${cand.lang}.md`);
-    if (existsSync12(langPath)) {
-      return { kind: "hit", suffix: `.${cand.lang}` };
-    }
-  }
-  const defaultPath = resolve6(sourceDir, `${baseName}.md`);
-  if (existsSync12(defaultPath)) {
-    return { kind: "hit", suffix: "" };
-  }
-  if (framework.type === "multi" && !framework.primary) {
-    process.stderr.write(
-      "massu: warning - framework.type=multi but framework.primary is undefined; falling back to default templates\n"
-    );
-    return { kind: "fallback", reason: "multi-without-primary" };
-  }
-  return { kind: "miss" };
-}
-function isVariantFilename(entry) {
-  return /^[^.]+\.[^.]+\.md$/.test(entry);
-}
-function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPrefix, topLevel = true, templateVars = {}) {
+function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPrefix, topLevel = true, templateVars = {}, resolveFragment) {
   const stats = { installed: 0, updated: 0, skipped: 0, kept: 0 };
-  if (!existsSync12(targetDir)) {
+  if (!existsSync14(targetDir)) {
     mkdirSync8(targetDir, { recursive: true });
   }
-  const entries = readdirSync4(sourceDir);
+  const entries = readdirSync5(sourceDir);
   for (const entry of entries) {
-    const sourcePath = resolve6(sourceDir, entry);
-    const entryStat = statSync3(sourcePath);
+    const sourcePath = resolve9(sourceDir, entry);
+    const entryStat = statSync4(sourcePath);
     if (entryStat.isDirectory()) {
-      const subTargetDir = resolve6(targetDir, entry);
+      const subTargetDir = resolve9(targetDir, entry);
       const subPrefix = manifestKeyPrefix === "" ? entry : `${manifestKeyPrefix}/${entry}`;
       const subStats = syncDirectory(
         sourcePath,
@@ -5168,7 +5576,8 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
         manifest,
         subPrefix,
         false,
-        templateVars
+        templateVars,
+        resolveFragment
       );
       stats.installed += subStats.installed;
       stats.updated += subStats.updated;
@@ -5177,46 +5586,39 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
       continue;
     }
     if (!entry.endsWith(".md")) continue;
+    if (entry === "README.md") continue;
     let sourceFilename = entry;
     let baseName = entry.slice(0, -".md".length);
     if (topLevel) {
       if (isVariantFilename(entry)) continue;
-      const choice = pickVariant(baseName, sourceDir, framework);
-      if (choice.kind === "miss") {
-        continue;
-      }
-      const suffix = choice.kind === "hit" ? choice.suffix : "";
-      sourceFilename = suffix === "" ? `${baseName}.md` : `${baseName}${suffix}.md`;
-    }
-    const resolvedSourcePath = resolve6(sourceDir, sourceFilename);
-    if (!existsSync12(resolvedSourcePath)) {
-      continue;
+      const selected = variantFilename(baseName, pickVariant(baseName, sourceDir, framework));
+      if (selected === null) continue;
+      sourceFilename = selected;
     }
+    const resolvedSourcePath = resolve9(sourceDir, sourceFilename);
     const targetFilename = topLevel ? `${baseName}.md` : entry;
-    const targetPath = resolve6(targetDir, targetFilename);
-    const rawContent = readFileSync8(resolvedSourcePath, "utf-8");
-    let sourceContent;
-    try {
-      sourceContent = renderTemplate(rawContent, templateVars);
-    } catch (err) {
-      if (err instanceof MissingVariableError || err instanceof TemplateParseError) {
-        process.stderr.write(
-          `massu: skipping ${resolvedSourcePath}: ${err.message}
-`
-        );
+    const targetPath = resolve9(targetDir, targetFilename);
+    const rendered = renderAssetFile(resolvedSourcePath, sourceFilename, {
+      vars: templateVars,
+      resolveFragment
+    });
+    if (rendered.kind !== "ok") {
+      if (rendered.kind === "error") {
+        process.stderr.write(`massu: skipping ${rendered.sourcePath}: ${rendered.message}
+`);
         stats.skipped++;
-        continue;
       }
-      throw err;
+      continue;
     }
+    const sourceContent = rendered.content;
     const sourceHash = hashContent(sourceContent);
     const manifestKey = manifestKeyPrefix === "" ? targetFilename : `${manifestKeyPrefix}/${targetFilename}`;
     const lastInstalledHash = manifest.entries[manifestKey];
-    if (existsSync12(targetPath)) {
+    if (existsSync14(targetPath)) {
       let existingContent;
       try {
-        if (!statSync3(targetPath).isFile()) throw new Error("not a regular file");
-        existingContent = readFileSync8(targetPath, "utf-8");
+        if (!statSync4(targetPath).isFile()) throw new Error("not a regular file");
+        existingContent = readFileSync10(targetPath, "utf-8");
       } catch (err) {
         process.stderr.write(
           `massu: skipping ${manifestKey}: target is not a readable file (${err instanceof Error ? err.message : String(err)}). Remove it and re-install.
@@ -5276,30 +5678,11 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
   }
   return stats;
 }
-function buildTemplateVars() {
-  const config = getConfig();
-  return {
-    framework: config.framework,
-    paths: config.paths,
-    detected: config.detected ?? {},
-    config,
-    // P-H006 (plan-stage-c-high-batch): RESERVED CLAUDE CODE PLACEHOLDER.
-    // Claude Code reads `{{ARGUMENTS}}` as a runtime placeholder inside
-    // slash-command files. The Massu template engine has no native concept
-    // of reserved literals; we model the placeholder as a variable whose
-    // value IS the literal `{{ARGUMENTS}}` string. Because the engine never
-    // re-renders output, this passes through verbatim. Closes the bug class
-    // where `/massu-article-review`, `/massu-autoresearch`, etc. silently
-    // failed to install because the engine threw MissingVariableError on
-    // their {{ARGUMENTS}} usage.
-    ARGUMENTS: "{{ARGUMENTS}}"
-  };
-}
 function installCommands(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve6(projectRoot, claudeDirName);
-  const targetDir = resolve6(claudeDir, "commands");
-  if (!existsSync12(targetDir)) {
+  const claudeDir = resolve9(projectRoot, claudeDirName);
+  const targetDir = resolve9(claudeDir, "commands");
+  if (!existsSync14(targetDir)) {
     mkdirSync8(targetDir, { recursive: true });
   }
   const sourceDir = resolveAssetDir("commands");
@@ -5309,7 +5692,8 @@ function installCommands(projectRoot, opts = {}) {
     return { installed: 0, updated: 0, skipped: 0, kept: 0, commandsDir: targetDir };
   }
   const framework = getConfig().framework;
-  const templateVars = buildTemplateVars();
+  const ctx = makeRenderContext(framework);
+  const { vars: templateVars, resolveFragment, fragments: fragmentStats } = ctx;
   const stats = runWithManifest(claudeDir, (manifest) => {
     const syncStats = syncDirectory(
       sourceDir,
@@ -5318,7 +5702,8 @@ function installCommands(projectRoot, opts = {}) {
       manifest,
       "commands",
       true,
-      templateVars
+      templateVars,
+      resolveFragment
     );
     if (!opts.skipPermissions) {
       installPermissions(claudeDir, manifest, { silent: true });
@@ -5329,7 +5714,7 @@ function installCommands(projectRoot, opts = {}) {
 }
 function installAll(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve6(projectRoot, claudeDirName);
+  const claudeDir = resolve9(projectRoot, claudeDirName);
   const assets = {};
   let totalInstalled = 0;
   let totalUpdated = 0;
@@ -5337,12 +5722,13 @@ function installAll(projectRoot, opts = {}) {
   let totalKept = 0;
   let permissionsResult;
   const framework = getConfig().framework;
-  const templateVars = buildTemplateVars();
+  const ctx = makeRenderContext(framework);
+  const { vars: templateVars, resolveFragment, fragments: fragmentStats } = ctx;
   runWithManifest(claudeDir, (manifest) => {
     for (const assetType of ASSET_TYPES) {
       const sourceDir = resolveAssetDir(assetType.name);
       if (!sourceDir) continue;
-      const targetDir = resolve6(claudeDir, assetType.targetSubdir);
+      const targetDir = resolve9(claudeDir, assetType.targetSubdir);
       const stats = syncDirectory(
         sourceDir,
         targetDir,
@@ -5350,7 +5736,8 @@ function installAll(projectRoot, opts = {}) {
         manifest,
         assetType.targetSubdir,
         true,
-        templateVars
+        templateVars,
+        resolveFragment
       );
       assets[assetType.name] = stats;
       totalInstalled += stats.installed;
@@ -5369,6 +5756,7 @@ function installAll(projectRoot, opts = {}) {
     totalSkipped,
     totalKept,
     claudeDir,
+    fragments: fragmentStats,
     permissions: permissionsResult
   };
 }
@@ -5420,16 +5808,15 @@ async function runInstallCommands() {
   console.log("  Restart your Claude Code session to use them.");
   console.log("");
 }
-var __filename, __dirname, ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, MASSU_OWNED_PATHS, PASSTHROUGH_LANG_KEYS;
+var ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, MASSU_OWNED_PATHS;
 var init_install_commands = __esm({
   "src/commands/install-commands.ts"() {
     "use strict";
     init_config();
-    init_template_engine();
+    init_asset_resolution();
+    init_asset_render();
     init_settings_local();
     init_permissions();
-    __filename = fileURLToPath2(import.meta.url);
-    __dirname = dirname9(__filename);
     ASSET_TYPES = [
       { name: "commands", targetSubdir: "commands", description: "slash commands" },
       { name: "agents", targetSubdir: "agents", description: "agent definitions" },
@@ -5440,14 +5827,6 @@ var init_install_commands = __esm({
     MANIFEST_VERSION = 1;
     MANIFEST_RELPATH = join8(".massu", "install-manifest.json");
     MASSU_OWNED_PATHS = ["commands/_verification-laws.md"];
-    PASSTHROUGH_LANG_KEYS = [
-      "typescript",
-      "javascript",
-      "python",
-      "swift",
-      "rust",
-      "go"
-    ];
   }
 });
 
@@ -5651,17 +6030,17 @@ var init_manifest_registry = __esm({
 });
 
 // src/detect/package-detector.ts
-import { readFileSync as readFileSync9, existsSync as existsSync13, statSync as statSync4, lstatSync, readdirSync as readdirSync5 } from "fs";
+import { readFileSync as readFileSync11, existsSync as existsSync15, statSync as statSync5, lstatSync, readdirSync as readdirSync6 } from "fs";
 import { join as join9, relative as relative2 } from "path";
 import { parse as parseToml } from "smol-toml";
 function safeRead(path) {
   try {
-    if (!existsSync13(path)) return null;
+    if (!existsSync15(path)) return null;
     const ls = lstatSync(path);
     if (ls.isSymbolicLink()) return null;
-    const st = statSync4(path);
+    const st = statSync5(path);
     if (!st.isFile()) return null;
-    return readFileSync9(path, "utf-8");
+    return readFileSync11(path, "utf-8");
   } catch {
     return null;
   }
@@ -5692,7 +6071,7 @@ function parsePackageJson(path, directory, root, warnings) {
   const peer = Object.keys(
     pkg.peerDependencies ?? {}
   );
-  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync13(join9(directory, "tsconfig.json"));
+  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync15(join9(directory, "tsconfig.json"));
   const language = hasTs ? "typescript" : "javascript";
   const scripts = Object.keys(
     pkg.scripts ?? {}
@@ -6119,13 +6498,13 @@ function detectManifestsInDir(dir, root, warnings) {
   for (const entry of getManifestRegistry2()) {
     if (!entry.pattern.startsWith("*")) {
       const path = join9(dir, entry.pattern);
-      if (!existsSync13(path)) continue;
+      if (!existsSync15(path)) continue;
       const m3 = entry.parse(path, dir, root, warnings);
       if (m3 !== null) out.push(m3);
     } else {
       if (dirEntries === null) {
         try {
-          dirEntries = readdirSync5(dir);
+          dirEntries = readdirSync6(dir);
         } catch {
           dirEntries = [];
         }
@@ -6133,7 +6512,7 @@ function detectManifestsInDir(dir, root, warnings) {
       for (const fname of dirEntries) {
         if (!matchManifestPattern2(fname, entry.pattern)) continue;
         const path = join9(dir, fname);
-        if (!existsSync13(path)) continue;
+        if (!existsSync15(path)) continue;
         const m3 = entry.parse(path, dir, root, warnings);
         if (m3 !== null) out.push(m3);
       }
@@ -6143,7 +6522,7 @@ function detectManifestsInDir(dir, root, warnings) {
 }
 function listSubdirs(dir) {
   try {
-    return readdirSync5(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS.has(e2.name)).map((e2) => join9(dir, e2.name));
+    return readdirSync6(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS.has(e2.name)).map((e2) => join9(dir, e2.name));
   } catch {
     return [];
   }
@@ -6154,7 +6533,7 @@ function detectPackageManifests(projectRoot) {
   manifests.push(...detectManifestsInDir(projectRoot, projectRoot, warnings));
   for (const ws of WORKSPACE_DIRS) {
     const wsRoot = join9(projectRoot, ws);
-    if (!existsSync13(wsRoot)) continue;
+    if (!existsSync15(wsRoot)) continue;
     for (const sub of listSubdirs(wsRoot)) {
       manifests.push(...detectManifestsInDir(sub, projectRoot, warnings));
       for (const sub2 of listSubdirs(sub)) {
@@ -6406,22 +6785,22 @@ import {
   openSync as openSync3,
   fsyncSync as fsyncSync3,
   closeSync as closeSync3,
-  existsSync as existsSync14,
+  existsSync as existsSync16,
   realpathSync as realpathSync2,
   unlinkSync as unlinkSync2,
   accessSync as accessSync2,
-  statSync as statSync5,
+  statSync as statSync6,
   chmodSync as chmodSync3,
   constants
 } from "fs";
-import { dirname as dirname10, resolve as resolve7, relative as relative3, isAbsolute, basename as basename3, sep } from "path";
+import { dirname as dirname10, resolve as resolve10, relative as relative3, isAbsolute, basename as basename3, sep } from "path";
 import { createHash as createHash4 } from "crypto";
 function assertContainedIn(rootDir, candidate, opts = {}) {
   if (candidate.includes("\0")) {
     throw new PathEscapeError("path contains a NUL byte");
   }
-  const root = resolve7(rootDir);
-  const abs = resolve7(root, candidate);
+  const root = resolve10(rootDir);
+  const abs = resolve10(root, candidate);
   if (!opts.allowNested) {
     const rel = relative3(root, abs);
     if (rel.includes(sep)) {
@@ -6440,13 +6819,13 @@ function assertContainedIn(rootDir, candidate, opts = {}) {
 }
 function isContainedIn(rootDir, candidate, opts = {}) {
   if (candidate.includes("\0")) return false;
-  const root = resolve7(rootDir);
-  const abs = resolve7(root, candidate);
+  const root = resolve10(rootDir);
+  const abs = resolve10(root, candidate);
   const rel = relative3(root, abs);
   if (rel === "" && !opts.allowRoot) return false;
   if (rel.startsWith("..") || isAbsolute(rel)) return false;
   let probe = abs;
-  while (!existsSync14(probe) && probe.length > 1) {
+  while (!existsSync16(probe) && probe.length > 1) {
     const parent = dirname10(probe);
     if (parent === probe) break;
     probe = parent;
@@ -6465,11 +6844,11 @@ function isContainedIn(rootDir, candidate, opts = {}) {
 }
 function atomicWriteFileSync(destPath, contents) {
   const dir = dirname10(destPath);
-  const tmp = resolve7(dir, `.${basename3(destPath)}.massu-tmp-${process.pid}`);
+  const tmp = resolve10(dir, `.${basename3(destPath)}.massu-tmp-${process.pid}`);
   let destMode;
-  if (existsSync14(destPath)) {
+  if (existsSync16(destPath)) {
     accessSync2(destPath, constants.W_OK);
-    destMode = statSync5(destPath).mode & 511;
+    destMode = statSync6(destPath).mode & 511;
   }
   let fd;
   try {
@@ -6488,7 +6867,7 @@ function atomicWriteFileSync(destPath, contents) {
       }
     }
     try {
-      if (existsSync14(tmp)) unlinkSync2(tmp);
+      if (existsSync16(tmp)) unlinkSync2(tmp);
     } catch {
     }
     throw err;
@@ -10422,11 +10801,11 @@ var require_out = __commonJS({
       async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports.stat = stat;
-    function statSync22(path, optionsOrSettings) {
+    function statSync23(path, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path, settings);
     }
-    exports.statSync = statSync22;
+    exports.statSync = statSync23;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -11091,41 +11470,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push(value) {
-        var p19 = new Promise(function(resolve47, reject) {
+        var p19 = new Promise(function(resolve49, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve47(result);
+            resolve49(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function unshift(value) {
-        var p19 = new Promise(function(resolve47, reject) {
+        var p19 = new Promise(function(resolve49, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve47(result);
+            resolve49(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function drained() {
-        var p19 = new Promise(function(resolve47) {
+        var p19 = new Promise(function(resolve49) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve47();
+              resolve49();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve47();
+                resolve49();
                 queue.drain = previousDrain;
               };
             }
@@ -11611,9 +11990,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve47, reject) => {
+        return new Promise((resolve49, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve47(stats) : reject(error);
+            return error === null ? resolve49(stats) : reject(error);
           });
         });
       }
@@ -11637,10 +12016,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve47, reject) => {
+        return new Promise((resolve49, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve47(entries);
+              resolve49(entries);
             } else {
               reject(error);
             }
@@ -11650,10 +12029,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve47, reject) => {
+        return new Promise((resolve49, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve47(entries));
+          stream.once("end", () => resolve49(entries));
         });
       }
     };
@@ -12499,25 +12878,25 @@ var init_source_dir_detector = __esm({
 });
 
