@mrciphersmith/keryx 0.2.123 → 0.2.125

package/dist/core.js

@@ -27,7 +27,7 @@ var __esm = (fn, res, err) => () => {
 
 // src/lib/fs.ts
 import { randomUUID } from "crypto";
-import { access, mkdir, readFile, rename, rm, stat, utimes, writeFile } from "fs/promises";
+import { access, chmod, mkdir, readFile, rename, rm, stat, utimes, writeFile } from "fs/promises";
 import path from "path";
 async function pathExists(filePath) {
   try {
@@ -47,12 +47,18 @@ function isPathInside(root, candidate) {
   const relative = path.relative(path.resolve(root), path.resolve(candidate));
   return relative === "" || relative.length > 0 && !relative.startsWith("..") && !path.isAbsolute(relative);
 }
-async function writeFileAtomic(filePath, content) {
+async function writeFileAtomic(filePath, content, options = {}) {
   const dir = path.dirname(filePath);
   await mkdir(dir, { recursive: true });
   const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`);
   try {
-    await writeFile(tmp, content, "utf8");
+    if (options.mode === undefined) {
+      await writeFile(tmp, content, "utf8");
+    } else {
+      await writeFile(tmp, content, { encoding: "utf8", mode: options.mode });
+      if (process.platform !== "win32")
+        await chmod(tmp, options.mode);
+    }
     await rename(tmp, filePath);
   } catch (error) {
     await rm(tmp, { force: true }).catch(() => {});
@@ -71,10 +77,14 @@ async function withFileLock(lockPath, fn, options = {}) {
   while (true) {
     try {
       await mkdir(lockPath);
+      const createdIno = (await stat(lockPath)).ino;
+      await options.raceHook?.("created");
       try {
         await writeFile(ownerPath, JSON.stringify(owner), { encoding: "utf8", flag: "wx", mode: 384 });
       } catch (error) {
-        await rm(lockPath, { recursive: true, force: true }).catch(() => {});
+        if (await isSameEmptyOrOwnerlessDir(lockPath, createdIno)) {
+          await rm(lockPath, { recursive: true, force: true }).catch(() => {});
+        }
         throw error;
       }
       break;
@@ -82,7 +92,7 @@ async function withFileLock(lockPath, fn, options = {}) {
       if (!isAlreadyExistsError(error)) {
         throw error;
       }
-      await removeStaleLock(lockPath, staleMs);
+      await removeStaleLock(lockPath, staleMs, options.raceHook);
       if (Date.now() - startedAt >= timeoutMs) {
         throw new Error(`Timed out waiting for lock: ${lockPath}`);
       }
@@ -106,7 +116,16 @@ async function withFileLock(lockPath, fn, options = {}) {
 function isAlreadyExistsError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
-async function removeStaleLock(lockPath, staleMs) {
+async function isSameEmptyOrOwnerlessDir(dir, ino) {
+  try {
+    if ((await stat(dir)).ino !== ino)
+      return false;
+    return await readLockOwner(path.join(dir, "owner.json")) === undefined;
+  } catch {
+    return false;
+  }
+}
+async function removeStaleLock(lockPath, staleMs, raceHook) {
   try {
     const stats = await stat(lockPath);
     if (Date.now() - stats.mtimeMs <= staleMs)
@@ -114,8 +133,17 @@ async function removeStaleLock(lockPath, staleMs) {
     const owner = await readLockOwner(path.join(lockPath, "owner.json"));
     if (owner && processIsAlive(owner.pid))
       return;
+    await raceHook?.("stale-judged");
     const stalePath = `${lockPath}.stale.${process.pid}.${randomUUID()}`;
     await rename(lockPath, stalePath);
+    await raceHook?.("moved-aside");
+    const movedIno = (await stat(stalePath)).ino;
+    const moved = await readLockOwner(path.join(stalePath, "owner.json"));
+    if (movedIno !== stats.ino || moved?.token !== owner?.token) {
+      await rename(stalePath, lockPath).catch(() => {});
+      await raceHook?.("restored");
+      return;
+    }
     await rm(stalePath, { recursive: true, force: true });
   } catch {}
 }
@@ -718,9 +746,9 @@ var init_lifecycle = __esm(() => {
 });
 
 // src/assets/lock.ts
-import path15 from "path";
+import path16 from "path";
 function lockPath(cwd) {
-  return path15.join(cwd, ".metaproject", "assets.lock.json");
+  return path16.join(cwd, ".metaproject", "assets.lock.json");
 }
 function normalizeLock(parsed) {
   const assets = {};
@@ -775,16 +803,16 @@ var init_lock = __esm(() => {
 import { createHash as createHash2 } from "crypto";
 import { readFile as readFile11 } from "fs/promises";
 import os from "os";
-import path16 from "path";
+import path17 from "path";
 function assetCacheDir() {
   const override = process.env.KERYX_ASSET_CACHE;
   if (override && override.length > 0) {
     return override;
   }
-  return path16.join(os.homedir(), ".cache", "keryx", "assets");
+  return path17.join(os.homedir(), ".cache", "keryx", "assets");
 }
 function cacheAssetPath(id) {
-  return path16.join(assetCacheDir(), id);
+  return path17.join(assetCacheDir(), id);
 }
 async function sha256File(file) {
   const buffer = await readFile11(file);
@@ -836,9 +864,9 @@ var init_warn_once = __esm(() => {
 });
 
 // src/capability/seam.ts
-import path17 from "path";
+import path18 from "path";
 async function isCapabilityEnabled(cwd, id) {
-  const manifestPath = path17.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path18.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return false;
   }
@@ -919,9 +947,9 @@ var init_seam = __esm(() => {
 });
 
 // src/gdgraph/config.ts
-import path18 from "path";
+import path19 from "path";
 function gdgraphConfigPath(cwd) {
-  return path18.join(cwd, ".metaproject", "gdgraph.config.json");
+  return path19.join(cwd, ".metaproject", "gdgraph.config.json");
 }
 function mergeGdgraphConfig(parsed) {
   const base = DEFAULT_GDGRAPH_CONFIG;
@@ -1526,7 +1554,7 @@ var init_extract = __esm(() => {
 });
 
 // src/gdgraph/treesitter/grammars.ts
-import path19 from "path";
+import path20 from "path";
 function grammarAssetId(language) {
   return `tree-sitter-${language}`;
 }
@@ -1542,7 +1570,7 @@ function symbolLanguage(language) {
 async function resolveGrammar(cwd, language, grammarsPath) {
   const id = grammarAssetId(language);
   const lock = await loadAssetsLock(cwd);
-  const overrides = grammarsPath ? { [id]: { path: path19.join(grammarsPath, `${id}.wasm`) } } : undefined;
+  const overrides = grammarsPath ? { [id]: { path: path20.join(grammarsPath, `${id}.wasm`) } } : undefined;
   const registry = registryFromLock(lock, overrides);
   const resolved = await resolveAsset(registry, id);
   if (!resolved) {
@@ -1572,7 +1600,7 @@ function toGrammarLanguages(languages) {
   return out;
 }
 function grammarForFile(file, available) {
-  const ext = path19.extname(file);
+  const ext = path20.extname(file);
   const preference = ext === ".tsx" ? ["tsx", "typescript"] : ext === ".ts" ? ["typescript"] : ext === ".jsx" || ext === ".js" || ext === ".mjs" || ext === ".cjs" ? ["javascript"] : ext === ".java" ? ["java"] : ext === ".py" ? ["python"] : [];
   for (const language of preference) {
     if (available.includes(language)) {
@@ -1834,7 +1862,7 @@ var init_adapter = __esm(() => {
 
 // src/gdgraph/enrich.ts
 import { mkdir as mkdir6, writeFile as writeFile3 } from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 async function enrichBuildWithSymbols(cwd, files, resolve) {
   const config = await loadGdgraphConfig(cwd);
   const treesitterConfig = {
@@ -1850,12 +1878,12 @@ async function enrichBuildWithSymbols(cwd, files, resolve) {
   return { enriched: true, symbols: layer.symbols.length, calls: layer.calls.length };
 }
 async function writeSymbolLayer(cwd, layer) {
-  const storageDir = path20.join(cwd, ".metaproject", "data", "gdgraph", "storage");
+  const storageDir = path21.join(cwd, ".metaproject", "data", "gdgraph", "storage");
   await mkdir6(storageDir, { recursive: true });
-  await writeFile3(path20.join(storageDir, "symbols.jsonl"), layer.symbols.map((symbol) => JSON.stringify(symbol)).join(`
+  await writeFile3(path21.join(storageDir, "symbols.jsonl"), layer.symbols.map((symbol) => JSON.stringify(symbol)).join(`
 `) + `
 `, "utf8");
-  await writeFile3(path20.join(storageDir, "calls.jsonl"), layer.calls.map((call) => JSON.stringify(call)).join(`
+  await writeFile3(path21.join(storageDir, "calls.jsonl"), layer.calls.map((call) => JSON.stringify(call)).join(`
 `) + `
 `, "utf8");
 }
@@ -2045,10 +2073,10 @@ var init_describes = __esm(() => {
 
 // src/sync/provenance.ts
 import { mkdir as mkdir7, readFile as readFile12, writeFile as writeFile4 } from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 import { spawn } from "child_process";
 function provenancePath(cwd, module) {
-  return path21.join(cwd, ".metaproject", "data", module, ".provenance.json");
+  return path22.join(cwd, ".metaproject", "data", module, ".provenance.json");
 }
 function gitCmdResult(cwd, args) {
   return new Promise((resolve) => {
@@ -2093,7 +2121,7 @@ async function recordProvenance(cwd, module, at) {
   if (!head)
     return;
   const file = provenancePath(cwd, module);
-  await mkdir7(path21.dirname(file), { recursive: true });
+  await mkdir7(path22.dirname(file), { recursive: true });
   const provenance = { commit: head.commit, branch: head.branch, builtAt: at };
   await writeFile4(file, `${JSON.stringify(provenance, null, 2)}
 `, "utf8");
@@ -2117,12 +2145,12 @@ var init_provenance = __esm(() => {
 
 // src/gdgraph/staleness.ts
 import { stat as stat3 } from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 function nodesJsonlPath(cwd) {
-  return path22.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  return path23.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
 }
 function gdgraphConfigPath2(cwd) {
-  return path22.join(cwd, ".metaproject", "gdgraph.config.json");
+  return path23.join(cwd, ".metaproject", "gdgraph.config.json");
 }
 function categorizeStatusLines(porcelain, rootPrefix) {
   const lines = porcelain.split(`
@@ -2169,7 +2197,7 @@ async function checkGraphStaleness(cwd) {
         reasons.push(`HEAD moved since the graph was built (built at ${provenance.commit.slice(0, 12)}, now ${head.commit.slice(0, 12)})`);
       }
     } else {
-      const logsHeadStat = await stat3(path22.join(cwd, ".git", "logs", "HEAD")).catch(() => null);
+      const logsHeadStat = await stat3(path23.join(cwd, ".git", "logs", "HEAD")).catch(() => null);
       if (logsHeadStat && logsHeadStat.mtimeMs > nodesStat.mtimeMs) {
         reasons.push("repo HEAD moved since the graph was built (no build provenance recorded; inferred from .git/logs/HEAD)");
       }
@@ -2303,15 +2331,15 @@ var init_types2 = __esm(() => {
 
 // src/wiki/collect.ts
 import { readFile as readFile13, readdir as readdir6 } from "fs/promises";
-import path23 from "path";
+import path24 from "path";
 function wikiRootPath(cwd) {
-  return path23.join(cwd, ".metaproject", "wiki");
+  return path24.join(cwd, ".metaproject", "wiki");
 }
 async function collectPages(cwd) {
   const root = wikiRootPath(cwd);
   const pages = [];
   for (const { type, folder } of WIKI_PAGE_TYPES) {
-    const dir = path23.join(root, folder);
+    const dir = path24.join(root, folder);
     let names;
     try {
       names = await readdir6(dir);
@@ -2326,7 +2354,7 @@ async function collectPages(cwd) {
       if (!entry.endsWith(".md")) {
         continue;
       }
-      const absolutePath = path23.join(dir, entry);
+      const absolutePath = path24.join(dir, entry);
       let content;
       try {
         content = await readFile13(absolutePath, "utf8");
@@ -4634,16 +4662,16 @@ var init_exfil = __esm(() => {
 
 // src/lib/contained-path.ts
 import { existsSync, lstatSync, realpathSync } from "fs";
-import path24 from "path";
+import path25 from "path";
 function resolveProjectRoot(startDir) {
-  let current = path24.resolve(startDir);
+  let current = path25.resolve(startDir);
   for (;; ) {
-    if (existsSync(path24.join(current, ".metaproject")) || existsSync(path24.join(current, ".git"))) {
+    if (existsSync(path25.join(current, ".metaproject")) || existsSync(path25.join(current, ".git"))) {
       return current;
     }
-    const parent = path24.dirname(current);
+    const parent = path25.dirname(current);
     if (parent === current) {
-      return path24.resolve(startDir);
+      return path25.resolve(startDir);
     }
     current = parent;
   }
@@ -4973,16 +5001,16 @@ var init_schemas = __esm(() => {
 });
 
 // src/security/config.ts
-import path25 from "path";
+import path26 from "path";
 import { createHash as createHash4 } from "crypto";
 function securityProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
 }
 function securityDataRoot(cwd) {
-  return path25.join(securityProjectRoot(cwd), ".metaproject", "data", "security");
+  return path26.join(securityProjectRoot(cwd), ".metaproject", "data", "security");
 }
 function configPath(cwd) {
-  return path25.join(securityProjectRoot(cwd), ".metaproject", "security.config.json");
+  return path26.join(securityProjectRoot(cwd), ".metaproject", "security.config.json");
 }
 function mergePolicy(base, override) {
   const merged = {
@@ -5146,9 +5174,9 @@ var init_config3 = __esm(() => {
 });
 
 // src/security/redact.ts
-import path26 from "path";
+import path27 from "path";
 import { createHmac, randomBytes } from "crypto";
-import { mkdir as mkdir8, readFile as readFile14, writeFile as writeFile5, chmod } from "fs/promises";
+import { mkdir as mkdir8, readFile as readFile14, writeFile as writeFile5, chmod as chmod2 } from "fs/promises";
 function maskFor(match) {
   return `[REDACTED:${match.mask ?? "sensitive"}]`;
 }
@@ -5221,11 +5249,11 @@ function redactSensitiveText(text) {
   return applyRedaction(text, matches);
 }
 function keyDir(cwd) {
-  return path26.join(securityDataRoot(cwd), "raw");
+  return path27.join(securityDataRoot(cwd), "raw");
 }
 async function getHmacKey(cwd) {
   const dir = keyDir(cwd);
-  const file = path26.join(dir, KEY_FILE);
+  const file = path27.join(dir, KEY_FILE);
   if (await pathExists(file)) {
     const existing = (await readFile14(file, "utf8")).trim();
     if (existing.length > 0) {
@@ -5237,7 +5265,7 @@ async function getHmacKey(cwd) {
   await writeFile5(file, `${key}
 `, "utf8");
   try {
-    await chmod(file, 384);
+    await chmod2(file, 384);
   } catch {}
   return key;
 }
@@ -6270,7 +6298,7 @@ var init_resolve = __esm(() => {
 });
 
 // src/security/report.ts
-import path27 from "path";
+import path28 from "path";
 import { mkdir as mkdir9, writeFile as writeFile6 } from "fs/promises";
 function tally(values) {
   const counts = {};
@@ -6387,26 +6415,26 @@ function renderFindings(findings) {
 `);
 }
 function artifactsDir(cwd) {
-  return path27.join(securityDataRoot(cwd), "artifacts");
+  return path28.join(securityDataRoot(cwd), "artifacts");
 }
 async function writeSecurityArtifacts(cwd, report, config) {
   const dir = artifactsDir(cwd);
   await mkdir9(dir, { recursive: true });
   const committable = toCommittableReport(report);
-  const markdown = path27.join(dir, "latest.md");
-  const json = path27.join(dir, "latest.json");
+  const markdown = path28.join(dir, "latest.md");
+  const json = path28.join(dir, "latest.json");
   await writeFile6(markdown, renderReportMarkdown(committable), "utf8");
   await writeFile6(json, `${JSON.stringify(committable, null, 2)}
 `, "utf8");
   if (config.storeHashes) {
-    const rawDir = path27.join(securityDataRoot(cwd), "raw");
+    const rawDir = path28.join(securityDataRoot(cwd), "raw");
     await mkdir9(rawDir, { recursive: true });
-    await writeFile6(path27.join(rawDir, "report.local.json"), `${JSON.stringify(report, null, 2)}
+    await writeFile6(path28.join(rawDir, "report.local.json"), `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   return {
-    markdownPath: path27.relative(cwd, markdown),
-    jsonPath: path27.relative(cwd, json)
+    markdownPath: path28.relative(cwd, markdown),
+    jsonPath: path28.relative(cwd, json)
   };
 }
 var SCHEMA_VERSION = 1;
@@ -6415,13 +6443,13 @@ var init_report = __esm(() => {
 });
 
 // src/security/incidents.ts
-import path28 from "path";
+import path29 from "path";
 import { appendFile as appendFile3, mkdir as mkdir10, readFile as readFile15 } from "fs/promises";
 function incidentsDir(cwd) {
-  return path28.join(securityDataRoot(cwd), "incidents");
+  return path29.join(securityDataRoot(cwd), "incidents");
 }
 function incidentsFile(cwd) {
-  return path28.join(incidentsDir(cwd), "incidents.jsonl");
+  return path29.join(incidentsDir(cwd), "incidents.jsonl");
 }
 async function appendIncident(cwd, entry) {
   const dir = incidentsDir(cwd);
@@ -6440,7 +6468,7 @@ var init_incidents = __esm(() => {
 });
 
 // src/security/self-protect.ts
-import path29 from "path";
+import path30 from "path";
 import { mkdir as mkdir11, readFile as readFile16, writeFile as writeFile7 } from "fs/promises";
 function currentState(config) {
   const policies = {};
@@ -6499,7 +6527,7 @@ function evaluateSelfProtection(config, previous, now = new Date().toISOString()
   return { warnings, incidents, findings, checksumMatch: checksum.match };
 }
 function stateFile(cwd) {
-  return path29.join(securityDataRoot(cwd), "raw", "state.json");
+  return path30.join(securityDataRoot(cwd), "raw", "state.json");
 }
 async function readState(cwd) {
   const file = stateFile(cwd);
@@ -6514,7 +6542,7 @@ async function readState(cwd) {
 }
 async function writeState(cwd, state) {
   const file = stateFile(cwd);
-  await mkdir11(path29.dirname(file), { recursive: true });
+  await mkdir11(path30.dirname(file), { recursive: true });
   await writeFile7(file, `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -6532,12 +6560,12 @@ var init_self_protect = __esm(() => {
 
 // src/lib/descriptor-read.ts
 import { constants, fstatSync, lstatSync as lstatSync2, statSync } from "fs";
-import path30 from "path";
+import path31 from "path";
 import { dlopen, FFIType, ptr } from "bun:ffi";
 function readDescriptorChain(workspaceRoot, absolutePath, options = {}) {
-  const relativePath = path30.relative(workspaceRoot, absolutePath);
-  const components = relativePath.split(path30.sep);
-  if (!relativePath || path30.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
+  const relativePath = path31.relative(workspaceRoot, absolutePath);
+  const components = relativePath.split(path31.sep);
+  if (!relativePath || path31.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
     throw new DescriptorReadError("invalid-path", "safe source path is not workspace-relative");
   }
   if (options.maxBytes !== undefined && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0)) {
@@ -6660,7 +6688,7 @@ var init_descriptor_read = __esm(() => {
 
 // src/lib/contained-read.ts
 import { lstat, realpath, stat as stat4 } from "fs/promises";
-import path31 from "path";
+import path32 from "path";
 async function readContainedFile(ownerRoot, candidatePath, options = {}) {
   if (options.backend === "unsupported") {
     throw new ContainedReadError("CONTAINED_READ_UNAVAILABLE", "safe descriptor source reads are unavailable on this platform");
@@ -6709,8 +6737,8 @@ async function readContainedFile(ownerRoot, candidatePath, options = {}) {
   }
 }
 function isInside(root, candidate) {
-  const relative = path31.relative(root, candidate);
-  return relative === "" || !path31.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path31.sep}`);
+  const relative = path32.relative(root, candidate);
+  return relative === "" || !path32.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path32.sep}`);
 }
 function mapDescriptorError(error) {
   if (!(error instanceof DescriptorReadError))
@@ -6735,16 +6763,16 @@ var init_contained_read = __esm(() => {
 
