@mrciphersmith/keryx 0.2.55 → 0.2.57

package/dist/cli.js

@@ -14422,101 +14422,66 @@ var init_slate_course = __esm(() => {
   unbound = { state: "unbound" };
 });
 
-// src/sac/secure-resource-read.ts
-import { constants } from "fs";
-import path71 from "path";
-import { dlopen, FFIType, ptr } from "bun:ffi";
-function readWorkspaceFileNoFollow(workspaceRoot, absolutePath) {
-  const relativePath = path71.relative(workspaceRoot, absolutePath);
-  const components = relativePath.split(path71.sep);
-  if (!relativePath || path71.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
-    throw new Error("safe source path is not workspace-relative");
-  }
-  const libc = loadPosixLibrary();
-  if (!libc || !Number.isInteger(constants.O_DIRECTORY) || !Number.isInteger(constants.O_NOFOLLOW)) {
-    throw new Error("safe descriptor source reads are unavailable on this platform");
-  }
-  const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
-  const fileFlags = constants.O_RDONLY | constants.O_NOFOLLOW;
-  const opened = [];
-  try {
-    let parent = openAt(libc, atFdcwd, workspaceRoot, directoryFlags);
-    opened.push(parent);
-    for (const component of components.slice(0, -1)) {
-      parent = openAt(libc, parent, component, directoryFlags);
-      opened.push(parent);
+// src/sac/trusted-wrap-up.ts
+import { createHash as createHash8, randomUUID as randomUUID6 } from "crypto";
+function createTrustedWrapUpAuthority(input2) {
+  const now = input2.now ?? (() => new Date);
+  return Object.freeze({
+    async issue(request) {
+      const resolved = await input2.resolveExplicitWrapUp(request);
+      if (!resolved.summary.trim() || resolved.evidence.length === 0 || new Date(resolved.expiresAt).getTime() <= now().getTime())
+        throw new Error("invalid trusted wrap-up issuance");
+      const provenance = Object.freeze({ id: `wrapup-${randomUUID6().replace(/-/g, "").slice(0, 16)}`, source: request.source, sourceRef: request.sourceRef, sourceRevision: resolved.sourceRevision, workspaceId: resolved.workspaceId, actorSubject: request.actor.subject, summaryDigest: digest(resolved.summary), evidence: resolved.evidence.map((item) => ({ ...item })), issuedAt: now().toISOString(), expiresAt: resolved.expiresAt });
+      issued.add(provenance);
+      return provenance;
+    },
+    verify(provenance, request) {
+      if (!issued.has(provenance))
+        return "untrusted";
+      if (consumed.has(provenance))
+        return "replayed";
+      if (new Date(provenance.expiresAt).getTime() <= now().getTime())
+        return "expired";
+      if (provenance.workspaceId !== request.workspaceId || provenance.actorSubject !== request.actor.subject)
+        return "mismatch";
+      return "ok";
+    },
+    consume(provenance, request) {
+      const result = this.verify(provenance, request);
+      if (result === "ok")
+        consumed.add(provenance);
+      return result;
     }
-    const name = components.at(-1);
-    if (!name)
-      throw new Error("safe source path has no final component");
-    const file = openAt(libc, parent, name, fileFlags);
-    opened.push(file);
-    return readAll(libc, file);
-  } finally {
-    for (const fd of opened.reverse())
-      libc.symbols.close(fd);
-    libc.close();
-  }
-}
-function loadPosixLibrary() {
-  for (const candidate of libcCandidates) {
-    try {
-      return dlopen(candidate, {
-        openat: { args: [FFIType.i32, FFIType.cstring, FFIType.i32, FFIType.i32], returns: FFIType.i32 },
-        read: { args: [FFIType.i32, FFIType.ptr, FFIType.u64], returns: FFIType.i64 },
-        close: { args: [FFIType.i32], returns: FFIType.i32 }
-      });
-    } catch {}
-  }
-  return;
-}
-function openAt(libc, directoryFd, component, flags) {
-  const name = Buffer.from(`${component}\x00`);
-  const fd = libc.symbols.openat(directoryFd, name, flags, 0);
-  if (fd < 0)
-    throw new Error("safe source descriptor open failed");
-  return fd;
+  });
 }
-function readAll(libc, fd) {
-  const chunks = [];
-  for (;; ) {
-    const chunk = Buffer.allocUnsafe(64 * 1024);
-    const read = libc.symbols.read(fd, ptr(chunk), chunk.length);
-    if (read < 0n)
-      throw new Error("safe source descriptor read failed");
-    if (read === 0n)
-      return Buffer.concat(chunks);
-    const length = Number(read);
-    if (!Number.isSafeInteger(length) || length > chunk.length)
-      throw new Error("safe source descriptor read returned an invalid length");
-    chunks.push(chunk.subarray(0, length));
-  }
+function digest(value) {
+  return createHash8("sha256").update(value).digest("hex");
 }
-var atFdcwd, libcCandidates;
-var init_secure_resource_read = __esm(() => {
-  atFdcwd = process.platform === "darwin" ? -2 : -100;
-  libcCandidates = process.platform === "darwin" ? ["/usr/lib/libSystem.B.dylib"] : process.platform === "linux" ? ["/lib/aarch64-linux-gnu/libc.so.6", "/lib/x86_64-linux-gnu/libc.so.6", "/lib64/libc.so.6"] : [];
+var issued, consumed;
+var init_trusted_wrap_up = __esm(() => {
+  issued = new WeakSet;
+  consumed = new WeakSet;
 });
 
 // src/sac/index.ts
 import { access as access2, readFile as readFile33, realpath as realpath2 } from "fs/promises";
-import { createHash as createHash8 } from "crypto";
-import path72 from "path";
+import { createHash as createHash9 } from "crypto";
+import path71 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 async function resolveSacNormativeSchemaPath(fileName, searchFrom = [fileURLToPath4(new URL(".", import.meta.url)), process.cwd()]) {
   const seen = new Set;
   for (const start of searchFrom) {
-    let dir = path72.resolve(start);
+    let dir = path71.resolve(start);
     for (let i = 0;i < 10; i++) {
       if (seen.has(dir))
         break;
       seen.add(dir);
-      const candidate = path72.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
+      const candidate = path71.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
       try {
         await access2(candidate);
         return candidate;
       } catch {}
-      const parent = path72.dirname(dir);
+      const parent = path71.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -15178,15 +15143,15 @@ async function validateSacContract(input2) {
   return { valid: errors.length === 0, errors };
 }
 function hashSacRecord(value) {
-  return createHash8("sha256").update(typeof value === "string" ? value : JSON.stringify(value)).digest("hex");
+  return createHash9("sha256").update(typeof value === "string" ? value : JSON.stringify(value)).digest("hex");
 }
 async function resolveWorkspaceReference(input2) {
-  if (!workspacePathPattern.test(input2.uri) || path72.isAbsolute(input2.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input2.uri) || input2.uri.includes("\\"))
+  if (!workspacePathPattern.test(input2.uri) || path71.isAbsolute(input2.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input2.uri) || input2.uri.includes("\\"))
     throw new SacReferenceError("unsafe workspace reference");
-  const lexicalRoot = path72.resolve(input2.workspaceRoot);
+  const lexicalRoot = path71.resolve(input2.workspaceRoot);
   const root = await realpath2(lexicalRoot);
-  const candidate = path72.resolve(lexicalRoot, input2.uri.slice(2));
-  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path72.sep}`))
+  const candidate = path71.resolve(lexicalRoot, input2.uri.slice(2));
+  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path71.sep}`))
     throw new SacReferenceError("workspace reference escapes root");
   let resolved;
   try {
@@ -15194,7 +15159,7 @@ async function resolveWorkspaceReference(input2) {
   } catch {
     throw new SacReferenceError("workspace reference is not resolvable");
   }
-  if (resolved !== root && !resolved.startsWith(`${root}${path72.sep}`))
+  if (resolved !== root && !resolved.startsWith(`${root}${path71.sep}`))
     throw new SacReferenceError("workspace reference escapes root after realpath");
   return candidate;
 }
@@ -15261,7 +15226,7 @@ var init_sac = __esm(() => {
     "review-decision": "review-decision.schema.json"
   };
   normativeSchemas = new Map;
-  NORMATIVE_SCHEMA_DIR = path72.join("docs", "requirements", "shared-agent-context", "schemas");
+  NORMATIVE_SCHEMA_DIR = path71.join("docs", "requirements", "shared-agent-context", "schemas");
   SacReferenceError = class SacReferenceError extends Error {
     code = "unsafe_workspace_reference";
   };
@@ -15269,9 +15234,85 @@ var init_sac = __esm(() => {
   roleRank = { viewer: 1, editor: 2, owner: 3 };
 });
 
+// src/sac/secure-resource-read.ts
+import { constants } from "fs";
+import path72 from "path";
+import { dlopen, FFIType, ptr } from "bun:ffi";
+function readWorkspaceFileNoFollow(workspaceRoot, absolutePath) {
+  const relativePath = path72.relative(workspaceRoot, absolutePath);
+  const components = relativePath.split(path72.sep);
+  if (!relativePath || path72.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
+    throw new Error("safe source path is not workspace-relative");
+  }
+  const libc = loadPosixLibrary();
+  if (!libc || !Number.isInteger(constants.O_DIRECTORY) || !Number.isInteger(constants.O_NOFOLLOW)) {
+    throw new Error("safe descriptor source reads are unavailable on this platform");
+  }
+  const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+  const fileFlags = constants.O_RDONLY | constants.O_NOFOLLOW;
+  const opened = [];
+  try {
+    let parent = openAt(libc, atFdcwd, workspaceRoot, directoryFlags);
+    opened.push(parent);
+    for (const component of components.slice(0, -1)) {
+      parent = openAt(libc, parent, component, directoryFlags);
+      opened.push(parent);
+    }
+    const name = components.at(-1);
+    if (!name)
+      throw new Error("safe source path has no final component");
+    const file = openAt(libc, parent, name, fileFlags);
+    opened.push(file);
+    return readAll(libc, file);
+  } finally {
+    for (const fd of opened.reverse())
+      libc.symbols.close(fd);
+    libc.close();
+  }
+}
+function loadPosixLibrary() {
+  for (const candidate of libcCandidates) {
+    try {
+      return dlopen(candidate, {
+        openat: { args: [FFIType.i32, FFIType.cstring, FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+        read: { args: [FFIType.i32, FFIType.ptr, FFIType.u64], returns: FFIType.i64 },
+        close: { args: [FFIType.i32], returns: FFIType.i32 }
+      });
+    } catch {}
+  }
+  return;
+}
+function openAt(libc, directoryFd, component, flags) {
+  const name = Buffer.from(`${component}\x00`);
+  const fd = libc.symbols.openat(directoryFd, name, flags, 0);
+  if (fd < 0)
+    throw new Error("safe source descriptor open failed");
+  return fd;
+}
+function readAll(libc, fd) {
+  const chunks = [];
+  for (;; ) {
+    const chunk = Buffer.allocUnsafe(64 * 1024);
+    const read = libc.symbols.read(fd, ptr(chunk), chunk.length);
+    if (read < 0n)
+      throw new Error("safe source descriptor read failed");
+    if (read === 0n)
+      return Buffer.concat(chunks);
+    const length = Number(read);
+    if (!Number.isSafeInteger(length) || length > chunk.length)
+      throw new Error("safe source descriptor read returned an invalid length");
+    chunks.push(chunk.subarray(0, length));
+  }
+}
+var atFdcwd, libcCandidates;
+var init_secure_resource_read = __esm(() => {
+  atFdcwd = process.platform === "darwin" ? -2 : -100;
+  libcCandidates = process.platform === "darwin" ? ["/usr/lib/libSystem.B.dylib"] : process.platform === "linux" ? ["/lib/aarch64-linux-gnu/libc.so.6", "/lib/x86_64-linux-gnu/libc.so.6", "/lib64/libc.so.6"] : [];
+});
+
 // src/sac/workspace-service.ts
 import { mkdir as mkdir27, readdir as readdir9, readFile as readFile34 } from "fs/promises";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import path73 from "path";
 
 class WorkspaceService {
@@ -15579,7 +15620,7 @@ function localWorkspaceAuthorizationServer(subject = `user:local-${process.getui
   return createSacAuthorizationServer({ authenticateRequest: async () => ({ subject, authenticationMethod: "local-os", roleRevision: "local-os-v1" }) });
 }
 function newWorkspaceId() {
-  return `workspace-${randomUUID6().replace(/-/g, "").slice(0, 16)}`;
+  return `workspace-${randomUUID7().replace(/-/g, "").slice(0, 16)}`;
 }
 async function resolveWorkspaceForActor(cwd, workspaceId) {
   const service = new WorkspaceService({
@@ -15588,7 +15629,7 @@ async function resolveWorkspaceForActor(cwd, workspaceId) {
     strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }
   });
   try {
-    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID6(), workspaceId });
+    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID7(), workspaceId });
     return { ok: true, manifest };
   } catch (error2) {
     if (error2 instanceof WorkspaceServiceError) {
@@ -15614,47 +15655,6 @@ var init_workspace_service = __esm(() => {
   };
 });
 