 // src/detect/monorepo-detector.ts
-import { readFileSync as readFileSync10, existsSync as existsSync15, statSync as statSync6, lstatSync as lstatSync2, readdirSync as readdirSync6 } from "fs";
+import { readFileSync as readFileSync12, existsSync as existsSync17, statSync as statSync7, lstatSync as lstatSync2, readdirSync as readdirSync7 } from "fs";
 import { join as join10, relative as relative4 } from "path";
 import { parse as parseYaml3 } from "yaml";
 import { parse as parseToml2 } from "smol-toml";
 function safeReadText(path) {
   try {
-    if (!existsSync15(path)) return null;
+    if (!existsSync17(path)) return null;
     const ls = lstatSync2(path);
     if (ls.isSymbolicLink()) return null;
-    const st = statSync6(path);
+    const st = statSync7(path);
     if (!st.isFile()) return null;
-    return readFileSync10(path, "utf-8");
+    return readFileSync12(path, "utf-8");
   } catch {
     return null;
   }
 }
 function firstManifestIn(dir) {
   for (const m3 of MANIFEST_PRIORITY) {
-    if (existsSync15(join10(dir, m3))) return m3;
+    if (existsSync17(join10(dir, m3))) return m3;
   }
   return null;
 }
@@ -12573,7 +12952,7 @@ function pkgFromDir(root, dir) {
 }
 function listSubdirs2(dir) {
   try {
-    return readdirSync6(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS2.has(e2.name)).map((e2) => join10(dir, e2.name));
+    return readdirSync7(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS2.has(e2.name)).map((e2) => join10(dir, e2.name));
   } catch {
     return [];
   }
@@ -12582,7 +12961,7 @@ function genericWorkspaces(root) {
   const out = [];
   for (const parent of CONVENTIONAL_WORKSPACE_PARENTS) {
     const p19 = join10(root, parent);
-    if (!existsSync15(p19)) continue;
+    if (!existsSync17(p19)) continue;
     for (const sub of listSubdirs2(p19)) {
       const pkg = pkgFromDir(root, sub);
       if (pkg) out.push(pkg);
@@ -12623,7 +13002,7 @@ function expandWorkspaceGlobs(root, globs) {
     const parts = pattern.split("/");
     if (parts.length === 2 && (parts[1] === "*" || parts[1] === "**")) {
       const parent = join10(root, parts[0]);
-      if (!existsSync15(parent)) continue;
+      if (!existsSync17(parent)) continue;
       for (const sub of listSubdirs2(parent)) {
         const pkg = pkgFromDir(root, sub);
         if (pkg && !seen.has(pkg.path)) {
@@ -12634,7 +13013,7 @@ function expandWorkspaceGlobs(root, globs) {
       continue;
     }
     const direct = join10(root, pattern);
-    if (existsSync15(direct)) {
+    if (existsSync17(direct)) {
       const pkg = pkgFromDir(root, direct);
       if (pkg && !seen.has(pkg.path)) {
         seen.add(pkg.path);
@@ -12645,16 +13024,16 @@ function expandWorkspaceGlobs(root, globs) {
   return out;
 }
 function hasTurbo(root) {
-  return existsSync15(join10(root, "turbo.json"));
+  return existsSync17(join10(root, "turbo.json"));
 }
 function hasNx(root) {
-  return existsSync15(join10(root, "nx.json"));
+  return existsSync17(join10(root, "nx.json"));
 }
 function hasLerna(root) {
-  return existsSync15(join10(root, "lerna.json"));
+  return existsSync17(join10(root, "lerna.json"));
 }
 function hasBazel(root) {
-  return existsSync15(join10(root, "WORKSPACE")) || existsSync15(join10(root, "WORKSPACE.bazel")) || existsSync15(join10(root, "MODULE.bazel"));
+  return existsSync17(join10(root, "WORKSPACE")) || existsSync17(join10(root, "WORKSPACE.bazel")) || existsSync17(join10(root, "MODULE.bazel"));
 }
 function detectMonorepo(projectRoot) {
   const nested = [];
@@ -12753,7 +13132,11 @@ function defaultsFor(language, fw, dir) {
         test: testFw === "unittest" ? prefix(dir, "python3 -m unittest") : prefix(dir, "python3 -m pytest -q"),
         type: prefix(dir, "python3 -m mypy ."),
         build: null,
-        syntax: prefix(dir, "python3 -m py_compile"),
+        // `python3 -m py_compile` with NO filenames exits 2 ('the following arguments are
+        // required: filenames') — a check that can never pass, i.e. a brick, and a brick
+        // gets bypassed. `compileall -q .` measured exit 1 on a tree with a syntax error
+        // and exit 0 on a clean tree (2026-09-20).
+        syntax: prefix(dir, "python3 -m compileall -q ."),
         lint: prefix(dir, "python3 -m ruff check .")
       };
     }
@@ -12791,7 +13174,12 @@ function defaultsFor(language, fw, dir) {
       return {
         test: prefix(dir, "swift test"),
         type: prefix(dir, "swift build"),
-        build: prefix(dir, "xcodebuild build"),
+        // `xcodebuild build` requires an .xcodeproj/.xcworkspace, but this block's other
+        // commands (`swift test`, `swift build`) and the swift-ios template's declared
+        // layout (Sources/) are SwiftPM. One stack cannot be SwiftPM for two keys and
+        // Xcode for a third. Operator-approved 2026-09-20; the three anti-vacuity plants
+        // that target this literal were re-pointed in the same change.
+        build: prefix(dir, "swift build -c release"),
         syntax: null,
         lint: prefix(dir, "swiftlint")
       };
@@ -12816,10 +13204,17 @@ function defaultsFor(language, fw, dir) {
     }
     case "ruby": {
       return {
-        test: prefix(dir, "bundle exec rspec"),
+        // Minitest is Rails' default; `bin/rails test` works on a fresh `rails new`.
+        // `bundle exec rspec` requires adding rspec-rails to the Gemfile first.
+        // https://guides.rubyonrails.org/testing.html
+        test: prefix(dir, "bin/rails test"),
         type: null,
         build: null,
-        syntax: prefix(dir, "ruby -c"),
+        // `ruby -c` with NO file argument reads STDIN: on empty stdin it prints
+        // 'Syntax OK' and exits 0 without inspecting one project file, and it BLOCKS on a
+        // TTY. A check that cannot fail is a blind gate. Measured 2026-09-20; the
+        // replacement exits 1 on a tree with a syntax error and 0 on a clean one.
+        syntax: prefix(dir, "find app lib -name '*.rb' -print0 | xargs -0 -n1 ruby -c > /dev/null"),
         lint: prefix(dir, "bundle exec rubocop")
       };
     }
@@ -12845,7 +13240,7 @@ var init_vr_command_map = __esm({
 });
 
 // src/detect/domain-inferrer.ts
-import { existsSync as existsSync16, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync18, readdirSync as readdirSync8 } from "fs";
 import { join as join11 } from "path";
 function titleCase(s) {
   if (!s) return s;
@@ -12867,9 +13262,9 @@ function topLevelSrcSubdirs(root, sourceDirs) {
   const seen = /* @__PURE__ */ new Set();
   for (const rel of effective) {
     const abs = join11(root, rel);
-    if (!existsSync16(abs)) continue;
+    if (!existsSync18(abs)) continue;
     try {
-      for (const e2 of readdirSync7(abs, { withFileTypes: true })) {
+      for (const e2 of readdirSync8(abs, { withFileTypes: true })) {
         if (!e2.isDirectory()) continue;
         if (IGNORED_SUBDIRS.has(e2.name)) continue;
         seen.add(e2.name);
@@ -12954,8 +13349,8 @@ var init_domain_inferrer = __esm({
 });
 
 // src/detect/regex-fallback.ts
-import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync11, statSync as statSync7 } from "fs";
-import { resolve as resolve8, join as join12, basename as basename4 } from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync9, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
+import { resolve as resolve11, join as join12, basename as basename4 } from "path";
 function introspectPython(detection, projectRoot) {
   const sourceDir = resolveSourceDir(detection, "python", projectRoot);
   if (!sourceDir) return null;
@@ -13121,10 +13516,10 @@ function resolveSourceDir(detection, lang, projectRoot) {
   const list = info?.source_dirs ?? [];
   if (list.length > 0) {
     const first = list[0];
-    const abs = resolve8(projectRoot, first);
-    return existsSync17(abs) ? abs : null;
+    const abs = resolve11(projectRoot, first);
+    return existsSync19(abs) ? abs : null;
   }
-  return existsSync17(projectRoot) ? projectRoot : null;
+  return existsSync19(projectRoot) ? projectRoot : null;
 }
 function sampleFiles(dir, nameRegex, pathFilter) {
   const out = [];
@@ -13134,7 +13529,7 @@ function sampleFiles(dir, nameRegex, pathFilter) {
     if (depth > MAX_DIR_DEPTH) continue;
     let entries;
     try {
-      entries = readdirSync8(path);
+      entries = readdirSync9(path);
     } catch {
       continue;
     }
@@ -13147,7 +13542,7 @@ function sampleFiles(dir, nameRegex, pathFilter) {
       const child = join12(path, entry);
       let st;
       try {
-        st = statSync7(child);
+        st = statSync8(child);
       } catch {
         continue;
       }
@@ -13167,9 +13562,9 @@ function sampleFiles(dir, nameRegex, pathFilter) {
 }
 function readSafe(path) {
   try {
-    const st = statSync7(path);
+    const st = statSync8(path);
     if (st.size > MAX_FILE_BYTES) return null;
-    return readFileSync11(path, "utf-8");
+    return readFileSync13(path, "utf-8");
   } catch {
     return null;
   }
@@ -13254,7 +13649,7 @@ var init_parse_guard = __esm({
 
 // src/detect/adapters/runner.ts
 import { basename as basename5, relative as relative5 } from "path";
-import { existsSync as existsSync18, readdirSync as readdirSync9, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
+import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync14, statSync as statSync9 } from "fs";
 import { join as join13 } from "path";
 async function runAdapters(adapters, rootDir, signals, options = {}) {
   const out = {
@@ -13349,10 +13744,10 @@ function buildDetectionSignals(rootDir) {
   const presentDirs = /* @__PURE__ */ new Set();
   const presentFiles = /* @__PURE__ */ new Set();
   try {
-    for (const entry of readdirSync9(rootDir)) {
+    for (const entry of readdirSync10(rootDir)) {
       if (entry.startsWith(".")) continue;
       try {
-        const st = statSync8(join13(rootDir, entry));
+        const st = statSync9(join13(rootDir, entry));
         if (st.isDirectory()) presentDirs.add(entry);
         else if (st.isFile()) presentFiles.add(entry);
       } catch {
@@ -13389,9 +13784,9 @@ function tryReadGradleBuild(rootDir, presentFiles) {
   return void 0;
 }
 function tryReadString(path) {
-  if (!existsSync18(path)) return void 0;
+  if (!existsSync20(path)) return void 0;
   try {
-    return readFileSync12(path, "utf-8");
+    return readFileSync14(path, "utf-8");
   } catch {
     return void 0;
   }
@@ -13509,8 +13904,8 @@ ${querySource}`
 import { createHash as createHash5 } from "crypto";
 import {
   mkdirSync as mkdirSync9,
-  readdirSync as readdirSync10,
-  readFileSync as readFileSync13,
+  readdirSync as readdirSync11,
+  readFileSync as readFileSync15,
   writeFileSync as writeFileSync4,
   renameSync as renameSync3,
   unlinkSync as unlinkSync3,
@@ -13546,7 +13941,7 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
   const dir = getCacheDir();
   let entries;
   try {
-    entries = readdirSync10(dir);
+    entries = readdirSync11(dir);
   } catch {
     return;
   }
@@ -13610,7 +14005,7 @@ async function loadGrammar(language, options = {}) {
     }
     let bytes;
     try {
-      bytes = readFileSync13(cachePath);
+      bytes = readFileSync15(cachePath);
     } catch (e2) {
       bytes = new Uint8Array(0);
     }
@@ -14528,7 +14923,7 @@ __export(file_sampler_exports, {
   SAMPLE_TEST_FILE_PATTERNS: () => SAMPLE_TEST_FILE_PATTERNS,
   sampleFilesForAdapter: () => sampleFilesForAdapter
 });
-import { readdirSync as readdirSync11, readFileSync as readFileSync14, lstatSync as lstatSync4 } from "node:fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync16, lstatSync as lstatSync4 } from "node:fs";
 import { join as join15, extname } from "node:path";
 function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
   const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
@@ -14560,7 +14955,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
   if (out.length >= maxFiles) return;
   let entries;
   try {
-    entries = readdirSync11(dir);
+    entries = readdirSync12(dir);
   } catch {
     return;
   }
@@ -14589,7 +14984,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
     seen.add(fullPath);
     let content;
     try {
-      content = readFileSync14(fullPath, "utf-8");
+      content = readFileSync16(fullPath, "utf-8");
     } catch {
       continue;
     }
@@ -15201,7 +15596,7 @@ function cD({ input: t2 = $, output: u2 = j, overwrite: F = true, hideCursor: e2
     t2.off("keypress", i), e2 && u2.write(import_sisteransi.cursor.show), t2.isTTY && !xD && t2.setRawMode(false), s.terminal = false, s.close();
   };
 }
-var import_sisteransi, import_picocolors, Q, P, X, DD, uD, FD, m, L, N, I, r, tD, eD, iD, v, CD, w, W, rD, R, y, V, z3, ED, _, nD, oD, aD, c, xD, S, AD, pD, h, x, fD, gD, vD, K, dD, bD, mD, Y, wD, yD, _D, Z, kD, SD, $D, q, jD, MD, TD, H, OD, PD;
+var import_sisteransi, import_picocolors, Q, P, X, DD, uD, FD, m, L, N, I, r, tD, eD, iD, v, CD, w, W, rD, R, y, V, z4, ED, _, nD, oD, aD, c, xD, S, AD, pD, h, x, fD, gD, vD, K, dD, bD, mD, Y, wD, yD, _D, Z, kD, SD, $D, q, jD, MD, TD, H, OD, PD;
 var init_dist = __esm({
   "../../node_modules/@clack/core/dist/index.mjs"() {
     import_sisteransi = __toESM(require_src(), 1);
@@ -15258,7 +15653,7 @@ var init_dist = __esm({
     R = "m";
     y = `${rD}8;;`;
     V = (t2) => `${v.values().next().value}${W}${t2}${R}`;
-    z3 = (t2) => `${v.values().next().value}${y}${t2}${w}`;
+    z4 = (t2) => `${v.values().next().value}${y}${t2}${w}`;
     ED = (t2) => t2.split(" ").map((u2) => A(u2));
     _ = (t2, u2, F) => {
       const e2 = [...u2];
@@ -15318,8 +15713,8 @@ var init_dist = __esm({
         }
         const n = iD.codes.get(Number(s));
         o[E2 + 1] === `
-` ? (i && (e2 += z3("")), s && n && (e2 += V(n))) : a2 === `
-` && (s && n && (e2 += V(s)), i && (e2 += z3(i)));
+` ? (i && (e2 += z4("")), s && n && (e2 += V(n))) : a2 === `
+` && (s && n && (e2 += V(s)), i && (e2 += z4(i)));
       }
       return e2;
     };
@@ -16022,8 +16417,8 @@ __export(init_exports, {
   validateWrittenConfig: () => validateWrittenConfig,
   writeConfigAtomic: () => writeConfigAtomic
 });
-import { closeSync as closeSync4, existsSync as existsSync19, fsyncSync as fsyncSync4, openSync as openSync4, readFileSync as readFileSync15, writeFileSync as writeFileSync5, writeSync as writeSync2, mkdirSync as mkdirSync10, readdirSync as readdirSync12, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync10, chmodSync as chmodSync5 } from "fs";
-import { resolve as resolve9, basename as basename6, dirname as dirname12 } from "path";
+import { closeSync as closeSync4, existsSync as existsSync21, fsyncSync as fsyncSync4, openSync as openSync4, readFileSync as readFileSync17, writeFileSync as writeFileSync5, writeSync as writeSync2, mkdirSync as mkdirSync10, readdirSync as readdirSync13, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync11, chmodSync as chmodSync5 } from "fs";
+import { resolve as resolve12, basename as basename6, dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { homedir as homedir7 } from "os";
 import { execFileSync as execFileSync2 } from "child_process";
@@ -16035,10 +16430,10 @@ function detectFramework(projectRoot) {
     orm: "none",
     ui: "none"
   };
-  const pkgPath = resolve9(projectRoot, "package.json");
-  if (!existsSync19(pkgPath)) return result;
+  const pkgPath = resolve12(projectRoot, "package.json");
+  if (!existsSync21(pkgPath)) return result;
   try {
-    const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
     const allDeps = {
       ...pkg.dependencies,
       ...pkg.devDependencies
@@ -16072,7 +16467,7 @@ function detectPython(projectRoot) {
     alembicDir: null
   };
   const markers = ["pyproject.toml", "setup.py", "requirements.txt", "Pipfile"];
-  const hasMarker = markers.some((m3) => existsSync19(resolve9(projectRoot, m3)));
+  const hasMarker = markers.some((m3) => existsSync21(resolve12(projectRoot, m3)));
   if (!hasMarker) return result;
   result.detected = true;
   const depFiles = [
@@ -16082,35 +16477,35 @@ function detectPython(projectRoot) {
     { file: "Pipfile" }
   ];
   for (const { file } of depFiles) {
-    const filePath = resolve9(projectRoot, file);
-    if (existsSync19(filePath)) {
+    const filePath = resolve12(projectRoot, file);
+    if (existsSync21(filePath)) {
       try {
-        const content = readFileSync15(filePath, "utf-8").toLowerCase();
+        const content = readFileSync17(filePath, "utf-8").toLowerCase();
         if (content.includes("fastapi")) result.hasFastapi = true;
         if (content.includes("sqlalchemy")) result.hasSqlalchemy = true;
       } catch {
       }
     }
   }
-  if (existsSync19(resolve9(projectRoot, "alembic.ini"))) {
+  if (existsSync21(resolve12(projectRoot, "alembic.ini"))) {
     result.hasAlembic = true;
-    if (existsSync19(resolve9(projectRoot, "alembic"))) {
+    if (existsSync21(resolve12(projectRoot, "alembic"))) {
       result.alembicDir = "alembic";
     }
-  } else if (existsSync19(resolve9(projectRoot, "alembic"))) {
+  } else if (existsSync21(resolve12(projectRoot, "alembic"))) {
     result.hasAlembic = true;
     result.alembicDir = "alembic";
   }
   const candidateRoots = ["app", "src", "backend", "api"];
   for (const candidate of candidateRoots) {
-    const candidatePath = resolve9(projectRoot, candidate);
-    if (existsSync19(candidatePath) && existsSync19(resolve9(candidatePath, "__init__.py"))) {
+    const candidatePath = resolve12(projectRoot, candidate);
+    if (existsSync21(candidatePath) && existsSync21(resolve12(candidatePath, "__init__.py"))) {
       result.root = candidate;
       break;
     }
-    if (existsSync19(candidatePath)) {
+    if (existsSync21(candidatePath)) {
       try {
-        const files = readdirSync12(candidatePath);
+        const files = readdirSync13(candidatePath);
         if (files.some((f2) => f2.endsWith(".py"))) {
           result.root = candidate;
           break;
@@ -16128,8 +16523,8 @@ function generateConfig(projectRoot, framework) {
   console.warn(
     "[@massu/core] generateConfig() is deprecated since 1.2.1 \u2014 use buildConfigFromDetection instead. It cannot produce valid configs for monorepos."
   );
-  const configPath = resolve9(projectRoot, "massu.config.yaml");
-  if (existsSync19(configPath)) {
+  const configPath = resolve12(projectRoot, "massu.config.yaml");
+  if (existsSync21(configPath)) {
     return false;
   }
   const projectName = basename6(projectRoot);
@@ -16240,10 +16635,10 @@ function buildConfigFromDetection(opts) {
       pathsSource = monorepoCommonRoot(detection.monorepo.packages);
     }
   }
-  if (pathsSource === "src" && !existsSync19(resolve9(projectRoot, "src"))) {
+  if (pathsSource === "src" && !existsSync21(resolve12(projectRoot, "src"))) {
     const fallbacks = ["app", "pages", "."];
     for (const fallback of fallbacks) {
-      if (fallback === "." || existsSync19(resolve9(projectRoot, fallback))) {
+      if (fallback === "." || existsSync21(resolve12(projectRoot, fallback))) {
         pathsSource = fallback;
         break;
       }
@@ -16327,7 +16722,7 @@ function buildConfigFromDetection(opts) {
     };
     if (pyFw?.framework) pythonBlock.framework = pyFw.framework;
     if (pyFw?.orm) pythonBlock.orm = pyFw.orm;
-    if (existsSync19(resolve9(projectRoot, "alembic.ini")) || existsSync19(resolve9(projectRoot, "alembic"))) {
+    if (existsSync21(resolve12(projectRoot, "alembic.ini")) || existsSync21(resolve12(projectRoot, "alembic"))) {
       pythonBlock.alembic_dir = "alembic";
     }
     config.python = pythonBlock;
@@ -16351,13 +16746,24 @@ function applyVariantTemplate(config, templatesDir) {
     }
   }
   if (templateId === null) return config;
-  const templatePath = resolve9(templatesDir, templateId, "massu.config.yaml");
-  if (!existsSync19(templatePath)) return config;
+  const templatePath = resolve12(templatesDir, templateId, "massu.config.yaml");
+  if (!existsSync21(templatePath)) return config;
   let template;
   try {
-    template = yamlParse(readFileSync15(templatePath, "utf-8"));
-  } catch {
-    return config;
+    template = yamlParse(readFileSync17(templatePath, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `massu: the shipped stack template '${templateId}' is unreadable at ${templatePath}: ${err instanceof Error ? err.message : String(err)}
+This is a defect in @massu/core, not in your project. Please report it.`
+    );
+  }
+  const validation = validateShippedTemplate(template, templateId);
+  if (!validation.ok) {
+    throw new Error(
+      `massu: the shipped stack template '${templateId}' does not satisfy the template contract:
+${validation.issues.map((i) => `  - ${i}`).join("\n")}
+This is a defect in @massu/core, not in your project. Please report it.`
+    );
   }
   const out = { ...config };
   const tplFw = template.framework;
@@ -16414,9 +16820,9 @@ ${yamlStringify(config)}`;
 function writeConfigAtomic(configPath, content) {
   const tmpPath = `${configPath}.tmp`;
   let existingMode;
-  if (existsSync19(configPath)) {
+  if (existsSync21(configPath)) {
     try {
-      existingMode = statSync10(configPath).mode;
+      existingMode = statSync11(configPath).mode;
     } catch {
       existingMode = void 0;
     }
@@ -16444,7 +16850,7 @@ function writeConfigAtomic(configPath, content) {
     }
     return { validated: true };
   } catch (err) {
-    if (existsSync19(tmpPath)) {
+    if (existsSync21(tmpPath)) {
       try {
         rmSync6(tmpPath, { force: true });
       } catch {
@@ -16455,8 +16861,8 @@ function writeConfigAtomic(configPath, content) {
 }
 function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
   try {
-    if (!existsSync19(configPath)) return "Config file does not exist after write";
-    const content = readFileSync15(configPath, "utf-8");
+    if (!existsSync21(configPath)) return "Config file does not exist after write";
+    const content = readFileSync17(configPath, "utf-8");
     const parsed = yamlParse(content);
     if (parsed === null || typeof parsed !== "object") {
       return "Config is not a valid YAML object";
@@ -16476,8 +16882,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
       if (checkPaths) {
         const src = cfg.paths.source;
         if (src && src !== ".") {
-          const srcAbs = resolve9(projectRoot, src);
-          if (!existsSync19(srcAbs)) {
+          const srcAbs = resolve12(projectRoot, src);
+          if (!existsSync21(srcAbs)) {
             return `paths.source '${src}' does not exist on disk`;
           }
         }
@@ -16487,8 +16893,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
           if (!Array.isArray(rawDirs)) continue;
           for (const d2 of rawDirs) {
             if (typeof d2 !== "string" || d2 === ".") continue;
-            const abs = resolve9(projectRoot, d2);
-            if (!existsSync19(abs)) {
+            const abs = resolve12(projectRoot, d2);
+            if (!existsSync21(abs)) {
               return `framework.languages.${lang}.source_dirs '${d2}' does not exist on disk`;
             }
           }
@@ -16497,7 +16903,7 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
         if (Array.isArray(mRoots)) {
           for (const r2 of mRoots) {
             if (typeof r2 !== "string" || r2 === ".") continue;
-            if (!existsSync19(resolve9(projectRoot, r2))) {
+            if (!existsSync21(resolve12(projectRoot, r2))) {
               return `paths.monorepo_roots '${r2}' does not exist on disk`;
             }
           }
@@ -16529,21 +16935,21 @@ function resolveTemplatesDir() {
   const cwd = process.cwd();
   const candidates = [
     // Project-local install: `<project>/node_modules/@massu/core/templates`.
-    resolve9(cwd, "node_modules/@massu/core/templates"),
+    resolve12(cwd, "node_modules/@massu/core/templates"),
     // Bundled cli.js layout: cli.js sits at `<package>/dist/cli.js`, so
     // templates live one level up at `<package>/templates`. (Plan 1.5.1
     // bug discovery: pre-existing layout assumed `dist/commands/init.js`
     // depth which never matched the bundled cli, so resolveTemplatesDir
     // returned null in production for both `--template` mode AND the
     // applyVariantTemplate path.)
-    resolve9(__dirname2, "../templates"),
+    resolve12(__dirname2, "../templates"),
     // Legacy nested layouts retained as fallbacks (in case a future
     // build moves cli.js back into a subdirectory).
-    resolve9(__dirname2, "../../templates"),
-    resolve9(__dirname2, "../../../templates")
+    resolve12(__dirname2, "../../templates"),
+    resolve12(__dirname2, "../../../templates")
   ];
   for (const c2 of candidates) {
-    if (existsSync19(c2)) return c2;
+    if (existsSync21(c2)) return c2;
   }
   return null;
 }
@@ -16552,12 +16958,12 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
   if (!templatesDir) {
     return { success: false, error: `Templates directory not found (looked in node_modules and dist/src)` };
   }
-  const srcPath = resolve9(templatesDir, templateName, "massu.config.yaml");
-  if (!existsSync19(srcPath)) {
+  const srcPath = resolve12(templatesDir, templateName, "massu.config.yaml");
+  if (!existsSync21(srcPath)) {
     return { success: false, error: `Template '${templateName}' not found at ${srcPath}` };
   }
   try {
-    let content = readFileSync15(srcPath, "utf-8");
+    let content = readFileSync17(srcPath, "utf-8");
     content = content.replace(/\{\{PROJECT_NAME\}\}/g, projectName);
     writeFileSync5(targetPath, content, "utf-8");
     return { success: true };
@@ -16567,13 +16973,13 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
 }
 function getInstallerVersion() {
   const candidates = [
-    resolve9(__dirname2, "../package.json"),
-    resolve9(__dirname2, "../../package.json")
+    resolve12(__dirname2, "../package.json"),
+    resolve12(__dirname2, "../../package.json")
   ];
   for (const candidate of candidates) {
-    if (existsSync19(candidate)) {
+    if (existsSync21(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync15(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync17(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0 && pkg.name === "@massu/core") {
           return pkg.version;
         }
@@ -16586,11 +16992,11 @@ function getInstallerVersion() {
   );
 }
 function registerMcpServer(projectRoot) {
-  const mcpPath = resolve9(projectRoot, ".mcp.json");
+  const mcpPath = resolve12(projectRoot, ".mcp.json");
   let existing = {};
-  if (existsSync19(mcpPath)) {
+  if (existsSync21(mcpPath)) {
     try {
-      existing = JSON.parse(readFileSync15(mcpPath, "utf-8"));
+      existing = JSON.parse(readFileSync17(mcpPath, "utf-8"));
     } catch {
       existing = {};
     }
@@ -16608,26 +17014,26 @@ function registerMcpServer(projectRoot) {
 }
 function resolveHooksDir() {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve9(cwd, "node_modules/@massu/core/dist/hooks");
-  if (existsSync19(nodeModulesPath)) {
+  const nodeModulesPath = resolve12(cwd, "node_modules/@massu/core/dist/hooks");
+  if (existsSync21(nodeModulesPath)) {
     return "node_modules/@massu/core/dist/hooks";
   }
-  const localPath = resolve9(__dirname2, "../dist/hooks");
-  if (existsSync19(localPath)) {
+  const localPath = resolve12(__dirname2, "../dist/hooks");
+  if (existsSync21(localPath)) {
     return localPath;
   }
   return "node_modules/@massu/core/dist/hooks";
 }
 function massuRuntimeDir(version, home = homedir7()) {
-  return resolve9(home, ".massu", "runtime", version);
+  return resolve12(home, ".massu", "runtime", version);
 }
 function massuRuntimeCliPath(version, home = homedir7()) {
-  return resolve9(massuRuntimeDir(version, home), "node_modules", "@massu", "core", "dist", "cli.js");
+  return resolve12(massuRuntimeDir(version, home), "node_modules", "@massu", "core", "dist", "cli.js");
 }
 function resolveMassuRuntimeCli(version, home = homedir7()) {
   if (process.env.MASSU_NO_NODE_DIRECT === "1") return null;
   const cli = massuRuntimeCliPath(version, home);
-  if (!existsSync19(cli)) return null;
+  if (!existsSync21(cli)) return null;
   try {
     execFileSync2(process.execPath, [cli, "--version"], { stdio: "ignore", timeout: 2e4 });
     return cli;
@@ -16652,7 +17058,7 @@ function materializeMassuRuntime(version, home = homedir7()) {
   return resolveMassuRuntimeCli(version, home) !== null;
 }
 function massuShimPath(home = homedir7()) {
-  return resolve9(home, ".massu", "bin", "massu-hook");
+  return resolve12(home, ".massu", "bin", "massu-hook");
 }
 function massuShimBody() {
   return `#!/bin/sh
@@ -16700,7 +17106,7 @@ function resolveMassuShim(home = homedir7()) {
   if (process.env.MASSU_NO_NODE_DIRECT === "1") return null;
   if (process.platform === "win32") return null;
   const shim = massuShimPath(home);
-  if (!existsSync19(shim)) return null;
+  if (!existsSync21(shim)) return null;
   try {
     execFileSync2(shim, [], { stdio: "ignore", timeout: 1e4 });
     return null;
@@ -16863,8 +17269,8 @@ function installHooks(projectRoot) {
   } catch {
     claudeDirName = ".claude";
   }
-  const claudeDir = resolve9(projectRoot, claudeDirName);
-  if (!existsSync19(claudeDir)) {
+  const claudeDir = resolve12(projectRoot, claudeDirName);
+  if (!existsSync21(claudeDir)) {
     mkdirSync10(claudeDir, { recursive: true });
   }
   const settings = readSettingsLocal(claudeDir);
@@ -16883,16 +17289,16 @@ function installHooks(projectRoot) {
 }
 function initMemoryDir(projectRoot) {
   const encodedRoot = encodeMemoryDirName(projectRoot);
-  const memoryDir = resolve9(homedir7(), `.claude/projects/${encodedRoot}/memory`);
+  const memoryDir = resolve12(homedir7(), `.claude/projects/${encodedRoot}/memory`);
   let migratedFromLegacy = false;
-  const legacyDir = resolve9(homedir7(), `.claude/projects/-${encodedRoot}/memory`);
-  if (existsSync19(legacyDir) && !existsSync19(memoryDir)) {
+  const legacyDir = resolve12(homedir7(), `.claude/projects/-${encodedRoot}/memory`);
+  if (existsSync21(legacyDir) && !existsSync21(memoryDir)) {
     try {
-      mkdirSync10(resolve9(memoryDir, ".."), { recursive: true });
+      mkdirSync10(resolve12(memoryDir, ".."), { recursive: true });
       renameSync4(legacyDir, memoryDir);
       try {
-        const legacyParent = resolve9(legacyDir, "..");
-        if (existsSync19(legacyParent) && readdirSync12(legacyParent).length === 0) {
+        const legacyParent = resolve12(legacyDir, "..");
+        if (existsSync21(legacyParent) && readdirSync13(legacyParent).length === 0) {
           rmSync6(legacyParent, { recursive: false });
         }
       } catch {
@@ -16902,13 +17308,13 @@ function initMemoryDir(projectRoot) {
     }
   }
   let created = false;
-  if (!existsSync19(memoryDir)) {
+  if (!existsSync21(memoryDir)) {
     mkdirSync10(memoryDir, { recursive: true });
     created = true;
   }
-  const memoryMdPath = resolve9(memoryDir, "MEMORY.md");
+  const memoryMdPath = resolve12(memoryDir, "MEMORY.md");
   let memoryMdCreated = false;
-  if (!existsSync19(memoryMdPath)) {
+  if (!existsSync21(memoryMdPath)) {
     const projectName = basename6(projectRoot);
     const memoryContent = `# ${projectName} - Massu Memory
 