 // src/security/path-scan.ts
 import { readdir as readdir7, realpath as realpath2, stat as stat5 } from "fs/promises";
-import path32 from "path";
+import path33 from "path";
 function isInside2(root, candidate) {
-  const relative = path32.relative(root, candidate);
-  return relative === "" || !path32.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path32.sep}`);
+  const relative = path33.relative(root, candidate);
+  return relative === "" || !path33.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path33.sep}`);
 }
 function identityFor(value) {
   return `${String(value.dev)}:${String(value.ino)}`;
 }
 function relativePath(root, candidate) {
-  const relative = path32.relative(root, candidate);
+  const relative = path33.relative(root, candidate);
   return relative === "" ? "." : relative;
 }
 function safeReason(error) {
@@ -6781,14 +6809,14 @@ async function scanContainedPath(input) {
     throw new Error("security scan target is outside the project root");
   }
   const exclusions = (input.exclusions ?? []).map((entry) => {
-    const absolute = path32.resolve(ownerRoot, entry);
+    const absolute = path33.resolve(ownerRoot, entry);
     return isInside2(ownerRoot, absolute) ? absolute : null;
   }).filter((entry) => entry !== null);
   const scope = {
     path: relativePath(ownerRoot, targetReal),
     recursive: input.recursive ?? true,
     exclusions: (input.exclusions ?? []).map((entry) => {
-      const absolute = path32.resolve(ownerRoot, entry);
+      const absolute = path33.resolve(ownerRoot, entry);
       return isInside2(ownerRoot, absolute) ? relativePath(ownerRoot, absolute) : "[external exclusion omitted]";
     }),
     limits
@@ -6806,7 +6834,7 @@ async function scanContainedPath(input) {
     if (!coverage.reasons.includes(reason))
       coverage.reasons.push(reason);
   };
-  const excluded = (candidate) => exclusions.some((entry) => candidate === entry || candidate.startsWith(`${entry}${path32.sep}`));
+  const excluded = (candidate) => exclusions.some((entry) => candidate === entry || candidate.startsWith(`${entry}${path33.sep}`));
   const visit = async (candidate, depth) => {
     if (stoppedByLimit)
       return;
@@ -6869,7 +6897,7 @@ async function scanContainedPath(input) {
         return;
       }
       for (const entry of entries) {
-        await visit(path32.join(canonical, entry), depth + 1);
+        await visit(path33.join(canonical, entry), depth + 1);
         if (stoppedByLimit)
           break;
       }
@@ -6933,7 +6961,7 @@ __export(exports_service2, {
   runScanPath: () => runScanPath,
   validateSerializedOutput: () => validateSerializedOutput
 });
-import path33 from "path";
+import path34 from "path";
 import { readFile as readFile17 } from "fs/promises";
 function validateSerializedOutput(content) {
   return validateSerializedContentForTransport(content);
@@ -7035,7 +7063,7 @@ function hasRecognizedGate(value) {
   return typeof gate === "string" && RECOGNIZED_GATES.has(gate);
 }
 async function readLatestReport(cwd) {
-  const file = path33.join(artifactsDir(cwd), "latest.json");
+  const file = path34.join(artifactsDir(cwd), "latest.json");
   if (!await pathExists(file)) {
     return { kind: "absent" };
   }
@@ -7152,7 +7180,7 @@ var init_service = __esm(() => {
 });
 
 // src/security/guard.ts
-import path34 from "path";
+import path35 from "path";
 function prepareOutputForPersistence(guard, original) {
   if (!guard.allowed) {
     return { allowed: false, reason: guard.reason ?? "security gate blocked" };
@@ -7170,7 +7198,7 @@ function prepareOutputForPersistence(guard, original) {
   };
 }
 async function resolveManifestSecurityState(cwd) {
-  const manifestPath = path34.join(securityProjectRoot(cwd), ".metaproject", "metaproject.json");
+  const manifestPath = path35.join(securityProjectRoot(cwd), ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return { enabled: false, manifestUnreadable: false };
   }
@@ -7368,9 +7396,9 @@ var MEMORY_EMBEDDING_ID = "memory.embedding", DEFAULT_EMBED_DIMS = 96;
 // src/memory/embedding/index.ts
 import { createHash as createHash5 } from "crypto";
 import { mkdir as mkdir12, readFile as readFile18, writeFile as writeFile8 } from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 function embeddingsDir(cwd) {
-  return path35.join(cwd, ".metaproject", "data", "memory", "embeddings");
+  return path36.join(cwd, ".metaproject", "data", "memory", "embeddings");
 }
 function entryText(entry) {
   return `${entry.title}
@@ -7399,17 +7427,17 @@ async function buildEmbeddingIndex(cwd, entries, embedder, model, now) {
   };
   const dir = embeddingsDir(cwd);
   await mkdir12(dir, { recursive: true });
-  await writeFile8(path35.join(dir, "index.meta.json"), `${JSON.stringify(meta, null, 2)}
+  await writeFile8(path36.join(dir, "index.meta.json"), `${JSON.stringify(meta, null, 2)}
 `, "utf8");
-  await writeFile8(path35.join(dir, "vectors.jsonl"), records.map((record) => JSON.stringify(record)).join(`
+  await writeFile8(path36.join(dir, "vectors.jsonl"), records.map((record) => JSON.stringify(record)).join(`
 `) + (records.length > 0 ? `
 ` : ""), "utf8");
   return toIndex(meta, records);
 }
 async function loadEmbeddingIndex(cwd) {
   const dir = embeddingsDir(cwd);
-  const metaPath = path35.join(dir, "index.meta.json");
-  const vectorsPath = path35.join(dir, "vectors.jsonl");
+  const metaPath = path36.join(dir, "index.meta.json");
+  const vectorsPath = path36.join(dir, "vectors.jsonl");
   if (!await pathExists(metaPath) || !await pathExists(vectorsPath)) {
     return null;
   }
@@ -7860,7 +7888,7 @@ var init_ask = __esm(() => {
 });
 
 // src/wiki/backlinks.ts
-import path36 from "path";
+import path37 from "path";
 function extractCodePaths(content) {
   const out = [];
   let match;
@@ -7890,8 +7918,8 @@ function resolveLink(fromRepoPath, raw) {
   const clean = (raw.split("#")[0] ?? "").trim();
   if (!clean)
     return "";
-  const fromDir = path36.posix.dirname(fromRepoPath.split(path36.sep).join("/"));
-  return path36.posix.normalize(path36.posix.join(fromDir, clean));
+  const fromDir = path37.posix.dirname(fromRepoPath.split(path37.sep).join("/"));
+  return path37.posix.normalize(path37.posix.join(fromDir, clean));
 }
 function buildBacklinkIndex(pages) {
   const index = new Map;
@@ -7905,18 +7933,18 @@ function buildBacklinkIndex(pages) {
     }
   };
   for (const page of pages) {
-    const from = page.repoPath.split(path36.sep).join("/");
+    const from = page.repoPath.split(path37.sep).join("/");
     for (const raw of extractLinks(page.content))
       add(resolveLink(from, raw), from);
     for (const raw of extractCodePaths(page.content))
-      add(path36.posix.normalize(raw), from);
+      add(path37.posix.normalize(raw), from);
   }
   for (const list of index.values())
     list.sort();
   return index;
 }
 function backlinksFor(index, targetRepoPath) {
-  const key = path36.posix.normalize(targetRepoPath.split(path36.sep).join("/"));
+  const key = path37.posix.normalize(targetRepoPath.split(path37.sep).join("/"));
   return index.get(key) ?? [];
 }
 var LINK, CODE_SPAN, FILE_LIKE;
@@ -7929,7 +7957,7 @@ var init_backlinks = __esm(() => {
 // src/ctx/assembly.ts
 import { createHash as createHash6 } from "crypto";
 import { mkdir as mkdir13, rename as rename4, writeFile as writeFile9 } from "fs/promises";
-import path37 from "path";
+import path38 from "path";
 function assembleContext(input) {
   let items = 0;
   let tokens = 0;
@@ -7973,9 +8001,9 @@ async function recordNoContentContext(input) {
   return assembly;
 }
 async function recordContextAssembly(input) {
-  const directory = path37.join(input.workspaceRoot, ".metaproject", "context-operations", "traces");
+  const directory = path38.join(input.workspaceRoot, ".metaproject", "context-operations", "traces");
   await mkdir13(directory, { recursive: true });
-  const target = path37.join(directory, path37.basename(input.assembly.traceRef));
+  const target = path38.join(directory, path38.basename(input.assembly.traceRef));
   const temporary = `${target}.${process.pid}.tmp`;
   await writeFile9(temporary, `${JSON.stringify({ schemaVersion: "1.0", correlationId: input.correlationId, outcome: input.outcome, configurationRevision: input.assembly.configurationRevision, policy: { ref: input.assembly.policyRef, revision: input.assembly.policyRevision }, selected: input.assembly.selected, omittedOptional: input.assembly.omittedOptional, partial: input.assembly.partial })}
 `, { mode: 384 });
@@ -7990,10 +8018,10 @@ function traceRefFor(traceId) {
 var init_assembly = () => {};
 
 // src/wiki/section-tombstone.ts
-import path38 from "path";
+import path39 from "path";
 import { stat as stat6 } from "fs/promises";
 function sectionRegistryPath(cwd) {
-  return path38.join(cwd, ".metaproject", "wiki", ".sections.json");
+  return path39.join(cwd, ".metaproject", "wiki", ".sections.json");
 }
 function emptySectionRegistry() {
   return { version: SECTION_REGISTRY_VERSION, entries: [], tombstones: [], lifted: [] };
@@ -9130,15 +9158,15 @@ __export(exports_service3, {
 import { spawn as spawn2 } from "child_process";
 import { createHash as createHash8 } from "crypto";
 import { mkdir as mkdir14, readFile as readFile20, readdir as readdir8, rm as rm3, writeFile as writeFile10 } from "fs/promises";
-import path39 from "path";
+import path40 from "path";
 function wikiRootPath2(cwd) {
-  return path39.join(cwd, ".metaproject", "wiki");
+  return path40.join(cwd, ".metaproject", "wiki");
 }
 function dataRootPath(cwd) {
-  return path39.join(cwd, ".metaproject", "data", "gdwiki");
+  return path40.join(cwd, ".metaproject", "data", "gdwiki");
 }
 function linkCheckReportPath(cwd) {
-  return path39.join(dataRootPath(cwd), "link-check", "latest.md");
+  return path40.join(dataRootPath(cwd), "link-check", "latest.md");
 }
 async function wikiStatus(cwd) {
   const root = wikiRootPath2(cwd);
@@ -9146,7 +9174,7 @@ async function wikiStatus(cwd) {
   const pages = enabled ? await collectPages(cwd) : [];
   return {
     enabled,
-    wikiRoot: path39.relative(cwd, root),
+    wikiRoot: path40.relative(cwd, root),
     totalPages: pages.length,
     countsByType: WIKI_PAGE_TYPES.map(({ type }) => ({
       type,
@@ -9177,9 +9205,9 @@ async function wikiCreatePage(input) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(input.slug)) {
     throw new Error(`Invalid slug: ${input.slug}. Use lowercase letters, digits, and hyphens.`);
   }
-  const dir = path39.join(wikiRootPath2(input.cwd), typeConfig.folder);
-  const filePath = path39.join(dir, `${input.slug}.md`);
-  const relativePath = path39.relative(input.cwd, filePath);
+  const dir = path40.join(wikiRootPath2(input.cwd), typeConfig.folder);
+  const filePath = path40.join(dir, `${input.slug}.md`);
+  const relativePath = path40.relative(input.cwd, filePath);
   if (await pathExists(filePath) && !input.force) {
     throw new Error(`Page already exists: ${relativePath}. Use --force to overwrite.`);
   }
@@ -9190,7 +9218,7 @@ async function wikiCreatePage(input) {
 }
 async function wikiGenerateIndex(cwd) {
   const root = wikiRootPath2(cwd);
-  const indexPath = path39.join(root, "index.md");
+  const indexPath = path40.join(root, "index.md");
   const pages = await collectPages(cwd);
   const generatedAt = new Date().toISOString();
   const managedBlock = `${WIKI_INDEX_BEGIN}
@@ -9208,7 +9236,7 @@ ${managedBlock}
   await mkdir14(root, { recursive: true });
   await writeFile10(indexPath, next, "utf8");
   return {
-    path: path39.relative(cwd, indexPath),
+    path: path40.relative(cwd, indexPath),
     pageCount: pages.length,
     generatedAt
   };
@@ -9216,13 +9244,13 @@ ${managedBlock}
 async function wikiCheckLinks(cwd) {
   const root = wikiRootPath2(cwd);
   const allFiles = await pathExists(root) ? await walkMarkdown(root) : [];
-  const files = allFiles.filter((absolutePath) => !path39.relative(root, absolutePath).startsWith(`templates${path39.sep}`));
+  const files = allFiles.filter((absolutePath) => !path40.relative(root, absolutePath).startsWith(`templates${path40.sep}`));
   const broken = [];
   let checkedLinks = 0;
   let skippedExternal = 0;
   for (const absolutePath of files) {
     const content = await readFile20(absolutePath, "utf8");
-    const pageRelative = path39.relative(cwd, absolutePath);
+    const pageRelative = path40.relative(cwd, absolutePath);
     for (const target of extractLinkTargets(content)) {
       if (EXTERNAL_LINK.test(target)) {
         skippedExternal += 1;
@@ -9233,7 +9261,7 @@ async function wikiCheckLinks(cwd) {
         continue;
       }
       checkedLinks += 1;
-      const resolved = path39.resolve(path39.dirname(absolutePath), filePart);
+      const resolved = path40.resolve(path40.dirname(absolutePath), filePart);
       if (!await pathExists(resolved)) {
         broken.push({
           page: pageRelative,
@@ -9245,7 +9273,7 @@ async function wikiCheckLinks(cwd) {
   }
   const generatedAt = new Date().toISOString();
   const reportPath = linkCheckReportPath(cwd);
-  await mkdir14(path39.dirname(reportPath), { recursive: true });
+  await mkdir14(path40.dirname(reportPath), { recursive: true });
   await writeFile10(reportPath, renderLinkCheckReport({
     generatedAt,
     checkedPages: files.length,
@@ -9254,7 +9282,7 @@ async function wikiCheckLinks(cwd) {
     broken
   }), "utf8");
   return {
-    reportPath: path39.relative(cwd, reportPath),
+    reportPath: path40.relative(cwd, reportPath),
     checkedPages: files.length,
     checkedLinks,
     skippedExternal,
@@ -9304,7 +9332,7 @@ async function wikiValidate(cwd) {
   }
   if (await isIndexStale(cwd, pages)) {
     issues.push({
-      page: path39.join(path39.relative(cwd, wikiRootPath2(cwd)), "index.md"),
+      page: path40.join(path40.relative(cwd, wikiRootPath2(cwd)), "index.md"),
       kind: "index",
       message: "index out of date, run `keryx wiki index`"
     });
@@ -9341,7 +9369,7 @@ async function wikiCollect(input) {
   };
 }
 async function wikiPruneOrphans(cwd) {
-  const componentsDir = path39.join(wikiRootPath2(cwd), "components");
+  const componentsDir = path40.join(wikiRootPath2(cwd), "components");
   if (!await pathExists(componentsDir)) {
     return { pruned: [], orphanedAccepted: [] };
   }
@@ -9358,20 +9386,20 @@ async function wikiPruneOrphans(cwd) {
     if (validSlugs.has(slug)) {
       continue;
     }
-    const filePath = path39.join(componentsDir, entry);
+    const filePath = path40.join(componentsDir, entry);
     const current = await readFile20(filePath, "utf8");
     const isUnmodifiedDraft = /\nStatus:\s*draft\s*\n/.test(current) && current.includes("Generated by `keryx wiki collect`");
     if (isUnmodifiedDraft) {
       await rm3(filePath);
-      pruned.push(path39.relative(cwd, filePath));
+      pruned.push(path40.relative(cwd, filePath));
     } else {
-      orphanedAccepted.push(path39.relative(cwd, filePath));
+      orphanedAccepted.push(path40.relative(cwd, filePath));
     }
   }
   return { pruned, orphanedAccepted };
 }
 async function validModuleNames(cwd) {
-  const nodesPath = path39.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  const nodesPath = path40.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
   if (!await pathExists(nodesPath)) {
     return;
   }
@@ -9440,9 +9468,9 @@ async function wikiEvidence(input) {
   });
 }
 function resolveEvidenceScope(cwd, override) {
-  const absolute = path39.resolve(cwd);
+  const absolute = path40.resolve(cwd);
   return {
-    projectId: override?.projectId ?? (path39.basename(absolute) || "project"),
+    projectId: override?.projectId ?? (path40.basename(absolute) || "project"),
     checkoutId: override?.checkoutId ?? `checkout:${createHash8("sha256").update(absolute).digest("hex").slice(0, 16)}`,
     ...override?.workspaceId ? { workspaceId: override.workspaceId } : {},
     ...override?.taskId ? { taskId: override.taskId } : {}
@@ -9457,7 +9485,7 @@ function isMachineAuthoredPage(pageType, relativePath, content) {
   if (source === null) {
     return false;
   }
-  const normalised = relativePath.split(path39.sep).join("/").replace(/^wiki\//, "");
+  const normalised = relativePath.split(path40.sep).join("/").replace(/^wiki\//, "");
   return WIKI_PAGE_PRODUCERS.some((producer) => producer.source === source && producer.pageType === pageType && producer.path.test(normalised) && /^-[ \t]+Link:.*\bsha256\b/m.test(content));
 }
 function createGdWikiService() {
@@ -9473,8 +9501,8 @@ function createGdWikiService() {
   };
 }
 async function collectGraphWikiCandidates(cwd, generatedAt, limit, onlyModules) {
-  const nodesPath = path39.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path39.join(cwd, ".metaproject", "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path40.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path40.join(cwd, ".metaproject", "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return [];
   }
@@ -9658,7 +9686,7 @@ function topCounts(bucket, limit) {
   return [...bucket.entries()].sort((a, b) => b[1] - a[1]).slice(0, limit);
 }
 async function readModuleReadme(cwd, moduleName) {
-  const readmePath = path39.join(cwd, ...moduleName.split("/"), "README.md");
+  const readmePath = path40.join(cwd, ...moduleName.split("/"), "README.md");
   if (!await pathExists(readmePath)) {
     return null;
   }
@@ -9679,7 +9707,7 @@ async function extractModuleExports(cwd, files) {
   const declRe = /export\s+(?:async\s+)?(?:default\s+)?(?:const|let|var|function|class|type|interface|enum)\s+([A-Za-z_$][\w$]*)/g;
   const braceRe = /export\s*\{([^}]+)\}/g;
   for (const file of files.slice(0, 4)) {
-    const filePath = path39.join(cwd, ...file.split("/"));
+    const filePath = path40.join(cwd, ...file.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -9710,7 +9738,7 @@ async function extractModuleExports(cwd, files) {
 }
 async function extractModuleApi(cwd, files) {
   const names = await extractModuleExports(cwd, files);
-  const symbolsPath = path39.join(cwd, ".metaproject", "data", "gdgraph", "storage", "symbols.jsonl");
+  const symbolsPath = path40.join(cwd, ".metaproject", "data", "gdgraph", "storage", "symbols.jsonl");
   if (names.length === 0 || !await pathExists(symbolsPath)) {
     return names.map((name) => "`" + name + "`");
   }
@@ -9736,7 +9764,7 @@ async function extractModuleApi(cwd, files) {
   });
 }
 async function collectHealthWikiCandidates(cwd, generatedAt) {
-  const healthPath = path39.join(cwd, ".metaproject", "data", "health", "artifacts", "latest.json");
+  const healthPath = path40.join(cwd, ".metaproject", "data", "health", "artifacts", "latest.json");
   if (!await pathExists(healthPath)) {
     return [];
   }
@@ -9778,7 +9806,7 @@ async function collectHealthWikiCandidates(cwd, generatedAt) {
   }];
 }
 async function collectTestingWikiCandidates(cwd, generatedAt) {
-  const contextPath = path39.join(cwd, ".metaproject", "data", "testing", "context.md");
+  const contextPath = path40.join(cwd, ".metaproject", "data", "testing", "context.md");
   if (!await pathExists(contextPath)) {
     return [];
   }
@@ -9809,8 +9837,8 @@ async function writeCollectedPage(cwd, candidate, force) {
   if (!folder) {
     throw new Error(`Unsupported collected wiki type: ${candidate.type}`);
   }
-  const filePath = path39.join(wikiRootPath2(cwd), folder, `${candidate.slug}.md`);
-  const relativePath = path39.relative(cwd, filePath);
+  const filePath = path40.join(wikiRootPath2(cwd), folder, `${candidate.slug}.md`);
+  const relativePath = path40.relative(cwd, filePath);
   const exists = await pathExists(filePath);
   if (exists && !force) {
     return { path: relativePath, type: candidate.type, source: candidate.source, action: "skipped" };
@@ -9838,7 +9866,7 @@ async function writeCollectedPage(cwd, candidate, force) {
       securityReason: output.reason
     };
   }
-  await mkdir14(path39.dirname(filePath), { recursive: true });
+  await mkdir14(path40.dirname(filePath), { recursive: true });
   await writeFile10(filePath, output.content, "utf8");
   return {
     path: relativePath,
@@ -9850,7 +9878,7 @@ async function writeCollectedPage(cwd, candidate, force) {
 async function wikiPagesForFile(cwd, targetRepoPath) {
   const pages = await collectPages(cwd);
   const refs = await Promise.all(pages.map(async (page) => ({
-    repoPath: path39.relative(cwd, page.absolutePath).split(path39.sep).join("/"),
+    repoPath: path40.relative(cwd, page.absolutePath).split(path40.sep).join("/"),
     content: await readFile20(page.absolutePath, "utf8")
   })));
   return backlinksFor(buildBacklinkIndex(refs), targetRepoPath);
@@ -9889,7 +9917,7 @@ function renderIndexBody(pages, generatedAt) {
 `).trimEnd();
 }
 async function isIndexStale(cwd, pages) {
-  const indexPath = path39.join(wikiRootPath2(cwd), "index.md");
+  const indexPath = path40.join(wikiRootPath2(cwd), "index.md");
   if (!await pathExists(indexPath)) {
     return true;
   }
@@ -9907,7 +9935,7 @@ async function walkMarkdown(root) {
   const results = [];
   const entries = await readdir8(root, { withFileTypes: true });
   for (const entry of entries) {
-    const absolutePath = path39.join(root, entry.name);
+    const absolutePath = path40.join(root, entry.name);
     if (entry.isDirectory()) {
       results.push(...await walkMarkdown(absolutePath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -9964,7 +9992,7 @@ ${JSON.stringify(state, null, 2)}
 `;
 }
 async function readIndexGeneratedAt(cwd) {
-  const indexPath = path39.join(wikiRootPath2(cwd), "index.md");
+  const indexPath = path40.join(wikiRootPath2(cwd), "index.md");
   if (!await pathExists(indexPath)) {
     return null;
   }
@@ -10201,7 +10229,7 @@ async function validateStructure(cwd, pages, issues) {
       if (pattern.includes("*")) {
         continue;
       }
-      if (!await pathExists(path39.join(cwd, pattern))) {
+      if (!await pathExists(path40.join(cwd, pattern))) {
         issues.push({
           page: page.relativePath,
           kind: "describes",
@@ -10272,9 +10300,9 @@ var init_service2 = __esm(() => {
 // src/gdgraph/wiki-layer.ts
 import { createHash as createHash9 } from "crypto";
 import { mkdir as mkdir15, stat as stat7, writeFile as writeFile11 } from "fs/promises";
-import path40 from "path";
+import path41 from "path";
 function storageDir(projectRoot) {
-  return path40.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  return path41.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
 }
 function wikiPageId(relativePath) {
   return `wiki:${relativePath}`;
@@ -10340,11 +10368,11 @@ async function enrichBuildWithWikiLayer(input) {
   const mtimes = new Map;
   for (const record of input.fileRecords) {
     try {
-      const info = await stat7(path40.join(input.projectRoot, record.path));
+      const info = await stat7(path41.join(input.projectRoot, record.path));
       mtimes.set(record.path, info.mtimeMs);
     } catch {}
   }
-  await writeFile11(path40.join(dir, BUILD_MANIFEST_FILE), `${JSON.stringify({ version: 1, files: computeFingerprints(input.fileRecords, mtimes) }, null, 2)}
+  await writeFile11(path41.join(dir, BUILD_MANIFEST_FILE), `${JSON.stringify({ version: 1, files: computeFingerprints(input.fileRecords, mtimes) }, null, 2)}
 `, "utf8");
   const validModules = input.validModules !== undefined ? input.validModules : await (input.loadValidModules ?? defaultLoadValidModules)(input.projectRoot);
   const wikiPages = await collectPages(input.projectRoot);
@@ -10369,8 +10397,8 @@ async function enrichBuildWithWikiLayer(input) {
       version: page.version
     }))
   });
-  await writeJsonl(path40.join(dir, WIKI_PAGES_FILE), layer.pages);
-  await writeJsonl(path40.join(dir, DESCRIBES_FILE), layer.describes);
+  await writeJsonl(path41.join(dir, WIKI_PAGES_FILE), layer.pages);
+  await writeJsonl(path41.join(dir, DESCRIBES_FILE), layer.describes);
   return layer;
 }
 async function defaultLoadValidModules(projectRoot) {
@@ -10393,7 +10421,7 @@ __export(exports_service, {
   createFlowService: () => createFlowService
 });
 import { mkdir as mkdir5, readFile as readFile10 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 
 // src/contracts/resolver.ts
 import { readFileSync } from "fs";
@@ -13083,8 +13111,10 @@ var DEFAULT_TASKS = [
 ];
 