-// src/sac/trusted-wrap-up.ts
-import { createHash as createHash9, randomUUID as randomUUID7 } from "crypto";
-function createTrustedWrapUpAuthority(input2) {
-  const now = input2.now ?? (() => new Date);
-  return Object.freeze({
-    async issue(request) {
-      const resolved = await input2.resolveExplicitWrapUp(request);
-      if (!resolved.summary.trim() || resolved.evidence.length === 0 || new Date(resolved.expiresAt).getTime() <= now().getTime())
-        throw new Error("invalid trusted wrap-up issuance");
-      const provenance = Object.freeze({ id: `wrapup-${randomUUID7().replace(/-/g, "").slice(0, 16)}`, source: request.source, sourceRef: request.sourceRef, sourceRevision: resolved.sourceRevision, workspaceId: resolved.workspaceId, actorSubject: request.actor.subject, summaryDigest: digest(resolved.summary), evidence: resolved.evidence.map((item) => ({ ...item })), issuedAt: now().toISOString(), expiresAt: resolved.expiresAt });
-      issued.add(provenance);
-      return provenance;
-    },
-    verify(provenance, request) {
-      if (!issued.has(provenance))
-        return "untrusted";
-      if (consumed.has(provenance))
-        return "replayed";
-      if (new Date(provenance.expiresAt).getTime() <= now().getTime())
-        return "expired";
-      if (provenance.workspaceId !== request.workspaceId || provenance.actorSubject !== request.actor.subject)
-        return "mismatch";
-      return "ok";
-    },
-    consume(provenance, request) {
-      const result = this.verify(provenance, request);
-      if (result === "ok")
-        consumed.add(provenance);
-      return result;
-    }
-  });
-}
-function digest(value) {
-  return createHash9("sha256").update(value).digest("hex");
-}
-var issued, consumed;
-var init_trusted_wrap_up = __esm(() => {
-  issued = new WeakSet;
-  consumed = new WeakSet;
-});
-
 // src/sac/guarded-owner-writer.ts
 import { createHash as createHash10 } from "crypto";
 function createGuardedOwnerWriter(input2) {
@@ -16208,290 +16208,16 @@ var init_store3 = __esm(() => {
   };
 });
 
-// src/sac/machine-wrap-up.ts
-import { createHash as createHash11, randomUUID as randomUUID9 } from "crypto";
-import { execFile } from "child_process";
-import { mkdir as mkdir28 } from "fs/promises";
-import path75 from "path";
-import { promisify } from "util";
-function describeSource(source) {
-  return source === "parent" ? "parent" : `child:${source.childDispatchId}`;
-}
-function dedupedAttributedSeeds(slate) {
-  const seen = new Set;
-  const result = [];
-  const take = (seeds, source) => {
-    for (const seed of dedupeSeeds(seeds)) {
-      const key = seed.text.trim();
-      if (seen.has(key))
-        continue;
-      seen.add(key);
-      result.push({ text: seed.text, kind: seed.kind ?? "follow-up", source });
-    }
-  };
-  take(slate.seeds, "parent");
-  const childDispatches = slate.childDispatches ?? {};
-  for (const [dispatchId, dispatch] of Object.entries(childDispatches)) {
-    take(dispatch.seeds, { childDispatchId: dispatchId });
-  }
-  return result;
-}
-function groupSeedsByKind(slate) {
-  const map = new Map;
-  for (const seed of dedupedAttributedSeeds(slate)) {
-    const bucket = map.get(seed.kind);
-    if (bucket)
-      bucket.push(seed);
-    else
-      map.set(seed.kind, [seed]);
-  }
-  return map;
-}
-function sha256(value) {
-  return createHash11("sha256").update(value).digest("hex");
-}
-async function gitDiff(cwd) {
-  try {
-    const { stdout: stdout2 } = await execFileAsync("git", ["diff"], { cwd, maxBuffer: 16 * 1024 * 1024 });
-    return stdout2;
-  } catch {
-    return "";
-  }
-}
-function diffStatLine(diffText) {
-  if (diffText.trim().length === 0)
-    return "no working-tree changes";
-  const added = (diffText.match(/^\+(?!\+\+)/gm) ?? []).length;
-  const removed = (diffText.match(/^-(?!--)/gm) ?? []).length;
-  return `working-tree diff: +${added}/-${removed} line(s)`;
-}
-function courseStatusLine(course) {
-  if (course.state !== "bound")
-    return "flow: unbound";
-  return `flow ${course.flowRef.uri} snapshot=${course.flowRef.snapshot} completed=${course.completed.length} next=${course.next.length} blocked=${course.blocked.length}`;
-}
-function mechanicalSummary(diffText, course) {
-  return `Mechanical wrap-up summary (model turn unavailable or timed out):
-${diffStatLine(diffText)}
-${courseStatusLine(course)}`;
-}
-async function resolveMachineWrapUp(input2) {
-  const now = input2.now ?? (() => new Date);
-  const diffText = await gitDiff(input2.cwd);
-  const course = await readCourse(input2.cwd, input2.slate.course.flowRef);
-  const seedsForKind = dedupedAttributedSeeds(input2.slate).filter((seed) => seed.kind === input2.kind);
-  const flowSnapshotJson = `${JSON.stringify(course, null, 2)}
-`;
-  const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
-`;
-  const sourceRevision = sha256([diffText, flowSnapshotJson, seedsJson].join("\x00"));
-  const shortHash = sourceRevision.slice(0, 16);
-  const system = "Summarize ONLY the machine evidence provided below \u2014 a git diff, a Flow snapshot, and the Seeds captured " + "this session for one proposal kind. Never invent facts that are not present in the evidence.";
-  const user = `--- git diff ---
-${diffText.length > 0 ? diffText : "(no working-tree changes)"}
-
-` + `--- flow snapshot ---
-${flowSnapshotJson}
-` + `--- seeds (${input2.kind}) ---
-${seedsJson}`;
-  let modelResult;
-  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS;
-  const turn = runModelTurn({
-    system,
-    user,
-    requestId: `machine-wrap-up-${shortHash}`,
-    ...input2.env !== undefined ? { env: input2.env } : {},
-    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {}
-  }).then((result) => {
-    modelResult = result;
-    return "done";
-  });
-  let timer;
-  const expired = new Promise((resolve) => {
-    timer = setTimeout(() => resolve("timeout"), modelTurnTimeoutMs);
-  });
-  let raceOutcome;
-  try {
-    raceOutcome = await Promise.race([turn, expired]);
-  } finally {
-    if (timer !== undefined)
-      clearTimeout(timer);
-  }
-  let summary;
-  if (raceOutcome === "timeout") {
-    turn.catch(() => {});
-    summary = mechanicalSummary(diffText, course);
-  } else {
-    const result = modelResult;
-    if (result.text.trim().length === 0 && !result.credentialAvailable) {
-      return { ok: false, code: "no_credential" };
-    }
-    summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(diffText, course);
-  }
-  const evidenceDir = path75.join(input2.cwd, ".metaproject", "workspaces", input2.workspaceId, "machine-evidence");
-  await mkdir28(evidenceDir, { recursive: true });
-  const diffFile = `${input2.kind}.${shortHash}.diff.txt`;
-  const flowFile = `${input2.kind}.${shortHash}.flow.json`;
-  const seedsFile = `${input2.kind}.${shortHash}.seeds.json`;
-  await writeFileAtomic(path75.join(evidenceDir, diffFile), diffText);
-  await writeFileAtomic(path75.join(evidenceDir, flowFile), flowSnapshotJson);
-  await writeFileAtomic(path75.join(evidenceDir, seedsFile), seedsJson);
-  const observedAt = now().toISOString();
-  const relBase = `./.metaproject/workspaces/${input2.workspaceId}/machine-evidence`;
-  const evidence = [
-    { kind: "diff", uri: `${relBase}/${diffFile}`, revision: sha256(diffText), observedAt },
-    { kind: "flow", uri: `${relBase}/${flowFile}`, revision: sha256(flowSnapshotJson), observedAt },
-    { kind: "seeds", uri: `${relBase}/${seedsFile}`, revision: sha256(seedsJson), observedAt }
-  ];
-  return {
-    ok: true,
-    resolution: {
-      workspaceId: input2.workspaceId,
-      sourceRevision,
-      summary,
-      evidence,
-      expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS).toISOString()
-    }
-  };
-}
-async function writeUnboundCandidateArtifact(dir, trigger, now, grouped, nonEmptyKinds) {
-  const archiveDir = path75.join(dir, "slate-archive");
-  await mkdir28(archiveDir, { recursive: true });
-  const nowIso2 = now().toISOString();
-  const filename = `${nowIso2.replace(/[:.]/g, "-")}-unbound-candidate.json`;
-  const content = {
-    recordType: "unbound-candidate",
-    trigger,
-    generatedAt: nowIso2,
-    groups: nonEmptyKinds.map((kind) => ({
-      kind,
-      seeds: (grouped.get(kind) ?? []).map((seed) => ({ text: seed.text, source: describeSource(seed.source) }))
-    }))
-  };
-  await writeFileAtomic(path75.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
-`);
-}
-async function writeWrapUpOutcomeArtifact(dir, trigger, now, groups) {
-  try {
-    const archiveDir = path75.join(dir, "slate-archive");
-    await mkdir28(archiveDir, { recursive: true });
-    const nowIso2 = now().toISOString();
-    const filename = `${nowIso2.replace(/[:.]/g, "-")}-wrap-up-outcome.json`;
-    const content = { recordType: "wrap-up-outcome", trigger, generatedAt: nowIso2, groups };
-    await writeFileAtomic(path75.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
-`);
-  } catch {}
-}
-async function proposeOneGroup(params) {
-  const wrapUpSource = params.wrapUpSource ?? "flow";
-  try {
-    const resolved = await resolveMachineWrapUp({
-      cwd: params.cwd,
-      workspaceId: params.workspaceId,
-      slate: params.slate,
-      kind: params.kind,
-      now: params.now,
-      ...params.env !== undefined ? { env: params.env } : {},
-      ...params.providerFactory !== undefined ? { providerFactory: params.providerFactory } : {},
-      ...params.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: params.modelTurnTimeoutMs } : {}
-    });
-    if (!resolved.ok)
-      return { kind: params.kind, outcome: "no_credential" };
-    const flowEvidence = resolved.resolution.evidence.find((item) => item.kind === "flow");
-    const sourceRef = (flowEvidence ?? resolved.resolution.evidence[0]).uri;
-    const flowRef = params.slate.course.flowRef ?? "";
-    const dedupHash = sha256(`${params.workspaceId}:${flowRef}:${resolved.resolution.sourceRevision}:${params.kind}`);
-    const proposalId = `wrapup-${dedupHash.slice(0, 32)}`;
-    const wrapUpAuthority = createTrustedWrapUpAuthority({
-      now: params.now,
-      resolveExplicitWrapUp: async (request) => {
-        if (request.source !== wrapUpSource) {
-          throw new Error(`machine-wrap-up only resolves "${wrapUpSource}" wrap-ups, got "${request.source}"`);
-        }
-        return resolved.resolution;
-      }
-    });
-    const { service, authorizationServer } = createHarnessProposalLifecycleService(params.cwd, {
-      workspaceId: params.workspaceId,
-      now: params.now
-    });
-    const requestCorrelationId = randomUUID9();
-    const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
-    if (!actor)
-      throw new Error("trusted ActorContext is required for a machine wrap-up propose");
-    const provenance = await wrapUpAuthority.issue({ actor, source: wrapUpSource, sourceRef });
-    try {
-      const proposal = await service.create({
-        request: undefined,
-        requestCorrelationId,
-        workspaceId: params.workspaceId,
-        id: proposalId,
-        proposalRevision: "1",
-        kind: params.kind,
-        wrapUp: provenance
-      });
-      return { kind: params.kind, outcome: "proposed", proposalId: proposal.id };
-    } catch (error2) {
-      if (error2 instanceof ProposalLifecycleError && error2.code === "conflict") {
-        return { kind: params.kind, outcome: "conflict" };
-      }
-      throw error2;
-    }
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : String(error2);
-    return { kind: params.kind, outcome: "error", message };
-  }
-}
-async function runWrapUp(input2) {
-  const now = input2.now ?? (() => new Date);
-  const grouped = groupSeedsByKind(input2.slate);
-  const nonEmptyKinds = [...grouped.keys()].filter((kind) => (grouped.get(kind)?.length ?? 0) > 0);
-  if (nonEmptyKinds.length === 0) {
-    return { groups: [] };
-  }
-  if (input2.slate.workspaceId === undefined) {
-    await writeUnboundCandidateArtifact(input2.dir, input2.trigger, now, grouped, nonEmptyKinds);
-    const groups2 = nonEmptyKinds.map((kind) => ({ kind, outcome: "unbound-candidate" }));
-    await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups2);
-    return { groups: groups2 };
-  }
-  const workspaceId = input2.slate.workspaceId;
-  const groups = await Promise.all(nonEmptyKinds.map((kind) => proposeOneGroup({
-    cwd: input2.cwd,
-    workspaceId,
-    slate: input2.slate,
-    kind,
-    now,
-    ...input2.wrapUpSource !== undefined ? { wrapUpSource: input2.wrapUpSource } : {},
-    ...input2.env !== undefined ? { env: input2.env } : {},
-    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
-    ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
-  })));
-  await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups);
-  return { groups };
-}
-var execFileAsync, WRAP_UP_TTL_MS, DEFAULT_MODEL_TURN_TIMEOUT_MS = 30000;
-var init_machine_wrap_up = __esm(() => {
-  init_fs();
-  init_slate();
-  init_slate_course();
-  init_trusted_wrap_up();
-  init_proposal_lifecycle();
-  init_single_turn();
-  execFileAsync = promisify(execFile);
-  WRAP_UP_TTL_MS = 60 * 60 * 1000;
-});
-
 // src/sac/session-wrap-up.ts
-import { createHash as createHash12 } from "crypto";
-import { mkdir as mkdir29, writeFile as writeFile27 } from "fs/promises";
-import path76 from "path";
+import { createHash as createHash11 } from "crypto";
+import { mkdir as mkdir28, writeFile as writeFile27 } from "fs/promises";
+import path75 from "path";
 function sessionEvidenceRef(workspaceId, sessionId) {
   return `./.metaproject/workspaces/${workspaceId}/session-evidence/${sessionId}.md`;
 }
 async function resolveSessionWrapUp(input2) {
   const now = input2.now ?? (() => new Date);
-  const sessionId = path76.posix.basename(input2.sourceRef, ".md");
+  const sessionId = path75.posix.basename(input2.sourceRef, ".md");
   const summary = findSession(input2.cwd, sessionId);
   if (summary === undefined || input2.sourceRef !== sessionEvidenceRef(input2.workspaceId, summary.id)) {
     throw new SessionWrapUpError("session_not_found", `no session matching "${input2.sourceRef}" in this project \u2014 use \`keryx sessions list\``);
@@ -16508,9 +16234,9 @@ async function resolveSessionWrapUp(input2) {
     throw new SessionWrapUpError("session_unreadable", `session "${summary.id}" could not be read: ${cause.message}`);
   }
   const relPath = sessionEvidenceRef(input2.workspaceId, summary.id).slice(2);
-  const evidenceDir = path76.dirname(relPath);
-  await mkdir29(path76.join(input2.cwd, evidenceDir), { recursive: true });
-  await writeFile27(path76.join(input2.cwd, relPath), markdown, "utf8");
+  const evidenceDir = path75.dirname(relPath);
+  await mkdir28(path75.join(input2.cwd, evidenceDir), { recursive: true });
+  await writeFile27(path75.join(input2.cwd, relPath), markdown, "utf8");
   const slate = await readSessionSlate(input2.cwd, summary.id);
   const diffText = await gitDiff(input2.cwd);
   const course = await readCourse(input2.cwd, slate?.course.flowRef);
@@ -16530,30 +16256,30 @@ async function resolveSessionWrapUp(input2) {
     ""
   ].join(`
 `);
-  const wrapUpRelPath = path76.join(evidenceDir, `${summary.id}.wrap-up.md`);
-  const diffRelPath = path76.join(evidenceDir, `${summary.id}.diff.txt`);
-  await writeFile27(path76.join(input2.cwd, wrapUpRelPath), wrapUpMarkdown, "utf8");
-  await writeFile27(path76.join(input2.cwd, diffRelPath), diffText, "utf8");
+  const wrapUpRelPath = path75.join(evidenceDir, `${summary.id}.wrap-up.md`);
+  const diffRelPath = path75.join(evidenceDir, `${summary.id}.diff.txt`);
+  await writeFile27(path75.join(input2.cwd, wrapUpRelPath), wrapUpMarkdown, "utf8");
+  await writeFile27(path75.join(input2.cwd, diffRelPath), diffText, "utf8");
   const observedAt = now().toISOString();
   const evidence = [
-    { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash12("sha256").update(wrapUpMarkdown).digest("hex"), observedAt },
-    { kind: "diff", uri: `./${diffRelPath}`, revision: createHash12("sha256").update(diffText).digest("hex"), observedAt },
-    { kind: "session", uri: `./${relPath}`, revision: createHash12("sha256").update(markdown).digest("hex"), observedAt }
+    { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash11("sha256").update(wrapUpMarkdown).digest("hex"), observedAt },
+    { kind: "diff", uri: `./${diffRelPath}`, revision: createHash11("sha256").update(diffText).digest("hex"), observedAt },
+    { kind: "session", uri: `./${relPath}`, revision: createHash11("sha256").update(markdown).digest("hex"), observedAt }
   ];
   return {
     workspaceId: input2.workspaceId,
     sourceRevision: summary.updatedAt,
     summary: `Session "${summary.title}" (${summary.archiveMessageCount} messages${summary.model ? `, ${summary.provider ?? "?"}/${summary.model}` : ""})`,
     evidence,
-    expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS2).toISOString()
+    expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS).toISOString()
   };
 }
-var WRAP_UP_TTL_MS2, SessionWrapUpError;
+var WRAP_UP_TTL_MS, SessionWrapUpError;
 var init_session_wrap_up = __esm(() => {
   init_store3();
   init_machine_wrap_up();
   init_slate_course();
-  WRAP_UP_TTL_MS2 = 60 * 60 * 1000;
+  WRAP_UP_TTL_MS = 60 * 60 * 1000;
   SessionWrapUpError = class SessionWrapUpError extends Error {
     code;
     constructor(code, message) {
@@ -16564,17 +16290,17 @@ var init_session_wrap_up = __esm(() => {
 });
 