@@ -17022,8 +17428,8 @@ async function runInit(argv, overrides) {
   log("Massu AI - Project Setup");
   log("========================");
   log("");
-  const configPath = resolve9(projectRoot, "massu.config.yaml");
-  if (existsSync19(configPath)) {
+  const configPath = resolve12(projectRoot, "massu.config.yaml");
+  if (existsSync21(configPath)) {
     if (opts.ci && !opts.force) {
       errLog(`error: massu.config.yaml already exists at ${configPath}`);
       errLog("       rerun with --force to overwrite, or remove the file first");
@@ -17162,8 +17568,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
       const commandStats = cmdResult.assets.commands;
       const stackResolved = !emptyStack && commandStats && (commandStats.installed > 0 || commandStats.updated > 0 || commandStats.kept > 0);
       if (!stackResolved) {
-        const placeholderPath = resolve9(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (!existsSync19(placeholderPath)) {
+        const placeholderPath = resolve12(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (!existsSync21(placeholderPath)) {
           const placeholderBody = [
             "# Massu \u2014 stack not yet detected",
             "",
@@ -17184,7 +17590,7 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
             "\u2014 Massu"
           ].join("\n");
           try {
-            mkdirSync10(resolve9(cmdResult.claudeDir, "commands"), { recursive: true });
+            mkdirSync10(resolve12(cmdResult.claudeDir, "commands"), { recursive: true });
             writeFileSync5(placeholderPath, placeholderBody, "utf-8");
             log("  Wrote _massu-needs-stack.md placeholder (no stack detected yet)");
           } catch {
@@ -17207,8 +17613,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
   (async () => {
     try {
       const encodedRoot = encodeMemoryDirName(projectRoot);
-      const memoryDir = resolve9(homedir7(), ".claude", "projects", encodedRoot, "memory");
-      const memFiles = existsSync19(memoryDir) ? readdirSync12(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
+      const memoryDir = resolve12(homedir7(), ".claude", "projects", encodedRoot, "memory");
+      const memFiles = existsSync21(memoryDir) ? readdirSync13(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
       if (memFiles.length > 0) {
         const { getMemoryDb: getMemoryDb2 } = await Promise.resolve().then(() => (init_memory_db(), memory_db_exports));
         const db = getMemoryDb2();
@@ -17264,6 +17670,7 @@ var init_init = __esm({
     "use strict";
     init_memory_file_ingest();
     init_config();
+    init_shipped_template_schema();
     init_install_commands();
     init_settings_local();
     init_memory_path();
@@ -17890,10 +18297,10 @@ var init_hook_registry = __esm({
 });
 
 // src/preflight.ts
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 function assertCodegraphUsable(dbPath) {
   const path = dbPath ?? getResolvedPaths().codegraphDbPath;
-  if (!existsSync20(path)) {
+  if (!existsSync22(path)) {
     throw new CodegraphDbUnusableError(path, "missing");
   }
   let db = null;
@@ -17978,8 +18385,8 @@ __export(hook_runner_exports, {
   resolveHookFile: () => resolveHookFile,
   runHookRunner: () => runHookRunner
 });
-import { existsSync as existsSync21 } from "fs";
-import { resolve as resolve10, dirname as dirname13 } from "path";
+import { existsSync as existsSync23 } from "fs";
+import { resolve as resolve13, dirname as dirname13 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { spawn } from "child_process";
 function resolveHookFile(hookName) {
@@ -17991,14 +18398,14 @@ function resolveHookFile(hookName) {
   }
   const candidates = [
     // Bundled compiled layout: dist/cli.js → ./hooks/<file>.js
-    resolve10(__dirname3, "hooks", file),
+    resolve13(__dirname3, "hooks", file),
     // TS-source dev / sibling layout: src/commands/ → ../hooks/<file>
-    resolve10(__dirname3, "../hooks", file),
+    resolve13(__dirname3, "../hooks", file),
     // TS-source dev fallback: src/commands/ → ../../dist/hooks/<file>
-    resolve10(__dirname3, "../../dist/hooks", file)
+    resolve13(__dirname3, "../../dist/hooks", file)
   ];
   for (const candidate of candidates) {
-    if (existsSync21(candidate)) {
+    if (existsSync23(candidate)) {
       return candidate;
     }
   }
@@ -18071,17 +18478,17 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor,
   runValidateConfig: () => runValidateConfig
 });
-import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync13 } from "fs";
-import { resolve as resolve11, dirname as dirname14 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync18, readdirSync as readdirSync14 } from "fs";
+import { resolve as resolve14, dirname as dirname14 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { parse as parseYaml4 } from "yaml";
 function checkConfig(projectRoot) {
-  const configPath = resolve11(projectRoot, "massu.config.yaml");
-  if (!existsSync22(configPath)) {
+  const configPath = resolve14(projectRoot, "massu.config.yaml");
+  if (!existsSync24(configPath)) {
     return { name: "Configuration", status: "fail", detail: "massu.config.yaml not found. Run: npx massu init" };
   }
   try {
-    const content = readFileSync16(configPath, "utf-8");
+    const content = readFileSync18(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       return { name: "Configuration", status: "fail", detail: "massu.config.yaml is empty or invalid YAML" };
@@ -18093,11 +18500,11 @@ function checkConfig(projectRoot) {
 }
 function checkMcpServer(projectRoot) {
   const mcpPath = getResolvedPaths().mcpJsonPath;
-  if (!existsSync22(mcpPath)) {
+  if (!existsSync24(mcpPath)) {
     return { name: "MCP Server", status: "fail", detail: ".mcp.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync16(mcpPath, "utf-8"));
+    const content = JSON.parse(readFileSync18(mcpPath, "utf-8"));
     const servers = content.mcpServers ?? {};
     if (!servers.massu) {
       return { name: "MCP Server", status: "fail", detail: "massu not registered in .mcp.json. Run: npx massu init" };
@@ -18111,7 +18518,7 @@ function readHookSources() {
   const { settingsPath, settingsLocalPath } = getResolvedPaths();
   const out = [];
   for (const [label, p19] of [["settings.json", settingsPath], ["settings.local.json", settingsLocalPath]]) {
-    if (!existsSync22(p19)) continue;
+    if (!existsSync24(p19)) continue;
     const content = readSettingsAtPath(p19);
     out.push({ label, hooks: content.hooks });
   }
@@ -18150,11 +18557,11 @@ function checkHooksConfig(_projectRoot2) {
   }
 }
 function checkHookFiles(projectRoot) {
-  const nodeModulesHooksDir = resolve11(projectRoot, "node_modules/@massu/core/dist/hooks");
+  const nodeModulesHooksDir = resolve14(projectRoot, "node_modules/@massu/core/dist/hooks");
   let hooksDir = nodeModulesHooksDir;
-  if (!existsSync22(nodeModulesHooksDir)) {
-    const devHooksDir = resolve11(__dirname4, "../../dist/hooks");
-    if (existsSync22(devHooksDir)) {
+  if (!existsSync24(nodeModulesHooksDir)) {
+    const devHooksDir = resolve14(__dirname4, "../../dist/hooks");
+    if (existsSync24(devHooksDir)) {
       hooksDir = devHooksDir;
     } else {
       return { name: "Hook Files", status: "fail", detail: "Compiled hooks not found. Run: npm install @massu/core" };
@@ -18162,7 +18569,7 @@ function checkHookFiles(projectRoot) {
   }
   const missing = [];
   for (const hookFile of EXPECTED_HOOKS) {
-    if (!existsSync22(resolve11(hooksDir, hookFile))) {
+    if (!existsSync24(resolve14(hooksDir, hookFile))) {
       missing.push(hookFile);
     }
   }
@@ -18188,12 +18595,12 @@ async function checkHookExecution(projectRoot, opts = {}) {
       detail: `Canary hook file unresolved: ${err instanceof Error ? err.message : String(err)}. Re-run: npx -y @massu/core init`
     };
   }
-  const tmpCwd = mkdtempSync2(resolve11(tmpdir2(), "massu-hook-canary-"));
+  const tmpCwd = mkdtempSync2(resolve14(tmpdir2(), "massu-hook-canary-"));
   try {
-    const realConfig = resolve11(projectRoot, "massu.config.yaml");
-    if (existsSync22(realConfig)) {
+    const realConfig = resolve14(projectRoot, "massu.config.yaml");
+    if (existsSync24(realConfig)) {
       try {
-        copyFileSync4(realConfig, resolve11(tmpCwd, "massu.config.yaml"));
+        copyFileSync4(realConfig, resolve14(tmpCwd, "massu.config.yaml"));
       } catch {
       }
     }
@@ -18256,8 +18663,8 @@ function checkNodeVersion2() {
   return { name: "Node.js", status: "fail", detail: `v${version} \u2014 Node.js >= ${floor} is required (node:sqlite engine)` };
 }
 async function checkGitRepo(projectRoot) {
-  const gitDir = resolve11(projectRoot, ".git");
-  if (!existsSync22(gitDir)) {
+  const gitDir = resolve14(projectRoot, ".git");
+  if (!existsSync24(gitDir)) {
     return { name: "Git Repository", status: "warn", detail: "Not a git repository (optional but recommended)" };
   }
   try {
@@ -18275,7 +18682,7 @@ async function checkGitRepo(projectRoot) {
 }
 function checkKnowledgeDb(projectRoot) {
   const knowledgeDbPath = getResolvedPaths().memoryDbPath;
-  if (!existsSync22(knowledgeDbPath)) {
+  if (!existsSync24(knowledgeDbPath)) {
     return {
       name: "Knowledge DB",
       status: "warn",
@@ -18286,7 +18693,7 @@ function checkKnowledgeDb(projectRoot) {
 }
 function checkMemoryDir(_projectRoot2) {
   const memoryDir = getResolvedPaths().memoryDir;
-  if (!existsSync22(memoryDir)) {
+  if (!existsSync24(memoryDir)) {
     return {
       name: "Memory Directory",
       status: "warn",
@@ -18396,8 +18803,8 @@ async function checkApiKeyHygiene(projectRoot) {
 function checkPythonHealth(projectRoot) {
   const config = getConfig();
   if (!config.python?.root) return null;
-  const pythonRoot = resolve11(projectRoot, config.python.root);
-  if (!existsSync22(pythonRoot)) {
+  const pythonRoot = resolve14(projectRoot, config.python.root);
+  if (!existsSync24(pythonRoot)) {
     return {
       name: "Python",
       status: "fail",
@@ -18411,15 +18818,15 @@ function checkPythonHealth(projectRoot) {
   function scanDir(dir, depth) {
     if (depth > 5) return;
     try {
-      const entries = readdirSync13(dir, { withFileTypes: true });
+      const entries = readdirSync14(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           const excludeDirs = config.python?.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
           if (!excludeDirs.includes(entry.name)) {
-            const subdir = resolve11(dir, entry.name);
-            if (depth <= 2 && !existsSync22(resolve11(subdir, "__init__.py"))) {
+            const subdir = resolve14(dir, entry.name);
+            if (depth <= 2 && !existsSync24(resolve14(subdir, "__init__.py"))) {
               try {
-                const subEntries = readdirSync13(subdir);
+                const subEntries = readdirSync14(subdir);
                 if (subEntries.some((f2) => f2.endsWith(".py") && f2 !== "__init__.py")) {
                   initPyMissing.push(entry.name);
                 }
@@ -18515,15 +18922,15 @@ async function runDoctor() {
 }
 async function runValidateConfig() {
   const projectRoot = process.cwd();
-  const configPath = resolve11(projectRoot, "massu.config.yaml");
-  if (!existsSync22(configPath)) {
+  const configPath = resolve14(projectRoot, "massu.config.yaml");
+  if (!existsSync24(configPath)) {
     console.error("Error: massu.config.yaml not found in current directory");
     console.error("Run: npx massu init");
     process.exit(1);
     return;
   }
   try {
-    const content = readFileSync16(configPath, "utf-8");
+    const content = readFileSync18(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       console.error("Error: massu.config.yaml is empty or not a valid YAML object");
@@ -18873,7 +19280,7 @@ __export(permissions_exports, {
   handlePermissionsSubcommand: () => handlePermissionsSubcommand,
   printPermissionsHelp: () => printPermissionsHelp
 });
-import { resolve as resolve12 } from "path";
+import { resolve as resolve15 } from "path";
 function resolveClaudeDir2() {
   let claudeDirName = ".claude";
   try {
@@ -18881,7 +19288,7 @@ function resolveClaudeDir2() {
   } catch {
     claudeDirName = ".claude";
   }
-  return resolve12(process.cwd(), claudeDirName);
+  return resolve15(process.cwd(), claudeDirName);
 }
 async function handlePermissionsSubcommand(args2) {
   const sub = args2[0];
@@ -18999,7 +19406,7 @@ var db_exports = {};
 __export(db_exports, {
   handleDbSubcommand: () => handleDbSubcommand
 });
-import { existsSync as existsSync23, statSync as statSync11 } from "fs";
+import { existsSync as existsSync25, statSync as statSync12 } from "fs";
 import { basename as basename7 } from "path";
 function human(bytes) {
   if (bytes < 1024) return `${bytes} B`;
@@ -19044,7 +19451,7 @@ async function handleDbSubcommand(args2) {
 