 // src/flow/allocation.ts
-init_fs();
 import { appendFile as appendFile2, mkdir as mkdir4, readFile as readFile9 } from "fs/promises";
+import path14 from "path";
+
+// src/lib/clone-scope.ts
 import path13 from "path";
 async function gitCommonDir(cwd) {
   try {
@@ -13115,27 +13145,30 @@ async function gitToplevel(cwd) {
     return null;
   }
 }
+
+// src/flow/allocation.ts
+init_fs();
 function projectKey(toplevel, cwd) {
   if (!toplevel) {
     return "root";
   }
-  const relative = path13.relative(toplevel, cwd);
+  const relative = path14.relative(toplevel, cwd);
   return relative === "" ? "root" : slugify(relative);
 }
 async function resolveAllocationScope(cwd) {
   const commonDir = await gitCommonDir(cwd);
   if (!commonDir) {
     return {
-      lockPath: path13.join(flowsRoot(cwd), ".flow-init.lock"),
+      lockPath: path14.join(flowsRoot(cwd), ".flow-init.lock"),
       ledgerPath: null,
       project: "root"
     };
   }
   const key = projectKey(await gitToplevel(cwd), cwd);
-  const dir = path13.join(commonDir, "keryx", "flow-ids");
+  const dir = path14.join(commonDir, "keryx", "flow-ids");
   return {
-    lockPath: path13.join(dir, `${key}.lock`),
-    ledgerPath: path13.join(dir, `${key}.jsonl`),
+    lockPath: path14.join(dir, `${key}.lock`),
+    ledgerPath: path14.join(dir, `${key}.jsonl`),
     project: key
   };
 }
@@ -13168,7 +13201,7 @@ async function recordAllocation(scope, record) {
   if (!scope.ledgerPath) {
     return;
   }
-  await mkdir4(path13.dirname(scope.ledgerPath), { recursive: true });
+  await mkdir4(path14.dirname(scope.ledgerPath), { recursive: true });
   await appendFile2(scope.ledgerPath, `${JSON.stringify(record)}
 `, "utf8");
 }
@@ -13274,7 +13307,7 @@ function createFlowService(deps) {
     return flow;
   }
   function flowLockPath(cwd, dir) {
-    return path14.join(flowsRoot(cwd), `.flow-lock-${dir}`);
+    return path15.join(flowsRoot(cwd), `.flow-lock-${dir}`);
   }
   async function mutate(cwd, id, run) {
     const dir = await resolveFlowDir(cwd, id);
@@ -13316,7 +13349,7 @@ function createFlowService(deps) {
         const date = now().slice(0, 10);
         const slug = slugify(input.slug ?? title);
         const dir = `${id}-${date}-${slug}`;
-        const absolute = path14.join(flowsRoot(input.cwd), dir);
+        const absolute = path15.join(flowsRoot(input.cwd), dir);
         if (await pathExists(absolute)) {
           throw new Error(`Flow directory already exists: ${dir}`);
         }
@@ -13343,15 +13376,15 @@ function createFlowService(deps) {
           history: [{ at: createdAt, event: "created" }]
         };
         const sourceLabel = input.issue ?? "user description";
-        await writeFileAtomic(path14.join(absolute, "description.md"), renderDescription(title, sourceLabel));
-        await writeFileAtomic(path14.join(absolute, "context.md"), context.markdown);
-        await writeFileAtomic(path14.join(absolute, "plan.md"), renderPlan());
-        await writeFileAtomic(path14.join(absolute, "tasks.md"), renderTasksDoc());
-        await writeFileAtomic(path14.join(absolute, "acceptance-criteria.md"), renderAcceptanceCriteria());
-        await writeFileAtomic(path14.join(absolute, "journal.md"), renderJournal(createdAt));
+        await writeFileAtomic(path15.join(absolute, "description.md"), renderDescription(title, sourceLabel));
+        await writeFileAtomic(path15.join(absolute, "context.md"), context.markdown);
+        await writeFileAtomic(path15.join(absolute, "plan.md"), renderPlan());
+        await writeFileAtomic(path15.join(absolute, "tasks.md"), renderTasksDoc());
+        await writeFileAtomic(path15.join(absolute, "acceptance-criteria.md"), renderAcceptanceCriteria());
+        await writeFileAtomic(path15.join(absolute, "journal.md"), renderJournal(createdAt));
         await writeFlow(input.cwd, dir, flow);
         await recordAllocation(scope, { id, dir, at: createdAt, project: scope.project });
-        return { flow, dir: path14.relative(input.cwd, absolute), contextNotes: context.notes };
+        return { flow, dir: path15.relative(input.cwd, absolute), contextNotes: context.notes };
       });
     },
     async list({ cwd }) {
@@ -13749,7 +13782,7 @@ function createFlowService(deps) {
           issues.push({ flow: dir, kind: "schema", message: `unknown schemaVersion ${flow.schemaVersion}` });
         }
         try {
-          const raw = JSON.parse(await Bun.file(path14.join(flowsRoot(cwd), dir, "flow.json")).text());
+          const raw = JSON.parse(await Bun.file(path15.join(flowsRoot(cwd), dir, "flow.json")).text());
           const validation = validateAgainstSchemaObject(flowStateSchema(), raw);
           if (!validation.valid) {
             issues.push({
@@ -13760,7 +13793,7 @@ function createFlowService(deps) {
           }
         } catch {}
         for (const file of ["description.md", "context.md", "plan.md", "tasks.md", "acceptance-criteria.md", "journal.md"]) {
-          if (!await pathExists(path14.join(flowsRoot(cwd), dir, file))) {
+          if (!await pathExists(path15.join(flowsRoot(cwd), dir, file))) {
             issues.push({ flow: dir, kind: "structure", message: `missing ${file}` });
           }
         }
@@ -13799,7 +13832,7 @@ function createFlowService(deps) {
   };
 }
 async function appendIdMap(cwd, entry) {
-  const file = path14.join(flowsRoot(cwd), "id-map.json");
+  const file = path15.join(flowsRoot(cwd), "id-map.json");
   let entries = [];
   if (await pathExists(file)) {
     const raw = await readFile10(file, "utf8");
@@ -13810,7 +13843,7 @@ async function appendIdMap(cwd, entry) {
       }
       entries = parsed;
     } catch (error) {
-      throw new Error(`Cannot read ${path14.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`);
+      throw new Error(`Cannot read ${path15.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
   entries.push(entry);
@@ -13992,7 +14025,7 @@ __export(exports_service4, {
 // src/gdgraph/build.ts
 import { mkdir as mkdir16, readdir as readdir9, readFile as readFile21, writeFile as writeFile12 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
-import path41 from "path";
+import path42 from "path";
 
 // src/gdgraph/types.ts
 var UNKNOWN_IMPORT_KIND = "unknown-static";
@@ -14057,7 +14090,7 @@ async function buildGraph(projectRoot) {
   const assetNodes = new Map;
   const fileRecords = [];
   for (const file of files) {
-    const absolutePath = path41.join(projectRoot, file);
+    const absolutePath = path42.join(projectRoot, file);
     const content = await readFile21(absolutePath, "utf8");
     fileRecords.push({ path: file, content });
     const language = getLanguage(file);
@@ -14110,24 +14143,24 @@ async function collectSourceFiles(projectRoot) {
   const result = [];
   const skippedDirectories = [];
   async function walk(relativeDir) {
-    const absoluteDir = path41.join(projectRoot, relativeDir);
+    const absoluteDir = path42.join(projectRoot, relativeDir);
     const entries = await readdir9(absoluteDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (IGNORE_DIRS.has(entry.name)) {
-          skippedDirectories.push(normalizePath2(path41.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
+          skippedDirectories.push(normalizePath2(path42.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
           continue;
         }
-        await walk(normalizePath2(path41.posix.join(relativeDir, entry.name)));
+        await walk(normalizePath2(path42.posix.join(relativeDir, entry.name)));
         continue;
       }
       if (!entry.isFile()) {
         continue;
       }
-      if (!SOURCE_EXTENSIONS.includes(path41.extname(entry.name))) {
+      if (!SOURCE_EXTENSIONS.includes(path42.extname(entry.name))) {
         continue;
       }
-      result.push(normalizePath2(path41.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
+      result.push(normalizePath2(path42.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
     }
   }
   await walk(".");
@@ -14209,8 +14242,8 @@ function resolveImport(projectRoot, fromFile, specifier, fileSet, resolver) {
 }
 function resolveAssetImport(projectRoot, fromFile, specifier, resolver) {
   for (const candidate of importCandidateBases(projectRoot, fromFile, specifier, resolver)) {
-    const extension = path41.posix.extname(candidate);
-    if (ASSET_EXTENSIONS.includes(extension) && existsSync2(path41.join(projectRoot, candidate))) {
+    const extension = path42.posix.extname(candidate);
+    if (ASSET_EXTENSIONS.includes(extension) && existsSync2(path42.join(projectRoot, candidate))) {
       return candidate;
     }
   }
@@ -14219,17 +14252,17 @@ function resolveAssetImport(projectRoot, fromFile, specifier, resolver) {
 function importCandidateBases(projectRoot, fromFile, specifier, resolver) {
   const normalizedSpecifier = stripImportSuffix(specifier);
   if (normalizedSpecifier.startsWith(".") && getLanguage(fromFile) !== "python") {
-    const fromDir = path41.posix.dirname(fromFile);
-    return [normalizePath2(path41.posix.normalize(path41.posix.join(fromDir, normalizedSpecifier)))];
+    const fromDir = path42.posix.dirname(fromFile);
+    return [normalizePath2(path42.posix.normalize(path42.posix.join(fromDir, normalizedSpecifier)))];
   }
-  return resolver.candidateBases(normalizedSpecifier, fromFile).map((candidate) => normalizePath2(path41.relative(projectRoot, path41.join(projectRoot, candidate))));
+  return resolver.candidateBases(normalizedSpecifier, fromFile).map((candidate) => normalizePath2(path42.relative(projectRoot, path42.join(projectRoot, candidate))));
 }
 function resolveSourceCandidate(base, fileSet) {
   const candidates = [
     base,
     ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => `${base}${extension}`),
-    ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => path41.posix.join(base, `index${extension}`)),
-    path41.posix.join(base, "__init__.py")
+    ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => path42.posix.join(base, `index${extension}`)),
+    path42.posix.join(base, "__init__.py")
   ];
   return candidates.find((candidate) => fileSet.has(candidate)) ?? null;
 }
@@ -14259,7 +14292,7 @@ async function loadJavaResolver(projectRoot) {
   return createJavaResolver(roots);
 }
 async function discoverJavaSourceRoots(projectRoot) {
-  const pomPath = path41.join(projectRoot, "pom.xml");
+  const pomPath = path42.join(projectRoot, "pom.xml");
   if (existsSync2(pomPath)) {
     try {
       const roots = parseMavenSourceRoots(await readFile21(pomPath, "utf8"));
@@ -14269,7 +14302,7 @@ async function discoverJavaSourceRoots(projectRoot) {
     } catch {}
   }
   for (const gradleName of ["build.gradle", "build.gradle.kts"]) {
-    const gradlePath = path41.join(projectRoot, gradleName);
+    const gradlePath = path42.join(projectRoot, gradleName);
     if (existsSync2(gradlePath)) {
       try {
         const roots = parseGradleSourceRoots(await readFile21(gradlePath, "utf8"));
@@ -14291,12 +14324,12 @@ function createJavaResolver(sourceRoots) {
         return [];
       }
       const relative = specifier.split(".").join("/");
-      return sourceRoots.map((root) => normalizePath2(path41.posix.join(root, relative)));
+      return sourceRoots.map((root) => normalizePath2(path42.posix.join(root, relative)));
     }
   };
 }
 function loadPythonResolver(projectRoot) {
-  const hasSrc = existsSync2(path41.join(projectRoot, "src"));
+  const hasSrc = existsSync2(path42.join(projectRoot, "src"));
   return createPythonResolver(hasSrc);
 }
 function createPythonResolver(hasSrc) {
@@ -14309,16 +14342,16 @@ function createPythonResolver(hasSrc) {
       if (specifier.startsWith(".")) {
         const dots = /^\.+/.exec(specifier)?.[0].length ?? 0;
         const rest = specifier.slice(dots);
-        let baseDir = path41.posix.dirname(fromFile);
+        let baseDir = path42.posix.dirname(fromFile);
         for (let level = 1;level < dots; level += 1) {
-          baseDir = path41.posix.dirname(baseDir);
+          baseDir = path42.posix.dirname(baseDir);
         }
         const suffix = rest ? rest.split(".").join("/") : "";
-        const base = suffix ? path41.posix.join(baseDir, suffix) : baseDir;
+        const base = suffix ? path42.posix.join(baseDir, suffix) : baseDir;
         return [normalizePath2(base)];
       }
       const relative = specifier.split(".").join("/");
-      return roots.map((root) => normalizePath2(root ? path41.posix.join(root, relative) : relative));
+      return roots.map((root) => normalizePath2(root ? path42.posix.join(root, relative) : relative));
     }
   };
 }
@@ -14327,8 +14360,8 @@ function parseMavenSourceRoots(pomXml) {
   for (const match of pomXml.matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
     const moduleDir = match[1]?.trim();
     if (moduleDir && !moduleDir.includes("${")) {
-      roots.add(normalizePath2(path41.posix.join(moduleDir, "src/main/java")));
-      roots.add(normalizePath2(path41.posix.join(moduleDir, "src/test/java")));
+      roots.add(normalizePath2(path42.posix.join(moduleDir, "src/main/java")));
+      roots.add(normalizePath2(path42.posix.join(moduleDir, "src/test/java")));
     }
   }
   for (const tag of ["sourceDirectory", "testSourceDirectory"]) {
@@ -14360,7 +14393,7 @@ function parseGradleSourceRoots(buildGradle) {
 }
 async function loadTsconfigResolver(projectRoot) {
   const empty = createTsconfigResolver(null, []);
-  const tsconfigPath = path41.join(projectRoot, "tsconfig.json");
+  const tsconfigPath = path42.join(projectRoot, "tsconfig.json");
   if (!existsSync2(tsconfigPath)) {
     return empty;
   }
@@ -14368,7 +14401,7 @@ async function loadTsconfigResolver(projectRoot) {
     const raw = await readFile21(tsconfigPath, "utf8");
     const parsed = JSON.parse(stripJsonComments(raw));
     const options = parsed.compilerOptions ?? {};
-    const baseUrl = typeof options.baseUrl === "string" ? normalizePath2(path41.posix.normalize(options.baseUrl)).replace(/^\.\//, "") : null;
+    const baseUrl = typeof options.baseUrl === "string" ? normalizePath2(path42.posix.normalize(options.baseUrl)).replace(/^\.\//, "") : null;
     const paths = isRecord2(options.paths) ? Object.entries(options.paths).filter((entry) => Array.isArray(entry[1])).map(([pattern, targets]) => ({
       pattern,
       targets: targets.filter((target) => typeof target === "string")
@@ -14397,7 +14430,7 @@ function createTsconfigResolver(baseUrl, mappings) {
         }
       }
       if (baseUrl !== null) {
-        candidates.push(normalizePath2(path41.posix.join(baseUrl, normalizedSpecifier)));
+        candidates.push(normalizePath2(path42.posix.join(baseUrl, normalizedSpecifier)));
       }
       return [...new Set(candidates.map((candidate) => candidate.replace(/^\.\//, "")))];
     }
@@ -14417,7 +14450,7 @@ function matchPathPattern(pattern, specifier) {
 }
 function applyPathTarget(baseUrl, target, wildcard) {
   const replaced = target.includes("*") ? target.replace("*", wildcard) : target;
-  return normalizePath2(path41.posix.normalize(path41.posix.join(baseUrl ?? "", replaced)));
+  return normalizePath2(path42.posix.normalize(path42.posix.join(baseUrl ?? "", replaced)));
 }
 function stripJsonComments(source) {
   let out = "";
@@ -14470,21 +14503,21 @@ function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function writeGraph(projectRoot, graph) {
-  const storageDir = path41.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
-  const artifactsDir = path41.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
+  const storageDir = path42.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  const artifactsDir = path42.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
   await mkdir16(storageDir, { recursive: true });
   await mkdir16(artifactsDir, { recursive: true });
-  await writeFile12(path41.join(storageDir, "nodes.jsonl"), graph.nodes.map((node) => JSON.stringify(node)).join(`
+  await writeFile12(path42.join(storageDir, "nodes.jsonl"), graph.nodes.map((node) => JSON.stringify(node)).join(`
 `) + `
 `, "utf8");
-  await writeFile12(path41.join(storageDir, "edges.jsonl"), graph.edges.map((edge) => JSON.stringify(edge)).join(`
+  await writeFile12(path42.join(storageDir, "edges.jsonl"), graph.edges.map((edge) => JSON.stringify(edge)).join(`
 `) + `
 `, "utf8");
-  await writeFile12(path41.join(artifactsDir, "module-map.json"), JSON.stringify(buildModuleMap(graph), null, 2) + `
+  await writeFile12(path42.join(artifactsDir, "module-map.json"), JSON.stringify(buildModuleMap(graph), null, 2) + `
 `, "utf8");
 }
 async function writeSummary(projectRoot, graph, collection) {
-  const artifactsDir = path41.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
+  const artifactsDir = path42.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
   await mkdir16(artifactsDir, { recursive: true });
   const unresolved = graph.edges.filter((edge) => edge.kind === "unresolved");
   const imports = graph.edges.filter((edge) => edge.kind === "imports");
@@ -14499,7 +14532,7 @@ async function writeSummary(projectRoot, graph, collection) {
 `);
   const skippedList = collection.skippedDirectories.length > 0 ? collection.skippedDirectories.slice(0, 30).map((dir) => `- \`${dir}\``).join(`
 `) : "- none";
-  const summaryPath = path41.join(artifactsDir, "summary.md");
+  const summaryPath = path42.join(artifactsDir, "summary.md");
   const content = `# gdgraph Summary
 