 // src/sac/review-confirm-token.ts
-import { createHash as createHash13, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes2 } from "crypto";
 import { readFile as readFile35 } from "fs/promises";
-import path77 from "path";
+import path76 from "path";
 function confirmTokenPath(cwd, workspaceId, proposalId) {
-  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
+  return path76.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
 }
 function confirmReceiptPath(cwd, workspaceId, proposalId, idempotencyKey) {
-  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2562(idempotencyKey)}.confirm-receipt.json`);
+  return path76.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha256(idempotencyKey)}.confirm-receipt.json`);
 }
-function sha2562(text) {
-  return createHash13("sha256").update(text).digest("hex");
+function sha256(text) {
+  return createHash12("sha256").update(text).digest("hex");
 }
 async function mintConfirmToken(cwd, workspaceId, proposalId, deps = {}) {
   const now = deps.now ?? (() => new Date);
@@ -16585,7 +16311,7 @@ async function mintConfirmToken(cwd, workspaceId, proposalId, deps = {}) {
   const file = confirmTokenPath(cwd, workspaceId, proposalId);
   const stored = {
     schemaVersion: 1,
-    hash: sha2562(token),
+    hash: sha256(token),
     workspaceId,
     proposalId,
     mintedAt: mintedAt.toISOString(),
@@ -16612,7 +16338,7 @@ async function consumeConfirmToken(cwd, workspaceId, proposalId, idempotencyKey,
     } catch (error2) {
       return { ok: false, reason: isNotFound(error2) ? "token_required" : "token_invalid" };
     }
-    if (stored.usedAt !== undefined || new Date(stored.expiresAt).getTime() <= now().getTime() || stored.hash !== sha2562(token) || stored.workspaceId !== workspaceId || stored.proposalId !== proposalId) {
+    if (stored.usedAt !== undefined || new Date(stored.expiresAt).getTime() <= now().getTime() || stored.hash !== sha256(token) || stored.workspaceId !== workspaceId || stored.proposalId !== proposalId) {
       return { ok: false, reason: "token_invalid" };
     }
     const consumed2 = { ...stored, usedAt: now().toISOString() };
@@ -16699,17 +16425,17 @@ function round2(value) {
 var init_dedup = () => {};
 
 // src/sac/proposal-evidence.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { readFile as readFile36 } from "fs/promises";
-import path78 from "path";
+import path77 from "path";
 function proposalPath(cwd, workspaceId, proposalId) {
-  return path78.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
 }
 function ownerReceiptPath(cwd, owner, workspaceId, idempotencyKey) {
-  return path78.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
+  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
 }
 function proposalNotePath(cwd, workspaceId, proposalId) {
-  return path78.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
+  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
 }
 async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
   let proposal;
@@ -16723,11 +16449,11 @@ async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
     return { ok: false, code: "no_evidence_to_write" };
   let content;
   try {
-    content = await readFile36(path78.join(cwd, evidence.uri), "utf8");
+    content = await readFile36(path77.join(cwd, evidence.uri), "utf8");
   } catch {
     return { ok: false, code: "evidence_file_unreadable" };
   }
-  if (createHash14("sha256").update(content).digest("hex") !== evidence.revision) {
+  if (createHash13("sha256").update(content).digest("hex") !== evidence.revision) {
     return { ok: false, code: "evidence_revision_mismatch" };
   }
   return { proposal, evidence, content };
@@ -16741,8 +16467,8 @@ var init_proposal_evidence = () => {};
 
 // src/sac/decision-dedup.ts
 import { readFile as readFile37, readdir as readdir10 } from "fs/promises";
-import { randomUUID as randomUUID10 } from "crypto";
-import path79 from "path";
+import { randomUUID as randomUUID9 } from "crypto";
+import path78 from "path";
 function asMemoryStatus(value) {
   return MEMORY_STATUSES.includes(value) ? value : "draft";
 }
@@ -16769,14 +16495,14 @@ function extractHeaderField(content, field3) {
 async function resolveWorkspaceModule(cwd, workspaceId) {
   try {
     const service = new WorkspaceService({ workspaceRoot: cwd, authorizationServer: localWorkspaceAuthorizationServer(), strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" } });
-    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID10(), workspaceId });
+    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID9(), workspaceId });
     return manifest.resources.find((r) => r.kind === "component")?.uri ?? null;
   } catch {
     return null;
   }
 }
 async function collectWikiDecisionEntries(cwd) {
-  const dir = path79.join(cwd, ".metaproject", "wiki", "decisions");
+  const dir = path78.join(cwd, ".metaproject", "wiki", "decisions");
   let files;
   try {
     files = (await readdir10(dir)).filter((name) => name.endsWith(".md"));
@@ -16785,12 +16511,12 @@ async function collectWikiDecisionEntries(cwd) {
   }
   const entries = [];
   for (const file of files) {
-    const absolutePath = path79.join(dir, file);
+    const absolutePath = path78.join(dir, file);
     try {
       const content = await readFile37(absolutePath, "utf8");
       entries.push({
         absolutePath,
-        relativePath: path79.posix.join("decisions", file),
+        relativePath: path78.posix.join("decisions", file),
         type: extractHeaderField(content, "Type") ?? "decision",
         title: extractTitle(content),
         version: extractHeaderField(content, "Version") ?? null,
@@ -16909,13 +16635,13 @@ var init_decision_dedup = __esm(() => {
 });
 