 `);
     for (const store of allStores()) {
-      if (!existsSync23(store.path)) {
+      if (!existsSync25(store.path)) {
         process.stdout.write(`  ${"\u2014"} ${store.name.padEnd(10)} not present, skipped
 `);
         continue;
@@ -19142,12 +19549,12 @@ Restore with:  massu db restore --latest memory
       target = found.path;
     }
     try {
-      const before = existsSync23(target) ? statSync11(target).size : 0;
+      const before = existsSync25(target) ? statSync12(target).size : 0;
       const res = restoreDb(backupPath, target);
       process.stdout.write(
         `Restored ${basename7(target)}
   from : ${res.restoredFrom}
-  size : ${human(before)} -> ${human(statSync11(target).size)}
+  size : ${human(before)} -> ${human(statSync12(target).size)}
 ` + (res.preservedOriginal ? `  the previous file was NOT destroyed \u2014 kept at:
     ${res.preservedOriginal}
 ` : "") + `  integrity_check: ok (verified before AND after the restore)
@@ -19308,8 +19715,8 @@ var init_license2 = __esm({
 });
 
 // src/changelog-generator.ts
-import { existsSync as existsSync24, readFileSync as readFileSync17, readdirSync as readdirSync14 } from "fs";
-import { resolve as resolve13 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync19, readdirSync as readdirSync15 } from "fs";
+import { resolve as resolve16 } from "path";
 function parseCommitsForPlanTokens(subjects) {
   const tokens = /* @__PURE__ */ new Set();
   const maintenance = [];
@@ -19326,16 +19733,16 @@ function parseCommitsForPlanTokens(subjects) {
 function loadPlanSummaries(tokens, planDir) {
   const result = /* @__PURE__ */ new Map();
   if (tokens.size === 0) return result;
-  if (!existsSync24(planDir)) {
+  if (!existsSync26(planDir)) {
     throw new Error(`Plan directory does not exist: ${planDir}`);
   }
-  const files = readdirSync14(planDir).filter((f2) => f2.endsWith(".md"));
+  const files = readdirSync15(planDir).filter((f2) => f2.endsWith(".md"));
   for (const token of tokens) {
     let matchedFile = null;
     let content = "";
     for (const file of files) {
-      const path = resolve13(planDir, file);
-      const text18 = readFileSync17(path, "utf-8");
+      const path = resolve16(planDir, file);
+      const text18 = readFileSync19(path, "utf-8");
       const tokenRe = new RegExp(
         `^\\*\\*Plan Token\\*\\*:\\s*\`?${token.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\`?(\\s|$)`,
         "m"
@@ -19416,8 +19823,8 @@ __export(changelog_exports, {
   printChangelogHelp: () => printChangelogHelp
 });
 import { execSync } from "child_process";
-import { existsSync as existsSync25, readFileSync as readFileSync18 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync20 } from "fs";
+import { resolve as resolve17 } from "path";
 function resolveRepoRoot() {
   try {
     return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
@@ -19441,25 +19848,25 @@ function getCommitSubjects(range) {
   }
 }
 function getCurrentVersion(repoRoot) {
-  const pkgPath = resolve14(repoRoot, "packages/core/package.json");
-  if (!existsSync25(pkgPath)) return "0.0.0";
-  const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
+  const pkgPath = resolve17(repoRoot, "packages/core/package.json");
+  if (!existsSync27(pkgPath)) return "0.0.0";
+  const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
   return pkg.version || "0.0.0";
 }
 function todayDate() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
 function getLatestChangelogEntryBody(repoRoot) {
-  const path = resolve14(repoRoot, "CHANGELOG.md");
-  if (!existsSync25(path)) return "";
-  const content = readFileSync18(path, "utf-8");
+  const path = resolve17(repoRoot, "CHANGELOG.md");
+  if (!existsSync27(path)) return "";
+  const content = readFileSync20(path, "utf-8");
   const m3 = content.match(/^## \[[\d.]+\][^\n]*\n([\s\S]*?)(?=\n## \[|$)/m);
   return m3 ? m3[1] : "";
 }
 async function handleChangelogSubcommand(args2) {
   const sub = args2[0];
   const repoRoot = resolveRepoRoot();
-  const planDir = resolve14(repoRoot, "docs/plans");
+  const planDir = resolve17(repoRoot, "docs/plans");
   switch (sub) {
     case "generate": {
       const lastTag = getLastTag();
@@ -19548,11 +19955,11 @@ var init_changelog = __esm({
 
 // src/knowledge-db.ts
 import { dirname as dirname15 } from "path";
-import { existsSync as existsSync26, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync11 } from "fs";
 function getKnowledgeDb() {
   const dbPath = getResolvedPaths().knowledgeDbPath;
   const dir = dirname15(dbPath);
-  if (!existsSync26(dir)) {
+  if (!existsSync28(dir)) {
     mkdirSync11(dir, { recursive: true });
   }
   const db = openDatabase2(dbPath);
@@ -19779,7 +20186,7 @@ var memory_embed_backfill_exports = {};
 __export(memory_embed_backfill_exports, {
   runMemoryEmbedBackfill: () => runMemoryEmbedBackfill
 });
-import { existsSync as existsSync27 } from "fs";
+import { existsSync as existsSync29 } from "fs";
 async function runMemoryEmbedBackfill(_args = []) {
   await embed("massu memory embed backfill probe");
   const active = getActiveEmbedModel();
@@ -19806,7 +20213,7 @@ async function runMemoryEmbedBackfill(_args = []) {
   );
   let chunks = { embedded: 0, scanned: 0 };
   const knowledgeDbPath = getResolvedPaths().knowledgeDbPath;
-  if (existsSync27(knowledgeDbPath)) {
+  if (existsSync29(knowledgeDbPath)) {
     const knowledgeDb = getKnowledgeDb();
     try {
       chunks = await embedMissingChunks(knowledgeDb);
@@ -19839,17 +20246,17 @@ var init_memory_embed_backfill = __esm({
 
 // src/memory-authorship.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync6, existsSync as existsSync28, mkdirSync as mkdirSync12, chmodSync as chmodSync6, statSync as statSync12 } from "fs";
+import { readFileSync as readFileSync21, writeFileSync as writeFileSync6, existsSync as existsSync30, mkdirSync as mkdirSync12, chmodSync as chmodSync6, statSync as statSync13 } from "fs";
 import { homedir as homedir8 } from "os";
-import { resolve as resolve15 } from "path";
+import { resolve as resolve18 } from "path";
 function renderKeyPath(home = homedir8()) {
-  return resolve15(home, ".massu", "render-key");
+  return resolve18(home, ".massu", "render-key");
 }
 function readRenderKey(home = homedir8()) {
   const p19 = renderKeyPath(home);
   try {
-    if (!existsSync28(p19)) return void 0;
-    const raw = readFileSync19(p19);
+    if (!existsSync30(p19)) return void 0;
+    const raw = readFileSync21(p19);
     if (raw.length !== 32) return void 0;
     return raw;
   } catch {
@@ -19861,7 +20268,7 @@ function ensureRenderKey(home = homedir8()) {
   if (existing) return existing;
   const p19 = renderKeyPath(home);
   try {
-    const dir = resolve15(home, ".massu");
+    const dir = resolve18(home, ".massu");
     mkdirSync12(dir, { recursive: true, mode: 448 });
     try {
       chmodSync6(dir, 448);
@@ -19919,11 +20326,11 @@ var init_memory_authorship = __esm({
 });
 
 // src/rule-candidate-snapshot.ts
-import { existsSync as existsSync29, readFileSync as readFileSync20, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4 } from "fs";
+import { existsSync as existsSync31, readFileSync as readFileSync22, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4 } from "fs";
 function takeSnapshots(paths) {
   const out = /* @__PURE__ */ new Map();
   for (const p19 of paths) {
-    if (existsSync29(p19)) out.set(p19, readFileSync20(p19, "utf-8"));
+    if (existsSync31(p19)) out.set(p19, readFileSync22(p19, "utf-8"));
     else out.set(p19, null);
   }
   return out;
@@ -19933,7 +20340,7 @@ function restoreSnapshots(snapshot) {
   for (const [path, content] of snapshot) {
     try {
       if (content === null) {
-        if (existsSync29(path)) unlinkSync4(path);
+        if (existsSync31(path)) unlinkSync4(path);
       } else {
         writeFileSync7(path, content, "utf-8");
       }
@@ -20013,7 +20420,7 @@ var init_memory_render_path = __esm({
 });
 
 // src/memory-tombstones.ts
-import { readFileSync as readFileSync21, appendFileSync as appendFileSync3, existsSync as existsSync30 } from "fs";
+import { readFileSync as readFileSync23, appendFileSync as appendFileSync3, existsSync as existsSync32 } from "fs";
 import { join as join16 } from "path";
 function tombstoneLedgerPath(memoryDir) {
   return join16(memoryDir, TOMBSTONE_LEDGER);
@@ -20021,10 +20428,10 @@ function tombstoneLedgerPath(memoryDir) {
 function readTombstones(memoryDir) {
   const out = /* @__PURE__ */ new Map();
   const p19 = tombstoneLedgerPath(memoryDir);
-  if (!existsSync30(p19)) return out;
+  if (!existsSync32(p19)) return out;
   let raw;
   try {
-    raw = readFileSync21(p19, "utf8");
+    raw = readFileSync23(p19, "utf8");
   } catch {
     return out;
   }
@@ -20263,29 +20670,29 @@ var init_memory_llm = __esm({
 
 // src/memory-backup.ts
 import {
-  readdirSync as readdirSync15,
+  readdirSync as readdirSync16,
   mkdirSync as mkdirSync13,
   copyFileSync as copyFileSync2,
-  statSync as statSync13,
-  existsSync as existsSync31,
+  statSync as statSync14,
+  existsSync as existsSync33,
   rmSync as rmSync7,
-  readFileSync as readFileSync22
+  readFileSync as readFileSync24
 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join17, resolve as resolve16 } from "path";
+import { join as join17, resolve as resolve19 } from "path";
 function backupsRoot(home = homedir9()) {
-  return resolve16(home, ".massu", "memory-backups");
+  return resolve19(home, ".massu", "memory-backups");
 }
 function backupStamp2(nowMs) {
   return new Date(nowMs).toISOString().replace(/:/g, "-");
 }
 function newestMtimeMs(dir) {
-  if (!existsSync31(dir)) return 0;
+  if (!existsSync33(dir)) return 0;
   let newest = 0;
-  for (const entry of readdirSync15(dir)) {
+  for (const entry of readdirSync16(dir)) {
     const p19 = join17(dir, entry);
     try {
-      const st = statSync13(p19);
+      const st = statSync14(p19);
       if (st.isFile() && st.mtimeMs > newest) newest = st.mtimeMs;
     } catch {
       continue;
@@ -20295,12 +20702,12 @@ function newestMtimeMs(dir) {
 }
 function listBackups(home = homedir9()) {
   const root = backupsRoot(home);
-  if (!existsSync31(root)) return [];
+  if (!existsSync33(root)) return [];
   const out = [];
-  for (const stamp of readdirSync15(root)) {
+  for (const stamp of readdirSync16(root)) {
     const dir = join17(root, stamp);
     try {
-      const st = statSync13(dir);
+      const st = statSync14(dir);
       if (!st.isDirectory()) continue;
       out.push({ stamp, dir, createdMs: st.mtimeMs });
     } catch {
@@ -20316,17 +20723,17 @@ function hasFreshBackup(memoryDir, home = homedir9()) {
   return backups[0].createdMs >= newestChange;
 }
 function takeBackup(memoryDir, nowMs, home = homedir9(), retention = DEFAULT_RETENTION2) {
-  if (!existsSync31(memoryDir)) {
+  if (!existsSync33(memoryDir)) {
     throw new BackupError(`memory directory does not exist: ${memoryDir}`);
   }
   const stamp = backupStamp2(nowMs);
   const dir = join17(backupsRoot(home), stamp);
   try {
     mkdirSync13(dir, { recursive: true, mode: 448 });
-    for (const entry of readdirSync15(memoryDir)) {
+    for (const entry of readdirSync16(memoryDir)) {
       const srcPath = join17(memoryDir, entry);
       try {
-        if (!statSync13(srcPath).isFile()) continue;
+        if (!statSync14(srcPath).isFile()) continue;
       } catch {
         continue;
       }
@@ -20354,16 +20761,16 @@ function restoreBackup(memoryDir, opts = {}) {
   const chosen = opts.from ? backups.find((b2) => b2.stamp === opts.from) : backups[0];
   if (!chosen) throw new BackupError(`no backup with stamp: ${opts.from}`);
   const wouldRestore = [];
-  for (const entry of readdirSync15(chosen.dir)) {
+  for (const entry of readdirSync16(chosen.dir)) {
     try {
-      if (statSync13(join17(chosen.dir, entry)).isFile()) wouldRestore.push(entry);
+      if (statSync14(join17(chosen.dir, entry)).isFile()) wouldRestore.push(entry);
     } catch {
       continue;
     }
   }
-  const currentFiles = existsSync31(memoryDir) ? readdirSync15(memoryDir).filter((e2) => {
+  const currentFiles = existsSync33(memoryDir) ? readdirSync16(memoryDir).filter((e2) => {
     try {
-      return statSync13(join17(memoryDir, e2)).isFile();
+      return statSync14(join17(memoryDir, e2)).isFile();
     } catch {
       return false;
     }
@@ -20407,7 +20814,7 @@ var init_memory_backup = __esm({
 });
 
 // src/memory-index-region.ts
-import { readFileSync as readFileSync23, existsSync as existsSync32 } from "fs";
+import { readFileSync as readFileSync25, existsSync as existsSync34 } from "fs";
 import { dirname as dirname16, join as join18 } from "path";
 function parseRegion(content) {
   const begins = countOccurrences(content, BEGIN_SENTINEL);
@@ -20512,9 +20919,9 @@ function withMemoryIndexLock(memoryDir, fn) {
   });
 }
 function readMemoryIndex(indexPath) {
-  if (!existsSync32(indexPath)) return void 0;
+  if (!existsSync34(indexPath)) return void 0;
   try {
-    return readFileSync23(indexPath, "utf8");
+    return readFileSync25(indexPath, "utf8");
   } catch {
     return void 0;
   }
@@ -20585,7 +20992,7 @@ var init_memory_files_config = __esm({
 });
 
 // src/memory-renderer.ts
-import { existsSync as existsSync33, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync35, readFileSync as readFileSync26 } from "fs";
 import { join as join19 } from "path";
 import { homedir as homedir10 } from "os";
 import { createHash as createHash8 } from "crypto";
@@ -20600,7 +21007,7 @@ function renderMemoryFiles(db, candidates, opts) {
   const audit = opts.audit ?? (() => {
   });
   const { memoryDir } = opts;
-  if (!existsSync33(memoryDir)) {
+  if (!existsSync35(memoryDir)) {
     return EMPTY("no_memory_dir", candidates.length);
   }
   try {
@@ -20671,8 +21078,8 @@ function renderLocked(db, candidates, o) {
       refusals.push({ name: c2.name, reason: "tombstoned" });
       continue;
     }
-    if (existsSync33(absPath)) {
-      const existing = readFileSync24(absPath, "utf8");
+    if (existsSync35(absPath)) {
+      const existing = readFileSync26(absPath, "utf8");
       const fm = readMemoryFileFrontmatter(existing);
       const storeRow = db.prepare(
         `SELECT massu_authored, massu_render_mac, adopted_human_at_epoch
@@ -20932,16 +21339,16 @@ var init_memory_renderer = __esm({
 });
 
 // src/commands/memory-render-cli.ts
-import { readdirSync as readdirSync16, readFileSync as readFileSync25, existsSync as existsSync34, rmSync as rmSync8, statSync as statSync14 } from "fs";
+import { readdirSync as readdirSync17, readFileSync as readFileSync27, existsSync as existsSync36, rmSync as rmSync8, statSync as statSync15 } from "fs";
 import { join as join20 } from "path";
 import { homedir as homedir11 } from "os";
 function memoryFiles(memoryDir) {
-  if (!existsSync34(memoryDir)) return [];
-  return readdirSync16(memoryDir).filter((f2) => {
+  if (!existsSync36(memoryDir)) return [];
+  return readdirSync17(memoryDir).filter((f2) => {
     if (!f2.endsWith(".md")) return false;
     if (f2 === "MEMORY.md") return false;
     try {
-      return statSync14(join20(memoryDir, f2)).isFile();
+      return statSync15(join20(memoryDir, f2)).isFile();
     } catch {
       return false;
     }
@@ -20952,7 +21359,7 @@ function massuAuthoredFiles(db, memoryDir, home = homedir11()) {
   for (const f2 of memoryFiles(memoryDir)) {
     let content;
     try {
-      content = readFileSync25(join20(memoryDir, f2), "utf8");
+      content = readFileSync27(join20(memoryDir, f2), "utf8");
     } catch {
       continue;
     }
@@ -20980,7 +21387,7 @@ function memoryAdopt(db, memoryDir, opts = {}) {
   for (const f2 of memoryFiles(memoryDir)) {
     const row = db.prepare(`SELECT id FROM memory_files WHERE rel_path = ? COLLATE NOCASE`).get(f2);
     if (row) continue;
-    const content = readFileSync25(join20(memoryDir, f2), "utf8");
+    const content = readFileSync27(join20(memoryDir, f2), "utf8");
     if (verifyAuthorship(stripFrontmatter(content), readMemoryFileFrontmatter(content), null, home)) {
       candidates.push(f2);
     }
@@ -21010,7 +21417,7 @@ function memoryAdopt(db, memoryDir, opts = {}) {
   db.exec("BEGIN");
   try {
     for (const f2 of candidates) {
-      const content = readFileSync25(join20(memoryDir, f2), "utf8");
+      const content = readFileSync27(join20(memoryDir, f2), "utf8");
       const fm = readMemoryFileFrontmatter(content);
       insert.run(
         f2,
@@ -21175,7 +21582,7 @@ var init_memory_render_candidates = __esm({
 });
 