 ## Stats
@@ -14580,7 +14613,7 @@ function groupBy(items, getKey) {
 }
 function unresolvedType(specifier) {
   const stripped = stripImportSuffix(specifier);
-  const extension = path41.posix.extname(stripped);
+  const extension = path42.posix.extname(stripped);
   if (extension) {
     return extension;
   }
@@ -14590,13 +14623,13 @@ function unresolvedType(specifier) {
   return "package";
 }
 function normalizePath2(value) {
-  return value.split(path41.sep).join("/");
+  return value.split(path42.sep).join("/");
 }
 
 // src/gdgraph/target.ts
-import path42 from "path";
+import path43 from "path";
 function normalizeTarget(target) {
-  return target.replace(/^\.\//, "").split(path42.sep).join("/");
+  return target.replace(/^\.\//, "").split(path43.sep).join("/");
 }
 function resolveGraphTarget(graph, target) {
   const normalized = normalizeTarget(target);
@@ -14689,15 +14722,15 @@ init_config2();
 
 // src/gdgraph/query.ts
 import { readFile as readFile22 } from "fs/promises";
-import path43 from "path";
+import path44 from "path";
 async function loadGraph(projectRoot) {
-  const storageDir = path43.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
-  const nodes = await readJsonl(path43.join(storageDir, "nodes.jsonl"));
-  const edges = await readJsonl(path43.join(storageDir, "edges.jsonl"));
-  const symbols = await readJsonl(path43.join(storageDir, "symbols.jsonl"));
-  const calls = await readJsonl(path43.join(storageDir, "calls.jsonl"));
-  const wikiPages = await readJsonl(path43.join(storageDir, "wiki-pages.jsonl"));
-  const describes = await readJsonl(path43.join(storageDir, "describes.jsonl"));
+  const storageDir = path44.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  const nodes = await readJsonl(path44.join(storageDir, "nodes.jsonl"));
+  const edges = await readJsonl(path44.join(storageDir, "edges.jsonl"));
+  const symbols = await readJsonl(path44.join(storageDir, "symbols.jsonl"));
+  const calls = await readJsonl(path44.join(storageDir, "calls.jsonl"));
+  const wikiPages = await readJsonl(path44.join(storageDir, "wiki-pages.jsonl"));
+  const describes = await readJsonl(path44.join(storageDir, "describes.jsonl"));
   const graph = { nodes, edges };
   if (symbols.length > 0) {
     graph.symbols = symbols;
@@ -14785,7 +14818,7 @@ function canonicalCycle(cycle) {
 
 // src/gdgraph/repomap.ts
 import { mkdir as mkdir17, writeFile as writeFile13 } from "fs/promises";
-import path44 from "path";
+import path45 from "path";
 
 // src/gdgraph/pagerank.ts
 function personalizedPageRank(nodes, edges, options) {
@@ -14896,7 +14929,7 @@ function overflowContent(required, missing, budget) {
 `);
 }
 function repomapArtifactPath(cwd) {
-  return path44.join(cwd, ".metaproject", "data", "gdgraph", "artifacts", "repomap.md");
+  return path45.join(cwd, ".metaproject", "data", "gdgraph", "artifacts", "repomap.md");
 }
 function buildRankEdges(graph, config) {
   const edges = [];
@@ -15041,7 +15074,7 @@ function computeRepomap(graph, config, options = {}) {
 async function writeRepomap(cwd, graph, config, options = {}) {
   const result = computeRepomap(graph, config, options);
   const artifactPath = repomapArtifactPath(cwd);
-  await mkdir17(path44.dirname(artifactPath), { recursive: true });
+  await mkdir17(path45.dirname(artifactPath), { recursive: true });
   await writeFile13(artifactPath, result.content, "utf8");
   return { ...result, path: artifactPath };
 }
@@ -15093,12 +15126,12 @@ __export(exports_service6, {
   createCodeHealthService: () => createCodeHealthService,
   gateExitCode: () => gateExitCode
 });
-import path64 from "path";
+import path65 from "path";
 
 // src/health/config.ts
 init_fs();
 init_json();
-import path45 from "path";
+import path46 from "path";
 var DEFAULT_HEALTH_CONFIG = {
   schemaVersion: 2,
   ignore: {
@@ -15154,7 +15187,7 @@ var DEFAULT_HEALTH_CONFIG = {
   }
 };
 function configPath2(cwd) {
-  return path45.join(cwd, ".metaproject", "health.config.json");
+  return path46.join(cwd, ".metaproject", "health.config.json");
 }
 var STRICTEST_GATE = {
   failOnPriorities: ["P0", "P1", "P2", "P3"],
@@ -15205,7 +15238,7 @@ async function loadHealthConfig(cwd) {
 // src/health/run.ts
 init_fs();
 import { mkdir as mkdir22, writeFile as writeFile18 } from "fs/promises";
-import path63 from "path";
+import path64 from "path";
 
 // src/metrics/provenance.ts
 async function collectGitProvenance(cwd) {
@@ -15304,12 +15337,12 @@ function computeGate2(input) {
 }
 
 // src/health/scopes.ts
-import path48 from "path";
+import path49 from "path";
 
 // src/health/util.ts
 init_fs();
 import { mkdir as mkdir18, readFile as readFile23, readdir as readdir10, writeFile as writeFile14 } from "fs/promises";
-import path46 from "path";
+import path47 from "path";
 var IGNORED_DIRS = new Set([
   "node_modules",
   ".git",
@@ -15353,14 +15386,14 @@ async function toolVersion(command, cwd) {
   }
 }
 function dataRoot(cwd) {
-  return path46.join(cwd, ".metaproject", "data", "health");
+  return path47.join(cwd, ".metaproject", "data", "health");
 }
 async function writeRaw(cwd, source, content, stamp) {
-  const dir = path46.join(dataRoot(cwd), "raw", source);
+  const dir = path47.join(dataRoot(cwd), "raw", source);
   await mkdir18(dir, { recursive: true });
-  const file = path46.join(dir, `${stamp}.log`);
+  const file = path47.join(dir, `${stamp}.log`);
   await writeFile14(file, content, "utf8");
-  return path46.relative(cwd, file);
+  return path47.relative(cwd, file);
 }
 async function listSourceFiles(cwd, ignorePaths = []) {
   const { files } = await listSourceFilesWithReasons(cwd, ignorePaths);
@@ -15380,7 +15413,7 @@ async function walk2(root, dir, out, incompleteReasons) {
   try {
     entries = await readdir10(dir, { withFileTypes: true });
   } catch (error) {
-    incompleteReasons.push(`${path46.relative(root, dir) || "."}: ${error instanceof Error ? error.message : String(error)}`);
+    incompleteReasons.push(`${path47.relative(root, dir) || "."}: ${error instanceof Error ? error.message : String(error)}`);
     return;
   }
   for (const entry of entries) {
@@ -15388,14 +15421,14 @@ async function walk2(root, dir, out, incompleteReasons) {
       if (entry.isDirectory() && !IGNORED_DIRS.has(entry.name)) {}
       continue;
     }
-    const abs = path46.join(dir, entry.name);
+    const abs = path47.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) {
         continue;
       }
       await walk2(root, abs, out, incompleteReasons);
-    } else if (entry.isFile() && SOURCE_EXT.has(path46.extname(entry.name))) {
-      out.push(path46.relative(root, abs));
+    } else if (entry.isFile() && SOURCE_EXT.has(path47.extname(entry.name))) {
+      out.push(path47.relative(root, abs));
     }
   }
 }
@@ -15410,7 +15443,7 @@ function moduleOfFile(file) {
   return null;
 }
 function isSourceFile(file) {
-  return SOURCE_EXT.has(path46.extname(file));
+  return SOURCE_EXT.has(path47.extname(file));
 }
 function matchesAnyPattern(file, patterns) {
   const normalized = file.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -15510,7 +15543,7 @@ function rankHotspots(files, churn, sourceAnalysis) {
 // src/health/source-analysis.ts
 init_fs();
 import { readFile as readFile24 } from "fs/promises";
-import path47 from "path";
+import path48 from "path";
 
 // src/health/metrics/complexity.ts
 var CONTROL_KEYWORDS = new Set([
@@ -15744,7 +15777,7 @@ async function analyzeSourceFiles(cwd, sourceFiles) {
   return new Map(entries.filter((entry) => entry !== null));
 }
 async function analyzeSourceFile(cwd, file) {
-  const abs = path47.join(cwd, file);
+  const abs = path48.join(cwd, file);
   if (!await pathExists(abs)) {
     return null;
   }
@@ -15817,14 +15850,14 @@ async function computeMetrics(input) {
   }
   const components = new Map;
   for (const file of sourceFiles) {
-    const dir = path48.posix.dirname(file);
+    const dir = path49.posix.dirname(file);
     if (dir === "." || dir === moduleOfFile(file)) {
       continue;
     }
     components.set(dir, [...components.get(dir) ?? [], file]);
   }
   for (const [name, files] of [...components.entries()].sort()) {
-    const compFindings = findings.filter((f) => f.file && path48.posix.dirname(f.file) === name);
+    const compFindings = findings.filter((f) => f.file && path49.posix.dirname(f.file) === name);
     scopes.push(build("component", `component:${name}`, name, files, compFindings, averageCoverage(files, coverage)));
   }
   const findingFiles = findings.map((f) => f.file).filter((f) => Boolean(f));
@@ -15869,9 +15902,9 @@ function tally2(values) {
 // src/health/baseline.ts
 init_fs();
 import { mkdir as mkdir19, readFile as readFile25, writeFile as writeFile15 } from "fs/promises";
-import path49 from "path";
+import path50 from "path";
 function baselinePath(cwd) {
-  return path49.join(cwd, ".metaproject", "health", "baselines", "scores.json");
+  return path50.join(cwd, ".metaproject", "health", "baselines", "scores.json");
 }
 async function loadBaseline(cwd) {
   const file = baselinePath(cwd);
@@ -15903,7 +15936,7 @@ async function writeBaseline(cwd, metrics, generatedAt, selector) {
     scopes[key] = value;
   }
   const file = baselinePath(cwd);
-  await mkdir19(path49.dirname(file), { recursive: true });
+  await mkdir19(path50.dirname(file), { recursive: true });
   await writeFile15(file, `${JSON.stringify({ generatedAt, scopes }, null, 2)}
 `, "utf8");
   return updated;
@@ -15957,10 +15990,10 @@ async function getChurn(cwd, windowDays) {
 
 // src/health/metrics/wiki-freshness.ts
 import { readFile as readFile26, stat as stat8 } from "fs/promises";
-import path50 from "path";
+import path51 from "path";
 var DEFAULT_STALE_EVIDENCE_DAYS = 7;
 function freshnessReportPath(cwd) {
-  return path50.join(cwd, ".metaproject", "data", "wiki", "freshness", "latest.json");
+  return path51.join(cwd, ".metaproject", "data", "wiki", "freshness", "latest.json");
 }
 async function readWikiFreshnessMetric(cwd, options = {}) {
   const file = freshnessReportPath(cwd);
@@ -15981,7 +16014,7 @@ async function readWikiFreshnessMetric(cwd, options = {}) {
   } catch {
     return {
       status: "unreadable-report",
-      reason: `${path50.relative(cwd, file)} is not valid JSON; re-run \`keryx wiki freshness\`.`
+      reason: `${path51.relative(cwd, file)} is not valid JSON; re-run \`keryx wiki freshness\`.`
     };
   }
   const report = parsed;
@@ -15991,7 +16024,7 @@ async function readWikiFreshnessMetric(cwd, options = {}) {
   if (pagesTotal === null || pagesFresh === null) {
     return {
       status: "unreadable-report",
-      reason: `${path50.relative(cwd, file)} is missing its totals; re-run \`keryx wiki freshness\`.`
+      reason: `${path51.relative(cwd, file)} is missing its totals; re-run \`keryx wiki freshness\`.`
     };
   }
   const pagesUndecidable = numberOr2(totals.pagesUndecidable) ?? 0;
@@ -16045,12 +16078,12 @@ function renderWikiFreshnessLine(metric) {
 }
 
 // src/health/sources/helpers.ts
-import path51 from "path";
+import path52 from "path";
 import { existsSync as existsSync3 } from "fs";
 class NoImportError extends Error {
 }
 function resolveBin(cwd, name) {
-  const local = path51.join(cwd, "node_modules", ".bin", name);
+  const local = path52.join(cwd, "node_modules", ".bin", name);
   if (existsSync3(local)) {
     return local;
   }
@@ -16131,13 +16164,13 @@ async function getComplexityFindings(cwd, sourceFiles, config, sourceAnalysis) {
 
 // src/health/metrics/coverage.ts
 import { existsSync as existsSync4 } from "fs";
-import path52 from "path";
+import path53 from "path";
 var SUMMARY_PATHS = [
   "coverage/coverage-summary.json",
   "coverage/coverage-final.json"
 ];
 async function getCoverage(cwd) {
-  const summary = SUMMARY_PATHS.map((rel) => path52.join(cwd, rel)).find((abs) => existsSync4(abs));
+  const summary = SUMMARY_PATHS.map((rel) => path53.join(cwd, rel)).find((abs) => existsSync4(abs));
   if (!summary) {
     return { status: "missing", total: null, byFile: new Map };
   }
@@ -16158,7 +16191,7 @@ async function getCoverage(cwd) {
       total = pct;
       continue;
     }
-    const relative = path52.isAbsolute(key) ? path52.relative(cwd, key) : key;
+    const relative = path53.isAbsolute(key) ? path53.relative(cwd, key) : key;
     byFile.set(relative.replace(/\\/g, "/"), pct);
   }
   return { status: "available", total, byFile };
@@ -16291,10 +16324,10 @@ function renderWikiFreshness(metric) {
 // src/health/skills.ts
 init_fs();
 import { readFile as readFile27 } from "fs/promises";
-import path53 from "path";
+import path54 from "path";
 var EMPTY = { skills: [], skillForFile: () => null };
 async function loadSkillOwnership(cwd) {
-  const manifestPath = path53.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path54.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return EMPTY;
   }
@@ -16332,7 +16365,7 @@ function normalize(value) {
 
 // src/health/sources/eslint.ts
 import { existsSync as existsSync5 } from "fs";
-import path54 from "path";
+import path55 from "path";
 var CONFIG_FILES = [
   ".eslintrc",
   ".eslintrc.js",
@@ -16346,7 +16379,7 @@ var CONFIG_FILES = [
   "eslint.config.ts"
 ];
 function hasConfig(cwd) {
-  return CONFIG_FILES.some((file) => existsSync5(path54.join(cwd, file)));
+  return CONFIG_FILES.some((file) => existsSync5(path55.join(cwd, file)));
 }
 var eslintAdapter = {
   id: "eslint",
@@ -16371,7 +16404,7 @@ var eslintAdapter = {
     };
   },
   async import(ctx) {
-    const report = path54.join(ctx.cwd, "eslint-report.json");
+    const report = path55.join(ctx.cwd, "eslint-report.json");
     if (!existsSync5(report)) {
       throw new NoImportError("no eslint-report.json");
     }
@@ -16398,7 +16431,7 @@ var eslintAdapter = {
     }
     const findings = [];
     for (const file of data) {
-      const relative = path54.isAbsolute(file.filePath) ? path54.relative(ctx.cwd, file.filePath) : file.filePath;
+      const relative = path55.isAbsolute(file.filePath) ? path55.relative(ctx.cwd, file.filePath) : file.filePath;
       for (const message of file.messages ?? []) {
         const isError = message.severity === 2;
         findings.push(makeFinding({
@@ -16430,9 +16463,9 @@ var eslintAdapter = {
 
 // src/health/sources/typescript.ts
 import { existsSync as existsSync6 } from "fs";
-import path55 from "path";
+import path56 from "path";
 function hasTsconfig(cwd) {
-  return existsSync6(path55.join(cwd, "tsconfig.json"));
+  return existsSync6(path56.join(cwd, "tsconfig.json"));
 }
 var typescriptAdapter = {
   id: "typescript",
@@ -16506,7 +16539,7 @@ __export(exports_service5, {
 });
 import { existsSync as existsSync7 } from "fs";
 import { mkdir as mkdir21, readFile as readFile30, readdir as readdir11, writeFile as writeFile17 } from "fs/promises";
-import path60 from "path";
+import path61 from "path";
 
 // src/lib/git-env.ts
 var GIT_DISCOVERY_OVERRIDE_VARS = [
@@ -16531,7 +16564,7 @@ function withoutGitDiscoveryOverrides(env) {
 init_fs();
 init_guard();
 import { readFile as readFile28 } from "fs/promises";
-import path56 from "path";
+import path57 from "path";
 
 // src/metrics/record.ts
 var RELIABILITIES = new Set(["exact", "estimated", "unknown"]);
@@ -16546,7 +16579,7 @@ var RETRY_TYPES = new Set([
 
 // src/metrics/lifecycle.ts
 async function readArtifactPointer(root, expected) {
-  const pointerFile = path56.join(root, "latest.json");
+  const pointerFile = path57.join(root, "latest.json");
   if (!await pathExists(pointerFile))
     return { status: "missing", pointer: null };
   let pointer;
@@ -16555,7 +16588,7 @@ async function readArtifactPointer(root, expected) {
   } catch {
     return { status: "stale", pointer: null, reason: "latest pointer is invalid JSON" };
   }
-  const recordFile = pointer.record ? path56.join(root, pointer.record) : null;
+  const recordFile = pointer.record ? path57.join(root, pointer.record) : null;
   if (!recordFile || !isPathInside(root, recordFile) || !await pathExists(recordFile)) {
     return { status: "stale", pointer, reason: "pointer record is missing" };
   }
@@ -16571,9 +16604,9 @@ init_guard();
 // src/testing/capability.ts
 init_fs();
 init_json();
-import path57 from "path";
+import path58 from "path";
 async function isTestingCapabilityEnabled(cwd, capability) {
-  const manifestPath = path57.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path58.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return false;
   }
@@ -16599,10 +16632,10 @@ async function isTestingCapabilityEnabled(cwd, capability) {
 init_fs();
 init_guard();
 import { readFile as readFile29, mkdir as mkdir20, writeFile as writeFile16 } from "fs/promises";
-import path58 from "path";
+import path59 from "path";
 var COVERAGE_MAP_SCHEMA_VERSION = 1;
 function coverageMapPath(cwd, cfg) {
-  return path58.isAbsolute(cfg.coverageMap.artifact) ? cfg.coverageMap.artifact : path58.join(cwd, cfg.coverageMap.artifact);
+  return path59.isAbsolute(cfg.coverageMap.artifact) ? cfg.coverageMap.artifact : path59.join(cwd, cfg.coverageMap.artifact);
 }
 async function loadCoverageMap(cwd, cfg) {
   const file = coverageMapPath(cwd, cfg);
@@ -16676,20 +16709,20 @@ function normalizePath4(file) {
 }
 