 // src/memory/write.ts
-import { mkdir as mkdir30, open, readFile as readFile38, rename as rename3, rm as rm5, writeFile as writeFile28 } from "fs/promises";
-import path80 from "path";
+import { mkdir as mkdir29, open, readFile as readFile38, rename as rename3, rm as rm5, writeFile as writeFile28 } from "fs/promises";
+import path79 from "path";
 async function resolveCanonicalEntryPath(cwd, relativePath) {
-  const root = path80.resolve(memoryRoot(cwd));
-  const absolutePath = path80.resolve(root, relativePath);
-  const normalized = toPosix2(path80.relative(root, absolutePath));
-  if (!normalized || normalized.startsWith("../") || path80.isAbsolute(normalized) || !normalized.endsWith(".md")) {
+  const root = path79.resolve(memoryRoot(cwd));
+  const absolutePath = path79.resolve(root, relativePath);
+  const normalized = toPosix2(path79.relative(root, absolutePath));
+  if (!normalized || normalized.startsWith("../") || path79.isAbsolute(normalized) || !normalized.endsWith(".md")) {
     return null;
   }
   return { absolutePath, relativePath: normalized };
@@ -17010,9 +16736,9 @@ function validateNextEntry(relativePath, content) {
   return null;
 }
 async function replaceAtomically(target, content) {
-  const dir = path80.dirname(target);
-  await mkdir30(dir, { recursive: true });
-  const tmp = path80.join(dir, `.${path80.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
+  const dir = path79.dirname(target);
+  await mkdir29(dir, { recursive: true });
+  const tmp = path79.join(dir, `.${path79.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
   try {
     await writeFile28(tmp, content, "utf8");
     const file = await open(tmp, "r");
@@ -17041,14 +16767,14 @@ function asPair(result, prior) {
     return { status: "skipped", paths: [...prior, result.path], warnings: result.warnings, reason: result.reason };
   return { status: "error", paths: [...prior, result.path], warnings: result.warnings, error: result.error };
 }
-function persistenceError(path81, cause, warnings) {
-  return { status: "error", path: path81, warnings, error: { code: "persistence-failed", message: message(cause) } };
+function persistenceError(path80, cause, warnings) {
+  return { status: "error", path: path80, warnings, error: { code: "persistence-failed", message: message(cause) } };
 }
 function header(content, name) {
   return content.match(new RegExp(`^${name}:\\s*(.+)$`, "mi"))?.[1]?.trim() ?? null;
 }
 function toPosix2(value) {
-  return value.split(path80.sep).join("/");
+  return value.split(path79.sep).join("/");
 }
 function message(cause) {
   return cause instanceof Error ? cause.message : String(cause);
@@ -17060,8 +16786,8 @@ var init_write = __esm(() => {
 });
 
 // src/sac/memory-owner-writer.ts
-import { mkdir as mkdir31, readFile as readFile39, writeFile as writeFile29 } from "fs/promises";
-import path81 from "path";
+import { mkdir as mkdir30, readFile as readFile39, writeFile as writeFile29 } from "fs/promises";
+import path80 from "path";
 function renderWrapUpMemoryEntry(input2) {
   const note2 = input2.note?.trim();
   return `# ${input2.title}
@@ -17146,7 +16872,7 @@ function createRealMemoryOwnerWriter(cwd, opts) {
         targetRef: `./memory/${result.path}`,
         completedAt: now().toISOString()
       };
-      await mkdir31(path81.dirname(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey)), { recursive: true });
+      await mkdir30(path80.dirname(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey)), { recursive: true });
       await writeFile29(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey), `${JSON.stringify(receipt, null, 2)}
 `, "utf8");
       return receipt;
@@ -17161,7 +16887,7 @@ var init_memory_owner_writer = __esm(() => {
 
 // src/sac/wiki-owner-writer.ts
 import { readFile as readFile40 } from "fs/promises";
-import path82 from "path";
+import path81 from "path";
 function renderWrapUpDecisionPage(input2) {
   const note2 = input2.note?.trim();
   return `# ${input2.title}
@@ -17202,7 +16928,7 @@ export is the source of truth for what actually happened.
 `;
 }
 function wikiPageRelativePath(proposalId) {
-  return path82.posix.join("decisions", `sac-${proposalId}.md`);
+  return path81.posix.join("decisions", `sac-${proposalId}.md`);
 }
 function createRealWikiOwnerWriter(cwd, opts) {
   const now = opts?.now ?? (() => new Date);
@@ -17239,7 +16965,7 @@ function createRealWikiOwnerWriter(cwd, opts) {
       const guard = await guardOutput({ cwd, content, target: "wiki", source: "tool-output", path: `wiki/${relativePath}` });
       if (!guard.allowed)
         return { ok: false, code: `security_gate_${guard.reason ?? "blocked"}` };
-      await writeFileAtomic(path82.join(cwd, ".metaproject", "wiki", relativePath), content);
+      await writeFileAtomic(path81.join(cwd, ".metaproject", "wiki", relativePath), content);
       const receipt = {
         receiptRef: `./wiki/${relativePath.replace(/\.md$/, "")}.receipt.json`,
         targetRef: `./wiki/${relativePath}`,
@@ -17258,23 +16984,23 @@ var init_wiki_owner_writer = __esm(() => {
 });
 
 // src/gdskills/project-skills.ts
-import { mkdir as mkdir32, readFile as readFile41, stat as stat4 } from "fs/promises";
-import path83 from "path";
+import { mkdir as mkdir31, readFile as readFile41, stat as stat4 } from "fs/promises";
+import path82 from "path";
 async function createProjectSkill(projectRoot, options) {
-  const metaprojectRoot = path83.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path82.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const moduleName = slugify3(options.module ?? inferModule(options.target));
   const skillName = slugify3(options.name ?? inferSkillName(options.target));
   const format = options.format ?? "auto";
-  const packageRoot = path83.join(metaprojectRoot, "project-skills", moduleName, skillName);
-  const relativeSkillPath = toPosix(path83.relative(projectRoot, packageRoot));
+  const packageRoot = path82.join(metaprojectRoot, "project-skills", moduleName, skillName);
+  const relativeSkillPath = toPosix(path82.relative(projectRoot, packageRoot));
   const evidence = await collectEvidence(projectRoot, options.target);
   const warnings = collectWarnings(evidence, format);
   const files = filesForPackage(packageRoot, format);
   if (!options.dryRun) {
-    await withFileLock2(path83.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
+    await withFileLock2(path82.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
       await writeProjectSkillPackage({
         projectRoot,
         packageRoot,
@@ -17301,7 +17027,7 @@ async function createProjectSkill(projectRoot, options) {
     name: skillName,
     target: options.target,
     skillPath: relativeSkillPath,
-    files: files.map((filePath) => toPosix(path83.relative(projectRoot, filePath))),
+    files: files.map((filePath) => toPosix(path82.relative(projectRoot, filePath))),
     warnings,
     dryRun: options.dryRun === true
   };
@@ -17323,31 +17049,31 @@ async function writeProjectSkillPackage({
 }) {
   const packageFormat = format === "single" ? "single" : "package";
   const skillContent = renderProjectSkill({ moduleName, skillName, target, evidence, packageFormat });
-  const relativeSkillMdPath = toPosix(path83.join(path83.relative(projectRoot, packageRoot), "SKILL.md"));
+  const relativeSkillMdPath = toPosix(path82.join(path82.relative(projectRoot, packageRoot), "SKILL.md"));
   const guard = await guardOutput({ cwd: projectRoot, content: skillContent, target: "skill", source: "generated", path: relativeSkillMdPath });
   if (!guard.allowed) {
     throw new Error(`Project skill blocked by the security gate: ${guard.reason ?? "policy violation"}`);
   }
-  await mkdir32(packageRoot, { recursive: true });
-  const skillPath = path83.join(packageRoot, "SKILL.md");
+  await mkdir31(packageRoot, { recursive: true });
+  const skillPath = path82.join(packageRoot, "SKILL.md");
   await writeFileAtomic(skillPath, skillContent);
-  const changelogPath = path83.join(packageRoot, "skill-changelog.md");
+  const changelogPath = path82.join(packageRoot, "skill-changelog.md");
   if (!await pathExists(changelogPath)) {
     await writeFileAtomic(changelogPath, renderSkillChangelog({ moduleName, skillName, target }));
   }
   if (packageFormat === "package") {
-    await mkdir32(path83.join(packageRoot, "references"), { recursive: true });
-    await mkdir32(path83.join(packageRoot, "templates"), { recursive: true });
-    await writeFileAtomic(path83.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
-    await writeFileAtomic(path83.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
-    await writeFileAtomic(path83.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
+    await mkdir31(path82.join(packageRoot, "references"), { recursive: true });
+    await mkdir31(path82.join(packageRoot, "templates"), { recursive: true });
+    await writeFileAtomic(path82.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
+    await writeFileAtomic(path82.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
+    await writeFileAtomic(path82.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
   }
 }
 async function collectEvidence(projectRoot, target) {
-  const absoluteTarget = path83.resolve(projectRoot, target);
+  const absoluteTarget = path82.resolve(projectRoot, target);
   const targetExists = await pathExists(absoluteTarget);
   const targetKind = await classifyTarget(absoluteTarget, targetExists);
-  const maybeRelativeTarget = targetExists ? toPosix(path83.relative(projectRoot, absoluteTarget)) : undefined;
+  const maybeRelativeTarget = targetExists ? toPosix(path82.relative(projectRoot, absoluteTarget)) : undefined;
   const graphArtifacts = await existingRelativePaths(projectRoot, [
     ".metaproject/data/gdgraph/artifacts/summary.md",
     ".metaproject/data/gdgraph/artifacts/module-map.json"
@@ -17377,7 +17103,7 @@ async function classifyTarget(absoluteTarget, targetExists) {
 async function existingRelativePaths(projectRoot, candidates) {
   const existing = [];
   for (const candidate of candidates) {
-    if (await pathExists(path83.join(projectRoot, candidate))) {
+    if (await pathExists(path82.join(projectRoot, candidate))) {
       existing.push(candidate);
     }
   }
@@ -17404,17 +17130,17 @@ function collectWarnings(evidence, format) {
 }
 function filesForPackage(packageRoot, format) {
   const base = [
-    path83.join(packageRoot, "SKILL.md"),
-    path83.join(packageRoot, "skill-changelog.md")
+    path82.join(packageRoot, "SKILL.md"),
+    path82.join(packageRoot, "skill-changelog.md")
   ];
   if (format === "single") {
     return base;
   }
   return [
     ...base,
-    path83.join(packageRoot, "verification.md"),
-    path83.join(packageRoot, "references", "context.md"),
-    path83.join(packageRoot, "templates", "README.md")
+    path82.join(packageRoot, "verification.md"),
+    path82.join(packageRoot, "references", "context.md"),
+    path82.join(packageRoot, "templates", "README.md")
   ];
 }
 function renderProjectSkill({
@@ -17633,7 +17359,7 @@ keryx skills verify ${moduleName}/${skillName}
 `;
 }
 async function updateManifest(projectRoot, entry) {
-  const manifestPath = path83.join(projectRoot, ".metaproject", "metaproject.json");
+  const manifestPath = path82.join(projectRoot, ".metaproject", "metaproject.json");
   const manifest = await readJsonFileOr(manifestPath, {});
   manifest.modules ??= {};
   manifest.modules.gdskills ??= {};
@@ -17647,8 +17373,8 @@ async function updateManifest(projectRoot, entry) {
 `);
 }
 async function updateSkillsCatalog(projectRoot) {
-  const manifestPath = path83.join(projectRoot, ".metaproject", "metaproject.json");
-  const catalogPath = path83.join(projectRoot, ".metaproject", "skills", "catalog.md");
+  const manifestPath = path82.join(projectRoot, ".metaproject", "metaproject.json");
+  const catalogPath = path82.join(projectRoot, ".metaproject", "skills", "catalog.md");
   const manifest = await readJsonFileOr(manifestPath, {});
   const registry = manifest.modules?.gdskills?.projectSkillRegistry ?? [];
   const rows = registry.length > 0 ? registry.map((entry) => `| ${entry.module} | ${entry.name} | \`${entry.target}\` | ${entry.path}/SKILL.md |`).join(`
@@ -17688,7 +17414,7 @@ function inferModule(target) {
 }
 function inferSkillName(target) {
   const normalized = target.trim().replace(/[#:]+/g, "/");
-  const base = path83.basename(normalized).replace(/\.[^.]+$/, "");
+  const base = path82.basename(normalized).replace(/\.[^.]+$/, "");
   return base || "entity";
 }
 function slugify3(value) {
@@ -17766,9 +17492,9 @@ var init_skill_owner_writer = __esm(() => {
 });
 