 // src/capability-advisor.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync14, readFileSync as readFileSync26, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync14, readFileSync as readFileSync28, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir12 } from "os";
 import { dirname as dirname17, join as join21 } from "path";
 function advisorStatePath(home = homedir12()) {
@@ -21184,8 +21591,8 @@ function advisorStatePath(home = homedir12()) {
 function readAdvisorState(home) {
   try {
     const p19 = advisorStatePath(home);
-    if (!existsSync35(p19)) return {};
-    return JSON.parse(readFileSync26(p19, "utf-8"));
+    if (!existsSync37(p19)) return {};
+    return JSON.parse(readFileSync28(p19, "utf-8"));
   } catch {
     return {};
   }
@@ -21433,9 +21840,9 @@ var init_memory_repo_identity = __esm({
 // src/memory-repos-registry.ts
 import {
   chmodSync as chmodSync7,
-  existsSync as existsSync36,
+  existsSync as existsSync38,
   mkdirSync as mkdirSync15,
-  readFileSync as readFileSync27,
+  readFileSync as readFileSync29,
   writeFileSync as writeFileSync9
 } from "fs";
 import { homedir as homedir13 } from "os";
@@ -21448,9 +21855,9 @@ function emptyRegistry() {
 }
 function readReposRegistry(home = homedir13()) {
   const p19 = reposRegistryPath(home);
-  if (!existsSync36(p19)) return emptyRegistry();
+  if (!existsSync38(p19)) return emptyRegistry();
   try {
-    const parsed = JSON.parse(readFileSync27(p19, "utf-8"));
+    const parsed = JSON.parse(readFileSync29(p19, "utf-8"));
     if (!parsed || typeof parsed !== "object") return emptyRegistry();
     const r2 = parsed;
     if (!Array.isArray(r2.repos)) return emptyRegistry();
@@ -21498,9 +21905,9 @@ var init_shared_memory_envelope = __esm({
 // src/security/local-share-signer.ts
 import {
   chmodSync as chmodSync8,
-  existsSync as existsSync37,
+  existsSync as existsSync39,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync30,
   writeFileSync as writeFileSync10
 } from "fs";
 import { homedir as homedir14 } from "os";
@@ -21519,7 +21926,7 @@ function localSharePubKeyPath(home = homedir14()) {
   return join23(localShareKeyDir(home), "local-share.pub");
 }
 function readLocalSharePublicKeyRaw(home = homedir14()) {
-  const pubPem = readFileSync28(localSharePubKeyPath(home), "utf-8");
+  const pubPem = readFileSync30(localSharePubKeyPath(home), "utf-8");
   const der = createPublicKey2(pubPem).export({ format: "der", type: "spki" });
   return Uint8Array.from(der.subarray(SPKI_ED25519_PREFIX_LEN));
 }
@@ -21938,26 +22345,6 @@ var init_memory_share_cli = __esm({
   }
 });
 
-// src/lib/corrections-md.ts
-function formatCorrectionEntry(e2) {
-  const one = (s) => s.replace(/\s*\n+\s*/g, " ").trim();
-  const lines = [`### ${e2.date} - ${one(e2.title)}`];
-  if (e2.wrong) lines.push(`- **Wrong**: ${one(e2.wrong)}`);
-  if (e2.correction) lines.push(`- **Correction**: ${one(e2.correction)}`);
-  lines.push(`- **Rule**: ${one(e2.rule)}`);
-  for (const [k3, v3] of Object.entries(e2.extra ?? {})) {
-    lines.push(`- ${k3}: ${one(String(v3))}`);
-  }
-  return `
-${lines.join("\n")}
-`;
-}
-var init_corrections_md = __esm({
-  "src/lib/corrections-md.ts"() {
-    "use strict";
-  }
-});
-
 // src/audit-trail.ts
 function p2(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -22458,7 +22845,7 @@ var init_promotion_apply_mac = __esm({
 });
 
 // src/rule-candidate-applier.ts
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync11, existsSync as existsSync38, unlinkSync as unlinkSync5, mkdirSync as mkdirSync17 } from "fs";
+import { readFileSync as readFileSync31, writeFileSync as writeFileSync11, existsSync as existsSync40, unlinkSync as unlinkSync5, mkdirSync as mkdirSync17 } from "fs";
 import { join as join24, dirname as dirname19, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir19 } from "os";
 import { createHash as createHash11 } from "crypto";
@@ -22491,7 +22878,7 @@ function writeIndexLineInRegion(indexPath, line) {
 function correctionsMdTargets(slug, projectRoot, home) {
   const dir = resolveMemoryDir(projectRoot, home);
   return {
-    correctionsMd: join24(dir, "corrections.md"),
+    correctionsMd: correctionsPath(dir),
     feedbackMd: join24(dir, `feedback_${slug}.md`),
     memoryIndex: join24(dir, "MEMORY.md")
   };
@@ -22501,8 +22888,8 @@ function readCandidate(candidateId, projectRoot = getProjectRoot()) {
     throw new InvalidCandidateIdError(candidateId);
   }
   const path = join24(projectRoot, ".massu", "rule-candidates", `${candidateId}.json`);
-  if (!existsSync38(path)) throw new CandidateNotFoundError(path);
-  const raw = readFileSync29(path, "utf-8");
+  if (!existsSync40(path)) throw new CandidateNotFoundError(path);
+  const raw = readFileSync31(path, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -22645,7 +23032,7 @@ async function applyRuleCandidate(db, opts) {
     throw new InvalidSlugError(slug);
   }
   const memoryIndex = resolveMemoryIndexPath(projectRoot, home);
-  if (!existsSync38(memoryIndex)) {
+  if (!existsSync40(memoryIndex)) {
     throw new MemoryIndexMissingError(memoryIndex);
   }
   let destTargets;
@@ -22701,7 +23088,7 @@ async function applyRuleCandidate(db, opts) {
         throw err;
       }
     }
-    if (existsSync38(candidatePath)) unlinkSync5(candidatePath);
+    if (existsSync40(candidatePath)) unlinkSync5(candidatePath);
     let teamShared = false;
     const localOrigin = candidate.provenance === void 0;
     const entitledTeam = entitledForTeamSharedPromotion(ent.currentTier);
@@ -22792,7 +23179,7 @@ function writeDestination(opts, candidate, slug, targets, auditRowId) {
 function writeCorrectionsMd(opts, candidate, slug, targets, auditRowId) {
   const [correctionsMd, feedbackMd] = targets.paths;
   const dateIso = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const correctionsEntry = formatCorrectionEntry({
+  const correctionsEntryData = {
     date: dateIso,
     title: slug,
     rule: opts.draftText,
@@ -22801,10 +23188,10 @@ function writeCorrectionsMd(opts, candidate, slug, targets, auditRowId) {
       score: candidate.score,
       audit_log_id: auditRowId
     }
-  });
-  if (!existsSync38(dirname19(correctionsMd))) mkdirSync17(dirname19(correctionsMd), { recursive: true });
-  const correctionsPre = existsSync38(correctionsMd) ? readFileSync29(correctionsMd, "utf-8") : "# Corrections\n";
-  writeFileSync11(correctionsMd, correctionsPre + correctionsEntry, "utf-8");
+  };
+  if (!existsSync40(dirname19(correctionsMd))) mkdirSync17(dirname19(correctionsMd), { recursive: true });
+  const correctionsPre = existsSync40(correctionsMd) ? readFileSync31(correctionsMd, "utf-8") : "";
+  writeFileSync11(correctionsMd, insertCorrectionEntry(correctionsPre, correctionsEntryData), "utf-8");
   const body = `${opts.draftText}
 `;
   const mac = mintAuthorship(body);
@@ -22829,7 +23216,7 @@ function writeCorrectionsMd(opts, candidate, slug, targets, auditRowId) {
 function writePatternScanner(opts, candidate, slug, targets) {
   const [scannerPath, driftGuardPath] = targets.paths;
   const checkNumber = opts.patternScannerCheckNumber;
-  const scannerPre = existsSync38(scannerPath) ? readFileSync29(scannerPath, "utf-8") : "";
+  const scannerPre = existsSync40(scannerPath) ? readFileSync31(scannerPath, "utf-8") : "";
   if (scannerPre.includes(`${SCANNER_AUTOGEN_MARKER_PREFIX} ${candidate.prompt_hash}`)) {
     throw new DestinationConfigError(
       `scanner already contains a check auto-generated for prompt_hash ${candidate.prompt_hash}`
@@ -22865,13 +23252,13 @@ function writePatternScanner(opts, candidate, slug, targets) {
     `});`,
     ""
   ].join("\n");
-  if (!existsSync38(dirname19(driftGuardPath))) mkdirSync17(dirname19(driftGuardPath), { recursive: true });
+  if (!existsSync40(dirname19(driftGuardPath))) mkdirSync17(dirname19(driftGuardPath), { recursive: true });
   writeFileSync11(driftGuardPath, driftGuard, "utf-8");
 }
 function writeClaudeMdCr(opts, candidate, slug, targets) {
   const [claudePath] = targets.paths;
   const crNumber = opts.claudeMdCrNumber;
-  const pre = existsSync38(claudePath) ? readFileSync29(claudePath, "utf-8") : "";
+  const pre = existsSync40(claudePath) ? readFileSync31(claudePath, "utf-8") : "";
   if (new RegExp(`\\bCR-${crNumber}\\b`).test(pre)) {
     throw new DestinationConfigError(`CLAUDE.md already contains a CR-${crNumber} entry`);
   }
@@ -22913,8 +23300,8 @@ function writeCustomDestination(opts, candidate, slug, targets) {
     destination_name: entry.name
   };
   const rendered = renderTemplate2(entry.template, vars);
-  if (!existsSync38(dirname19(destPath))) mkdirSync17(dirname19(destPath), { recursive: true });
-  const pre = existsSync38(destPath) ? readFileSync29(destPath, "utf-8") : "";
+  if (!existsSync40(dirname19(destPath))) mkdirSync17(dirname19(destPath), { recursive: true });
+  const pre = existsSync40(destPath) ? readFileSync31(destPath, "utf-8") : "";
   const sep4 = pre && !pre.endsWith("\n") ? "\n" : "";
   writeFileSync11(destPath, pre + sep4 + rendered + (rendered.endsWith("\n") ? "" : "\n"), "utf-8");
 }
@@ -22967,8 +23354,8 @@ function dismissRuleCandidate(db, opts) {
   }
   try {
     const dismissedLog = join24(projectRoot, ".massu", "rule-candidates", ".dismissed.jsonl");
-    if (!existsSync38(dirname19(dismissedLog))) mkdirSync17(dirname19(dismissedLog), { recursive: true });
-    const pre = existsSync38(dismissedLog) ? readFileSync29(dismissedLog, "utf-8") : "";
+    if (!existsSync40(dirname19(dismissedLog))) mkdirSync17(dirname19(dismissedLog), { recursive: true });
+    const pre = existsSync40(dismissedLog) ? readFileSync31(dismissedLog, "utf-8") : "";
     const sep4 = pre && !pre.endsWith("\n") ? "\n" : "";
     writeFileSync11(dismissedLog, pre + sep4 + JSON.stringify({
       id: opts.candidateId,
@@ -22979,7 +23366,7 @@ function dismissRuleCandidate(db, opts) {
       audit_log_id: auditRowId,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }) + "\n", "utf-8");
-    if (existsSync38(candidatePath)) unlinkSync5(candidatePath);
+    if (existsSync40(candidatePath)) unlinkSync5(candidatePath);
   } catch (err) {
     appendFailureLog(projectRoot, {
       candidate_id: opts.candidateId,
@@ -22998,9 +23385,9 @@ function dismissRuleCandidate(db, opts) {
 function appendFailureLog(projectRoot, entry) {
   try {
     const dir = join24(projectRoot, ".massu", "rule-candidates");
-    if (!existsSync38(dir)) mkdirSync17(dir, { recursive: true });
+    if (!existsSync40(dir)) mkdirSync17(dir, { recursive: true });
     const logPath = join24(dir, ".failures.jsonl");
-    const pre = existsSync38(logPath) ? readFileSync29(logPath, "utf-8") : "";
+    const pre = existsSync40(logPath) ? readFileSync31(logPath, "utf-8") : "";
     const sep4 = pre && !pre.endsWith("\n") ? "\n" : "";
     writeFileSync11(logPath, pre + sep4 + JSON.stringify(entry) + "\n", "utf-8");
   } catch {
@@ -23085,7 +23472,7 @@ var init_rule_candidate_applier = __esm({
 });
 
 // src/rule-candidate-preview.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync12, existsSync as existsSync39 } from "node:fs";
+import { readFileSync as readFileSync32, writeFileSync as writeFileSync12, existsSync as existsSync41 } from "node:fs";
 function renderHardenedPreview(destination, body) {
   const rendered = String(body ?? "");
   const riskFindings = RISK_PATTERNS.filter((p19) => p19.re.test(rendered)).map((p19) => p19.label);
@@ -23113,11 +23500,11 @@ function validateReviewAttestation(att) {
   };
 }
 function recordHardenedReviewAttestation(sidecarPath2, attestation) {
-  if (!existsSync39(sidecarPath2)) {
+  if (!existsSync41(sidecarPath2)) {
     throw new Error(`candidate sidecar not found: ${sidecarPath2}`);
   }
   const validated = validateReviewAttestation(attestation);
-  const raw = readFileSync30(sidecarPath2, "utf-8");
+  const raw = readFileSync32(sidecarPath2, "utf-8");
   const sidecar = JSON.parse(raw);
   const prov = sidecar.provenance;
   if (!prov || prov.origin !== "team" || prov.hardened !== true) {
@@ -23225,7 +23612,7 @@ var init_rule_candidate_renderer = __esm({
 });
 
 // src/rule-promotion-effectiveness.ts
-import { readFileSync as readFileSync31, existsSync as existsSync40 } from "fs";
+import { readFileSync as readFileSync33, existsSync as existsSync42 } from "fs";
 function evaluateCr53Effectiveness(inputs) {
   const { db, failureLogPath, knownLimitations } = inputs;
   const allowlist = new Set(knownLimitations.map((k3) => k3.promptHash));
@@ -23256,9 +23643,9 @@ function evaluateCr53Effectiveness(inputs) {
     });
   }
   const failureLogViolations = [];
-  if (existsSync40(failureLogPath)) {
+  if (existsSync42(failureLogPath)) {
     try {
-      const raw = readFileSync31(failureLogPath, "utf-8");
+      const raw = readFileSync33(failureLogPath, "utf-8");
       const cutoff = Date.now() - SEVEN_DAYS_MS;
       for (const line of raw.split("\n")) {
         const trimmed = line.trim();
@@ -23435,7 +23822,7 @@ var init_rule_pack_schema = __esm({
 });
 
 // src/rule-pack-sync.ts
-import { existsSync as existsSync41, writeFileSync as writeFileSync13, mkdirSync as mkdirSync18 } from "fs";
+import { existsSync as existsSync43, writeFileSync as writeFileSync13, mkdirSync as mkdirSync18 } from "fs";
 import { homedir as homedir20 } from "os";
 import { join as join25, dirname as dirname20 } from "path";
 async function pullInstalledPackRules(db, opts = {}) {
@@ -23500,7 +23887,7 @@ async function pullInstalledPackRules(db, opts = {}) {
       result.pulled += 1;
       const promptHash = packRulePromptHash(pack.slug, rule);
       const candidatePath = sidecarPath(projectRoot, promptHash);
-      if (existsSync41(candidatePath) || alreadyApplied(db, promptHash)) {
+      if (existsSync43(candidatePath) || alreadyApplied(db, promptHash)) {
         result.skipped += 1;
         continue;
       }
@@ -23593,7 +23980,7 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
     draft_text: draftText
   };
   const dir = dirname20(candidatePath);
-  if (!existsSync41(dir)) mkdirSync18(dir, { recursive: true });
+  if (!existsSync43(dir)) mkdirSync18(dir, { recursive: true });
   writeFileSync13(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
 }
 function emitDropTelemetry(db, eventType, data) {
@@ -24465,7 +24852,7 @@ var init_memory_supersede = __esm({
 
 // src/memory-consolidate.ts
 import { createHash as createHash12 } from "crypto";
-import { existsSync as existsSync42, mkdirSync as mkdirSync19, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync19, writeFileSync as writeFileSync14 } from "fs";
 import { join as join27 } from "path";
 function emptyResult() {
   return {
@@ -24642,7 +25029,7 @@ ${representative.detail}` : ""}`;
     const clusterKey = cluster.map((c2) => c2.title.toLowerCase().replace(/\s+/g, " ").trim()).sort().join("|");
     const promptHash = createHash12("sha256").update(clusterKey).digest("hex").slice(0, 16);
     const candidatePath = join27(candidateDir, `${promptHash}.json`);
-    if (existsSync42(candidatePath)) continue;
+    if (existsSync44(candidatePath)) continue;
     if (dryRun) {
       promoted++;
       continue;
@@ -24935,8 +25322,6 @@ var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync43, readFileSync as readFileSync32 } from "fs";
-import { resolve as resolve17 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
 }
@@ -24956,28 +25341,34 @@ async function runShowTemplate(args2) {
     return;
   }
   const framework = getConfig().framework;
-  const choice = pickVariant(baseName, sourceDir, framework);
-  if (choice.kind === "miss") {
+  const rendered = renderResolvedAsset(
+    baseName,
+    sourceDir,
+    framework,
+    makeRenderContext(framework)
+  );
+  if (rendered.kind === "miss") {
     process.stderr.write(`massu: no template named "${baseName}" found
 `);
     process.exit(1);
     return;
   }
-  const suffix = choice.kind === "hit" ? choice.suffix : "";
-  const file = suffix === "" ? resolve17(sourceDir, `${baseName}.md`) : resolve17(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync43(file)) {
-    process.stderr.write(`massu: resolved template "${file}" no longer exists
-`);
+  if (rendered.kind === "error") {
+    process.stderr.write(
+      `massu: template "${baseName}" could not be rendered: ${rendered.message}
+`
+    );
     process.exit(1);
     return;
   }
-  process.stdout.write(readFileSync32(file, "utf-8"));
+  process.stdout.write(rendered.content);
 }
 var init_show_template = __esm({
   "src/commands/show-template.ts"() {
     "use strict";
     init_config();
-    init_install_commands();
+    init_asset_resolution();
+    init_asset_render();
   }
 });
 
@@ -25024,9 +25415,9 @@ var init_passthrough = __esm({
 });
 
 // src/lib/installLock.ts
-import { resolve as resolve18 } from "path";
+import { resolve as resolve20 } from "path";
 function withInstallLock(projectRoot, fn, opts = {}) {
-  const lockPath = resolve18(projectRoot, ".massu", "installAll.lock");
+  const lockPath = resolve20(projectRoot, ".massu", "installAll.lock");
   return withFileLockSync(
     lockPath,
     fn,
@@ -25066,8 +25457,8 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync44, readFileSync as readFileSync33, rmSync as rmSync9 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync34, rmSync as rmSync9 } from "fs";
+import { resolve as resolve21 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
   const out = {};
@@ -25195,17 +25586,17 @@ function renderDiff(diff) {
 }
 async function runConfigRefresh(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve19(cwd, "massu.config.yaml");
+  const configPath = resolve21(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync44(configPath)) {
+  if (!existsSync45(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
   }
   let existing;
   try {
-    const content = readFileSync33(configPath, "utf-8");
+    const content = readFileSync34(configPath, "utf-8");
     const parsed = parseYaml5(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -25278,8 +25669,8 @@ async function runConfigRefresh(opts = {}) {
 `);
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
-        const placeholderPath = resolve19(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync44(placeholderPath)) {
+        const placeholderPath = resolve21(installResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (existsSync45(placeholderPath)) {
           try {
             rmSync9(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
@@ -25389,7 +25780,7 @@ var init_gitToplevel = __esm({
 