 // src/testing/selection.ts
-import path59 from "path";
+import path60 from "path";
 var TEST_FILE_RE = /(^|\/)(__tests__\/.*|.*\.(test|spec)\.[cm]?[tj]sx?$|e2e\/.*\.[cm]?[tj]sx?$|tests\/.*\.[cm]?[tj]sx?$)/;
 function normalizePath5(file) {
   return file.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function relatedByNamingAndDirectory(target, testFiles) {
   const normalized = normalizePath5(target);
-  const ext = path59.extname(normalized);
+  const ext = path60.extname(normalized);
   const withoutExt = ext ? normalized.slice(0, -ext.length) : normalized;
-  const base = path59.basename(withoutExt);
-  const dir = path59.dirname(normalized);
+  const base = path60.basename(withoutExt);
+  const dir = path60.dirname(normalized);
   return testFiles.filter((file) => {
-    const fileDir = path59.dirname(file);
-    const fileBase = path59.basename(file);
+    const fileDir = path60.dirname(file);
+    const fileBase = path60.basename(file);
     return file.startsWith(`${withoutExt}.`) || file.includes(`${withoutExt}.`) || fileDir === dir && fileBase.startsWith(`${base}.`) || fileDir.startsWith(dir) && fileBase.includes(base);
   }).sort();
 }
@@ -16804,7 +16837,7 @@ var DEFAULT_TESTING_CONFIG = {
   }
 };
 function testingDataRoot(cwd) {
-  return path60.join(cwd, ".metaproject", "data", "testing");
+  return path61.join(cwd, ".metaproject", "data", "testing");
 }
 async function computeTestingContext(cwd) {
   const { files, incompleteReasons } = await listProjectFiles(cwd);
@@ -16979,7 +17012,7 @@ async function runTesting(input) {
   return runResult;
 }
 async function loadTestingContext(cwd) {
-  const file = path60.join(testingDataRoot(cwd), "context.json");
+  const file = path61.join(testingDataRoot(cwd), "context.json");
   if (!await pathExists(file)) {
     return null;
   }
@@ -16990,18 +17023,18 @@ async function loadTestingContext(cwd) {
   }
 }
 async function loadTestingReport(cwd) {
-  const file = path60.join(testingDataRoot(cwd), "artifacts", "latest.json");
+  const file = path61.join(testingDataRoot(cwd), "artifacts", "latest.json");
   if (!await pathExists(file)) {
     return null;
   }
   try {
     const latest = JSON.parse(await readFile30(file, "utf8"));
     if (typeof latest.record === "string") {
-      const pointer = await readArtifactPointer(path60.join(testingDataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
+      const pointer = await readArtifactPointer(path61.join(testingDataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
       if (pointer.status !== "fresh")
         return null;
-      const recordFile = path60.join(testingDataRoot(cwd), "artifacts", latest.record);
-      if (!isPathInside(path60.join(testingDataRoot(cwd), "artifacts"), recordFile))
+      const recordFile = path61.join(testingDataRoot(cwd), "artifacts", latest.record);
+      if (!isPathInside(path61.join(testingDataRoot(cwd), "artifacts"), recordFile))
         return null;
       if (!await pathExists(recordFile))
         return null;
@@ -17049,25 +17082,25 @@ async function ensureContext(cwd) {
 async function writeContext(cwd, context) {
   const root = testingDataRoot(cwd);
   await mkdir21(root, { recursive: true });
-  await writeFile17(path60.join(root, "context.json"), `${JSON.stringify(context, null, 2)}
+  await writeFile17(path61.join(root, "context.json"), `${JSON.stringify(context, null, 2)}
 `, "utf8");
-  await writeFile17(path60.join(root, "context.md"), renderContextMarkdown(context), "utf8");
-  await writeFile17(path60.join(root, "recommendations.md"), renderRecommendationsMarkdown(context), "utf8");
+  await writeFile17(path61.join(root, "context.md"), renderContextMarkdown(context), "utf8");
+  await writeFile17(path61.join(root, "recommendations.md"), renderRecommendationsMarkdown(context), "utf8");
 }
 async function writeReport(cwd, report) {
   const root = testingDataRoot(cwd);
-  const artifacts = path60.join(root, "artifacts");
-  const history = path60.join(root, "history");
+  const artifacts = path61.join(root, "artifacts");
+  const history = path61.join(root, "history");
   await mkdir21(artifacts, { recursive: true });
   await mkdir21(history, { recursive: true });
   const stamp = report.generatedAt.replace(/[:.]/g, "-");
-  const json = path60.join(artifacts, "latest.json");
-  const markdown = path60.join(artifacts, "latest.md");
+  const json = path61.join(artifacts, "latest.json");
+  const markdown = path61.join(artifacts, "latest.md");
   const serialized = `${JSON.stringify(report, null, 2)}
 `;
   if (report.runId) {
-    const runJson = path60.join(artifacts, "runs", `${report.runId}.json`);
-    const runMarkdown = path60.join(artifacts, "runs", `${report.runId}.md`);
+    const runJson = path61.join(artifacts, "runs", `${report.runId}.json`);
+    const runMarkdown = path61.join(artifacts, "runs", `${report.runId}.md`);
     if (await pathExists(runJson))
       throw new Error(`immutable testing run already exists: ${report.runId}`);
     await writeFileAtomic(runJson, serialized);
@@ -17078,25 +17111,25 @@ async function writeReport(cwd, report) {
       branch: report.provenance?.branch ?? null,
       worktree: report.provenance?.worktree ?? null,
       generated_at: report.generatedAt,
-      record: path60.posix.join("runs", `${report.runId}.json`)
+      record: path61.posix.join("runs", `${report.runId}.json`)
     }, null, 2)}
 `);
   } else {
     await writeFile17(json, serialized, "utf8");
   }
   await writeFile17(markdown, renderReportMarkdown3(report), "utf8");
-  await writeFile17(path60.join(history, `${stamp}.json`), serialized, "utf8");
+  await writeFile17(path61.join(history, `${stamp}.json`), serialized, "utf8");
   return {
-    markdownPath: path60.relative(cwd, markdown),
-    jsonPath: path60.relative(cwd, json)
+    markdownPath: path61.relative(cwd, markdown),
+    jsonPath: path61.relative(cwd, json)
   };
 }
 async function writeRawLog(cwd, raw) {
-  const logs = path60.join(testingDataRoot(cwd), "logs");
+  const logs = path61.join(testingDataRoot(cwd), "logs");
   await mkdir21(logs, { recursive: true });
-  const latest = path60.join(logs, "latest.raw.log");
+  const latest = path61.join(logs, "latest.raw.log");
   await writeFile17(latest, raw, "utf8");
-  return path60.relative(cwd, latest);
+  return path61.relative(cwd, latest);
 }
 async function listProjectFiles(cwd) {
   const out = [];
@@ -17109,11 +17142,11 @@ async function walk3(root, dir, out, incompleteReasons) {
   try {
     entries = await readdir11(dir, { withFileTypes: true });
   } catch (error) {
-    incompleteReasons.push(`${normalizePath6(path60.relative(root, dir)) || "."}: ${error instanceof Error ? error.message : String(error)}`);
+    incompleteReasons.push(`${normalizePath6(path61.relative(root, dir)) || "."}: ${error instanceof Error ? error.message : String(error)}`);
     return;
   }
   for (const entry of entries) {
-    const abs = path60.join(dir, entry.name);
+    const abs = path61.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (IGNORED_DIRS2.has(entry.name) || entry.name.startsWith(".tmp-")) {
         continue;
@@ -17122,12 +17155,12 @@ async function walk3(root, dir, out, incompleteReasons) {
       continue;
     }
     if (entry.isFile()) {
-      out.push(normalizePath6(path60.relative(root, abs)));
+      out.push(normalizePath6(path61.relative(root, abs)));
     }
   }
 }
 async function readPackageJson(cwd) {
-  const file = path60.join(cwd, "package.json");
+  const file = path61.join(cwd, "package.json");
   if (!await pathExists(file)) {
     return null;
   }
@@ -17138,7 +17171,7 @@ async function readPackageJson(cwd) {
   }
 }
 async function loadTestingConfig(cwd) {
-  const file = path60.join(cwd, ".metaproject", "testing.config.json");
+  const file = path61.join(cwd, ".metaproject", "testing.config.json");
   if (!await pathExists(file)) {
     return DEFAULT_TESTING_CONFIG;
   }
@@ -17203,7 +17236,7 @@ function detectFrameworks(input) {
 async function extractConventions(cwd, files) {
   const conventions = new Set;
   for (const file of files.slice(0, 40)) {
-    const abs = path60.join(cwd, file);
+    const abs = path61.join(cwd, file);
     if (!await pathExists(abs)) {
       continue;
     }
@@ -17333,7 +17366,7 @@ async function findTestsByImportedTargets(cwd, targets, testFiles) {
   const targetKeys = new Set(targets.map((target) => modulePathKey(normalizePath6(target))));
   const selected = new Set;
   for (const testFile of testFiles) {
-    const absoluteTest = path60.join(cwd, testFile);
+    const absoluteTest = path61.join(cwd, testFile);
     if (!await pathExists(absoluteTest)) {
       continue;
     }
@@ -17367,10 +17400,10 @@ function resolveImportPath(cwd, testFile, importPath) {
   if (!importPath.startsWith(".")) {
     return null;
   }
-  const importerDir = path60.dirname(testFile);
-  const absoluteResolved = path60.resolve(path60.join(cwd, importerDir), importPath);
-  const relative = path60.relative(cwd, absoluteResolved);
-  if (relative.startsWith(`..${path60.sep}`) || relative === "..") {
+  const importerDir = path61.dirname(testFile);
+  const absoluteResolved = path61.resolve(path61.join(cwd, importerDir), importPath);
+  const relative = path61.relative(cwd, absoluteResolved);
+  if (relative.startsWith(`..${path61.sep}`) || relative === "..") {
     return null;
   }
   const relativeNormalized = normalizePath6(relative);
@@ -17422,13 +17455,13 @@ function resolveTestCommand(cwd, context, input) {
 }
 var BUN_LOCKFILES = ["bun.lock", "bun.lockb"];
 function detectPackageManager(cwd) {
-  if (resolveBunBin() && BUN_LOCKFILES.some((name) => pathExistsSync(path60.join(cwd, name)))) {
+  if (resolveBunBin() && BUN_LOCKFILES.some((name) => pathExistsSync(path61.join(cwd, name)))) {
     return "bun";
   }
-  if (Bun.which("pnpm") && pathExistsSync(path60.join(cwd, "pnpm-lock.yaml"))) {
+  if (Bun.which("pnpm") && pathExistsSync(path61.join(cwd, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (Bun.which("yarn") && pathExistsSync(path60.join(cwd, "yarn.lock"))) {
+  if (Bun.which("yarn") && pathExistsSync(path61.join(cwd, "yarn.lock"))) {
     return "yarn";
   }
   return "npm";
@@ -17768,7 +17801,7 @@ async function compatibleReportForHealth(ctx) {
 
 // src/health/sources/dependency-audit.ts
 import { existsSync as existsSync8 } from "fs";
-import path61 from "path";
+import path62 from "path";
 function auditSeverityToPriority(severity) {
   if (severity === "critical" || severity === "high")
     return "P0";
@@ -17887,7 +17920,7 @@ var LOCKFILE_COMMANDS = [
 ];
 function auditCommand(cwd) {
   for (const entry of LOCKFILE_COMMANDS) {
-    if (!entry.lockfiles.some((name) => existsSync8(path61.join(cwd, name))))
+    if (!entry.lockfiles.some((name) => existsSync8(path62.join(cwd, name))))
       continue;
     const bin = resolveBin(cwd, entry.bin);
     if (bin)
@@ -17946,13 +17979,13 @@ var dependencyAuditAdapter = {
 
 // src/health/sources/sonarqube.ts
 import { existsSync as existsSync9 } from "fs";
-import path62 from "path";
+import path63 from "path";
 var REPORT_FILES = ["sonar-issues.json", ".metaproject/data/health/sonar-issues.json"];
 function reportPath(cwd) {
   const fromEnv = process.env.SONAR_ISSUES_FILE;
   const candidates = fromEnv ? [fromEnv, ...REPORT_FILES] : REPORT_FILES;
   for (const rel of candidates) {
-    const abs = path62.isAbsolute(rel) ? rel : path62.join(cwd, rel);
+    const abs = path63.isAbsolute(rel) ? rel : path63.join(cwd, rel);
     if (existsSync9(abs)) {
       return abs;
     }
@@ -18036,7 +18069,7 @@ var sonarqubeAdapter = {
 function relativizeComponent(component, cwd) {
   const colon = component.indexOf(":");
   const value = colon >= 0 ? component.slice(colon + 1) : component;
-  return path62.isAbsolute(value) ? path62.relative(cwd, value) : value;
+  return path63.isAbsolute(value) ? path63.relative(cwd, value) : value;
 }
 
 // src/health/sources/index.ts
@@ -18366,19 +18399,19 @@ function filteredInfo(source, cfg) {
   };
 }
 async function writeOutputs(cwd, report, config, stamp) {
-  const artifacts = path63.join(dataRoot(cwd), "artifacts");
-  const history = path63.join(dataRoot(cwd), "history");
+  const artifacts = path64.join(dataRoot(cwd), "artifacts");
+  const history = path64.join(dataRoot(cwd), "history");
   await mkdir22(artifacts, { recursive: true });
   await mkdir22(history, { recursive: true });
-  const markdown = path63.join(artifacts, "latest.md");
-  const json = path63.join(artifacts, "latest.json");
-  const historyJson = path63.join(history, `${stamp}.json`);
+  const markdown = path64.join(artifacts, "latest.md");
+  const json = path64.join(artifacts, "latest.json");
+  const historyJson = path64.join(history, `${stamp}.json`);
   const serialized = `${JSON.stringify(report, null, 2)}
 `;
   await writeFile18(markdown, renderReportMarkdown2(report, config), "utf8");
   if (report.runId) {
-    const runJson = path63.join(artifacts, "runs", `${report.runId}.json`);
-    const runMarkdown = path63.join(artifacts, "runs", `${report.runId}.md`);
+    const runJson = path64.join(artifacts, "runs", `${report.runId}.json`);
+    const runMarkdown = path64.join(artifacts, "runs", `${report.runId}.md`);
     if (await pathExists(runJson))
       throw new Error(`immutable health run already exists: ${report.runId}`);
     await writeFileAtomic(runJson, serialized);
@@ -18389,7 +18422,7 @@ async function writeOutputs(cwd, report, config, stamp) {
       branch: report.provenance?.branch ?? null,
       worktree: report.provenance?.worktree ?? null,
       generated_at: report.generatedAt,
-      record: path63.posix.join("runs", `${report.runId}.json`)
+      record: path64.posix.join("runs", `${report.runId}.json`)
     }, null, 2)}
 `);
   } else {
@@ -18397,8 +18430,8 @@ async function writeOutputs(cwd, report, config, stamp) {
   }
   await writeFile18(historyJson, serialized, "utf8");
   return {
-    markdownPath: path63.relative(cwd, markdown),
-    jsonPath: path63.relative(cwd, json)
+    markdownPath: path64.relative(cwd, markdown),
+    jsonPath: path64.relative(cwd, json)
   };
 }
 async function resolveChanged(cwd, selector) {
@@ -18451,7 +18484,7 @@ function hasGateShape(value) {
   return Array.isArray(report.metrics) && Array.isArray(report.sources) && Array.isArray(report.findings);
 }
 async function readLatest(cwd) {
-  const file = path64.join(dataRoot(cwd), "artifacts", "latest.json");
+  const file = path65.join(dataRoot(cwd), "artifacts", "latest.json");
   if (!await pathExists(file)) {
     return null;
   }
@@ -18462,11 +18495,11 @@ async function readLatest(cwd) {
     const latest = read.value;
     const record = latest.record;
     if (typeof record === "string") {
-      const pointer = await readArtifactPointer(path64.join(dataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
+      const pointer = await readArtifactPointer(path65.join(dataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
       if (pointer.status !== "fresh")
         return null;
-      const recordFile = path64.join(dataRoot(cwd), "artifacts", record);
-      if (!isPathInside(path64.join(dataRoot(cwd), "artifacts"), recordFile))
+      const recordFile = path65.join(dataRoot(cwd), "artifacts", record);
+      if (!isPathInside(path65.join(dataRoot(cwd), "artifacts"), recordFile))
         return null;
       if (!await pathExists(recordFile))
         return null;
@@ -18539,7 +18572,7 @@ function createCodeHealthService() {
   return {
     run: (input) => runHealth(input),
     async status(input) {
-      const enabled = await pathExists(path64.join(input.cwd, ".metaproject", "health.config.json"));
+      const enabled = await pathExists(path65.join(input.cwd, ".metaproject", "health.config.json"));
       const latest = await readLatest(input.cwd);
       const project = latest?.metrics.find((m) => m.key === "project") ?? null;
       const decliningScopes = latest ? latest.metrics.filter((m) => m.regression_score > 0).length : 0;
@@ -18607,7 +18640,7 @@ __export(exports_service7, {
   createJobService: () => createJobService
 });
 import { copyFile, mkdir as mkdir24 } from "fs/promises";
-import path67 from "path";
+import path68 from "path";
 
 // src/job/types.ts
 var JOB_INTENTS = ["implement", "analyze", "review", "custom"];
@@ -18745,12 +18778,12 @@ function defaultPlan(intent) {
 
 // src/job/store.ts
 import { appendFile as appendFile4, mkdir as mkdir23, readFile as readFile32, readdir as readdir12 } from "fs/promises";
-import path66 from "path";
+import path67 from "path";
 
 // src/gdskills/contracts.ts
 import { readFile as readFile31 } from "fs/promises";
 import { existsSync as existsSync10 } from "fs";
-import path65 from "path";
+import path66 from "path";
 import { fileURLToPath } from "url";
 var CONTRACTS = [
   {
@@ -18873,10 +18906,10 @@ async function loadSchema(name) {
   return JSON.parse(raw);
 }
 function contractPath(contract) {
-  const here = path65.dirname(fileURLToPath(import.meta.url));
+  const here = path66.dirname(fileURLToPath(import.meta.url));
   if (contract.sourcePath) {
-    for (const root of [path65.join(here, "..", ".."), path65.join(here, ".."), here]) {
-      const candidate = path65.resolve(root, contract.sourcePath);
+    for (const root of [path66.join(here, "..", ".."), path66.join(here, ".."), here]) {
+      const candidate = path66.resolve(root, contract.sourcePath);
       if (existsSync10(candidate)) {
         return candidate;
       }
@@ -18886,7 +18919,7 @@ function contractPath(contract) {
   if (existsSync10(directPath)) {
     return directPath;
   }
-  const packagedSourcePath = path65.join(here, "..", "src", "gdskills", "contracts", contract.fileName);
+  const packagedSourcePath = path66.join(here, "..", "src", "gdskills", "contracts", contract.fileName);
   if (existsSync10(packagedSourcePath)) {
     return packagedSourcePath;
   }
@@ -18900,13 +18933,13 @@ var SCHEMA_ROOTS = [
 // src/job/store.ts
 init_fs();
 function jobsRoot(cwd) {
-  return path66.join(cwd, ".metaproject", "jobs");
+  return path67.join(cwd, ".metaproject", "jobs");
 }
 function jobDir(cwd, name) {
-  return path66.join(jobsRoot(cwd), name);
+  return path67.join(jobsRoot(cwd), name);
 }
 function jobStatePath(cwd, name) {
-  return path66.join(jobDir(cwd, name), "state.json");
+  return path67.join(jobDir(cwd, name), "state.json");
 }
 var JOB_NAME_PATTERN = /^[a-z0-9-]+$/;
 function assertJobName(name) {
@@ -18943,12 +18976,12 @@ async function writeJob(cwd, name, state) {
 `));
   }
   const file = jobStatePath(cwd, name);
-  await mkdir23(path66.dirname(file), { recursive: true });
+  await mkdir23(path67.dirname(file), { recursive: true });
   await writeFileAtomic(file, `${JSON.stringify(state, null, 2)}
 `);
 }
 async function appendJournal2(cwd, name, at, line) {
-  await appendFile4(path66.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
+  await appendFile4(path67.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
 `, "utf8");
 }
 function renderJournal2(name, at) {
@@ -18969,7 +19002,7 @@ function assertDocumentType(raw) {
   return raw;
 }
 function documentFileName(type, sourcePath) {
-  const extension = path66.extname(sourcePath) || ".md";
+  const extension = path67.extname(sourcePath) || ".md";
   return `${type}${extension}`;
 }
 