 // src/sac/proposal-lifecycle.ts
-import { createHash as createHash15, randomUUID as randomUUID11 } from "crypto";
-import { appendFile as appendFile3, mkdir as mkdir33, readdir as readdir11, readFile as readFile43 } from "fs/promises";
-import path84 from "path";
+import { createHash as createHash14, randomUUID as randomUUID10 } from "crypto";
+import { appendFile as appendFile3, mkdir as mkdir32, readdir as readdir11, readFile as readFile43 } from "fs/promises";
+import path83 from "path";
 
 class ProposalLifecycleService {
   options;
@@ -17776,7 +17502,7 @@ class ProposalLifecycleService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path84.resolve(options.workspaceRoot);
+    this.root = path83.resolve(options.workspaceRoot);
     this.now = options.now ?? (() => new Date);
   }
   async create(input2) {
@@ -17795,7 +17521,7 @@ class ProposalLifecycleService {
       if (manifest.status === "archived")
         throw new ProposalLifecycleError("guard_denied", "workspace is archived");
       const file = this.proposalPath(workspaceId, proposal.id);
-      await mkdir33(path84.dirname(file), { recursive: true, mode: 448 });
+      await mkdir32(path83.dirname(file), { recursive: true, mode: 448 });
       return withFileLock2(`${file}.lock`, async () => {
         const consume = this.options.wrapUpAuthority.consume(input2.wrapUp, { actor, workspaceId });
         if (consume !== "ok")
@@ -17823,7 +17549,7 @@ class ProposalLifecycleService {
     return this.options.workspaces.withAuthorizedActor({ actorContext: actor, workspaceId: input2.workspaceId, action: "review", execute: async (manifest) => {
       const proposal = await this.loadProposal(input2.workspaceId, input2.proposalId);
       const ledger = this.ledgerPath(input2.workspaceId);
-      await mkdir33(path84.dirname(ledger), { recursive: true, mode: 448 });
+      await mkdir32(path83.dirname(ledger), { recursive: true, mode: 448 });
       return withFileLock2(`${ledger}.lock`, async () => {
         const records = (await this.records(ledger)).filter((record) => record.proposalId === proposal.id);
         const events = records.filter((record) => record.recordType === "proposal-transition");
@@ -17864,7 +17590,7 @@ class ProposalLifecycleService {
     } });
   }
   async listProposedProposals(workspaceId) {
-    const proposalsDir = path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
+    const proposalsDir = path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
     let entries;
     try {
       entries = (await readdir11(proposalsDir)).filter((name) => name.endsWith(".json"));
@@ -17876,7 +17602,7 @@ class ProposalLifecycleService {
     const proposals = [];
     for (const entry of entries) {
       try {
-        const parsed = JSON.parse(await readFile43(path84.join(proposalsDir, entry), "utf8"));
+        const parsed = JSON.parse(await readFile43(path83.join(proposalsDir, entry), "utf8"));
         if (parsed.recordType === "proposal-created")
           proposals.push(parsed);
       } catch {}
@@ -17935,7 +17661,7 @@ class ProposalLifecycleService {
   }
   async transition(input2) {
     const previous = input2.records.at(-1);
-    const base = { schemaVersion: "1.0", recordType: "proposal-transition", eventId: `event-${randomUUID11().replace(/-/g, "").slice(0, 16)}`, proposalId: input2.proposal.id, proposalRevision: input2.proposal.proposalRevision, correlationId: input2.input.requestCorrelationId, workspaceId: input2.proposal.workspaceId, sequence: input2.records.length + 1, priorEventHash: previous ? recordHash(previous) : hash("GENESIS"), fromStatus: "proposed", toStatus: input2.outcome, occurredAt: this.timestamp(), idempotencyKey: input2.input.idempotencyKey };
+    const base = { schemaVersion: "1.0", recordType: "proposal-transition", eventId: `event-${randomUUID10().replace(/-/g, "").slice(0, 16)}`, proposalId: input2.proposal.id, proposalRevision: input2.proposal.proposalRevision, correlationId: input2.input.requestCorrelationId, workspaceId: input2.proposal.workspaceId, sequence: input2.records.length + 1, priorEventHash: previous ? recordHash(previous) : hash("GENESIS"), fromStatus: "proposed", toStatus: input2.outcome, occurredAt: this.timestamp(), idempotencyKey: input2.input.idempotencyKey };
     if (input2.outcome === "accepted") {
       const write = input2.targetWrite;
       if (!write?.ok)
@@ -17982,7 +17708,7 @@ class ProposalLifecycleService {
       if (!isNotFound(error2))
         throw error2;
     }
-    const intent = { schemaVersion: "1.0", recordType: "proposal-write-intent", intentId: `intent-${randomUUID11().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, sequence: records.length + 1, priorEventHash: records.length ? recordHash(records.at(-1)) : hash("GENESIS"), idempotencyKey: input2.idempotencyKey, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, approvalRef, security: { gate: "pass", policyRef: this.options.policyRef, policyRevision }, evidence: proposal.evidence, createdAt: this.timestamp() };
+    const intent = { schemaVersion: "1.0", recordType: "proposal-write-intent", intentId: `intent-${randomUUID10().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, sequence: records.length + 1, priorEventHash: records.length ? recordHash(records.at(-1)) : hash("GENESIS"), idempotencyKey: input2.idempotencyKey, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, approvalRef, security: { gate: "pass", policyRef: this.options.policyRef, policyRevision }, evidence: proposal.evidence, createdAt: this.timestamp() };
     await this.validateRecord(intent);
     await this.writeImmutable(this.intentPath(proposal.workspaceId, proposal.id, input2.idempotencyKey), intent);
     await appendFile3(ledger, `${JSON.stringify(intent)}
@@ -18050,7 +17776,7 @@ class ProposalLifecycleService {
       throw new ProposalLifecycleError("invalid_proposal", validation.errors.map((error2) => error2.code).join(","));
   }
   async reviewDecision(proposal, actor, reviewerAuthority, input2, decision, targetWrite, policyRevision) {
-    const base = { schemaVersion: "1.0", id: `review-${randomUUID11().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, decision, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, decidedAt: this.timestamp(), idempotencyKey: input2.idempotencyKey };
+    const base = { schemaVersion: "1.0", id: `review-${randomUUID10().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, decision, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, decidedAt: this.timestamp(), idempotencyKey: input2.idempotencyKey };
     if (decision === "accepted" && targetWrite?.ok)
       Object.assign(base, { security: { gate: "pass", policyRef: this.options.policyRef, policyRevision }, freshness: { state: "fresh", verifiedAt: this.timestamp(), evidenceRevision: proposal.evidence[0].revision }, targetWrite: { receiptRef: targetWrite.receipt.receiptRef, targetRef: targetWrite.receipt.targetRef, completedAt: targetWrite.receipt.completedAt } });
     else
@@ -18082,28 +17808,28 @@ class ProposalLifecycleService {
     }
   }
   proposalPath(workspaceId, proposalId) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
   }
   decisionRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.decision.json`;
   }
   decisionPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
   }
   approvalRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.approval.json`;
   }
   approvalPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
   }
   writeResultPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
   }
   intentRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.write-intent.json`;
   }
   intentPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
   }
   async loadWriteResult(workspaceId, proposalId, key) {
     try {
@@ -18130,14 +17856,14 @@ class ProposalLifecycleService {
     }
   }
   ledgerPath(workspaceId) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
   }
   timestamp() {
     return this.now().toISOString();
   }
 }
 function hash(value) {
-  return createHash15("sha256").update(value).digest("hex");
+  return createHash14("sha256").update(value).digest("hex");
 }
 function recordHash(value) {
   return hash(JSON.stringify(value));
@@ -18235,9 +17961,9 @@ var init_proposal_lifecycle = __esm(() => {
 });
 
 // src/harness/tool/builtin/workspace-lifecycle-tool.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { writeFile as writeFile30 } from "fs/promises";
-import path85 from "path";
+import path84 from "path";
 function service(cwd) {
   return new WorkspaceService({
     workspaceRoot: cwd,
@@ -18248,11 +17974,11 @@ function service(cwd) {
 function errorOutput(prefix, cause) {
   return { output: `${prefix}: ${cause instanceof Error ? cause.message : String(cause)}`, isError: true };
 }
-function workspaceCreateTool(cwd) {
+function workspaceCreateTool(cwd, getSessionDir) {
   return {
     definition: {
       name: "workspace_create",
-      description: "Create a new Shared Agent Context (SAC) workspace to bind this session's work to. Call workspace_list FIRST and only create when no existing workspace already fits the current topic \u2014 a workspace is meant to persist and accumulate context across sessions, not to be created per-session. Input: { title: string, component?: string }. `component` is an optional workspace-relative path this workspace is scoped to.",
+      description: "Create a new Shared Agent Context (SAC) workspace to bind this session's work to. Call workspace_list FIRST and only create when no existing workspace already fits the current topic \u2014 a workspace is meant to persist and accumulate context across sessions, not to be created per-session. The created workspace is BOUND to this session's slate (its workspaceId is written to the slate), so wrap-up can propose into it. Input: { title: string, component?: string }. `component` is an optional workspace-relative path this workspace is scoped to.",
       inputSchema: {
         type: "object",
         properties: { title: { type: "string" }, component: { type: "string" } },
@@ -18269,11 +17995,23 @@ function workspaceCreateTool(cwd) {
       try {
         const workspace = await service(cwd).create({
           request: undefined,
-          requestCorrelationId: randomUUID12(),
+          requestCorrelationId: randomUUID11(),
           id: newWorkspaceId(),
           title,
           ...component ? { component: { kind: "component", uri: component } } : {}
         });
+        const dir = getSessionDir?.();
+        if (dir !== undefined) {
+          try {
+            await writeSlate(dir, (prev) => ({
+              anchors: prev?.anchors ?? { root: "", touched: [] },
+              course: prev?.course ?? {},
+              seeds: prev?.seeds ?? [],
+              ...prev !== undefined ? { workspaceId: prev.workspaceId } : {},
+              workspaceId: workspace.id
+            }));
+          } catch {}
+        }
         return { output: JSON.stringify(workspace, null, 2), isError: false };
       } catch (cause) {
         return errorOutput("workspace_create failed", cause);
@@ -18296,7 +18034,7 @@ function workspaceListTool(cwd) {
     invoke: async (input2) => {
       const includeArchived = input2.includeArchived === true;
       try {
-        const workspaces = await service(cwd).list({ request: undefined, requestCorrelationId: randomUUID12(), includeArchived });
+        const workspaces = await service(cwd).list({ request: undefined, requestCorrelationId: randomUUID11(), includeArchived });
         return { output: JSON.stringify(workspaces, null, 2), isError: false };
       } catch (cause) {
         return errorOutput("workspace_list failed", cause);
@@ -18322,7 +18060,7 @@ function workspaceShowTool(cwd) {
       if (workspaceId.length === 0)
         return { output: "workspace_show requires a non-empty 'workspaceId'", isError: true };
       try {
-        const workspace = await service(cwd).show({ request: undefined, requestCorrelationId: randomUUID12(), workspaceId });
+        const workspace = await service(cwd).show({ request: undefined, requestCorrelationId: randomUUID11(), workspaceId });
         return { output: JSON.stringify(workspace, null, 2), isError: false };
       } catch (cause) {
         return errorOutput("workspace_show failed", cause);
@@ -18358,7 +18096,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
         return { output: `workspace_propose: unrecognized 'kind' \u2014 expected one of: ${PROPOSAL_KINDS.join(", ")}`, isError: true };
       }
       const explicitSessionId = typeof input2.sessionId === "string" && input2.sessionId.length > 0 ? input2.sessionId : undefined;
-      const sessionRef = explicitSessionId ?? path85.basename(getSessionDir() ?? "");
+      const sessionRef = explicitSessionId ?? path84.basename(getSessionDir() ?? "");
       if (sessionRef.length === 0) {
         return { output: "workspace_propose: no 'sessionId' given and no active session in this run", isError: true };
       }
@@ -18367,7 +18105,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
         if (!session)
           return { output: `workspace_propose: no session matching "${sessionRef}" in this project`, isError: true };
         const { service: lifecycle, wrapUpAuthority, authorizationServer } = createHarnessProposalLifecycleService(cwd, { workspaceId, ...note2 ? { note: note2 } : {} });
-        const requestCorrelationId = randomUUID12();
+        const requestCorrelationId = randomUUID11();
         const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
         if (!actor)
           return { output: "workspace_propose: trusted ActorContext is required", isError: true };
@@ -18376,7 +18114,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
           request: undefined,
           requestCorrelationId,
           workspaceId,
-          id: `proposal-${randomUUID12().replace(/-/g, "").slice(0, 16)}`,
+          id: `proposal-${randomUUID11().replace(/-/g, "").slice(0, 16)}`,
           proposalRevision: "1",
           kind,
           wrapUp
@@ -18396,6 +18134,7 @@ var init_workspace_lifecycle_tool = __esm(() => {
   init_proposal_lifecycle();
   init_proposal_evidence();
   init_session_wrap_up();
+  init_slate();
   init_store3();
   PROPOSAL_KINDS = ["decision", "wiki-update", "memory-entry", "follow-up", "contract-change", "risk"];
 });
@@ -18445,7 +18184,7 @@ ${topicHint}
 ${existing.map((w) => `${w.id}: ${w.title}`).join(`
 `)}`;
   let modelResult;
-  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS2;
+  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS;
   const turn = runModelTurn({
     system,
     user,
@@ -18490,13 +18229,315 @@ ${existing.map((w) => `${w.id}: ${w.title}`).join(`
   const { id } = JSON.parse(created.output);
   return { ok: true, workspaceId: id, action: "created" };
 }
-var DEFAULT_MODEL_TURN_TIMEOUT_MS2 = 15000, TOPIC_HINT_MAX_LENGTH = 200;
+var DEFAULT_MODEL_TURN_TIMEOUT_MS = 15000, TOPIC_HINT_MAX_LENGTH = 200;
 var init_workspace_resolve = __esm(() => {
   init_redact();
   init_workspace_lifecycle_tool();
   init_single_turn();
 });
 