 // src/watch/canary.ts
 import { mkdirSync as mkdirSync20, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "fs";
-import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve20, sep as sep2 } from "path";
+import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve22, sep as sep2 } from "path";
 function toRelative(projectRoot, p19) {
   const raw = String(p19);
   const rel = isAbsolute3(raw) ? relative7(projectRoot, raw) : raw;
@@ -25409,9 +25800,9 @@ function canaryAwareIgnore(ignore, projectRoot) {
   return [...withoutMassu, massuButNotCanary];
 }
 function createWatcherCanary(opts) {
-  const projectRoot = resolve20(opts.projectRoot);
+  const projectRoot = resolve22(opts.projectRoot);
   const now = opts.now ?? Date.now;
-  const filePath = resolve20(projectRoot, CANARY_FILE_REL);
+  const filePath = resolve22(projectRoot, CANARY_FILE_REL);
   let outstanding = false;
   let echoed = false;
   let consecutiveDead = 0;
@@ -25425,7 +25816,7 @@ function createWatcherCanary(opts) {
     arm() {
       if (outstanding) return "armed";
       try {
-        mkdirSync20(resolve20(projectRoot, CANARY_DIR_REL), { recursive: true });
+        mkdirSync20(resolve22(projectRoot, CANARY_DIR_REL), { recursive: true });
         writeFileSync15(filePath, `${now()}
 `, "utf-8");
       } catch {
@@ -25478,14 +25869,14 @@ var init_canary = __esm({
 });
 
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync45, statSync as statSync15 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync46, statSync as statSync16 } from "fs";
+import { resolve as resolve23 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
-    const p19 = resolve21(projectRoot, lf);
-    if (!existsSync45(p19)) continue;
+    const p19 = resolve23(projectRoot, lf);
+    if (!existsSync46(p19)) continue;
     try {
-      const stat = statSync15(p19);
+      const stat = statSync16(p19);
       const delta = now - stat.mtimeMs;
       if (delta >= 0 && delta < windowMs) return true;
     } catch {
@@ -25496,7 +25887,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync45(resolve21(projectRoot, ".git", s))) return true;
+    if (existsSync46(resolve23(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -25695,18 +26086,18 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync5, existsSync as existsSync46, fsyncSync as fsyncSync5, mkdirSync as mkdirSync21, openSync as openSync5, readFileSync as readFileSync34, renameSync as renameSync5, rmSync as rmSync11, writeFileSync as writeFileSync16, writeSync as writeSync3 } from "fs";
-import { dirname as dirname21, resolve as resolve22 } from "path";
+import { closeSync as closeSync5, existsSync as existsSync47, fsyncSync as fsyncSync5, mkdirSync as mkdirSync21, openSync as openSync5, readFileSync as readFileSync35, renameSync as renameSync5, rmSync as rmSync11, writeFileSync as writeFileSync16, writeSync as writeSync3 } from "fs";
+import { dirname as dirname21, resolve as resolve24 } from "path";
 function watchStatePath(projectRoot) {
-  return resolve22(projectRoot, ".massu", "watch-state.json");
+  return resolve24(projectRoot, ".massu", "watch-state.json");
 }
 function backupStatePath(projectRoot) {
-  return resolve22(projectRoot, ".massu", "watch-state.v0.bak.json");
+  return resolve24(projectRoot, ".massu", "watch-state.v0.bak.json");
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync46(path)) return { ...DEFAULT_STATE };
-  const content = readFileSync34(path, "utf-8");
+  if (!existsSync47(path)) return { ...DEFAULT_STATE };
+  const content = readFileSync35(path, "utf-8");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -25769,7 +26160,7 @@ function writeStateAtomic(projectRoot, state) {
     renameSync5(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync46(tmp)) {
+    if (!renamed && existsSync47(tmp)) {
       try {
         rmSync11(tmp, { force: true });
       } catch {
@@ -25815,7 +26206,7 @@ var init_state = __esm({
 // src/watch/daemon.ts
 import * as chokidar from "chokidar";
 import { mkdirSync as mkdirSync22 } from "fs";
-import { resolve as resolve23 } from "path";
+import { resolve as resolve25 } from "path";
 function readDaemonConfig(projectRoot) {
   const cfg = getConfig();
   const w2 = cfg.watch ?? {};
@@ -26106,7 +26497,7 @@ async function startDaemon(projectRoot, hooks) {
     );
     canary = createWatcherCanary({ projectRoot: cfg.projectRoot, now });
     try {
-      mkdirSync22(resolve23(cfg.projectRoot, canary.dirRel), { recursive: true });
+      mkdirSync22(resolve25(cfg.projectRoot, canary.dirRel), { recursive: true });
     } catch {
     }
     watchSpec = {
@@ -26157,8 +26548,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync5 } from "child_process";
-import { basename as basename8, dirname as dirname22, resolve as resolve24 } from "path";
-import { appendFileSync as appendFileSync4, existsSync as existsSync47, mkdirSync as mkdirSync23, readFileSync as readFileSync35 } from "fs";
+import { basename as basename8, dirname as dirname22, resolve as resolve26 } from "path";
+import { appendFileSync as appendFileSync4, existsSync as existsSync48, mkdirSync as mkdirSync23, readFileSync as readFileSync36 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -26183,8 +26574,8 @@ function parseFlags(args2) {
 }
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
-  const fixed = home ? resolve24(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync47(fixed)) return fixed;
+  const fixed = home ? resolve26(home, ".claude", "bin", "claude-bg") : null;
+  if (fixed && existsSync48(fixed)) return fixed;
   const which = spawnSync5("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
@@ -26245,7 +26636,7 @@ async function runWatch(args2) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync47(path)) {
+  if (!existsSync48(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -26327,7 +26718,7 @@ async function runForeground(root) {
     }
     throw err;
   }
-  return new Promise((resolve47) => {
+  return new Promise((resolve49) => {
     const shutdown = async () => {
       if (stopped) return;
       stopped = true;
@@ -26337,7 +26728,7 @@ async function runForeground(root) {
         process.chdir(priorCwd);
       } catch {
       }
-      resolve47({ exitCode: 0 });
+      resolve49({ exitCode: 0 });
     };
     process.on("SIGINT", () => {
       void shutdown();
@@ -26398,7 +26789,7 @@ async function runOnQuiescent(projectRoot) {
   );
 }
 function refreshLogPath(projectRoot) {
-  return resolve24(projectRoot, ".massu", "refresh-log.jsonl");
+  return resolve26(projectRoot, ".massu", "refresh-log.jsonl");
 }
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
@@ -26410,11 +26801,11 @@ function appendRefreshLog(projectRoot, event) {
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync47(path)) return [];
+  if (!existsSync48(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
-  const lines = readFileSync35(path, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync36(path, "utf-8").split("\n").filter(Boolean);
   const tail = lines.slice(-limit);
   const out = [];
   let corrupt = 0;
@@ -26487,13 +26878,13 @@ var init_refresh_log = __esm({
 import {
   chmodSync as chmodSync9,
   closeSync as closeSync6,
-  existsSync as existsSync48,
+  existsSync as existsSync49,
   fsyncSync as fsyncSync6,
   mkdirSync as mkdirSync24,
   openSync as openSync6,
   renameSync as renameSync6,
   rmSync as rmSync12,
-  statSync as statSync16,
+  statSync as statSync17,
   writeSync as writeSync4
 } from "node:fs";
 import { dirname as dirname23 } from "node:path";
@@ -26501,7 +26892,7 @@ function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
   const parentDir = dirname23(path);
   try {
-    if (!existsSync48(parentDir)) {
+    if (!existsSync49(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
@@ -26523,7 +26914,7 @@ function atomicWrite(path, content, opts = {}) {
     renameSync6(tmpPath, path);
     return { written: true };
   } catch (err) {
-    if (existsSync48(tmpPath)) {
+    if (existsSync49(tmpPath)) {
       try {
         rmSync12(tmpPath, { force: true });
       } catch {
@@ -26539,23 +26930,23 @@ var init_atomic_write = __esm({
 });
 
 // src/security/manifest-schema.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var MIN_KNOWN_SCHEMA_VERSION, KNOWN_MAX_SCHEMA_VERSION, Sha256HexSchema, PrintableAsciiStringSchema, Base64Schema, AdapterEntrySchema, ManifestBodySchema, EnvelopeSchema;
 var init_manifest_schema = __esm({
   "src/security/manifest-schema.ts"() {
     "use strict";
     MIN_KNOWN_SCHEMA_VERSION = 1;
     KNOWN_MAX_SCHEMA_VERSION = 1;
-    Sha256HexSchema = z4.string().regex(/^[0-9a-f]{64}$/, "sha256 hex must be 64 lowercase hex chars");
-    PrintableAsciiStringSchema = z4.string().min(1).regex(
+    Sha256HexSchema = z5.string().regex(/^[0-9a-f]{64}$/, "sha256 hex must be 64 lowercase hex chars");
+    PrintableAsciiStringSchema = z5.string().min(1).regex(
       /^[\x20-\x7e]+$/,
       "must be printable ASCII (0x20-0x7e); control characters like ESC, tab, newline, and non-ASCII are rejected to prevent log injection"
     );
-    Base64Schema = z4.string().regex(
+    Base64Schema = z5.string().regex(
       /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/,
       "must be standard base64 (RFC 4648; length divisible by 4 with optional == or = padding)"
     ).min(1);
-    AdapterEntrySchema = z4.object({
+    AdapterEntrySchema = z5.object({
       // CR-9 iter-4 audit LOW-NEW4-3 fix: every string field rendered in CLI
       // output (discover.ts deprecation warning + adapters.ts search status)
       // uses PrintableAsciiStringSchema to prevent log-injection from a
@@ -26566,24 +26957,24 @@ var init_manifest_schema = __esm({
       version: PrintableAsciiStringSchema,
       sha256: Sha256HexSchema,
       signing_key_id: Sha256HexSchema,
-      deprecated: z4.object({
+      deprecated: z5.object({
         since: PrintableAsciiStringSchema,
         replacement: PrintableAsciiStringSchema.nullable().optional(),
         reason: PrintableAsciiStringSchema
       }).optional(),
-      unpublished: z4.boolean().optional()
+      unpublished: z5.boolean().optional()
     }).passthrough();
-    ManifestBodySchema = z4.object({
-      manifest_schema_version: z4.number().int().positive().default(1),
-      issued_at: z4.string().min(1),
-      adapters: z4.array(AdapterEntrySchema)
+    ManifestBodySchema = z5.object({
+      manifest_schema_version: z5.number().int().positive().default(1),
+      issued_at: z5.string().min(1),
+      adapters: z5.array(AdapterEntrySchema)
     }).passthrough();
-    EnvelopeSchema = z4.object({
+    EnvelopeSchema = z5.object({
       manifest: ManifestBodySchema,
       manifest_b64: Base64Schema,
       signature: Base64Schema,
       manifest_sha256: Sha256HexSchema,
-      signed_at: z4.string().min(1),
+      signed_at: z5.string().min(1),
       signing_key_id: Sha256HexSchema
     }).passthrough();
   }
@@ -26872,24 +27263,24 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync49, readFileSync as readFileSync36, statSync as statSync17 } from "node:fs";
+import { existsSync as existsSync50, readFileSync as readFileSync37, statSync as statSync18 } from "node:fs";
 import { homedir as homedir21 } from "node:os";
-import { resolve as resolve25 } from "node:path";
-import { z as z5 } from "zod";
+import { resolve as resolve27 } from "node:path";
+import { z as z6 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve25(homedir21(), ".massu");
+  const dir = resolve27(homedir21(), ".massu");
   return {
-    cachePath: resolve25(dir, "adapter-manifest.json"),
-    lockPath: resolve25(dir, ".adapter-manifest.lock")
+    cachePath: resolve27(dir, "adapter-manifest.json"),
+    lockPath: resolve27(dir, ".adapter-manifest.lock")
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync49(paths.cachePath)) {
+  if (!existsSync50(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
   try {
-    const content = readFileSync36(paths.cachePath, "utf-8");
+    const content = readFileSync37(paths.cachePath, "utf-8");
     raw = JSON.parse(content);
   } catch (err) {
     return {
@@ -27036,7 +27427,7 @@ var init_manifest_cache = __esm({
     MAX_FRESH_MS = 24 * 60 * 60 * 1e3;
     MAX_STALE_MS = 7 * 24 * 60 * 60 * 1e3;
     REGISTRY_MANIFEST_URL = "https://registry.massu.ai/adapters/manifest.json";
-    CacheWrapperSchema = z5.object({
+    CacheWrapperSchema = z6.object({
       envelope: EnvelopeSchema,
       // CR-9 iter-6 audit LOW-NEW6-1 fix: fetched_at flows into the
       // 'fetched_at not parseable as Date' reason render at line 163 → wrapped
@@ -27047,7 +27438,7 @@ var init_manifest_cache = __esm({
       // drift-guard test (test_security_schemas_printable_ascii_drift.test.ts)
       // makes this class of bug structurally impossible to recur.
       fetched_at: PrintableAsciiStringSchema,
-      bundled_pubkey_fingerprint: z5.string().regex(/^[0-9a-f]{64}$/)
+      bundled_pubkey_fingerprint: z6.string().regex(/^[0-9a-f]{64}$/)
     }).strict();
   }
 });
@@ -27078,15 +27469,15 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync50, readFileSync as readFileSync37, lstatSync as lstatSync5 } from "node:fs";
+import { existsSync as existsSync51, readFileSync as readFileSync38, lstatSync as lstatSync5 } from "node:fs";
 import { homedir as homedir22 } from "node:os";
-import { resolve as resolve26, isAbsolute as isAbsolute4 } from "node:path";
+import { resolve as resolve28, isAbsolute as isAbsolute4 } from "node:path";
 import { createHash as createHash14 } from "node:crypto";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
   for (const p19 of localPaths) {
-    const abs = isAbsolute4(p19) ? p19 : resolve26(projectRoot, p19);
+    const abs = isAbsolute4(p19) ? p19 : resolve28(projectRoot, p19);
     let contentTag;
     try {
       const lst = lstatSync5(abs);
@@ -27095,7 +27486,7 @@ function computeLocalFingerprint(localPaths, projectRoot) {
       } else if (!lst.isFile()) {
         contentTag = "<not-a-file>";
       } else {
-        contentTag = createHash14("sha256").update(readFileSync37(abs)).digest("hex");
+        contentTag = createHash14("sha256").update(readFileSync38(abs)).digest("hex");
       }
     } catch {
       contentTag = "<missing>";
@@ -27107,10 +27498,10 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   return createHash14("sha256").update(canonical2).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync50(path)) return null;
+  if (!existsSync51(path)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync37(path, "utf-8"));
+    raw = JSON.parse(readFileSync38(path, "utf-8"));
   } catch {
     return null;
   }
@@ -27158,10 +27549,10 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve26(homedir22(), ".massu", "adapters-local-fingerprint.json");
-    FingerprintSentinelSchema = z6.object({
-      fingerprint: z6.string().regex(/^[0-9a-f]{64}$/),
-      source: z6.enum(["cli", "cli-resync"]),
+    FINGERPRINT_PATH = resolve28(homedir22(), ".massu", "adapters-local-fingerprint.json");
+    FingerprintSentinelSchema = z7.object({
+      fingerprint: z7.string().regex(/^[0-9a-f]{64}$/),
+      source: z7.enum(["cli", "cli-resync"]),
       // CR-9 iter-5 audit LOW-NEW5-1 fix: ts is rendered to stderr in the
       // drift warning at line 214 (`${sentinel.source} at ${sentinel.ts}`);
       // a same-user attacker writing the sentinel file with control chars
@@ -27174,15 +27565,15 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync38, readdirSync as readdirSync17, lstatSync as lstatSync6, existsSync as existsSync51 } from "node:fs";
+import { readFileSync as readFileSync39, readdirSync as readdirSync18, lstatSync as lstatSync6, existsSync as existsSync52 } from "node:fs";
 import { join as join28, relative as relative8, sep as sep3 } from "node:path";
 import { homedir as homedir23 } from "node:os";
-import { resolve as resolve27 } from "node:path";
+import { resolve as resolve29 } from "node:path";
 import { createHash as createHash15 } from "node:crypto";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync51(`${packageDir}/${hidden}`)) {
+    if (existsSync52(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -27194,7 +27585,7 @@ function sha256OfDir(dir, opts = {}) {
   function walk(currentDir) {
     let entries;
     try {
-      entries = readdirSync17(currentDir);
+      entries = readdirSync18(currentDir);
     } catch {
       return;
     }
@@ -27228,7 +27619,7 @@ function sha256OfDir(dir, opts = {}) {
   files.sort((a2, b2) => a2.relativePath < b2.relativePath ? -1 : a2.relativePath > b2.relativePath ? 1 : 0);
   const top = createHash15("sha256");
   for (const f2 of files) {
-    const fileHash = createHash15("sha256").update(readFileSync38(f2.absPath)).digest("hex");
+    const fileHash = createHash15("sha256").update(readFileSync39(f2.absPath)).digest("hex");
     top.update(f2.relativePath, "utf-8");
     top.update("\0", "utf-8");
     top.update(fileHash, "utf-8");
@@ -27237,10 +27628,10 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync51(path)) return {};
+  if (!existsSync52(path)) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync38(path, "utf-8"));
+    raw = JSON.parse(readFileSync39(path, "utf-8"));
   } catch {
     return {};
   }
@@ -27304,10 +27695,10 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve27(homedir23(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve29(homedir23(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
-    InstallEntrySchema = z7.object({
+    InstallEntrySchema = z8.object({
       // CR-9 iter-3 audit LOW-NEW3-1 fix: reject control characters in version.
       // Without this, a same-user attacker writing the install-tracking
       // sidecar could embed ANSI escapes (or other control chars) in version,
@@ -27317,35 +27708,35 @@ var init_install_tracking = __esm({
       // rejected at parse time. Schema-level validation closes the vector
       // at every callsite that reads the sidecar — no per-callsite escaping
       // gymnastics needed.
-      version: z7.string().min(1).regex(/^[\x20-\x7e]+$/, "version must be printable ASCII (no control characters)"),
-      installed_sha256: z7.string().regex(/^[0-9a-f]{64}$/),
-      manifest_sha256: z7.string().regex(/^[0-9a-f]{64}$/),
-      ts: z7.string().min(1).regex(/^[\x20-\x7e]+$/, "ts must be printable ASCII (no control characters)")
+      version: z8.string().min(1).regex(/^[\x20-\x7e]+$/, "version must be printable ASCII (no control characters)"),
+      installed_sha256: z8.string().regex(/^[0-9a-f]{64}$/),
+      manifest_sha256: z8.string().regex(/^[0-9a-f]{64}$/),
+      ts: z8.string().min(1).regex(/^[\x20-\x7e]+$/, "ts must be printable ASCII (no control characters)")
     }).strict();
-    InstalledManifestSchema = z7.record(z7.string(), InstallEntrySchema);
+    InstalledManifestSchema = z8.record(z8.string(), InstallEntrySchema);
   }
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync52, readdirSync as readdirSync18, readFileSync as readFileSync39, lstatSync as lstatSync7 } from "node:fs";
-import { resolve as resolve28, isAbsolute as isAbsolute5 } from "node:path";
-import { z as z8 } from "zod";
+import { existsSync as existsSync53, readdirSync as readdirSync19, readFileSync as readFileSync40, lstatSync as lstatSync7 } from "node:fs";
+import { resolve as resolve30, isAbsolute as isAbsolute5 } from "node:path";
+import { z as z9 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
-  const nodeModulesDir = resolve28(projectRoot, "node_modules");
-  if (!existsSync52(nodeModulesDir)) {
+  const nodeModulesDir = resolve30(projectRoot, "node_modules");
+  if (!existsSync53(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
   let topLevelEntries;
   try {
-    topLevelEntries = readdirSync18(nodeModulesDir);
+    topLevelEntries = readdirSync19(nodeModulesDir);
   } catch (err) {
     warnings.push(`failed to read node_modules: ${err instanceof Error ? err.message : String(err)}`);
     return [];
   }
   for (const entry of topLevelEntries) {
     if (entry.startsWith(".")) continue;
-    const entryPath = resolve28(nodeModulesDir, entry);
+    const entryPath = resolve30(nodeModulesDir, entry);
     let entryStat;
     try {
       entryStat = lstatSync7(entryPath);
@@ -27362,12 +27753,12 @@ function walkNodeModules(projectRoot, warnings) {
     if (entry.startsWith("@")) {
       let scopedEntries;
       try {
-        scopedEntries = readdirSync18(entryPath);
+        scopedEntries = readdirSync19(entryPath);
       } catch {
         continue;
       }
       for (const sub of scopedEntries) {
-        const subPath = resolve28(entryPath, sub);
+        const subPath = resolve30(entryPath, sub);
         let subStat;
         try {
           subStat = lstatSync7(subPath);
@@ -27386,11 +27777,11 @@ function walkNodeModules(projectRoot, warnings) {
   return candidates;
 }
 function tryReadAdapterPackage(packageDir, warnings) {
-  const pkgJsonPath = resolve28(packageDir, "package.json");
-  if (!existsSync52(pkgJsonPath)) return null;
+  const pkgJsonPath = resolve30(packageDir, "package.json");
+  if (!existsSync53(pkgJsonPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync39(pkgJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync40(pkgJsonPath, "utf-8"));
   } catch (err) {
     warnings.push(
       `skipping ${packageDir}: package.json parse failed (${err instanceof Error ? err.message : String(err)})`
@@ -27524,8 +27915,8 @@ function discoverAdapters(opts) {
   const localSet = new Set(opts.configLocalPaths);
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
-    const absPath = isAbsolute5(localPath) ? localPath : resolve28(opts.projectRoot, localPath);
-    if (!existsSync52(absPath)) {
+    const absPath = isAbsolute5(localPath) ? localPath : resolve30(opts.projectRoot, localPath);
+    if (!existsSync53(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -27556,7 +27947,7 @@ var init_discover = __esm({
     init_manifest_schema();
     init_local_fingerprint();
     init_install_tracking();
-    AdapterPackageJsonSchema = z8.object({
+    AdapterPackageJsonSchema = z9.object({
       // CR-9 iter-4 audit LOW-NEW4-2 fix: name/version are rendered in stderr
       // warnings via `${pkg.name}@${pkg.version}` strings; without the
       // printable-ASCII regex, a malicious local node_modules/<pkg>/package.json
@@ -27566,9 +27957,9 @@ var init_discover = __esm({
       version: PrintableAsciiStringSchema,
       // Plan 3c gap-31 + gap-50: `"massu-adapter": true` is the explicit opt-in
       // marker. @massu/adapter-* packages also declare this.
-      "massu-adapter": z8.union([z8.boolean(), z8.literal(void 0)]).optional(),
+      "massu-adapter": z9.union([z9.boolean(), z9.literal(void 0)]).optional(),
       // Plan 3c gap-31: api version. Loader refuses incompatible major (caller-side).
-      "massu-adapter-api-version": z8.union([z8.string(), z8.number(), z8.literal(void 0)]).optional()
+      "massu-adapter-api-version": z9.union([z9.string(), z9.number(), z9.literal(void 0)]).optional()
     }).passthrough();
   }
 });
@@ -27607,8 +27998,8 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync53, readFileSync as readFileSync40 } from "node:fs";
-import { resolve as resolve29 } from "node:path";
+import { existsSync as existsSync54, readFileSync as readFileSync41 } from "node:fs";
+import { resolve as resolve31 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
   const sub = args2[0];
@@ -27875,8 +28266,8 @@ function mutateLocalArray(mutator, command) {
     );
     return { exitCode: 2 };
   }
-  const yamlPath = resolve29(projectRoot, "massu.config.yaml");
-  if (!existsSync53(yamlPath)) {
+  const yamlPath = resolve31(projectRoot, "massu.config.yaml");
+  if (!existsSync54(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -27885,7 +28276,7 @@ function mutateLocalArray(mutator, command) {
   }
   let yamlText;
   try {
-    yamlText = readFileSync40(yamlPath, "utf-8");
+    yamlText = readFileSync41(yamlPath, "utf-8");
   } catch (err) {
     process.stderr.write(`${command}: failed to read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -27906,7 +28297,7 @@ function mutateLocalArray(mutator, command) {
   if (next === null) {
     return { exitCode: 0 };
   }
-  const lockPath = resolve29(projectRoot, ".massu", "adapters-local-mutate.lock");
+  const lockPath = resolve31(projectRoot, ".massu", "adapters-local-mutate.lock");
   return withFileLockSync(lockPath, () => {
     doc.setIn(["adapters", "local"], next);
     const newYaml = doc.toString();
@@ -27975,23 +28366,23 @@ async function runAdaptersInstall(args2) {
 `);
     return { exitCode: 1 };
   }
-  const packageDir = resolve29(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync53(packageDir)) {
+  const packageDir = resolve31(projectRoot, "node_modules", ...packageName.split("/"));
+  if (!existsSync54(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
     );
     return { exitCode: 1 };
   }
-  const pkgJsonPath = resolve29(packageDir, "package.json");
-  if (!existsSync53(pkgJsonPath)) {
+  const pkgJsonPath = resolve31(packageDir, "package.json");
+  if (!existsSync54(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync40(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(readFileSync41(pkgJsonPath, "utf-8"));
   } catch (err) {
     process.stderr.write(`install: ${packageName} has malformed package.json: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -28110,8 +28501,8 @@ async function runAdaptersResign(_args) {
       removeInstalledManifestEntry(name);
       continue;
     }
-    const packageDir = resolve29(projectRoot, "node_modules", ...name.split("/"));
-    if (!existsSync53(packageDir)) {
+    const packageDir = resolve31(projectRoot, "node_modules", ...name.split("/"));
+    if (!existsSync54(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name);
@@ -28209,7 +28600,7 @@ var init_sql_table_names = __esm({
 