@@ -18977,7 +19010,7 @@ function documentFileName(type, sourcePath) {
 function createJobService(deps) {
   const now = () => deps.now().toISOString();
   function lockPath(cwd, name) {
-    return path67.join(jobsRoot(cwd), `.job-lock-${name}`);
+    return path68.join(jobsRoot(cwd), `.job-lock-${name}`);
   }
   async function mutate(cwd, name, run) {
     assertJobName(name);
@@ -19026,20 +19059,20 @@ function createJobService(deps) {
         },
         plan: { steps: defaultPlan(intent) },
         documentation: {
-          job_path: path67.join(".metaproject", "jobs", name),
+          job_path: path68.join(".metaproject", "jobs", name),
           documents_created: []
         },
         metrics: { steps: [] },
-        jobs_root: path67.join(".metaproject", "jobs"),
+        jobs_root: path68.join(".metaproject", "jobs"),
         updated_at: createdAt
       };
       const first = firstOpenStep(state.plan.steps);
       if (first) {
         state.plan.current_step = first.id;
       }
-      await writeFileAtomic(path67.join(absolute, "journal.md"), renderJournal2(name, createdAt));
+      await writeFileAtomic(path68.join(absolute, "journal.md"), renderJournal2(name, createdAt));
       await writeJob(input.cwd, name, state);
-      return { state, dir: path67.relative(input.cwd, absolute) };
+      return { state, dir: path68.relative(input.cwd, absolute) };
     },
     async status({ cwd, name }) {
       assertJobName(name);
@@ -19051,7 +19084,7 @@ function createJobService(deps) {
       }
       return {
         state,
-        dir: path67.join(".metaproject", "jobs", name),
+        dir: path68.join(".metaproject", "jobs", name),
         stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
         stepsTotal: state.plan.steps.length,
         nextStep: firstOpenStep(state.plan.steps),
@@ -19108,23 +19141,23 @@ function createJobService(deps) {
       if (!input.file) {
         throw new Error("Missing --file. Usage: keryx job document <name> --type <type> --file <path>");
       }
-      const source = path67.isAbsolute(input.file) ? input.file : path67.join(input.cwd, input.file);
+      const source = path68.isAbsolute(input.file) ? input.file : path68.join(input.cwd, input.file);
       if (!await pathExists(source)) {
         throw new Error(`--file not found: ${input.file}. Write the document first, then record it.`);
       }
       let recorded;
       await mutate(input.cwd, input.name, async (state) => {
         const fileName = documentFileName(type, source);
-        const target = path67.join(jobDir(input.cwd, state.job_name), fileName);
+        const target = path68.join(jobDir(input.cwd, state.job_name), fileName);
         await copyFile(source, target);
         state.documentation ??= {};
-        state.documentation.job_path ??= path67.join(".metaproject", "jobs", state.job_name);
+        state.documentation.job_path ??= path68.join(".metaproject", "jobs", state.job_name);
         const created = state.documentation.documents_created ?? [];
         state.documentation.documents_created = created.includes(fileName) ? created : [...created, fileName];
         recorded = {
           state,
           document: fileName,
-          path: path67.join(".metaproject", "jobs", state.job_name, fileName)
+          path: path68.join(".metaproject", "jobs", state.job_name, fileName)
         };
         return { state, event: "document", detail: `${type} -> ${fileName}` };
       });
@@ -19159,7 +19192,7 @@ function createJobService(deps) {
             name: state.job_name,
             phase: state.phase,
             intent: state.intent,
-            dir: path67.join(".metaproject", "jobs", name),
+            dir: path68.join(".metaproject", "jobs", name),
             stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
             stepsTotal: state.plan.steps.length,
             nextStep: firstOpenStep(state.plan.steps)?.id ?? null
@@ -19180,24 +19213,24 @@ __export(exports_service8, {
 });
 import { createHash as createHash10 } from "crypto";
 import { mkdir as mkdir26, readFile as readFile37, writeFile as writeFile20 } from "fs/promises";
-import path73 from "path";
+import path74 from "path";
 
 // src/memory/check.ts
 init_fs();
 init_store();
-import path69 from "path";
+import path70 from "path";
 
 // src/memory/cross-layer.ts
 init_collect();
 init_section_index();
 init_section_tombstone();
 import { readFile as readFile33 } from "fs/promises";
-import path68 from "path";
+import path69 from "path";
 var MARKDOWN_LINK_RE = /\[[^\]]*\]\(([^)\s]+)\)/g;
 var SECTION_REF_RE = /keryx:page\/[a-z0-9][a-z0-9._-]*(?:#[a-z0-9][a-z0-9._-]*)?/gi;
 function extractWikiReferences(entryRelativePath, entryAbsolutePath, content, wikiRoot) {
   const references = [];
-  const entryDir = path68.dirname(entryAbsolutePath);
+  const entryDir = path69.dirname(entryAbsolutePath);
   const lines = content.split(`
 `);
   for (let index = 0;index < lines.length; index += 1) {
@@ -19212,16 +19245,16 @@ function extractWikiReferences(entryRelativePath, entryAbsolutePath, content, wi
       if (withoutAnchor.length === 0) {
         continue;
       }
-      const absolute = path68.resolve(entryDir, withoutAnchor);
-      const relativeToWiki = path68.relative(wikiRoot, absolute);
-      if (relativeToWiki.startsWith("..") || path68.isAbsolute(relativeToWiki)) {
+      const absolute = path69.resolve(entryDir, withoutAnchor);
+      const relativeToWiki = path69.relative(wikiRoot, absolute);
+      if (relativeToWiki.startsWith("..") || path69.isAbsolute(relativeToWiki)) {
         continue;
       }
       references.push({
         entry: entryRelativePath,
         kind: "page-path",
         raw: href,
-        target: relativeToWiki.split(path68.sep).join("/"),
+        target: relativeToWiki.split(path69.sep).join("/"),
         line
       });
     }
@@ -19241,7 +19274,7 @@ function isDangling(finding) {
   return finding.state !== "intact";
 }
 async function loadWikiKnowledgeView(cwd) {
-  const wikiRoot = path68.join(cwd, ".metaproject", "wiki");
+  const wikiRoot = path69.join(cwd, ".metaproject", "wiki");
   const pages = await collectPages(cwd);
   const index = buildSectionIndex(await Promise.all(pages.map(async (page) => ({
     page,
@@ -19466,7 +19499,7 @@ async function checkMemory(cwd, config) {
     }
     for (const file of entry.scopes.files) {
       const clean = file.replace(/^`|`$/g, "");
-      if (!await pathExists(path69.resolve(cwd, clean))) {
+      if (!await pathExists(path70.resolve(cwd, clean))) {
         issues.push({ path: entry.relativePath, kind: "link", message: `related file not found: ${clean}` });
       }
     }
@@ -19518,19 +19551,19 @@ init_types();
 init_store();
 import { existsSync as existsSync11 } from "fs";
 import { readFile as readFile35 } from "fs/promises";
-import path71 from "path";
+import path72 from "path";
 
 // src/memory/write.ts
 init_guard();
 init_store();
 init_types();
 import { mkdir as mkdir25, open, readFile as readFile34, rename as rename5, rm as rm4, writeFile as writeFile19 } from "fs/promises";
-import path70 from "path";
+import path71 from "path";
 async function resolveCanonicalEntryPath(cwd, relativePath) {
-  const root = path70.resolve(memoryRoot(cwd));
-  const absolutePath = path70.resolve(root, relativePath);
-  const normalized = toPosix2(path70.relative(root, absolutePath));
-  if (!normalized || normalized.startsWith("../") || path70.isAbsolute(normalized) || !normalized.endsWith(".md")) {
+  const root = path71.resolve(memoryRoot(cwd));
+  const absolutePath = path71.resolve(root, relativePath);
+  const normalized = toPosix2(path71.relative(root, absolutePath));
+  if (!normalized || normalized.startsWith("../") || path71.isAbsolute(normalized) || !normalized.endsWith(".md")) {
     return null;
   }
   return { absolutePath, relativePath: normalized };
@@ -19626,9 +19659,9 @@ function validateNextEntry(relativePath, content) {
   return null;
 }
 async function replaceAtomically(target, content) {
-  const dir = path70.dirname(target);
+  const dir = path71.dirname(target);
   await mkdir25(dir, { recursive: true });
-  const tmp = path70.join(dir, `.${path70.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
+  const tmp = path71.join(dir, `.${path71.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
   try {
     await writeFile19(tmp, content, "utf8");
     const file = await open(tmp, "r");
@@ -19664,7 +19697,7 @@ function header(content, name) {
   return content.match(new RegExp(`^${name}:\\s*(.+)$`, "mi"))?.[1]?.trim() ?? null;
 }
 function toPosix2(value) {
-  return value.split(path70.sep).join("/");
+  return value.split(path71.sep).join("/");
 }
 function message(cause) {
   return cause instanceof Error ? cause.message : String(cause);
@@ -19684,7 +19717,7 @@ var SOURCE_CONFIDENCE = {
   "skill-verifier": "medium"
 };
 async function ingestMemory(cwd, source, filePath, config, now) {
-  const absolute = path71.resolve(cwd, filePath);
+  const absolute = path72.resolve(cwd, filePath);
   if (!await pathExists(absolute)) {
     throw new Error(`Ingest source not found: ${filePath}`);
   }
@@ -19701,8 +19734,8 @@ async function ingestMemory(cwd, source, filePath, config, now) {
   const securityWarnings = [];
   const securitySkipped = [];
   let skippedDuplicates = 0;
-  const dir = path71.join(memoryRoot(cwd), folder);
-  const link = path71.relative(cwd, absolute);
+  const dir = path72.join(memoryRoot(cwd), folder);
+  const link = path72.relative(cwd, absolute);
   const date = dateString(now);
   for (const text of candidates) {
     const title = toTitle(text);
@@ -19883,7 +19916,7 @@ function uniqueSlug(dir, title) {
   const base = slugify3(title) || "entry";
   let slug = base;
   let counter = 2;
-  while (existsSync11(path71.join(dir, `${slug}.md`))) {
+  while (existsSync11(path72.join(dir, `${slug}.md`))) {
     slug = `${base}-${counter}`;
     counter += 1;
   }
@@ -19903,7 +19936,7 @@ init_store();
 init_fs();
 init_store();
 import { readFile as readFile36 } from "fs/promises";
-import path72 from "path";
+import path73 from "path";
 async function supersedeEntry(input, now) {
   const date = input.date ?? now.toISOString().slice(0, 10);
   const today = now.toISOString().slice(0, 10);
@@ -19963,12 +19996,12 @@ async function supersedeEntry(input, now) {
 async function resolveEntryPath(cwd, raw) {
   const root = memoryRoot(cwd);
   const candidates = [
-    path72.resolve(cwd, raw),
-    path72.resolve(root, raw),
-    path72.isAbsolute(raw) ? raw : path72.join(cwd, raw)
+    path73.resolve(cwd, raw),
+    path73.resolve(root, raw),
+    path73.isAbsolute(raw) ? raw : path73.join(cwd, raw)
   ];
   for (const absolute of candidates) {
-    const confined = await resolveCanonicalEntryPath(cwd, path72.relative(root, absolute));
+    const confined = await resolveCanonicalEntryPath(cwd, path73.relative(root, absolute));
     if (confined && await pathExists(confined.absolutePath)) {
       return { absolute: confined.absolutePath, relative: confined.relativePath };
     }
@@ -20102,7 +20135,7 @@ Main memory content.
 init_embedding();
 init_types();
 function dataRoot2(cwd) {
-  return path73.join(cwd, ".metaproject", "data", "memory");
+  return path74.join(cwd, ".metaproject", "data", "memory");
 }
 function createMemoryService() {
   const reportStore = createMemoryReportStore();
@@ -20117,9 +20150,9 @@ function createMemoryService() {
       if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
         throw new Error(`Invalid slug: ${slug}. Use lowercase letters, digits, and hyphens.`);
       }
-      const dir = path73.join(memoryRoot(input.cwd), typeConfig.folder);
-      const filePath = path73.join(dir, `${slug}.md`);
-      const relativePath = path73.relative(input.cwd, filePath);
+      const dir = path74.join(memoryRoot(input.cwd), typeConfig.folder);
+      const filePath = path74.join(dir, `${slug}.md`);
+      const relativePath = path74.relative(input.cwd, filePath);
       if (await pathExists(filePath) && !input.force) {
         throw new Error(`Entry already exists: ${relativePath}. Use --force to overwrite.`);
       }
@@ -20150,9 +20183,9 @@ function createMemoryService() {
     async index(input) {
       const entries = await collectEntries(input.cwd);
       const generatedAt = new Date().toISOString();
-      const indexDir = path73.join(dataRoot2(input.cwd), "index");
+      const indexDir = path74.join(dataRoot2(input.cwd), "index");
       await mkdir26(indexDir, { recursive: true });
-      const indexPath = path73.join(indexDir, "index.json");
+      const indexPath = path74.join(indexDir, "index.json");
       await writeFile20(indexPath, `${JSON.stringify({
         catalogVersion: 1,
         sourceFingerprint: createHash10("sha256").update(JSON.stringify(entries.map((e) => ({
@@ -20173,7 +20206,7 @@ function createMemoryService() {
       }, null, 2)}
 `, "utf8");
       const result = {
-        path: path73.relative(input.cwd, indexPath),
+        path: path74.relative(input.cwd, indexPath),
         entryCount: entries.length,
         generatedAt
       };
@@ -20186,7 +20219,7 @@ function createMemoryService() {
           const built = await buildEmbeddingIndex(input.cwd, entries, embedder.embed, embedder.model, new Date);
           result.embeddings = {
             built: true,
-            path: path73.relative(input.cwd, embeddingsDir(input.cwd)),
+            path: path74.relative(input.cwd, embeddingsDir(input.cwd)),
             vectorCount: built.meta.entryCount,
             model: built.meta.model
           };
@@ -20371,12 +20404,12 @@ __export(exports_service9, {
 init_assembly();
 import { createHash as createHash15, randomUUID as randomUUID4 } from "crypto";
 import { appendFile as appendFile5, mkdir as mkdir28, open as open2, readFile as readFile40, rename as rename6, rm as rm5, stat as stat9, writeFile as writeFile21 } from "fs/promises";
-import path77 from "path";
+import path78 from "path";
 
 // src/sac/index.ts
 import { access as access3, readFile as readFile38, realpath as realpath3 } from "fs/promises";
 import { createHash as createHash11 } from "crypto";
-import path74 from "path";
+import path75 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var idPattern = /^[a-z][a-z0-9-]{2,63}$/;
 var subjectPattern = /^(?:user|team|service|agent):[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -20394,21 +20427,21 @@ var normativeSchemaFiles = {
   "review-decision": "review-decision.schema.json"
 };
 var normativeSchemas = new Map;
-var NORMATIVE_SCHEMA_DIR = path74.join("docs", "requirements", "shared-agent-context", "schemas");
+var NORMATIVE_SCHEMA_DIR = path75.join("docs", "requirements", "shared-agent-context", "schemas");
 async function resolveSacNormativeSchemaPath(fileName, searchFrom = [fileURLToPath2(new URL(".", import.meta.url)), process.cwd()]) {
   const seen = new Set;
   for (const start of searchFrom) {
-    let dir = path74.resolve(start);
+    let dir = path75.resolve(start);
     for (let i = 0;i < 10; i++) {
       if (seen.has(dir))
         break;
       seen.add(dir);
-      const candidate = path74.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
+      const candidate = path75.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
       try {
         await access3(candidate);
         return candidate;
       } catch {}
-      const parent = path74.dirname(dir);
+      const parent = path75.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -21077,12 +21110,12 @@ class SacReferenceError extends Error {
   code = "unsafe_workspace_reference";
 }
 async function resolveWorkspaceReference(input) {
-  if (!workspacePathPattern.test(input.uri) || path74.isAbsolute(input.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input.uri) || input.uri.includes("\\"))
+  if (!workspacePathPattern.test(input.uri) || path75.isAbsolute(input.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input.uri) || input.uri.includes("\\"))
     throw new SacReferenceError("unsafe workspace reference");
-  const lexicalRoot = path74.resolve(input.workspaceRoot);
+  const lexicalRoot = path75.resolve(input.workspaceRoot);
   const root = await realpath3(lexicalRoot);
-  const candidate = path74.resolve(lexicalRoot, input.uri.slice(2));
-  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path74.sep}`))
+  const candidate = path75.resolve(lexicalRoot, input.uri.slice(2));
+  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path75.sep}`))
     throw new SacReferenceError("workspace reference escapes root");
   let resolved;
   try {
@@ -21090,7 +21123,7 @@ async function resolveWorkspaceReference(input) {
   } catch {
     throw new SacReferenceError("workspace reference is not resolvable");
   }
-  if (resolved !== root && !resolved.startsWith(`${root}${path74.sep}`))
+  if (resolved !== root && !resolved.startsWith(`${root}${path75.sep}`))
     throw new SacReferenceError("workspace reference escapes root after realpath");
   return candidate;
 }
@@ -21146,16 +21179,16 @@ async function evaluateStrictSacGuard(input) {
 init_fs();
 import { mkdir as mkdir27, readdir as readdir13, readFile as readFile39 } from "fs/promises";
 import { createHash as createHash12, randomUUID as randomUUID3 } from "crypto";
-import path76 from "path";
+import path77 from "path";
 
 // src/sac/secure-resource-read.ts
 init_contained_read();
 init_descriptor_read();
-import path75 from "path";
+import path76 from "path";
 function readWorkspaceFileNoFollow(workspaceRoot, absolutePath) {
-  const relativePath = path75.relative(workspaceRoot, absolutePath);
-  const components = relativePath.split(path75.sep);
-  if (!relativePath || path75.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
+  const relativePath = path76.relative(workspaceRoot, absolutePath);
+  const components = relativePath.split(path76.sep);
+  if (!relativePath || path76.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
     throw new Error("safe source path is not workspace-relative");
   }
   return readDescriptorChain(workspaceRoot, absolutePath, {
@@ -21182,8 +21215,8 @@ class WorkspaceService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path76.resolve(options.workspaceRoot);
-    this.storageRoot = path76.resolve(options.storageRoot ?? path76.join(this.root, ".metaproject", "workspaces"));
+    this.root = path77.resolve(options.workspaceRoot);
+    this.storageRoot = path77.resolve(options.storageRoot ?? path77.join(this.root, ".metaproject", "workspaces"));
     this.now = options.now ?? (() => new Date);
   }
   async create(input) {
@@ -21508,13 +21541,13 @@ class WorkspaceService {
     return parsed;
   }
   workspaceDir(id) {
-    return path76.join(this.storageRoot, id);
+    return path77.join(this.storageRoot, id);
   }
   manifestPath(id) {
-    return path76.join(this.workspaceDir(id), "workspace.json");
+    return path77.join(this.workspaceDir(id), "workspace.json");
   }
   lockPath(id) {
-    return path76.join(this.storageRoot, `.${id}.lock`);
+    return path77.join(this.storageRoot, `.${id}.lock`);
   }
   timestamp() {
     return this.now().toISOString();
@@ -22303,7 +22336,7 @@ function hasReportIntegrity(report) {
   return reportHashPattern.test(reportDigest) && sha2563(body) === reportDigest;
 }
 async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
-  const configPath = path77.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path78.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile40(configPath, "utf8").catch((error) => {
@@ -22501,9 +22534,9 @@ class FwkReadService {
     const recordedAt = nowIso(now);
     const id = `receipt-${randomUUID4().replace(/-/g, "").slice(0, 16)}`;
     const base = { schemaVersion: "1.0", id, workspaceId, actor, action, decision, recordedAt, cost: { tokens: 0, toolCalls: 1, elapsedMs: 0 }, contextAssembly: { traceRef: assembly.traceRef, configurationRevision: assembly.configurationRevision, selected: assembly.selected.map((id) => `./ids/${id}`), omittedOptional: assembly.omittedOptional.map((id) => `./ids/${id}`) }, policy: { ref: assembly.policyRef, revision: assembly.policyRevision }, ...action === "resource" ? { resourceRef: `./ids/${resourceId ?? "unknown"}` } : {} };
-    const ledger = path77.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
-    const checkpointPath = path77.join(path77.dirname(ledger), "access-receipts.checkpoint.json");
-    await mkdir28(path77.dirname(ledger), { recursive: true, mode: 448 });
+    const ledger = path78.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
+    const checkpointPath = path78.join(path78.dirname(ledger), "access-receipts.checkpoint.json");
+    await mkdir28(path78.dirname(ledger), { recursive: true, mode: 448 });
     return withFileLock(`${ledger}.lock`, async () => {
       const state = await resolveLedgerState(ledger, checkpointPath, this.options.verifyReceiptLedger ?? verifyAccessReceiptLedger);
       const receipt = sealAccessReceipt(base, state.headHash);
@@ -22607,7 +22640,7 @@ function normalizeFwkResult(result) {
 init_fs();
 import { createHash as createHash22, randomUUID as randomUUID7 } from "crypto";
 import { appendFile as appendFile6, mkdir as mkdir32, readdir as readdir15, readFile as readFile49 } from "fs/promises";
-import path87 from "path";
+import path88 from "path";
 
 // src/sac/trusted-wrap-up.ts
 import { createHash as createHash16, randomUUID as randomUUID5 } from "crypto";
@@ -22679,7 +22712,7 @@ function bindingHash(owner, intent) {
 // src/sac/session-wrap-up.ts
 import { createHash as createHash18 } from "crypto";
 import { mkdir as mkdir30, writeFile as writeFile22 } from "fs/promises";
-import path81 from "path";
+import path82 from "path";
 
 // src/session/store.ts
 import {
@@ -22690,7 +22723,7 @@ import {
   renameSync as renameSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import path80 from "path";
+import path81 from "path";
 