+// src/sac/machine-wrap-up.ts
+import { createHash as createHash15, randomUUID as randomUUID12 } from "crypto";
+import { execFile } from "child_process";
+import { mkdir as mkdir33 } from "fs/promises";
+import path85 from "path";
+import { promisify } from "util";
+function describeSource(source) {
+  return source === "parent" ? "parent" : `child:${source.childDispatchId}`;
+}
+function dedupedAttributedSeeds(slate) {
+  const seen = new Set;
+  const result = [];
+  const take = (seeds, source) => {
+    for (const seed of dedupeSeeds(seeds)) {
+      const key = seed.text.trim();
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      result.push({ text: seed.text, kind: seed.kind ?? "follow-up", source });
+    }
+  };
+  take(slate.seeds, "parent");
+  const childDispatches = slate.childDispatches ?? {};
+  for (const [dispatchId, dispatch] of Object.entries(childDispatches)) {
+    take(dispatch.seeds, { childDispatchId: dispatchId });
+  }
+  return result;
+}
+function groupSeedsByKind(slate) {
+  const map = new Map;
+  for (const seed of dedupedAttributedSeeds(slate)) {
+    const bucket = map.get(seed.kind);
+    if (bucket)
+      bucket.push(seed);
+    else
+      map.set(seed.kind, [seed]);
+  }
+  return map;
+}
+function sha2562(value) {
+  return createHash15("sha256").update(value).digest("hex");
+}
+async function gitDiff(cwd) {
+  try {
+    const { stdout: stdout2 } = await execFileAsync("git", ["diff"], { cwd, maxBuffer: 16 * 1024 * 1024 });
+    return stdout2;
+  } catch {
+    return "";
+  }
+}
+function diffStatLine(diffText) {
+  if (diffText.trim().length === 0)
+    return "no working-tree changes";
+  const added = (diffText.match(/^\+(?!\+\+)/gm) ?? []).length;
+  const removed = (diffText.match(/^-(?!--)/gm) ?? []).length;
+  return `working-tree diff: +${added}/-${removed} line(s)`;
+}
+function courseStatusLine(course) {
+  if (course.state !== "bound")
+    return "flow: unbound";
+  return `flow ${course.flowRef.uri} snapshot=${course.flowRef.snapshot} completed=${course.completed.length} next=${course.next.length} blocked=${course.blocked.length}`;
+}
+function mechanicalSummary(diffText, course) {
+  return `Mechanical wrap-up summary (model turn unavailable or timed out):
+${diffStatLine(diffText)}
+${courseStatusLine(course)}`;
+}
+async function resolveMachineWrapUp(input2) {
+  const now = input2.now ?? (() => new Date);
+  const diffText = await gitDiff(input2.cwd);
+  const course = await readCourse(input2.cwd, input2.slate.course.flowRef);
+  const seedsForKind = dedupedAttributedSeeds(input2.slate).filter((seed) => seed.kind === input2.kind);
+  const flowSnapshotJson = `${JSON.stringify(course, null, 2)}
+`;
+  const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
+`;
+  const sourceRevision = sha2562([diffText, flowSnapshotJson, seedsJson].join("\x00"));
+  const shortHash = sourceRevision.slice(0, 16);
+  const system = "Summarize ONLY the machine evidence provided below \u2014 a git diff, a Flow snapshot, and the Seeds captured " + "this session for one proposal kind. Never invent facts that are not present in the evidence.";
+  const user = `--- git diff ---
+${diffText.length > 0 ? diffText : "(no working-tree changes)"}
+
+` + `--- flow snapshot ---
+${flowSnapshotJson}
+` + `--- seeds (${input2.kind}) ---
+${seedsJson}`;
+  let modelResult;
+  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS2;
+  const turn = runModelTurn({
+    system,
+    user,
+    requestId: `machine-wrap-up-${shortHash}`,
+    ...input2.env !== undefined ? { env: input2.env } : {},
+    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {}
+  }).then((result) => {
+    modelResult = result;
+    return "done";
+  });
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), modelTurnTimeoutMs);
+  });
+  let raceOutcome;
+  try {
+    raceOutcome = await Promise.race([turn, expired]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+  }
+  let summary;
+  if (raceOutcome === "timeout") {
+    turn.catch(() => {});
+    summary = mechanicalSummary(diffText, course);
+  } else {
+    const result = modelResult;
+    if (result.text.trim().length === 0 && !result.credentialAvailable) {
+      return { ok: false, code: "no_credential" };
+    }
+    summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(diffText, course);
+  }
+  const evidenceDir = path85.join(input2.cwd, ".metaproject", "workspaces", input2.workspaceId, "machine-evidence");
+  await mkdir33(evidenceDir, { recursive: true });
+  const diffFile = `${input2.kind}.${shortHash}.diff.txt`;
+  const flowFile = `${input2.kind}.${shortHash}.flow.json`;
+  const seedsFile = `${input2.kind}.${shortHash}.seeds.json`;
+  await writeFileAtomic(path85.join(evidenceDir, diffFile), diffText);
+  await writeFileAtomic(path85.join(evidenceDir, flowFile), flowSnapshotJson);
+  await writeFileAtomic(path85.join(evidenceDir, seedsFile), seedsJson);
+  const observedAt = now().toISOString();
+  const relBase = `./.metaproject/workspaces/${input2.workspaceId}/machine-evidence`;
+  const evidence = [
+    { kind: "diff", uri: `${relBase}/${diffFile}`, revision: sha2562(diffText), observedAt },
+    { kind: "flow", uri: `${relBase}/${flowFile}`, revision: sha2562(flowSnapshotJson), observedAt },
+    { kind: "seeds", uri: `${relBase}/${seedsFile}`, revision: sha2562(seedsJson), observedAt }
+  ];
+  return {
+    ok: true,
+    resolution: {
+      workspaceId: input2.workspaceId,
+      sourceRevision,
+      summary,
+      evidence,
+      expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS2).toISOString()
+    }
+  };
+}
+async function writeUnboundCandidateArtifact(dir, trigger, now, grouped, nonEmptyKinds) {
+  const archiveDir = path85.join(dir, "slate-archive");
+  await mkdir33(archiveDir, { recursive: true });
+  const nowIso2 = now().toISOString();
+  const filename = `${nowIso2.replace(/[:.]/g, "-")}-unbound-candidate.json`;
+  const content = {
+    recordType: "unbound-candidate",
+    trigger,
+    generatedAt: nowIso2,
+    groups: nonEmptyKinds.map((kind) => ({
+      kind,
+      seeds: (grouped.get(kind) ?? []).map((seed) => ({ text: seed.text, source: describeSource(seed.source) }))
+    }))
+  };
+  await writeFileAtomic(path85.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
+`);
+}
+async function writeWrapUpOutcomeArtifact(dir, trigger, now, groups) {
+  try {
+    const archiveDir = path85.join(dir, "slate-archive");
+    await mkdir33(archiveDir, { recursive: true });
+    const nowIso2 = now().toISOString();
+    const filename = `${nowIso2.replace(/[:.]/g, "-")}-wrap-up-outcome.json`;
+    const content = { recordType: "wrap-up-outcome", trigger, generatedAt: nowIso2, groups };
+    await writeFileAtomic(path85.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
+`);
+  } catch {}
+}
+async function proposeOneGroup(params) {
+  const wrapUpSource = params.wrapUpSource ?? "flow";
+  try {
+    const resolved = await resolveMachineWrapUp({
+      cwd: params.cwd,
+      workspaceId: params.workspaceId,
+      slate: params.slate,
+      kind: params.kind,
+      now: params.now,
+      ...params.env !== undefined ? { env: params.env } : {},
+      ...params.providerFactory !== undefined ? { providerFactory: params.providerFactory } : {},
+      ...params.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: params.modelTurnTimeoutMs } : {}
+    });
+    if (!resolved.ok)
+      return { kind: params.kind, outcome: "no_credential" };
+    const flowEvidence = resolved.resolution.evidence.find((item) => item.kind === "flow");
+    const sourceRef = (flowEvidence ?? resolved.resolution.evidence[0]).uri;
+    const flowRef = params.slate.course.flowRef ?? "";
+    const dedupHash = sha2562(`${params.workspaceId}:${flowRef}:${resolved.resolution.sourceRevision}:${params.kind}`);
+    const proposalId = `wrapup-${dedupHash.slice(0, 32)}`;
+    const wrapUpAuthority = createTrustedWrapUpAuthority({
+      now: params.now,
+      resolveExplicitWrapUp: async (request) => {
+        if (request.source !== wrapUpSource) {
+          throw new Error(`machine-wrap-up only resolves "${wrapUpSource}" wrap-ups, got "${request.source}"`);
+        }
+        return resolved.resolution;
+      }
+    });
+    const { service: service2, authorizationServer } = createHarnessProposalLifecycleService(params.cwd, {
+      workspaceId: params.workspaceId,
+      now: params.now
+    });
+    const requestCorrelationId = randomUUID12();
+    const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
+    if (!actor)
+      throw new Error("trusted ActorContext is required for a machine wrap-up propose");
+    const provenance = await wrapUpAuthority.issue({ actor, source: wrapUpSource, sourceRef });
+    try {
+      const proposal = await service2.create({
+        request: undefined,
+        requestCorrelationId,
+        workspaceId: params.workspaceId,
+        id: proposalId,
+        proposalRevision: "1",
+        kind: params.kind,
+        wrapUp: provenance
+      });
+      return { kind: params.kind, outcome: "proposed", proposalId: proposal.id };
+    } catch (error2) {
+      if (error2 instanceof ProposalLifecycleError && error2.code === "conflict") {
+        return { kind: params.kind, outcome: "conflict" };
+      }
+      throw error2;
+    }
+  } catch (error2) {
+    const message2 = error2 instanceof Error ? error2.message : String(error2);
+    return { kind: params.kind, outcome: "error", message: message2 };
+  }
+}
+async function runWrapUp(input2) {
+  const now = input2.now ?? (() => new Date);
+  const grouped = groupSeedsByKind(input2.slate);
+  const nonEmptyKinds = [...grouped.keys()].filter((kind) => (grouped.get(kind)?.length ?? 0) > 0);
+  if (nonEmptyKinds.length === 0) {
+    return { groups: [] };
+  }
+  let workspaceId = input2.slate.workspaceId;
+  if (workspaceId === undefined && input2.wrapUpSource === "external-slate") {
+    await writeUnboundCandidateArtifact(input2.dir, input2.trigger, now, grouped, nonEmptyKinds);
+    const groups2 = nonEmptyKinds.map((kind) => ({ kind, outcome: "unbound-candidate" }));
+    await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups2);
+    return { groups: groups2 };
+  }
+  if (workspaceId === undefined) {
+    const topicHint = dedupedAttributedSeeds(input2.slate).map((seed) => seed.text).join("; ").trim().slice(0, 2000);
+    const resolver = input2.resolveWorkspace ?? resolveOrCreateWorkspace;
+    const resolved = await resolver({
+      cwd: input2.cwd,
+      topicHint: topicHint.length > 0 ? topicHint : "Untitled session wrap-up",
+      ...input2.env !== undefined ? { env: input2.env } : {},
+      ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
+      ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
+    });
+    if (!resolved.ok) {
+      await writeUnboundCandidateArtifact(input2.dir, input2.trigger, now, grouped, nonEmptyKinds);
+      const groups2 = nonEmptyKinds.map((kind) => ({ kind, outcome: "unbound-candidate" }));
+      await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups2);
+      return { groups: groups2 };
+    }
+    workspaceId = resolved.workspaceId;
+    const boundWorkspaceId = resolved.workspaceId;
+    try {
+      await writeSlate(input2.dir, (prev) => ({
+        anchors: prev?.anchors ?? { root: "", touched: [] },
+        course: prev?.course ?? {},
+        seeds: prev?.seeds ?? [],
+        workspaceId: boundWorkspaceId
+      }));
+    } catch {}
+  }
+  const groups = await Promise.all(nonEmptyKinds.map((kind) => proposeOneGroup({
+    cwd: input2.cwd,
+    workspaceId,
+    slate: input2.slate,
+    kind,
+    now,
+    ...input2.wrapUpSource !== undefined ? { wrapUpSource: input2.wrapUpSource } : {},
+    ...input2.env !== undefined ? { env: input2.env } : {},
+    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
+    ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
+  })));
+  await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups);
+  return { groups };
+}
+var execFileAsync, WRAP_UP_TTL_MS2, DEFAULT_MODEL_TURN_TIMEOUT_MS2 = 30000;
+var init_machine_wrap_up = __esm(() => {
+  init_fs();
+  init_slate();
+  init_slate_course();
+  init_trusted_wrap_up();
+  init_proposal_lifecycle();
+  init_workspace_resolve();
+  init_single_turn();
+  execFileAsync = promisify(execFile);
+  WRAP_UP_TTL_MS2 = 60 * 60 * 1000;
+});
+
 // src/session/slate-lifecycle.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -18870,8 +18911,8 @@ function buildAgentSystemInstruction(orient, ctx = {}) {
 ` + "- To find where a function/class/symbol is defined (or who calls it): call " + "**graph_symbol** with `{ name }` FIRST \u2014 it returns the exact file + line in one call. " + "read_file is capped at its first bytes only (see its own description) and cannot page " + "forward, so re-reading a large file to hunt for a symbol wastes calls without ever " + "reaching content past the cap; use graph_symbol (or search_code for a text pattern) " + `to get the location, THEN read_file only if you need surrounding context near it.
 ` + "- Prefer ONE correct shell_exec over many exploratory tool calls when the user asks " + `to run a known keryx workflow.
 ` + "- Tool-call budget: shell_exec, file-mutating shell, workspace_create/workspace_propose, and spawn_subagent " + "all share ONE small per-turn pool (distinct non-read actions), separate from the much larger read-tool pool. " + "search_code/graph_*/memory_search/read_wiki/wiki_*/test_related/health_status/flow_status/repomap/read_file/" + "list_dir do NOT touch it. Conserve the small pool: batch multiple shell steps into ONE call with `&&` instead " + "of issuing them one at a time, get a command's arguments right the first time instead of trying variants, and " + "for any check covered by a read tool above, use that tool instead of shelling out to the equivalent `keryx \u2026` " + `CLI command.
-` + "- This session has its own Slate (working-set scratch, not project knowledge): " + "**slate_read** shows the Course (if a Flow is bound) and Seeds recorded so far \u2014 nothing " + "here is auto-injected, so call it if you want to see it. **slate_write_seed** with " + "`{ text, kind? }` records a draft hypothesis/decision/follow-up worth a later human review " + "\u2014 use it for a real finding worth not losing (e.g. a root cause, a risk, a suggested " + `change), not for routine progress notes. A Seed is never accepted knowledge by itself.
-` + "- Shared Agent Context (SAC) workspaces hold accepted, evidence-backed project context " + "beyond this codebase. **workspace_list** with `{ includeArchived? }` shows every workspace " + "visible to you \u2014 call it first when the user references a shared team workspace or accepted " + "project context, or before creating a new workspace, to judge whether an existing one " + "already fits the current topic. **workspace_show** with `{ workspaceId }` shows one " + "workspace's manifest. **workspace_overview** with `{ workspaceId }`, then **workspace_read** " + "with `{ workspaceId, itemId }` for one specific item, reads its accepted Facts/Work/Know-how. " + "**workspace_create** with `{ title, component? }` creates a new workspace \u2014 only when " + "workspace_list found no fitting one; a workspace is meant to persist across sessions, so " + "prefer an existing one over creating another for the same topic. **workspace_propose** with " + "`{ workspaceId, kind, sessionId?, note? }` (sessionId defaults to this session) proposes a decision/wiki-update/memory-entry/" + "follow-up/contract-change/risk from this session for later human review \u2014 it never accepts " + "anything by itself; accepting always requires a human running `keryx workspace review` at a " + `real terminal, never this tool.
+` + "- This session has its own Slate (working-set scratch, not project knowledge): " + "**slate_read** shows the Course (if a Flow is bound) and Seeds recorded so far \u2014 nothing " + "here is auto-injected, so call it if you want to see it. **slate_write_seed** with " + "`{ text, kind? }` records a draft hypothesis/decision/follow-up worth a later human " + "review. WRITE A SEED when you: found a root cause or a bug worth remembering; changed or " + "added code (summarize WHAT changed and WHY); took a design/architecture decision; " + "identified a risk; or discovered a constraint/lesson. Use the `kind` that fits: " + "`decision` (a choice made), `wiki-update` (something a wiki page should say), " + "`memory-entry` (a lesson/constraint), `follow-up` (a TODO for a later session), " + "`risk`, or `contract-change`. Keep each Seed to 2-3 sentences, concrete and specific. " + "Do NOT write Seeds for routine progress notes, one-shot operational requests (e.g. " + '"run git pull", "count files"), or trivia \u2014 those need no workspace and no proposal. ' + "Seeds are the ONLY input wrap-up proposes from: a session whose Slate has zero Seeds " + `produces zero proposals. A Seed is never accepted knowledge by itself.
+` + "- Shared Agent Context (SAC) workspaces hold accepted, evidence-backed project context " + "beyond this codebase. **workspace_list** with `{ includeArchived? }` shows every workspace " + "visible to you \u2014 call it first when the user references a shared team workspace or accepted " + "project context, or before creating a new workspace, to judge whether an existing one " + "already fits the current topic. **workspace_show** with `{ workspaceId }` shows one " + "workspace's manifest. **workspace_overview** with `{ workspaceId }`, then **workspace_read** " + "with `{ workspaceId, itemId }` for one specific item, reads its accepted Facts/Work/Know-how. " + "**workspace_create** with `{ title, component? }` creates a new workspace AND binds it to " + "this session's slate (wrap-up then proposes into it) \u2014 only when workspace_list found no " + "fitting one and the session has real, durable results worth persisting; a workspace is " + "meant to persist across sessions, so prefer an existing one over creating another for the " + "same topic, and do NOT create one for one-shot operational requests. **workspace_propose** with " + "`{ workspaceId, kind, sessionId?, note? }` (sessionId defaults to this session) proposes a decision/wiki-update/memory-entry/" + "follow-up/contract-change/risk from this session for later human review \u2014 it never accepts " + "anything by itself; accepting always requires a human running `keryx workspace review` at a " + `real terminal, never this tool.
 ` + "- When you need a decision, interview step, or clarification: use **ask_user** with " + "2\u20136 options `{ id, label, description, recommended? }` (mark one recommended). " + `Do not dump long prose questions without options.
 ` + "- For a focused independent subtask (investigate X, review Y, research Z): use " + "**spawn_subagent** with `{ task, mode?: 'read_only'|'general', label? }`. " + "Default mode is read_only (no shell). Prefer spawn for work that can finish " + `without your intermediate turns; do not spawn for trivial one-line answers.
 