 // src/db.ts
 import { dirname as dirname24, join as join29 } from "path";
-import { existsSync as existsSync54, mkdirSync as mkdirSync25, readdirSync as readdirSync19, statSync as statSync18 } from "fs";
+import { existsSync as existsSync55, mkdirSync as mkdirSync25, readdirSync as readdirSync20, statSync as statSync19 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
   assertCodegraphUsable(dbPath);
@@ -28220,7 +28611,7 @@ function getCodeGraphDb() {
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
   const dir = dirname24(dbPath);
-  if (!existsSync54(dir)) {
+  if (!existsSync55(dir)) {
     mkdirSync25(dir, { recursive: true });
   }
   const db = openDatabase2(dbPath);
@@ -28502,14 +28893,14 @@ function isPythonDataStale(dataDb, pythonRoot) {
   const lastBuildTime = new Date(lastBuild.value).getTime();
   function checkDir(dir) {
     try {
-      const entries = readdirSync19(dir, { withFileTypes: true });
+      const entries = readdirSync20(dir, { withFileTypes: true });
       for (const entry of entries) {
         const fullPath = join29(dir, entry.name);
         if (entry.isDirectory()) {
           if (["__pycache__", ".venv", "venv", "node_modules", ".mypy_cache", ".pytest_cache"].includes(entry.name)) continue;
           if (checkDir(fullPath)) return true;
         } else if (entry.name.endsWith(".py")) {
-          if (statSync18(fullPath).mtimeMs > lastBuildTime) return true;
+          if (statSync19(fullPath).mtimeMs > lastBuildTime) return true;
         }
       }
     } catch {
@@ -28536,10 +28927,10 @@ var init_db2 = __esm({
 });
 
 // src/security-utils.ts
-import { resolve as resolve30, normalize } from "path";
+import { resolve as resolve32, normalize } from "path";
 function ensureWithinRoot(filePath, projectRoot) {
-  const resolvedRoot = resolve30(projectRoot);
-  const resolvedPath = resolve30(resolvedRoot, filePath);
+  const resolvedRoot = resolve32(projectRoot);
+  const resolvedPath = resolve32(resolvedRoot, filePath);
   const normalizedPath = normalize(resolvedPath);
   const normalizedRoot = normalize(resolvedRoot);
   if (!normalizedPath.startsWith(normalizedRoot + "/") && normalizedPath !== normalizedRoot) {
@@ -28728,8 +29119,8 @@ var init_source_layout = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync41, existsSync as existsSync55, statSync as statSync19 } from "fs";
-import { resolve as resolve31, dirname as dirname25, join as join30 } from "path";
+import { readFileSync as readFileSync42, existsSync as existsSync56, statSync as statSync20 } from "fs";
+import { resolve as resolve33, dirname as dirname25, join as join30 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -28785,23 +29176,23 @@ function resolveImportPath(specifier, fromFile) {
   let basePath;
   if (specifier.startsWith("@/")) {
     const paths = getResolvedPaths();
-    basePath = resolve31(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
+    basePath = resolve33(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve31(dirname25(fromFile), specifier);
+    basePath = resolve33(dirname25(fromFile), specifier);
   }
-  if (existsSync55(basePath) && !isDirectory(basePath)) {
+  if (existsSync56(basePath) && !isDirectory(basePath)) {
     return toRelative2(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync55(withExt)) {
+    if (existsSync56(withExt)) {
       return toRelative2(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
     const indexPath = join30(basePath, indexFile);
-    if (existsSync55(indexPath)) {
+    if (existsSync56(indexPath)) {
       return toRelative2(indexPath);
     }
   }
@@ -28809,7 +29200,7 @@ function resolveImportPath(specifier, fromFile) {
 }
 function isDirectory(path) {
   try {
-    return statSync19(path).isDirectory();
+    return statSync20(path).isDirectory();
   } catch {
     return false;
   }
@@ -28845,11 +29236,11 @@ function buildImportIndex(dataDb, codegraphDb) {
   const batchSize = 500;
   let batch = [];
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve31(projectRoot, file.path), projectRoot);
-    if (!existsSync55(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve33(projectRoot, file.path), projectRoot);
+    if (!existsSync56(absPath)) continue;
     let source;
     try {
-      source = readFileSync41(absPath, "utf-8");
+      source = readFileSync42(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -28887,15 +29278,15 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync42, existsSync as existsSync56, readdirSync as readdirSync20 } from "fs";
-import { resolve as resolve32, join as join31 } from "path";
+import { readFileSync as readFileSync43, existsSync as existsSync57, readdirSync as readdirSync21 } from "fs";
+import { resolve as resolve34, join as join31 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync56(rootPath)) {
+  if (!existsSync57(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
-  const source = readFileSync42(rootPath, "utf-8");
+  const source = readFileSync43(rootPath, "utf-8");
   const mappings = [];
   const importMap = /* @__PURE__ */ new Map();
   const importRegex = /import\s+\{[^}]*?(\w+Router)[^}]*\}\s+from\s+['"]\.\/routers\/([^'"]+)['"]/g;
@@ -28903,16 +29294,16 @@ function parseRootRouter() {
   while ((match = importRegex.exec(source)) !== null) {
     const variable = match[1];
     let filePath = match[2];
-    const fullPath = resolve32(paths.routersDir, filePath);
+    const fullPath = resolve34(paths.routersDir, filePath);
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync56(candidate)) {
+      if (existsSync57(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
       const indexCandidate = join31(fullPath, "index.ts");
-      if (existsSync56(indexCandidate)) {
+      if (existsSync57(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -28931,9 +29322,9 @@ function parseRootRouter() {
   return mappings;
 }
 function extractProcedures(routerFilePath) {
-  const absPath = resolve32(getProjectRoot(), routerFilePath);
-  if (!existsSync56(absPath)) return [];
-  const source = readFileSync42(absPath, "utf-8");
+  const absPath = resolve34(getProjectRoot(), routerFilePath);
+  if (!existsSync57(absPath)) return [];
+  const source = readFileSync43(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
   const procRegex = /(\w+)\s*:\s*(protected|public)Procedure/g;
@@ -28956,19 +29347,19 @@ function findUICallSites(routerKey, procedureName) {
   const root = getProjectRoot();
   const src = config.paths.source;
   const searchDirs = [
-    resolve32(root, config.paths.pages ?? src + "/app"),
-    resolve32(root, config.paths.components ?? src + "/components"),
-    resolve32(root, config.paths.hooks ?? src + "/hooks")
+    resolve34(root, config.paths.pages ?? src + "/app"),
+    resolve34(root, config.paths.components ?? src + "/components"),
+    resolve34(root, config.paths.hooks ?? src + "/hooks")
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync56(dir)) continue;
+    if (!existsSync57(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
 }
 function searchDirectory(dir, pattern, results) {
-  const entries = readdirSync20(dir, { withFileTypes: true });
+  const entries = readdirSync21(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join31(dir, entry.name);
     if (entry.isDirectory()) {
@@ -28976,7 +29367,7 @@ function searchDirectory(dir, pattern, results) {
       searchDirectory(fullPath, pattern, results);
     } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
       try {
-        const source = readFileSync42(fullPath, "utf-8");
+        const source = readFileSync43(fullPath, "utf-8");
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (lines[i].includes(pattern)) {
@@ -29040,8 +29431,8 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync43, existsSync as existsSync57 } from "fs";
-import { resolve as resolve33 } from "path";
+import { readFileSync as readFileSync44, existsSync as existsSync58 } from "fs";
+import { resolve as resolve35 } from "path";
 function deriveRoute(pageFile) {
   const pagesDir = getSourceLayout().pagesDir;
   const prefix3 = pagesDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -29081,10 +29472,10 @@ function findRouterCalls(files) {
   const routers = /* @__PURE__ */ new Set();
   const projectRoot = getProjectRoot();
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve33(projectRoot, file), projectRoot);
-    if (!existsSync57(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve35(projectRoot, file), projectRoot);
+    if (!existsSync58(absPath)) continue;
     try {
-      const source = readFileSync43(absPath, "utf-8");
+      const source = readFileSync44(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
       let match;
       while ((match = apiCallRegex.exec(source)) !== null) {
@@ -29102,10 +29493,10 @@ function findTablesFromRouters(routerNames, dataDb) {
       `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ? LIMIT 10000`
     ).all(routerName);
     for (const proc of procs) {
-      const absPath = ensureWithinRoot(resolve33(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync57(absPath)) continue;
+      const absPath = ensureWithinRoot(resolve35(getProjectRoot(), proc.router_file), getProjectRoot());
+      if (!existsSync58(absPath)) continue;
       try {
-        const source = readFileSync43(absPath, "utf-8");
+        const source = readFileSync44(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
         const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
         const tableRegex = new RegExp(regexStr + "\\.", "g");
@@ -29380,14 +29771,14 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync44, existsSync as existsSync58, readdirSync as readdirSync21 } from "fs";
+import { readFileSync as readFileSync45, existsSync as existsSync59, readdirSync as readdirSync22 } from "fs";
 import { join as join32 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync58(schemaPath)) {
+  if (!existsSync59(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
-  const source = readFileSync44(schemaPath, "utf-8");
+  const source = readFileSync45(schemaPath, "utf-8");
   const models = [];
   const sourceLines = source.split("\n");
   let i = 0;
@@ -29445,12 +29836,12 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage2 = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync58(routersDir)) return usage2;
+  if (!existsSync59(routersDir)) return usage2;
   scanDirectory(routersDir, tableName, usage2);
   return usage2;
 }
 function scanDirectory(dir, tableName, usage2) {
-  const entries = readdirSync21(dir, { withFileTypes: true });
+  const entries = readdirSync22(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join32(dir, entry.name);
     if (entry.isDirectory()) {
@@ -29462,7 +29853,7 @@ function scanDirectory(dir, tableName, usage2) {
 }
 function scanFile(absPath, tableName, usage2) {
   try {
-    const source = readFileSync44(absPath, "utf-8");
+    const source = readFileSync45(absPath, "utf-8");
     if (!source.includes(tableName)) return;
     const relPath = absPath.slice(getProjectRoot().length + 1);
     const lines = source.split("\n");
@@ -29507,15 +29898,15 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync58(dir)) return result;
-  const entries = readdirSync21(dir, { withFileTypes: true });
+  if (!existsSync59(dir)) return result;
+  const entries = readdirSync22(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join32(dir, entry.name);
     if (entry.isDirectory()) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
       try {
-        const source = readFileSync44(fullPath, "utf-8");
+        const source = readFileSync45(fullPath, "utf-8");
         if (source.includes(tableName) && source.includes(column)) {
           result.push(fullPath.slice(getProjectRoot().length + 1));
         }
@@ -29660,12 +30051,12 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync45, existsSync as existsSync59, readdirSync as readdirSync22 } from "fs";
-import { resolve as resolve35, join as join33, relative as relative9, dirname as dirname26 } from "path";
+import { readFileSync as readFileSync46, existsSync as existsSync60, readdirSync as readdirSync23 } from "fs";
+import { resolve as resolve37, join as join33, relative as relative9, dirname as dirname26 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname26(resolve35(projectRoot, fromFile));
+    let baseDir = dirname26(resolve37(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
       baseDir = dirname26(baseDir);
     }
@@ -29677,17 +30068,17 @@ function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join33(resolve35(projectRoot, pythonRoot), ...parts);
+  const candidate = join33(resolve37(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync59(basePath + ".py")) {
+  if (existsSync60(basePath + ".py")) {
     return relative9(projectRoot, basePath + ".py");
   }
-  if (existsSync59(join33(basePath, "__init__.py"))) {
+  if (existsSync60(join33(basePath, "__init__.py"))) {
     return relative9(projectRoot, join33(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync59(basePath)) {
+  if (basePath.endsWith(".py") && existsSync60(basePath)) {
     return relative9(projectRoot, basePath);
   }
   return null;
@@ -29695,7 +30086,7 @@ function tryResolvePythonPath(basePath, projectRoot) {
 function walkPythonFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync22(dir, { withFileTypes: true });
+    const entries = readdirSync23(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
@@ -29710,7 +30101,7 @@ function walkPythonFiles(dir, excludeDirs) {
 }
 function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = resolve35(projectRoot, pythonRoot);
+  const absRoot = resolve37(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_imports")}`);
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("py_imports")} (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)`
@@ -29727,7 +30118,7 @@ function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__"
     const relFile = relative9(projectRoot, absFile);
     let source;
     try {
-      source = readFileSync45(absFile, "utf-8");
+      source = readFileSync46(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -29994,12 +30385,12 @@ var init_route_parser = __esm({
 });
 
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync46, readdirSync as readdirSync23 } from "fs";
+import { readFileSync as readFileSync47, readdirSync as readdirSync24 } from "fs";
 import { join as join34, relative as relative10 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync23(dir, { withFileTypes: true });
+    const entries = readdirSync24(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
@@ -30027,7 +30418,7 @@ function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative10(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync46(absFile, "utf-8");
+        source = readFileSync47(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -30239,12 +30630,12 @@ var init_model_parser = __esm({
 });
 
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync47, readdirSync as readdirSync24 } from "fs";
+import { readFileSync as readFileSync48, readdirSync as readdirSync25 } from "fs";
 import { join as join35, relative as relative11 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync24(dir, { withFileTypes: true });
+    const entries = readdirSync25(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
@@ -30275,7 +30666,7 @@ function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative11(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync47(absFile, "utf-8");
+        source = readFileSync48(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -30536,7 +30927,7 @@ var init_migration_parser = __esm({
 });
 
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync48, readdirSync as readdirSync25 } from "fs";
+import { readFileSync as readFileSync49, readdirSync as readdirSync26 } from "fs";
 import { join as join36, relative as relative12 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
@@ -30545,10 +30936,10 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
   const versionsDir = join36(absDir, "versions");
   let files = [];
   try {
-    files = readdirSync25(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join36(versionsDir, f2));
+    files = readdirSync26(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join36(versionsDir, f2));
   } catch {
     try {
-      files = readdirSync25(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join36(absDir, f2));
+      files = readdirSync26(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join36(absDir, f2));
     } catch {
     }
   }
@@ -30562,7 +30953,7 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
   for (const absFile of files) {
     let source;
     try {
-      source = readFileSync48(absFile, "utf-8");
+      source = readFileSync49(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -30597,7 +30988,7 @@ var init_migration_indexer = __esm({
 });
 