 // src/lib/config-dir.ts
 import {
@@ -22735,7 +22768,7 @@ function readTranscriptFile(file) {
 // src/session/paths.ts
 import { existsSync as existsSync12 } from "fs";
 import { homedir } from "os";
-import path78 from "path";
+import path79 from "path";
 function keryxDataDir(override) {
   if (override !== undefined && override.length > 0) {
     return override;
@@ -22747,22 +22780,22 @@ function keryxDataDir(override) {
   const home = homedir();
   if (process.platform === "win32") {
     const appData = process.env.APPDATA;
-    const base = appData !== undefined && appData.length > 0 ? appData : path78.join(home, "AppData", "Roaming");
-    return path78.join(base, "keryx");
+    const base = appData !== undefined && appData.length > 0 ? appData : path79.join(home, "AppData", "Roaming");
+    return path79.join(base, "keryx");
   }
   const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg !== undefined && xdg.length > 0 ? xdg : path78.join(home, ".local", "share");
-  return path78.join(base, "keryx");
+  const base = xdg !== undefined && xdg.length > 0 ? xdg : path79.join(home, ".local", "share");
+  return path79.join(base, "keryx");
 }
 function resolveProjectRoot2(cwd) {
-  const abs = path78.resolve(cwd);
+  const abs = path79.resolve(cwd);
   let dir = abs;
   for (;; ) {
-    const gitPath = path78.join(dir, ".git");
+    const gitPath = path79.join(dir, ".git");
     if (existsSync12(gitPath)) {
       return dir;
     }
-    const parent = path78.dirname(dir);
+    const parent = path79.dirname(dir);
     if (parent === dir) {
       break;
     }
@@ -22771,12 +22804,12 @@ function resolveProjectRoot2(cwd) {
   return abs;
 }
 function projectKeyFromPath(projectPath) {
-  const abs = path78.resolve(projectPath);
+  const abs = path79.resolve(projectPath);
   const encoded = encodeURIComponent(abs);
   if (encoded.length <= 200) {
     return encoded;
   }
-  const base = path78.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40);
+  const base = path79.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40);
   let h = 0;
   for (let i = 0;i < abs.length; i++) {
     h = Math.imul(31, h) + abs.charCodeAt(i) | 0;
@@ -22786,17 +22819,17 @@ function projectKeyFromPath(projectPath) {
 }
 function projectSessionsDir(projectPath, dataDir) {
   const key = projectKeyFromPath(resolveProjectRoot2(projectPath));
-  return path78.join(keryxDataDir(dataDir), "sessions", key);
+  return path79.join(keryxDataDir(dataDir), "sessions", key);
 }
 function sessionDir(projectPath, sessionId, dataDir) {
-  return path78.join(projectSessionsDir(projectPath, dataDir), sessionId);
+  return path79.join(projectSessionsDir(projectPath, dataDir), sessionId);
 }
 
 // src/session/slate.ts
 init_fs();
 init_assembly();
 import { mkdir as mkdir29, readFile as readFile41, rm as rm6 } from "fs/promises";
-import path79 from "path";
+import path80 from "path";
 init_redact();
 var SLATE_SEED_KINDS = [
   "decision",
@@ -22811,7 +22844,7 @@ function isSlateSeedKind(value) {
 }
 var SEED_TEXT_MAX_LENGTH = 4000;
 function slatePath(dir) {
-  return path79.join(dir, "slate.json");
+  return path80.join(dir, "slate.json");
 }
 function slateLockPath(dir) {
   return `${slatePath(dir)}.lock`;
@@ -23014,11 +23047,11 @@ function listSessions(cwd, dataDir) {
     if (name.startsWith(".")) {
       continue;
     }
-    const summary = readSummaryFile(path80.join(root, name, "summary.json"));
+    const summary = readSummaryFile(path81.join(root, name, "summary.json"));
     if (summary === undefined) {
       continue;
     }
-    if (path80.resolve(summary.projectPath) !== path80.resolve(projectPath)) {
+    if (path81.resolve(summary.projectPath) !== path81.resolve(projectPath)) {
       continue;
     }
     out.push(summary);
@@ -23051,15 +23084,15 @@ async function readSessionSlate(cwd, sessionId, dataDir) {
 }
 function loadContext(cwd, sessionId, dataDir) {
   const dir = sessionDir(resolveProjectRoot2(cwd), sessionId, dataDir);
-  const contextPath = path80.join(dir, "context.jsonl");
+  const contextPath = path81.join(dir, "context.jsonl");
   if (existsSync13(contextPath)) {
     return readJsonl2(contextPath);
   }
-  return readJsonl2(path80.join(dir, "transcript.jsonl"));
+  return readJsonl2(path81.join(dir, "transcript.jsonl"));
 }
 function loadArchive(cwd, sessionId, dataDir, onDegraded) {
   const dir = sessionDir(resolveProjectRoot2(cwd), sessionId, dataDir);
-  const archivePath = path80.join(dir, "archive.jsonl");
+  const archivePath = path81.join(dir, "archive.jsonl");
   if (existsSync13(archivePath)) {
     try {
       const archive = readJsonl2(archivePath);
@@ -23243,7 +23276,7 @@ function sessionEvidenceRef(workspaceId, sessionId) {
 }
 async function resolveSessionWrapUp(input) {
   const now = input.now ?? (() => new Date);
-  const sessionId = path81.posix.basename(input.sourceRef, ".md");
+  const sessionId = path82.posix.basename(input.sourceRef, ".md");
   const summary = findSession(input.cwd, sessionId);
   if (summary === undefined || input.sourceRef !== sessionEvidenceRef(input.workspaceId, summary.id)) {
     throw new SessionWrapUpError("session_not_found", `no session matching "${input.sourceRef}" in this project \u2014 use \`keryx sessions list\``);
@@ -23260,7 +23293,7 @@ async function resolveSessionWrapUp(input) {
     throw new SessionWrapUpError("session_unreadable", `session "${summary.id}" could not be read: ${cause.message}`);
   }
   const relPath = sessionEvidenceRef(input.workspaceId, summary.id).slice(2);
-  const evidenceDir = path81.dirname(relPath);
+  const evidenceDir = path82.dirname(relPath);
   const slate = await readSessionSlate(input.cwd, summary.id);
   const diff = await gitDiff(input.cwd);
   const diffBody = diff.kind === "measured" ? diff.text : unmeasurableDiffBody(diff.detail);
@@ -23282,23 +23315,23 @@ async function resolveSessionWrapUp(input) {
     ""
   ].join(`
 `);
-  const wrapUpRelPath = path81.join(evidenceDir, `${summary.id}.wrap-up.md`);
-  const diffRelPath = path81.join(evidenceDir, `${summary.id}.diff.txt`);
-  const noticeRelPath = path81.join(evidenceDir, `${summary.id}.redaction.md`);
+  const wrapUpRelPath = path82.join(evidenceDir, `${summary.id}.wrap-up.md`);
+  const diffRelPath = path82.join(evidenceDir, `${summary.id}.diff.txt`);
+  const noticeRelPath = path82.join(evidenceDir, `${summary.id}.redaction.md`);
   const floor = await applyEvidenceRedactionFloor(input.cwd, [
-    { name: path81.basename(relPath), content: markdown, path: relPath, source: "generated" },
-    { name: path81.basename(wrapUpRelPath), content: wrapUpMarkdown, path: wrapUpRelPath, source: "generated" },
-    { name: path81.basename(diffRelPath), content: diffBody, path: diffRelPath, source: "tool-output" }
+    { name: path82.basename(relPath), content: markdown, path: relPath, source: "generated" },
+    { name: path82.basename(wrapUpRelPath), content: wrapUpMarkdown, path: wrapUpRelPath, source: "generated" },
+    { name: path82.basename(diffRelPath), content: diffBody, path: diffRelPath, source: "tool-output" }
   ]);
   if (!floor.ok)
     throw new SessionWrapUpError("security_denied", floor.reason);
   const [safeSession, safeWrapUp, safeDiff] = floor.bodies;
-  await mkdir30(path81.join(input.cwd, evidenceDir), { recursive: true });
-  await writeFile22(path81.join(input.cwd, relPath), safeSession.content, "utf8");
-  await writeFile22(path81.join(input.cwd, wrapUpRelPath), safeWrapUp.content, "utf8");
-  await writeFile22(path81.join(input.cwd, diffRelPath), safeDiff.content, "utf8");
+  await mkdir30(path82.join(input.cwd, evidenceDir), { recursive: true });
+  await writeFile22(path82.join(input.cwd, relPath), safeSession.content, "utf8");
+  await writeFile22(path82.join(input.cwd, wrapUpRelPath), safeWrapUp.content, "utf8");
+  await writeFile22(path82.join(input.cwd, diffRelPath), safeDiff.content, "utf8");
   if (floor.notice !== undefined)
-    await writeFile22(path81.join(input.cwd, noticeRelPath), floor.notice, "utf8");
+    await writeFile22(path82.join(input.cwd, noticeRelPath), floor.notice, "utf8");
   const observedAt = now().toISOString();
   const evidence = [
     { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash18("sha256").update(safeWrapUp.content).digest("hex"), observedAt },
@@ -23321,13 +23354,13 @@ async function resolveSessionWrapUp(input) {
 init_fs();
 import { createHash as createHash19, randomBytes as randomBytes2 } from "crypto";
 import { readFile as readFile42 } from "fs/promises";
-import path82 from "path";
+import path83 from "path";
 var CONFIRM_TOKEN_TTL_MS = 2 * 60000;
 function confirmTokenPath(cwd, workspaceId, proposalId) {
-  return path82.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
+  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
 }
 function confirmReceiptPath(cwd, workspaceId, proposalId, idempotencyKey) {
-  return path82.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2564(idempotencyKey)}.confirm-receipt.json`);
+  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2564(idempotencyKey)}.confirm-receipt.json`);
 }
 function sha2564(text) {
   return createHash19("sha256").update(text).digest("hex");
@@ -23365,7 +23398,7 @@ async function consumeConfirmToken(cwd, workspaceId, proposalId, idempotencyKey,
 // src/sac/decision-dedup.ts
 import { readFile as readFile44, readdir as readdir14 } from "fs/promises";
 import { randomUUID as randomUUID6 } from "crypto";
-import path84 from "path";
+import path85 from "path";
 init_store();
 init_config();
 
@@ -23373,15 +23406,15 @@ init_config();
 init_fs();
 import { createHash as createHash20 } from "crypto";
 import { readFile as readFile43, rm as rm7 } from "fs/promises";
-import path83 from "path";
+import path84 from "path";
 function proposalPath(cwd, workspaceId, proposalId) {
-  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+  return path84.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
 }
 function ownerReceiptPath(cwd, owner, workspaceId, idempotencyKey) {
-  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
+  return path84.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
 }
 function proposalNotePath(cwd, workspaceId, proposalId) {
-  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
+  return path84.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
 }
 async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
   let proposal;
@@ -23395,7 +23428,7 @@ async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
     return { ok: false, code: "no_evidence_to_write" };
   let content;
   try {
-    content = await readFile43(path83.join(cwd, evidence.uri), "utf8");
+    content = await readFile43(path84.join(cwd, evidence.uri), "utf8");
   } catch {
     return { ok: false, code: "evidence_file_unreadable" };
   }
@@ -23425,22 +23458,22 @@ function targetRelPath(targetRef) {
   return targetRef.replace(/^\.\//, "");
 }
 function targetAbsolutePath(cwd, targetRef) {
-  return path83.join(cwd, ".metaproject", targetRelPath(targetRef));
+  return path84.join(cwd, ".metaproject", targetRelPath(targetRef));
 }
 function targetKey(targetRef) {
   return digestOf2(targetRelPath(targetRef)).slice(0, 32);
 }
 function ownerTargetVersionPath(cwd, owner, workspaceId, targetRef) {
-  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-target-versions`, `${targetKey(targetRef)}.json`);
+  return path84.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-target-versions`, `${targetKey(targetRef)}.json`);
 }
 function ownerTargetLockPath(cwd, owner, targetRef) {
-  return path83.join(cwd, ".metaproject", "data", "sac", "target-locks", owner, `${targetKey(targetRef)}.lock`);
+  return path84.join(cwd, ".metaproject", "data", "sac", "target-locks", owner, `${targetKey(targetRef)}.lock`);
 }
 function ownerStagingDir(cwd, owner, workspaceId, idempotencyKey) {
-  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-staging`, digestOf2(idempotencyKey).slice(0, 32));
+  return path84.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-staging`, digestOf2(idempotencyKey).slice(0, 32));
 }
 function ownerConflictDir(cwd, owner, workspaceId, idempotencyKey) {
-  return path83.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-conflicts`, digestOf2(idempotencyKey).slice(0, 32));
+  return path84.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-conflicts`, digestOf2(idempotencyKey).slice(0, 32));
 }
 async function readJson2(file) {
   try {
@@ -23511,7 +23544,7 @@ async function applyGuardedTargetWrite(input) {
       staged: input.staged,
       stagedAt: receipt.completedAt
     };
-    await writeFileAtomic(path83.join(ownerStagingDir(cwd, owner, intent.workspaceId, intent.idempotencyKey), "plan.json"), `${JSON.stringify(staged, null, 2)}
+    await writeFileAtomic(path84.join(ownerStagingDir(cwd, owner, intent.workspaceId, intent.idempotencyKey), "plan.json"), `${JSON.stringify(staged, null, 2)}
 `);
     const applied = await input.apply(input.staged);
     if (!applied.ok) {
@@ -23537,15 +23570,15 @@ async function recoverStagedOwnerWrite(input) {
   });
 }
 async function readStagedOwnerWrite(cwd, owner, workspaceId, idempotencyKey) {
-  return readJson2(path83.join(ownerStagingDir(cwd, owner, workspaceId, idempotencyKey), "plan.json"));
+  return readJson2(path84.join(ownerStagingDir(cwd, owner, workspaceId, idempotencyKey), "plan.json"));
 }
 async function recordConflict(input) {
   const base = { targetRef: input.targetRef, expectedVersion: input.expectedVersion, currentVersion: input.currentVersion };
   if (input.proposedContent === undefined)
     return base;
   const dir = ownerConflictDir(input.cwd, input.owner, input.intent.workspaceId, input.intent.idempotencyKey);
-  await writeFileAtomic(path83.join(dir, "proposed"), input.proposedContent);
-  const diffRef = `./workspaces/${input.intent.workspaceId}/${input.owner}-write-conflicts/${path83.basename(dir)}/proposed`;
+  await writeFileAtomic(path84.join(dir, "proposed"), input.proposedContent);
+  const diffRef = `./workspaces/${input.intent.workspaceId}/${input.owner}-write-conflicts/${path84.basename(dir)}/proposed`;
   return { ...base, diffRef };
 }
 