@@ -19114,22 +19155,6 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
           if (freshSlate !== undefined) {
             history.push({ role: "user", content: renderAnchorsBlock(freshSlate.anchors), provenance: "project" });
             io.onHistoryChange?.("tool");
-            if (freshSlate.workspaceId === undefined) {
-              const resolver = options.resolveWorkspace ?? resolveOrCreateWorkspace;
-              const resolved = await resolver({
-                cwd: options.slateSession.cwd,
-                topicHint: userLine,
-                provider: deps.providerId,
-                model: deps.modelId
-              });
-              if (resolved.ok) {
-                await writeSlate(options.slateSession.dir, (prev) => {
-                  if (!prev)
-                    throw new Error(`SLATE-16 bind: no open slate in ${options.slateSession.dir}`);
-                  return { ...prev, workspaceId: resolved.workspaceId };
-                });
-              }
-            }
           }
         }
       }
@@ -19710,7 +19735,6 @@ var init_agent = __esm(() => {
   init_scheduler();
   init_slate();
   init_slate_course();
-  init_workspace_resolve();
   init_machine_wrap_up();
   init_slate_lifecycle();
   init_slate_terminal_state();
@@ -26111,6 +26135,10 @@ ${markdown.slice(4)}`;
   }
   return markdown;
 }
+function extractFrontmatterStatus(markdown) {
+  const bodyMatch = /\nStatus:\s*(\S+)/i.exec(markdown) ?? /^Status:\s*(\S+)/im.exec(markdown);
+  return bodyMatch?.[1] ?? "draft";
+}
 async function mapPool(items, concurrency, worker) {
   const results = new Array(items.length);
   let next = 0;
@@ -26137,7 +26165,6 @@ async function wikiEnrich(input2) {
   const concurrency = Math.max(1, Math.min(MAX_CONCURRENCY, input2.concurrency ?? DEFAULT_CONCURRENCY));
   const maxOutputTokens = input2.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
   const validate = input2.validate !== false;
-  const markAccepted = input2.keepStatus === true ? false : input2.markAccepted !== false;
   const wikiConfig = await loadWikiConfig(input2.cwd);
   const result = {
     provider,
@@ -26231,9 +26258,7 @@ async function wikiEnrich(input2) {
             return { path: page.relativePath, action: "failed", reason: `validation: ${structural}` };
           }
         }
-        if (markAccepted) {
-          enriched = setFrontmatterStatus(enriched, "accepted");
-        }
+        enriched = setFrontmatterStatus(enriched, extractFrontmatterStatus(original));
         if (input2.dryRun) {
           onPage({ index, total, path: page.relativePath, status, phase: "done" });
           return {
@@ -26247,7 +26272,7 @@ async function wikiEnrich(input2) {
         await writeFile36(page.absolutePath, `${enriched.endsWith(`
 `) ? enriched : `${enriched}
 `}`, "utf8");
-        onPage({ index, total, path: page.relativePath, status: markAccepted ? "accepted" : status, phase: "done" });
+        onPage({ index, total, path: page.relativePath, status, phase: "done" });
         return {
           path: page.relativePath,
           action: "enriched",
@@ -26273,7 +26298,6 @@ async function wikiEnrich(input2) {
       model,
       maxOutputTokens,
       validate,
-      markAccepted,
       concurrency,
       total,
       onPage,
@@ -26356,8 +26380,8 @@ function finalizeEnrichedText(original, rawText, options) {
   if (options.validate) {
     structuralError = validateEnrichedMarkdown(original, content);
   }
-  if (structuralError === null && options.markAccepted) {
-    content = setFrontmatterStatus(content, "accepted");
+  if (structuralError === null) {
+    content = setFrontmatterStatus(content, extractFrontmatterStatus(original));
   }
   return { content, structuralError };
 }
@@ -26384,7 +26408,7 @@ async function finishSuccess(ctx, page, originalRaw, content, keyFiles, extra) {
     index,
     total: ctx.total,
     path: page.relativePath,
-    status: ctx.markAccepted ? "accepted" : status,
+    status,
     phase: "done"
   });
   return {
@@ -26428,8 +26452,7 @@ async function runDeepSingle(ctx, item) {
     let content = null;
     if (rawText !== null) {
       const finalized = finalizeEnrichedText(original, rawText, {
-        validate: ctx.validate,
-        markAccepted: ctx.markAccepted
+        validate: ctx.validate
       });
       if (finalized.structuralError === null) {
         content = finalized.content;
@@ -26614,8 +26637,7 @@ async function runLightBatch(ctx, items) {
       continue;
     }
     const finalized = finalizeEnrichedText(item.original, rawText, {
-      validate: ctx.validate,
-      markAccepted: ctx.markAccepted
+      validate: ctx.validate
     });
     if (finalized.structuralError !== null) {
       ctx.onPage({ index, total: ctx.total, path: item.page.relativePath, status, phase: "failed" });
@@ -26666,7 +26688,6 @@ async function runRlmPipeline(ctxInput) {
     model: ctxInput.model,
     maxOutputTokens: ctxInput.maxOutputTokens,
     validate: ctxInput.validate,
-    markAccepted: ctxInput.markAccepted,
     total: ctxInput.total,
     onPage: ctxInput.onPage,
     input: input2,
@@ -36675,7 +36696,6 @@ async function runEnrich(args2) {
   const resume = args2.includes("--resume");
   const refreshGraph = args2.includes("--refresh-graph");
   const dryRun = args2.includes("--dry-run");
-  const keepStatus = args2.includes("--keep-status");
   const noValidate = args2.includes("--no-validate");
   const valueFlags = new Set([
     "--page",
@@ -36744,9 +36764,7 @@ async function runEnrich(args2) {
     resume,
     refreshGraph,
     dryRun,
-    keepStatus,
     validate: !noValidate,
-    markAccepted: !keepStatus,
     ...prompt ? { prompt } : {},
     ...provider ? { provider } : {},
     ...model ? { model } : {},
@@ -36823,10 +36841,12 @@ Usage:
   keryx wiki validate
   keryx wiki ask "<question>" [--k <n>] [--rerank]
   keryx wiki enrich [<page>|--all] [--force] [--list] [--resume] [--limit N] [--concurrency N]
-                    [--refresh-graph] [--max-tokens N] [--keep-status] [--no-validate]
+                    [--refresh-graph] [--max-tokens N] [--no-validate]
                     [--prompt "<i>"] [--provider <p>] [--model <m>] [--dry-run] [--json]
                          # defaults: drafts only; provider/model from auth.json; validate on;
-                         # mark Status: accepted; concurrency 1 (raise for parallel page swarm)
+                         # concurrency 1 (raise for parallel page swarm)
+                         # rewrites prose only \u2014 Status is always left exactly as it was
+                         # before the run; enrich can never itself accept a page (issue #391)
   keryx wiki context
   keryx wiki backlinks <wiki-page-or-code-file>
 