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync49, readdirSync as readdirSync26 } from "fs";
+import { readFileSync as readFileSync50, readdirSync as readdirSync27 } from "fs";
 import { join as join37, relative as relative13 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
@@ -30634,7 +31025,7 @@ function buildPythonCouplingIndex(dataDb) {
       const relFile = relative13(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync49(absFile, "utf-8");
+        source = readFileSync50(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -30662,7 +31053,7 @@ function walkFrontendFiles(dir) {
   const files = [];
   const exclude = ["node_modules", ".next", "dist", ".git", "__pycache__", ".venv", "venv"];
   try {
-    const entries = readdirSync26(dir, { withFileTypes: true });
+    const entries = readdirSync27(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (exclude.includes(entry.name)) continue;
@@ -31040,8 +31431,8 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync50, existsSync as existsSync60 } from "fs";
-import { resolve as resolve36, basename as basename9 } from "path";
+import { readFileSync as readFileSync51, existsSync as existsSync61 } from "fs";
+import { resolve as resolve38, basename as basename9 } from "path";
 function p4(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -31096,10 +31487,10 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync60(mapPath)) {
+  if (!existsSync61(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
-  return JSON.parse(readFileSync50(mapPath, "utf-8"));
+  return JSON.parse(readFileSync51(mapPath, "utf-8"));
 }
 function matchesPattern(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -31169,13 +31560,13 @@ function extractFrontmatter(content) {
 }
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
-  const absPath = ensureWithinRoot(resolve36(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync60(absPath)) {
-    const altPath = ensureWithinRoot(resolve36(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
-    if (!existsSync60(altPath)) return [];
-    return extractProcedureNamesFromContent(readFileSync50(altPath, "utf-8"));
+  const absPath = ensureWithinRoot(resolve38(getResolvedPaths().srcDir, "..", routerPath), root);
+  if (!existsSync61(absPath)) {
+    const altPath = ensureWithinRoot(resolve38(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
+    if (!existsSync61(altPath)) return [];
+    return extractProcedureNamesFromContent(readFileSync51(altPath, "utf-8"));
   }
-  return extractProcedureNamesFromContent(readFileSync50(absPath, "utf-8"));
+  return extractProcedureNamesFromContent(readFileSync51(absPath, "utf-8"));
 }
 function extractProcedureNamesFromContent(content) {
   const procRegex = /\.(?:query|mutation)\s*\(/g;
@@ -31215,8 +31606,8 @@ function handleDocsAudit(args2) {
   for (const [mappingId, triggeringFiles] of affectedMappings) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
-    const helpPagePath = ensureWithinRoot(resolve36(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync60(helpPagePath)) {
+    const helpPagePath = ensureWithinRoot(resolve38(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    if (!existsSync61(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -31228,7 +31619,7 @@ function handleDocsAudit(args2) {
       });
       continue;
     }
-    const content = readFileSync50(helpPagePath, "utf-8");
+    const content = readFileSync51(helpPagePath, "utf-8");
     const sections = extractSections(content);
     const frontmatter = extractFrontmatter(content);
     const staleReasons = [];
@@ -31268,9 +31659,9 @@ function handleDocsAudit(args2) {
     });
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
-        const guidePath = ensureWithinRoot(resolve36(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync60(guidePath)) {
-          const guideContent = readFileSync50(guidePath, "utf-8");
+        const guidePath = ensureWithinRoot(resolve38(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
+        if (existsSync61(guidePath)) {
+          const guideContent = readFileSync51(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
             results.push({
@@ -31303,14 +31694,14 @@ function handleDocsCoverage(args2) {
   const gaps = [];
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
-    const helpPagePath = ensureWithinRoot(resolve36(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync60(helpPagePath);
+    const helpPagePath = ensureWithinRoot(resolve38(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    const exists = existsSync61(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
     let status = null;
     if (exists) {
-      const content = readFileSync50(helpPagePath, "utf-8");
+      const content = readFileSync51(helpPagePath, "utf-8");
       lineCount = content.split("\n").length;
       hasContent = lineCount > 10;
       const frontmatter = extractFrontmatter(content);
@@ -31651,8 +32042,8 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync61 } from "fs";
-import { resolve as resolve37 } from "path";
+import { existsSync as existsSync62 } from "fs";
+import { resolve as resolve39 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
   try {
@@ -31888,23 +32279,23 @@ function validateFeatures(db, domainFilter) {
     const missingProcedures = [];
     const missingPages = [];
     for (const comp of components) {
-      const absPath = resolve37(PROJECT_ROOT, comp.component_file);
-      if (!existsSync61(absPath)) {
+      const absPath = resolve39(PROJECT_ROOT, comp.component_file);
+      if (!existsSync62(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
-      const routerPath = resolve37(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync61(routerPath)) {
+      const routerPath = resolve39(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
+      if (!existsSync62(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
-      const absPath = resolve37(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync61(absPath)) {
-        const altPath = resolve37(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync61(altPath)) {
+      const absPath = resolve39(PROJECT_ROOT, routeToPath);
+      if (page.page_route.startsWith("/") && !existsSync62(absPath)) {
+        const altPath = resolve39(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
+        if (!existsSync62(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -32430,8 +32821,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync51, existsSync as existsSync62, readdirSync as readdirSync27, statSync as statSync20 } from "fs";
-import { resolve as resolve38, join as join38, basename as basename10, dirname as dirname27, relative as relative14 } from "path";
+import { readFileSync as readFileSync52, existsSync as existsSync63, readdirSync as readdirSync28, statSync as statSync21 } from "fs";
+import { resolve as resolve40, join as join38, basename as basename10, dirname as dirname27, relative as relative14 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -32562,10 +32953,10 @@ function scanComponentExports(dataDb) {
   const projectRoot = getProjectRoot();
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
-  const basePath = resolve38(projectRoot, componentsBase);
-  if (existsSync62(basePath)) {
+  const basePath = resolve40(projectRoot, componentsBase);
+  if (existsSync63(basePath)) {
     try {
-      const entries = readdirSync27(basePath, { withFileTypes: true });
+      const entries = readdirSync28(basePath, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           componentDirs.push(componentsBase + "/" + entry.name);
@@ -32575,12 +32966,12 @@ function scanComponentExports(dataDb) {
     }
   }
   for (const dir of componentDirs) {
-    const absDir = resolve38(projectRoot, dir);
-    if (!existsSync62(absDir)) continue;
+    const absDir = resolve40(projectRoot, dir);
+    if (!existsSync63(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative14(projectRoot, file);
-      const source = readFileSync51(file, "utf-8");
+      const source = readFileSync52(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
         for (const ann of annotations) {
@@ -32629,11 +33020,11 @@ function scanComponentExports(dataDb) {
 function walkDir2(dir) {
   const results = [];
   try {
-    const entries = readdirSync27(dir);
+    const entries = readdirSync28(dir);
     for (const entry of entries) {
       const fullPath = join38(dir, entry);
       try {
-        const stat = statSync20(fullPath);
+        const stat = statSync21(fullPath);
         if (stat.isDirectory()) {
           results.push(...walkDir2(fullPath));
         } else {
@@ -33341,7 +33732,7 @@ var init_prompt_analyzer = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync63, readFileSync as readFileSync52 } from "fs";
+import { existsSync as existsSync64, readFileSync as readFileSync53 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -33372,7 +33763,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync63(absPath)) {
+  if (!existsSync64(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -33381,7 +33772,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  const source = readFileSync52(absPath, "utf-8");
+  const source = readFileSync53(absPath, "utf-8");
   const lines = source.split("\n");
   if (activeChecks.rule_compliance !== false) {
     for (const ruleSet of config.rules) {
@@ -33840,7 +34231,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync64, readFileSync as readFileSync53 } from "fs";
+import { existsSync as existsSync65, readFileSync as readFileSync54 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -33864,12 +34255,12 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync64(absPath)) {
+  if (!existsSync65(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
   try {
-    source = readFileSync53(absPath, "utf-8");
+    source = readFileSync54(absPath, "utf-8");
   } catch {
     return { riskScore: 0, findings: [] };
   }
@@ -34159,8 +34550,8 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync65, readFileSync as readFileSync54 } from "fs";
-import { resolve as resolve39 } from "path";
+import { existsSync as existsSync66, readFileSync as readFileSync55 } from "fs";
+import { resolve as resolve41 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -34192,10 +34583,10 @@ function calculateDepRisk(factors) {
   return Math.min(100, risk);
 }
 function getInstalledPackages(projectRoot) {
-  const pkgPath = resolve39(projectRoot, "package.json");
-  if (!existsSync65(pkgPath)) return /* @__PURE__ */ new Map();
+  const pkgPath = resolve41(projectRoot, "package.json");
+  if (!existsSync66(pkgPath)) return /* @__PURE__ */ new Map();
   try {
-    const pkg = JSON.parse(readFileSync54(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync55(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
     for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
       packages.set(name, version);
@@ -34801,8 +35192,8 @@ var init_regression_detector = __esm({
 
 // src/knowledge-indexer.ts
 import { createHash as createHash16 } from "crypto";
-import { readFileSync as readFileSync55, readdirSync as readdirSync28, statSync as statSync21, existsSync as existsSync66 } from "fs";
-import { resolve as resolve40, relative as relative15, basename as basename11, extname as extname2 } from "path";
+import { readFileSync as readFileSync56, readdirSync as readdirSync29, statSync as statSync22, existsSync as existsSync67 } from "fs";
+import { resolve as resolve42, relative as relative15, basename as basename11, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
   const config = getConfig();
@@ -34828,9 +35219,9 @@ function discoverMarkdownFiles(baseDir) {
   const files = [];
   function walk(dir) {
     try {
-      const entries = readdirSync28(dir, { withFileTypes: true });
+      const entries = readdirSync29(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = resolve40(dir, entry.name);
+        const fullPath = resolve42(dir, entry.name);
         if (entry.isDirectory()) {
           if (entry.name === "archive" && dir.includes("session-state")) continue;
           if (entry.name === "archive" && dir.includes("status")) continue;
@@ -34892,14 +35283,17 @@ function hashContent2(content) {
 }
 function parseCRTable(content) {
   const rules = [];
-  const tableRegex = /\|\s*(CR-\d+)\s*\|\s*([^|]+)\|\s*([^|]+)\|\s*\[?([^\]|]+)\]?[^|]*\|/g;
-  let match;
-  while ((match = tableRegex.exec(content)) !== null) {
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("|")) continue;
+    const cells = trimmed.split("|").slice(1, -1).map((c2) => c2.trim());
+    if (cells.length < 3) continue;
+    if (!/^CR-\d+$/.test(cells[0])) continue;
     rules.push({
-      rule_id: match[1].trim(),
-      rule_text: match[2].trim(),
-      vr_type: match[3].trim(),
-      reference_path: match[4].trim().replace(/\(.*\)/, "").trim()
+      rule_id: cells[0],
+      rule_text: cells[1],
+      vr_type: cells[2],
+      reference_path: (cells[3] ?? "").replace(/^\[|\]$/g, "").replace(/\(.*\)/, "").trim()
     });
   }
   return rules;
@@ -35082,7 +35476,7 @@ function buildCrossReferences(db) {
   return edgeCount;
 }
 function indexAllKnowledge(db) {
-  const stats = { filesIndexed: 0, chunksCreated: 0, edgesCreated: 0 };
+  const stats = { filesIndexed: 0, chunksCreated: 0, edgesCreated: 0, indexedPaths: [] };
   const paths = getKnowledgePaths();
   const insertDoc = db.prepare(
     "INSERT INTO knowledge_documents (file_path, category, title, description, content_hash, indexed_at, indexed_at_epoch) VALUES (?, ?, ?, ?, ?, ?, ?)"
@@ -35109,11 +35503,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync66(paths.plansDir)) {
+  if (existsSync67(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync66(paths.docsDir)) {
+  if (existsSync67(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -35156,8 +35550,8 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync66(filePath)) continue;
-      const content = readFileSync55(filePath, "utf-8");
+      if (!existsSync67(filePath)) continue;
+      const content = readFileSync56(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative15(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative15(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative15(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative15(paths.memoryDir, filePath)}` : basename11(filePath);
       const category = categorizeFile(filePath);
@@ -35166,6 +35560,7 @@ function indexAllKnowledge(db) {
       const result = insertDoc.run(relPath, category, title, description, hash, nowIso2, nowEpoch);
       const docId = result.lastInsertRowid;
       stats.filesIndexed++;
+      stats.indexedPaths.push(filePath);
       const sections = parseSections(content, filePath);
       for (const section of sections) {
         if (section.content.length > 10) {
@@ -35234,7 +35629,7 @@ function indexAllKnowledge(db) {
           stats.chunksCreated++;
         }
       }
-      if (fileNameLower === "corrections.md") {
+      if (fileNameLower === CORRECTIONS_FILENAME) {
         const corrections = parseCorrections(content);
         for (const c2 of corrections) {
           insertChunk.run(
@@ -35292,17 +35687,17 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync66(paths.plansDir)) {
+  if (existsSync67(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync66(paths.docsDir)) {
+  if (existsSync67(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
   }
   for (const filePath of files) {
     try {
-      const stat = statSync21(filePath);
+      const stat = statSync22(filePath);
       if (stat.mtimeMs > lastIndexTime) return true;
     } catch {
       continue;
@@ -35314,18 +35709,19 @@ function indexIfStale(db) {
   if (isKnowledgeStale(db)) {
     return indexAllKnowledge(db);
   }
-  return { filesIndexed: 0, chunksCreated: 0, edgesCreated: 0 };
+  return { filesIndexed: 0, chunksCreated: 0, edgesCreated: 0, indexedPaths: [] };
 }
 var init_knowledge_indexer = __esm({
   "src/knowledge-indexer.ts"() {
     "use strict";
+    init_corrections_md();
     init_config();
   }
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync56, writeFileSync as writeFileSync17, appendFileSync as appendFileSync5, readdirSync as readdirSync29 } from "fs";
-import { resolve as resolve41, basename as basename12 } from "path";
+import { readFileSync as readFileSync57, writeFileSync as writeFileSync17, readdirSync as readdirSync30 } from "fs";
+import { basename as basename12 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -36080,30 +36476,23 @@ function handleCorrect(db, args2) {
   if (!wrong || !correction || !rule) {
     return text15("Error: wrong, correction, and rule are all required.");
   }
-  const correctionsPath = resolve41(getResolvedPaths().memoryDir, "corrections.md");
+  const correctionsFile = correctionsPath(getResolvedPaths().memoryDir);
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const title = rule.slice(0, 60);
-  const entry = formatCorrectionEntry({
+  const correctionEntry = {
     date: today,
     title,
     wrong,
     correction,
     rule,
     ...crRule ? { extra: { CR: crRule } } : {}
-  });
+  };
   let existing = "";
   try {
-    existing = readFileSync56(correctionsPath, "utf-8");
+    existing = readFileSync57(correctionsFile, "utf-8");
   } catch {
   }
-  const archiveIdx = existing.indexOf("## Archived");
-  if (archiveIdx > 0) {
-    const before = existing.slice(0, archiveIdx);
-    const after = existing.slice(archiveIdx);
-    writeFileSync17(correctionsPath, before + entry + after);
-  } else {
-    appendFileSync5(correctionsPath, entry);
-  }
+  writeFileSync17(correctionsFile, insertCorrectionEntry(existing, correctionEntry));
   const doc = db.prepare("SELECT id FROM knowledge_documents WHERE file_path LIKE ?").get("%corrections.md");
   if (doc) {
     db.prepare("INSERT INTO knowledge_chunks (document_id, chunk_type, heading, content, metadata) VALUES (?, ?, ?, ?, ?)").run(
@@ -36275,7 +36664,7 @@ function handleGaps(db, args2) {
   } else if (checkType === "routers") {
     try {
       const routersDir = getResolvedPaths().routersDir;
-      const routerFiles = readdirSync29(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
+      const routerFiles = readdirSync30(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
       lines.push(`| Router | Knowledge Hits | Status |`);
       lines.push(`|--------|----------------|--------|`);
       for (const file of routerFiles) {
@@ -37050,8 +37439,8 @@ var init_framework_supports = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync57, existsSync as existsSync68 } from "fs";
-import { resolve as resolve42, basename as basename13 } from "path";
+import { readFileSync as readFileSync58, existsSync as existsSync69 } from "fs";
+import { resolve as resolve44, basename as basename13 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
 }
@@ -37086,7 +37475,7 @@ function ensureIndexes(dataDb, codegraphDb, force = false) {
   if (config.python?.root) {
     const pythonRoot = config.python.root;
     const excludeDirs = config.python.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
-    if (force || isPythonDataStale(dataDb, resolve42(getProjectRoot(), pythonRoot))) {
+    if (force || isPythonDataStale(dataDb, resolve44(getProjectRoot(), pythonRoot))) {
       const pyImports = buildPythonImportIndex(dataDb, pythonRoot, excludeDirs);
       results.push(`Python imports: ${pyImports}`);
       const pyRoutes = buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs);
@@ -37469,9 +37858,9 @@ function handleContext(file, dataDb, codegraphDb) {
         try {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
-          const absFilePath = ensureWithinRoot(resolve42(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync68(absFilePath)) {
-            const fileContent = readFileSync57(absFilePath, "utf-8").slice(0, 3e3);
+          const absFilePath = ensureWithinRoot(resolve44(resolvedPaths.srcDir, "..", file), root);
+          if (existsSync69(absFilePath)) {
+            const fileContent = readFileSync58(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
             if (fileContent.includes("BigInt") || fileContent.includes("Decimal")) keywords.push("BigInt", "serialization");
@@ -37910,11 +38299,11 @@ function handleSchema(args2) {
     lines.push("Checking all column references against Prisma schema...");
     lines.push("");
     const projectRoot = getProjectRoot();
-    const absPath = ensureWithinRoot(resolve42(projectRoot, file), projectRoot);
-    if (!existsSync68(absPath)) {
+    const absPath = ensureWithinRoot(resolve44(projectRoot, file), projectRoot);
+    if (!existsSync69(absPath)) {
       return text17(`File not found: ${file}`);
     }
-    const source = readFileSync57(absPath, "utf-8");
+    const source = readFileSync58(absPath, "utf-8");
     const config = getConfig();
     const dbPattern = config.dbAccessPattern ?? "ctx.db.{table}";
     const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
@@ -38347,8 +38736,8 @@ var init_startup_health = __esm({
 
 // src/server.ts
 var server_exports = {};
-import { readFileSync as readFileSync58 } from "fs";
-import { resolve as resolve43, dirname as dirname28 } from "path";
+import { readFileSync as readFileSync59 } from "fs";
+import { resolve as resolve45, dirname as dirname28 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function pruneMemoryOnStartup() {
   try {
@@ -38396,7 +38785,7 @@ var init_server = __esm({
     __dirname5 = dirname28(fileURLToPath6(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync58(resolve43(__dirname5, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync59(resolve45(__dirname5, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -38699,19 +39088,19 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync69, readFileSync as readFileSync59, writeFileSync as writeFileSync18, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
-import { resolve as resolve44 } from "path";
+import { existsSync as existsSync70, readFileSync as readFileSync60, writeFileSync as writeFileSync18, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
+import { resolve as resolve46 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve44(cwd, "massu.config.yaml");
+  const configPath = resolve46(cwd, "massu.config.yaml");
   const bakPath = `${configPath}.bak`;
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync69(bakPath)) {
+    if (!existsSync70(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err(message + "\n");
       return { exitCode: 1, action: "none", message };
@@ -38727,14 +39116,14 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync69(configPath)) {
+  if (!existsSync70(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return { exitCode: 1, action: "none", message };
   }
   let existing;
   try {
-    const content = readFileSync59(configPath, "utf-8");
+    const content = readFileSync60(configPath, "utf-8");
     const parsed = parseYaml6(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -38757,7 +39146,7 @@ async function runConfigUpgrade(opts = {}) {
     fingerprint: computeFingerprint(detection)
   };
   try {
-    const original = readFileSync59(configPath, "utf-8");
+    const original = readFileSync60(configPath, "utf-8");
     writeFileSync18(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
@@ -38791,8 +39180,8 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync70, readFileSync as readFileSync60 } from "fs";
-import { resolve as resolve45 } from "path";
+import { existsSync as existsSync71, readFileSync as readFileSync61 } from "fs";
+import { resolve as resolve47 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
   if (changes.length === 0) return "(none)\n";
@@ -38800,12 +39189,12 @@ function renderChanges(changes) {
 }
 async function runConfigCheckDrift(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve45(cwd, "massu.config.yaml");
+  const configPath = resolve47(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync70(configPath)) {
+  if (!existsSync71(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return {
@@ -38819,7 +39208,7 @@ async function runConfigCheckDrift(opts = {}) {
   }
   let config;
   try {
-    const content = readFileSync60(configPath, "utf-8");
+    const content = readFileSync61(configPath, "utf-8");
     const parsed = parseYaml7(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -38886,8 +39275,8 @@ var init_config_check_drift = __esm({
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync61 } from "fs";
-import { resolve as resolve46, dirname as dirname29 } from "path";
+import { readFileSync as readFileSync62 } from "fs";
+import { resolve as resolve48, dirname as dirname29 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/lib/node-bootstrap.ts
@@ -39389,7 +39778,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync61(resolve46(__dirname6, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync62(resolve48(__dirname6, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");