@@ -23595,7 +23628,7 @@ async function resolveWorkspaceModule(cwd, workspaceId) {
   }
 }
 async function collectWikiDecisionEntries(cwd) {
-  const dir = path84.join(cwd, ".metaproject", "wiki", "decisions");
+  const dir = path85.join(cwd, ".metaproject", "wiki", "decisions");
   let files;
   try {
     files = (await readdir14(dir)).filter((name) => name.endsWith(".md"));
@@ -23604,12 +23637,12 @@ async function collectWikiDecisionEntries(cwd) {
   }
   const entries = [];
   for (const file of files) {
-    const absolutePath = path84.join(dir, file);
+    const absolutePath = path85.join(dir, file);
     try {
       const content = await readFile44(absolutePath, "utf8");
       entries.push({
         absolutePath,
-        relativePath: path84.posix.join("decisions", file),
+        relativePath: path85.posix.join("decisions", file),
         type: extractHeaderField(content, "Type") ?? "decision",
         title: extractTitle(content),
         version: extractHeaderField(content, "Version") ?? null,
@@ -23830,7 +23863,7 @@ function createRealMemoryOwnerWriter(cwd, opts) {
 init_fs();
 init_guard();
 import { readFile as readFile46 } from "fs/promises";
-import path85 from "path";
+import path86 from "path";
 function renderWrapUpDecisionPage(input) {
   const note = input.note?.trim();
   return `# ${input.title}
@@ -23871,14 +23904,14 @@ export is the source of truth for what actually happened.
 `;
 }
 function wikiPageRelativePath(proposalId) {
-  return path85.posix.join("decisions", `sac-${proposalId}.md`);
+  return path86.posix.join("decisions", `sac-${proposalId}.md`);
 }
 function createRealWikiOwnerWriter(cwd, opts) {
   const now = opts?.now ?? (() => new Date);
   const applyStaged = async (staged) => {
     const relativePath = staged.relativePath;
     const content = staged.content;
-    await writeFileAtomic(path85.join(cwd, ".metaproject", "wiki", relativePath), content);
+    await writeFileAtomic(path86.join(cwd, ".metaproject", "wiki", relativePath), content);
     return { ok: true };
   };
   return {
@@ -23947,10 +23980,10 @@ init_guard();
 import { createHash as createHash21 } from "crypto";
 import { homedir as homedir2 } from "os";
 import { mkdir as mkdir31, readFile as readFile47, stat as stat10 } from "fs/promises";
-import path86 from "path";
+import path87 from "path";
 var VERSION = "0.1.0";
 async function createProjectSkill(projectRoot, options) {
-  const metaprojectRoot = path86.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path87.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
@@ -23960,8 +23993,8 @@ async function createProjectSkill(projectRoot, options) {
   const moduleName = slugify5(options.module ?? inferModule(options.target));
   const skillName = slugify5(options.name ?? inferSkillName(options.target));
   const format = options.format ?? "auto";
-  const packageRoot = path86.join(metaprojectRoot, "project-skills", moduleName, skillName);
-  const relativeSkillPath = toPosix(path86.relative(projectRoot, packageRoot));
+  const packageRoot = path87.join(metaprojectRoot, "project-skills", moduleName, skillName);
+  const relativeSkillPath = toPosix(path87.relative(projectRoot, packageRoot));
   const origin = options.origin ? options.originContent !== undefined ? {
     ref: options.origin.trim(),
     hash: hashOriginContent(options.originContent),
@@ -23971,7 +24004,7 @@ async function createProjectSkill(projectRoot, options) {
   const warnings = collectWarnings(evidence, format);
   const files = filesForPackage(packageRoot, format);
   if (!options.dryRun) {
-    await withFileLock(path86.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
+    await withFileLock(path87.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
       await writeProjectSkillPackage({
         projectRoot,
         packageRoot,
@@ -24000,7 +24033,7 @@ async function createProjectSkill(projectRoot, options) {
     name: skillName,
     target: options.target,
     skillPath: relativeSkillPath,
-    files: files.map((filePath) => toPosix(path86.relative(projectRoot, filePath))),
+    files: files.map((filePath) => toPosix(path87.relative(projectRoot, filePath))),
     warnings,
     dryRun: options.dryRun === true
   };
@@ -24009,9 +24042,9 @@ var MAX_SKILL_TARGET_LENGTH = 80;
 function resolveOriginPath(ref, projectRoot) {
   const trimmed = ref.trim();
   if (trimmed === "~" || trimmed.startsWith("~/")) {
-    return path86.join(homedir2(), trimmed.slice(1));
+    return path87.join(homedir2(), trimmed.slice(1));
   }
-  return path86.resolve(projectRoot, trimmed);
+  return path87.resolve(projectRoot, trimmed);
 }
 function hashOriginContent(content) {
   return `sha256:${createHash21("sha256").update(content).digest("hex")}`;
@@ -24049,32 +24082,32 @@ async function writeProjectSkillPackage({
 }) {
   const packageFormat = format === "single" ? "single" : "package";
   const skillContent = renderProjectSkill({ moduleName, skillName, target, note, origin, evidence, packageFormat });
-  const relativeSkillMdPath = toPosix(path86.join(path86.relative(projectRoot, packageRoot), "SKILL.md"));
+  const relativeSkillMdPath = toPosix(path87.join(path87.relative(projectRoot, packageRoot), "SKILL.md"));
   const guard = await guardOutput({ cwd: projectRoot, content: skillContent, target: "skill", source: "generated", path: relativeSkillMdPath });
   const output = prepareOutputForPersistence(guard, skillContent);
   if (!output.allowed) {
     throw new Error(`Project skill blocked by the security gate: ${output.reason}`);
   }
   await mkdir31(packageRoot, { recursive: true });
-  const skillPath = path86.join(packageRoot, "SKILL.md");
+  const skillPath = path87.join(packageRoot, "SKILL.md");
   await writeFileAtomic(skillPath, output.content);
-  const changelogPath = path86.join(packageRoot, "skill-changelog.md");
+  const changelogPath = path87.join(packageRoot, "skill-changelog.md");
   if (!await pathExists(changelogPath)) {
     await writeFileAtomic(changelogPath, renderSkillChangelog({ moduleName, skillName, target }));
   }
   if (packageFormat === "package") {
-    await mkdir31(path86.join(packageRoot, "references"), { recursive: true });
-    await mkdir31(path86.join(packageRoot, "templates"), { recursive: true });
-    await writeFileAtomic(path86.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
-    await writeFileAtomic(path86.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
-    await writeFileAtomic(path86.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
+    await mkdir31(path87.join(packageRoot, "references"), { recursive: true });
+    await mkdir31(path87.join(packageRoot, "templates"), { recursive: true });
+    await writeFileAtomic(path87.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
+    await writeFileAtomic(path87.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
+    await writeFileAtomic(path87.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
   }
 }
 async function collectEvidence(projectRoot, target) {
-  const absoluteTarget = path86.resolve(projectRoot, target);
+  const absoluteTarget = path87.resolve(projectRoot, target);
   const targetExists = await pathExists(absoluteTarget);
   const targetKind = await classifyTarget(absoluteTarget, targetExists);
-  const maybeRelativeTarget = targetExists ? toPosix(path86.relative(projectRoot, absoluteTarget)) : undefined;
+  const maybeRelativeTarget = targetExists ? toPosix(path87.relative(projectRoot, absoluteTarget)) : undefined;
   const graphArtifacts = await existingRelativePaths(projectRoot, [
     ".metaproject/data/gdgraph/artifacts/summary.md",
     ".metaproject/data/gdgraph/artifacts/module-map.json"
@@ -24104,7 +24137,7 @@ async function classifyTarget(absoluteTarget, targetExists) {
 async function existingRelativePaths(projectRoot, candidates) {
   const existing = [];
   for (const candidate of candidates) {
-    if (await pathExists(path86.join(projectRoot, candidate))) {
+    if (await pathExists(path87.join(projectRoot, candidate))) {
       existing.push(candidate);
     }
   }
@@ -24131,17 +24164,17 @@ function collectWarnings(evidence, format) {
 }
 function filesForPackage(packageRoot, format) {
   const base = [
-    path86.join(packageRoot, "SKILL.md"),
-    path86.join(packageRoot, "skill-changelog.md")
+    path87.join(packageRoot, "SKILL.md"),
+    path87.join(packageRoot, "skill-changelog.md")
   ];
   if (format === "single") {
     return base;
   }
   return [
     ...base,
-    path86.join(packageRoot, "verification.md"),
-    path86.join(packageRoot, "references", "context.md"),
-    path86.join(packageRoot, "templates", "README.md")
+    path87.join(packageRoot, "verification.md"),
+    path87.join(packageRoot, "references", "context.md"),
+    path87.join(packageRoot, "templates", "README.md")
   ];
 }
 function renderProjectSkill({
@@ -24369,7 +24402,7 @@ keryx skills verify ${moduleName}/${skillName}
 `;
 }
 async function updateManifest(projectRoot, entry) {
-  const manifestPath = path86.join(projectRoot, ".metaproject", "metaproject.json");
+  const manifestPath = path87.join(projectRoot, ".metaproject", "metaproject.json");
   const manifest = await readJsonFileOr(manifestPath, {});
   manifest.modules ??= {};
   manifest.modules.gdskills ??= {};
@@ -24383,8 +24416,8 @@ async function updateManifest(projectRoot, entry) {
 `);
 }
 async function updateSkillsCatalog(projectRoot) {
-  const manifestPath = path86.join(projectRoot, ".metaproject", "metaproject.json");
-  const catalogPath = path86.join(projectRoot, ".metaproject", "skills", "catalog.md");
+  const manifestPath = path87.join(projectRoot, ".metaproject", "metaproject.json");
+  const catalogPath = path87.join(projectRoot, ".metaproject", "skills", "catalog.md");
   const manifest = await readJsonFileOr(manifestPath, {});
   const registry = manifest.modules?.gdskills?.projectSkillRegistry ?? [];
   const rows = registry.length > 0 ? registry.map((entry) => `| ${entry.module} | ${entry.name} | \`${entry.target}\` | ${entry.path}/SKILL.md |`).join(`
@@ -24424,7 +24457,7 @@ function inferModule(target) {
 }
 function inferSkillName(target) {
   const normalized = target.trim().replace(/[#:]+/g, "/");
-  const base = path86.basename(normalized).replace(/\.[^.]+$/, "");
+  const base = path87.basename(normalized).replace(/\.[^.]+$/, "");
   return base || "entity";
 }
 function slugify5(value) {
@@ -24527,7 +24560,7 @@ class ProposalLifecycleService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path87.resolve(options.workspaceRoot);
+    this.root = path88.resolve(options.workspaceRoot);
     this.now = options.now ?? (() => new Date);
   }
   async create(input) {
@@ -24546,7 +24579,7 @@ class ProposalLifecycleService {
       if (manifest.status === "archived")
         throw new ProposalLifecycleError("guard_denied", "workspace is archived");
       const file = this.proposalPath(workspaceId, proposal.id);
-      await mkdir32(path87.dirname(file), { recursive: true, mode: 448 });
+      await mkdir32(path88.dirname(file), { recursive: true, mode: 448 });
       return withFileLock(`${file}.lock`, async () => {
         const consume = this.options.wrapUpAuthority.consume(input.wrapUp, { actor, workspaceId });
         if (consume !== "ok")
@@ -24574,7 +24607,7 @@ class ProposalLifecycleService {
     return this.options.workspaces.withAuthorizedActor({ actorContext: actor, workspaceId: input.workspaceId, action: "review", execute: async (manifest) => {
       const proposal = await this.loadProposal(input.workspaceId, input.proposalId);
       const ledger = this.ledgerPath(input.workspaceId);
-      await mkdir32(path87.dirname(ledger), { recursive: true, mode: 448 });
+      await mkdir32(path88.dirname(ledger), { recursive: true, mode: 448 });
       return withFileLock(`${ledger}.lock`, async () => {
         const records = (await this.records(ledger)).filter((record) => record.proposalId === proposal.id);
         const events = records.filter((record) => record.recordType === "proposal-transition");
@@ -24615,7 +24648,7 @@ class ProposalLifecycleService {
     } });
   }
   async listProposedProposals(workspaceId) {
-    const proposalsDir = path87.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
+    const proposalsDir = path88.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
     let entries;
     try {
       entries = (await readdir15(proposalsDir)).filter((name) => name.endsWith(".json"));
@@ -24627,7 +24660,7 @@ class ProposalLifecycleService {
     const proposals = [];
     for (const entry of entries) {
       try {
-        const parsed = JSON.parse(await readFile49(path87.join(proposalsDir, entry), "utf8"));
+        const parsed = JSON.parse(await readFile49(path88.join(proposalsDir, entry), "utf8"));
         if (parsed.recordType === "proposal-created")
           proposals.push(parsed);
       } catch {}
@@ -24893,31 +24926,31 @@ class ProposalLifecycleService {
     }
   }
   proposalPath(workspaceId, proposalId) {
-    return path87.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+    return path88.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
   }
   decisionRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.decision.json`;
   }
   decisionPath(workspaceId, proposalId, key) {
-    return path87.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
+    return path88.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
   }
   approvalRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.approval.json`;
   }
   approvalPath(workspaceId, proposalId, key) {
-    return path87.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
+    return path88.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
   }
   writeResultPath(workspaceId, proposalId, key) {
-    return path87.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
+    return path88.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
   }
   intentRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.write-intent.json`;
   }
   intentPath(workspaceId, proposalId, key) {
-    return path87.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
+    return path88.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
   }
   attemptPath(workspaceId, proposalId, key) {
-    return path87.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.owner-write-attempt.json`);
+    return path88.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.owner-write-attempt.json`);
   }
   async loadWriteResult(workspaceId, proposalId, key) {
     try {
@@ -24944,7 +24977,7 @@ class ProposalLifecycleService {
     }
   }
   ledgerPath(workspaceId) {
-    return path87.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
+    return path88.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
   }
   timestamp() {
     return this.now().toISOString();
@@ -25027,7 +25060,7 @@ function normalizeProposalLifecycleResult(value) {
 // src/sac/collaboration-service.ts
 import { appendFile as appendFile7, mkdir as mkdir33, readFile as readFile50 } from "fs/promises";
 import { randomUUID as randomUUID8 } from "crypto";
-import path88 from "path";
+import path89 from "path";
 class CollaborationServiceError extends Error {
   code;
   constructor(code, message) {
@@ -25042,7 +25075,7 @@ class CollaborationService {
     this.input = input;
   }
   file(id) {
-    return path88.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
+    return path89.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
   }
   async overview(input) {
     const manifest = await this.input.workspaces.show(input);
@@ -25079,7 +25112,7 @@ class CollaborationService {
         occurredAt: (this.input.now ?? (() => new Date))().toISOString(),
         ...suppliedHandoff ? { handoff: { ...suppliedHandoff, from: actor.subject } } : {}
       });
-      await mkdir33(path88.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
+      await mkdir33(path89.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
       await appendFile7(this.file(manifest.id), `${JSON.stringify(activity)}
 `, { mode: 384 });
       return normalizeCollaborationResult(activity);
@@ -25129,13 +25162,13 @@ function normalizeCollaborationResult(value) {
 // src/session/external-slate.ts
 init_fs();
 import { mkdir as mkdir35, readdir as readdir16, readFile as readFile51 } from "fs/promises";
-import path90 from "path";
+import path91 from "path";
 
 // src/sac/machine-wrap-up.ts
 init_fs();
 import { createHash as createHash23, randomUUID as randomUUID10 } from "crypto";
 import { mkdir as mkdir34 } from "fs/promises";
-import path89 from "path";
+import path90 from "path";
 
 // src/sac/workspace-resolve.ts
 init_redact();
@@ -25276,11 +25309,11 @@ async function resolveMachineWrapUp(input) {
 `;
   const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
 `;
-  const evidenceRelBase = path89.posix.join(".metaproject", "workspaces", input.workspaceId, "machine-evidence");
+  const evidenceRelBase = path90.posix.join(".metaproject", "workspaces", input.workspaceId, "machine-evidence");
   const floor = await applyEvidenceRedactionFloor(input.cwd, [
-    { name: `${input.kind}.diff.txt`, content: diffBody, path: path89.posix.join(evidenceRelBase, `${input.kind}.diff.txt`), source: "tool-output" },
-    { name: `${input.kind}.flow.json`, content: flowSnapshotJson, path: path89.posix.join(evidenceRelBase, `${input.kind}.flow.json`), source: "generated" },
-    { name: `${input.kind}.seeds.json`, content: seedsJson, path: path89.posix.join(evidenceRelBase, `${input.kind}.seeds.json`), source: "generated" }
+    { name: `${input.kind}.diff.txt`, content: diffBody, path: path90.posix.join(evidenceRelBase, `${input.kind}.diff.txt`), source: "tool-output" },
+    { name: `${input.kind}.flow.json`, content: flowSnapshotJson, path: path90.posix.join(evidenceRelBase, `${input.kind}.flow.json`), source: "generated" },
+    { name: `${input.kind}.seeds.json`, content: seedsJson, path: path90.posix.join(evidenceRelBase, `${input.kind}.seeds.json`), source: "generated" }
   ]);
   if (!floor.ok)
     return { ok: false, code: "security_denied", detail: floor.reason };
@@ -25334,14 +25367,14 @@ ${safeSeeds.content}`;
     }
     summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(summaryDiff, course);
   }
-  const evidenceDir = path89.join(input.cwd, ".metaproject", "workspaces", input.workspaceId, "machine-evidence");
+  const evidenceDir = path90.join(input.cwd, ".metaproject", "workspaces", input.workspaceId, "machine-evidence");
   await mkdir34(evidenceDir, { recursive: true });
   const diffFile = `${input.kind}.${shortHash}.diff.txt`;
   const flowFile = `${input.kind}.${shortHash}.flow.json`;
   const seedsFile = `${input.kind}.${shortHash}.seeds.json`;
-  await writeFileAtomic(path89.join(evidenceDir, diffFile), safeDiff.content);
-  await writeFileAtomic(path89.join(evidenceDir, flowFile), safeFlow.content);
-  await writeFileAtomic(path89.join(evidenceDir, seedsFile), safeSeeds.content);
+  await writeFileAtomic(path90.join(evidenceDir, diffFile), safeDiff.content);
+  await writeFileAtomic(path90.join(evidenceDir, flowFile), safeFlow.content);
+  await writeFileAtomic(path90.join(evidenceDir, seedsFile), safeSeeds.content);
   const observedAt = now().toISOString();
   const relBase = `./.metaproject/workspaces/${input.workspaceId}/machine-evidence`;
   const evidence = [
@@ -25351,7 +25384,7 @@ ${safeSeeds.content}`;
   ];
   if (floor.notice !== undefined) {
     const noticeFile = `${input.kind}.${shortHash}.redaction.md`;
-    await writeFileAtomic(path89.join(evidenceDir, noticeFile), floor.notice);
+    await writeFileAtomic(path90.join(evidenceDir, noticeFile), floor.notice);
     evidence.push({ kind: REDACTION_NOTICE_KIND, uri: `${relBase}/${noticeFile}`, revision: sha2565(floor.notice), observedAt });
   }
   return {
@@ -25370,18 +25403,18 @@ async function writeFlooredArchiveArtifact(params) {
     {
       name: params.filename,
       content: params.content,
-      path: path89.posix.join("slate-archive", params.filename),
+      path: path90.posix.join("slate-archive", params.filename),
       source: "generated"
     }
   ]);
   if (!floor.ok)
     return { ok: false, code: "security_denied", detail: floor.reason };
   const body = floor.bodies[0];
-  const archiveDir = path89.join(params.dir, "slate-archive");
+  const archiveDir = path90.join(params.dir, "slate-archive");
   await mkdir34(archiveDir, { recursive: true });
-  await writeFileAtomic(path89.join(archiveDir, params.filename), body.content);
+  await writeFileAtomic(path90.join(archiveDir, params.filename), body.content);
   if (floor.notice !== undefined) {
-    await writeFileAtomic(path89.join(archiveDir, `${params.filename}${ARCHIVE_REDACTION_NOTICE_SUFFIX}`), floor.notice);
+    await writeFileAtomic(path90.join(archiveDir, `${params.filename}${ARCHIVE_REDACTION_NOTICE_SUFFIX}`), floor.notice);
   }
   return { ok: true, altered: body.altered };
 }
@@ -25417,9 +25450,9 @@ async function writeWrapUpOutcomeArtifact(cwd, dir, trigger, now, groups) {
       return;
     const refusalIso = now().toISOString();
     const refusalFilename = `${refusalIso.replace(/[:.]/g, "-")}-wrap-up-outcome.json`;
-    const archiveDir = path89.join(dir, "slate-archive");
+    const archiveDir = path90.join(dir, "slate-archive");
     await mkdir34(archiveDir, { recursive: true });
-    await writeFileAtomic(path89.join(archiveDir, refusalFilename), `${JSON.stringify({
+    await writeFileAtomic(path90.join(archiveDir, refusalFilename), `${JSON.stringify({
       recordType: "wrap-up-outcome",
       trigger,
       generatedAt: refusalIso,
@@ -25555,7 +25588,7 @@ async function runWrapUp(input) {
 
 // src/session/external-slate.ts
 function externalSlatesDir(cwd) {
-  return path90.join(cwd, ".keryx", "external-slates");
+  return path91.join(cwd, ".keryx", "external-slates");
 }
 var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function assertValidExternalSessionId(externalSessionId) {
@@ -25565,14 +25598,14 @@ function assertValidExternalSessionId(externalSessionId) {
 }
 function externalSlatePath(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path90.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+  return path91.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
 }
 function externalSlateLockPath(cwd, externalSessionId) {
   return `${externalSlatePath(cwd, externalSessionId)}.lock`;
 }
 function externalSlateEvidenceDir(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path90.join(externalSlatesDir(cwd), externalSessionId);
+  return path91.join(externalSlatesDir(cwd), externalSessionId);
 }
 async function readExternalSlate(cwd, externalSessionId) {
   try {
@@ -25661,12 +25694,12 @@ __export(exports_service10, {
   runDoctor: () => runDoctor,
   runValidate: () => runValidate
 });
-import path93 from "path";
+import path94 from "path";
 import { readFile as readFile54 } from "fs/promises";
 
 // src/standard/validate.ts
 init_fs();
-import path92 from "path";
+import path93 from "path";
 import { readFile as readFile53 } from "fs/promises";
 
 // src/standard/schemas.ts
@@ -25795,7 +25828,7 @@ var SCHEMA_REGISTRY2 = {
 
 // src/standard/profiles.ts
 init_fs();
-import path91 from "path";
+import path92 from "path";
 import { readFile as readFile52 } from "fs/promises";
 var AGENT_MODULES = ["gdgraph", "gdctx", "gdskills", "gdwiki", "memory"];
 var CI_MODULES = ["health", "testing"];
@@ -25807,7 +25840,7 @@ function enabledModuleKeys(manifest) {
 }
 async function rootEntrypointLinksIndex(cwd) {
   for (const name of ROOT_ENTRYPOINTS) {
-    const filePath = path91.join(cwd, name);
+    const filePath = path92.join(cwd, name);
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -25819,16 +25852,16 @@ async function rootEntrypointLinksIndex(cwd) {
   return false;
 }
 async function minimalSatisfied(cwd) {
-  const metaprojectRoot = path91.join(cwd, ".metaproject");
+  const metaprojectRoot = path92.join(cwd, ".metaproject");
   const requiredFiles = ["index.md", "README.md", "metaproject.json"];
   const requiredDirs = ["modules", "rules", "skills", "data"];
   for (const file of requiredFiles) {
-    if (!await pathExists(path91.join(metaprojectRoot, file))) {
+    if (!await pathExists(path92.join(metaprojectRoot, file))) {
       return false;
     }
   }
   for (const dir of requiredDirs) {
-    if (!await pathExists(path91.join(metaprojectRoot, dir))) {
+    if (!await pathExists(path92.join(metaprojectRoot, dir))) {
       return false;
     }
   }
@@ -25841,7 +25874,7 @@ async function ciSatisfied(cwd, manifest) {
     return false;
   }
   for (const key of ciModules) {
-    if (await pathExists(path91.join(cwd, ".metaproject", "data", key, "artifacts"))) {
+    if (await pathExists(path92.join(cwd, ".metaproject", "data", key, "artifacts"))) {
       return true;
     }
   }
@@ -25854,7 +25887,7 @@ async function evaluateProfiles(cwd, manifest) {
     satisfied.push("minimal");
   }
   const hasAgentModule = AGENT_MODULES.some((key) => new Set(enabledModuleKeys(manifest)).has(key));
-  const agent = minimal && hasAgentModule && await rootEntrypointLinksIndex(cwd) && await pathExists(path91.join(cwd, ".metaproject", "rules"));
+  const agent = minimal && hasAgentModule && await rootEntrypointLinksIndex(cwd) && await pathExists(path92.join(cwd, ".metaproject", "rules"));
   if (agent) {
     satisfied.push("agent");
   }
@@ -26024,20 +26057,20 @@ var MANIFEST_TOP_LEVEL_SCHEMA = {
 async function validateWorkspace2(cwd) {
   const errors = [];
   const warnings = [];
-  const metaprojectRoot = path92.join(cwd, ".metaproject");
+  const metaprojectRoot = path93.join(cwd, ".metaproject");
   const requiredFiles = ["index.md", "README.md", "metaproject.json"];
   for (const file of requiredFiles) {
-    if (!await pathExists(path92.join(metaprojectRoot, file))) {
+    if (!await pathExists(path93.join(metaprojectRoot, file))) {
       errors.push(issue("missing-required-file", `Required file .metaproject/${file} is missing`, `Run \`keryx init\` to scaffold .metaproject/${file}.`));
     }
   }
   const requiredDirs = ["modules", "rules", "skills", "data"];
   for (const dir of requiredDirs) {
-    if (!await pathExists(path92.join(metaprojectRoot, dir))) {
+    if (!await pathExists(path93.join(metaprojectRoot, dir))) {
       errors.push(issue("missing-required-dir", `Required directory .metaproject/${dir}/ is missing`, `Run \`keryx init\` to create .metaproject/${dir}/.`));
     }
   }
-  const manifestPath = path92.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path93.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return { ok: errors.length === 0, errors, warnings };
   }
@@ -26069,7 +26102,7 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path92.join(cwd, value))) {
+      if (!await pathExists(path93.join(cwd, value))) {
         errors.push(issue("missing-declared-path", `Declared path paths.${key} -> ${value} does not exist`, `Create ${value} or remove paths.${key} from metaproject.json.`));
       }
     }
@@ -26079,7 +26112,7 @@ async function validateWorkspace2(cwd) {
       continue;
     }
     if (typeof entry.manifest === "string") {
-      if (!await pathExists(path92.join(cwd, entry.manifest))) {
+      if (!await pathExists(path93.join(cwd, entry.manifest))) {
         errors.push(issue("missing-module-manifest", `Enabled module "${key}" manifest ${entry.manifest} is missing`, `Create ${entry.manifest} or run \`keryx update\` to regenerate module manifests.`));
       }
     }
@@ -26088,14 +26121,14 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path92.join(cwd, value))) {
+      if (!await pathExists(path93.join(cwd, value))) {
         const sink = field === "data" ? warnings : errors;
         sink.push(issue("missing-module-path", `Module "${key}" declares ${String(field)} ${value}, which does not exist`, field === "data" ? `Run the module (e.g. \`keryx ${key} ...\`) to generate ${value}, or update modules.${key}.data in metaproject.json.` : `Create ${value} or update modules.${key}.${String(field)} in metaproject.json.`));
       }
     }
   }
   for (const name of ROOT_ENTRYPOINTS2) {
-    const filePath = path92.join(cwd, name);
+    const filePath = path93.join(cwd, name);
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -26149,7 +26182,7 @@ async function runDoctor(cwd) {
   return validateWorkspace2(cwd);
 }
 async function readManifest(cwd) {
-  const manifestPath = path93.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path94.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     throw new Error("Metaproject is not initialized (missing .metaproject/metaproject.json). Run `keryx init` first.");
   }