@@ -49836,7 +49856,7 @@ function buildInteractiveAgentTools(input2) {
     applyPatchTool(input2.cwd),
     workspaceOverviewTool(input2.cwd),
     workspaceReadTool(input2.cwd),
-    workspaceCreateTool(input2.cwd),
+    workspaceCreateTool(input2.cwd, getSessionDir),
     workspaceListTool(input2.cwd),
     workspaceShowTool(input2.cwd),
     workspaceProposeTool(input2.cwd, getSessionDir),
@@ -49941,7 +49961,8 @@ var PREFIX_BANNED = new Set([
   "osascript",
   "open",
   "tee",
-  "cd"
+  "cd",
+  "keryx"
 ]);
 var PREFIX_BANNED_READERS = new Set([
   "cat",
@@ -50012,6 +50033,17 @@ function validateShellPattern(pattern) {
   }
   return { ok: true };
 }
+function getRunningBinaryName() {
+  try {
+    const argv0 = process.argv0;
+    if (!argv0)
+      return "";
+    const name = argv0.split(/[\\/]/).pop() ?? "";
+    return name.toLowerCase();
+  } catch {
+    return "";
+  }
+}
 function bannedPrefixGrant(pattern, firstToken) {
   const rest = pattern.slice(firstToken.length).trim();
   const wildcardOnly = /^\*+$/.test(rest) || rest.length === 0 && /\*+$/.test(firstToken);
@@ -50024,6 +50056,13 @@ function bannedPrefixGrant(pattern, firstToken) {
       reason: `\`${word} *\` grants arbitrary execution: ${word} is an interpreter or wrapper, so its first token does not constrain what runs`
     };
   }
+  const runningBinary = getRunningBinaryName();
+  if (runningBinary && word === runningBinary) {
+    return {
+      word,
+      reason: `\`${word} *\` grants arbitrary execution: ${word} can run arbitrary subcommands, so remembering this grant would silently approve mutating/destructive operations forever`
+    };
+  }
   if (PREFIX_BANNED_READERS.has(word)) {
     return {
       word,
@@ -53106,10 +53145,11 @@ init_agent();
 init_slate_lifecycle();
 init_slate();
 init_workspace_service();
-init_workspace_resolve();
 init_service7();
+init_store2();
 init_fs();
 import path149 from "path";
+import { readFile as readFile79 } from "fs/promises";
 var POSITIVE_INTEGER = /^[1-9][0-9]*$/;
 var DEFAULT_AUTO_GOAL_ROUNDS = 8;
 function parseGoalArgs(rest) {
@@ -53211,9 +53251,20 @@ async function autoProvisionFlow(cwd, goalText) {
   await service5.start({ cwd, id: result.flow.id });
   return result.flow.id;
 }
+var ROUND_DONE_MARKER = "GOAL_ROUND_COMPLETE";
+function continuationRoundClaimsDone(history) {
+  for (let i = history.length - 1;i >= 0; i--) {
+    const message2 = history[i];
+    if (message2?.role === "assistant") {
+      return message2.content.includes(ROUND_DONE_MARKER);
+    }
+  }
+  return false;
+}
 async function buildContinuationMessage(cwd, slateSession, round4, roundsCap) {
   const totalRounds = roundsCap + 1;
-  const generic = `Continue working toward the stated goal (round ${round4} of ${totalRounds}).`;
+  const doneInstruction = `If \u2014 and only if \u2014 the stated goal is now FULLY achieved and there is nothing further to do this round, ` + `end your reply with the exact line ${ROUND_DONE_MARKER} on its own, and nothing else on that line. ` + `Otherwise do not include that line at all.`;
+  const generic = `Continue working toward the stated goal (round ${round4} of ${totalRounds}). ${doneInstruction}`;
   const slate = await readSlate(slateSession.dir).catch(() => {
     return;
   });
@@ -53251,11 +53302,61 @@ function parseVerifierVerdict(output2) {
     return;
   }
 }
-async function runGoalVerifier(deps, goalText) {
+var MAX_EVIDENCE_SEEDS = 10;
+function summarizeRecentSeeds(seeds) {
+  return seeds.slice(-MAX_EVIDENCE_SEEDS).map((seed) => `- Seed${seed.kind !== undefined ? ` [${seed.kind}]` : ""}: ${seed.text}`);
+}
+function summarizeWorkspaceProposals(history) {
+  const lines = [];
+  for (const message2 of history) {
+    if (message2.role !== "assistant" || message2.toolCalls === undefined) {
+      continue;
+    }
+    for (const call of message2.toolCalls) {
+      if (call.name !== "workspace_propose") {
+        continue;
+      }
+      const resultMessage = history.find((candidate) => candidate.role === "tool" && candidate.toolCallId === call.id);
+      let argSummary = call.arguments;
+      try {
+        const parsedArgs = JSON.parse(call.arguments);
+        const kind2 = typeof parsedArgs.kind === "string" ? parsedArgs.kind : "?";
+        const note2 = typeof parsedArgs.note === "string" ? parsedArgs.note : undefined;
+        argSummary = `kind=${kind2}${note2 !== undefined ? `, note=${note2}` : ""}`;
+      } catch {}
+      const outcome = resultMessage !== undefined ? resultMessage.content : "(no result recorded this run)";
+      lines.push(`- workspace_propose: ${argSummary} -> ${outcome}`);
+    }
+  }
+  return lines;
+}
+async function flowDefersCompletionToVerifier(cwd, flowId) {
+  try {
+    const dir = await resolveFlowDir(cwd, flowId);
+    const text = await readFile79(acPath(cwd, dir), "utf8");
+    const normalized = text.replace(/\s+/g, " ");
+    return normalized.includes("judged by the verifier subagent");
+  } catch {
+    return false;
+  }
+}
+async function buildVerifierEvidence(cwd, slateSession, history) {
+  const slate = await readSlate(slateSession.dir).catch(() => {
+    return;
+  });
+  const lines = [...slate !== undefined ? summarizeRecentSeeds(slate.seeds) : [], ...summarizeWorkspaceProposals(history)];
+  const evidenceText = lines.length > 0 ? lines.join(`
+`) : "(no Seeds or workspace_propose records were recorded this run)";
+  const flowId = slate?.course.flowRef;
+  const deferToVerifier = flowId !== undefined ? await flowDefersCompletionToVerifier(cwd, flowId) : false;
+  return { evidenceText, deferToVerifier };
+}
+async function runGoalVerifier(deps, goalText, cwd, slateSession, history, io, mintCallId) {
   const tool = deps.tools.find((candidate) => candidate.definition.name === "spawn_subagent");
   if (tool === undefined) {
     return;
   }
+  const { evidenceText, deferToVerifier } = await buildVerifierEvidence(cwd, slateSession, history);
   const task = [
     "Independently verify whether the following goal has ACTUALLY been achieved, based on the",
     "current, real state of the repository (read the real files/tests \u2014 never trust a prior",
@@ -53263,24 +53364,56 @@ async function runGoalVerifier(deps, goalText) {
     "",
     `Goal: "${goalText}"`,
     "",
+    "Evidence this run already produced (recent Slate Seeds and workspace_propose records) \u2014",
+    "weigh this as real evidence of what was actually done, not merely a claim:",
+    evidenceText,
+    "",
+    ...deferToVerifier ? [
+      "This run's Task Manager flow acceptance criteria explicitly defer the completion",
+      "judgment to THIS verifier check, not to the flow's own task checkboxes \u2014 its tasks",
+      "are expected to remain unchecked even when the goal is genuinely achieved. Do NOT",
+      "treat an incomplete/unchecked flow task list, by itself, as evidence the goal is NOT",
+      "achieved; judge achievement from the real repository state and the evidence above.",
+      ""
+    ] : [],
     "Reply with EXACTLY one JSON object and nothing else, no prose before or after it:",
     '{"achieved": true or false, "gaps": ["specific reason it is not fully achieved", ...]}',
     '"gaps" must be empty when "achieved" is true.'
   ].join(`
 `);
+  const input2 = { task, mode: "read_only", label: "goal-verifier" };
+  const callId = mintCallId();
+  io.onToolCall?.("spawn_subagent", JSON.stringify(input2));
+  history.push({
+    role: "assistant",
+    content: "",
+    provenance: "model",
+    toolCalls: [{ id: callId, name: "spawn_subagent", arguments: JSON.stringify(input2) }]
+  });
+  io.onHistoryChange?.("tool");
   let result;
   try {
-    result = await tool.invoke({ task, mode: "read_only", label: "goal-verifier" });
-  } catch {
+    result = await tool.invoke(input2);
+  } catch (err) {
+    const errorResult = {
+      output: `spawn_subagent dispatch failed: ${err instanceof Error ? err.message : String(err)}`,
+      isError: true
+    };
+    io.onToolResult?.("spawn_subagent", errorResult);
+    history.push({ role: "tool", content: errorResult.output, provenance: "tool", toolCallId: callId });
+    io.onHistoryChange?.("tool");
     return;
   }
+  io.onToolResult?.("spawn_subagent", result);
+  history.push({ role: "tool", content: result.output, provenance: "tool", toolCallId: callId });
+  io.onHistoryChange?.("tool");
   if (result.isError) {
     return;
   }
   return parseVerifierVerdict(result.output);
 }
 async function runGoalCommand(params) {
-  const { raw, cwd, io, deps, history, slateSession, mintAttemptId, resolveWorkspace } = params;
+  const { raw, cwd, io, deps, history, slateSession, mintAttemptId } = params;
   const parsed = parseGoalArgs(raw);
   if ("error" in parsed) {
     systemLine(io, `/goal: ${parsed.error}
@@ -53314,19 +53447,6 @@ async function runGoalCommand(params) {
           const base = prev ?? { anchors: { root: "", touched: [] }, course: {}, seeds: [] };
           return { ...base, workspaceId };
         });
-      } else {
-        const current = await readSlate(slateSession.dir);
-        if (current !== undefined && current.workspaceId === undefined) {
-          const resolver = resolveWorkspace ?? resolveOrCreateWorkspace;
-          const resolved2 = await resolver({ cwd, topicHint: parsed.text, provider: deps.providerId, model: deps.modelId });
-          if (resolved2.ok) {
-            await writeSlate(slateSession.dir, (prev) => {
-              if (!prev)
-                throw new Error(`SLATE-16 bind: no open slate in ${slateSession.dir}`);
-              return { ...prev, workspaceId: resolved2.workspaceId };
-            });
-          }
-        }
       }
       if (parsed.auto !== undefined) {
         const forCourse = await readSlate(slateSession.dir);
@@ -53363,10 +53483,21 @@ async function runGoalCommand(params) {
       systemLine(io, `/goal --auto: round ${round4}/${roundsCap + 1} \u2014 continuing toward the goal.
 `);
       await runAgentTurn(io, deps, history, continuationText, turnOptions);
+      if (continuationRoundClaimsDone(history)) {
+        systemLine(io, `/goal --auto: model signaled this round's work is complete (round ${round4}/${roundsCap + 1}) \u2014 ` + `ending the round budget early; the verifier will confirm.
+`);
+        break;
+      }
     }
     const wasOpenBeforeVerifier = slateSession.opened;
-    const verdict = await runGoalVerifier(deps, parsed.text);
-    if (verdict !== undefined && !verdict.achieved) {
+    const verdict = await runGoalVerifier(deps, parsed.text, cwd, slateSession, history, io, mintAttemptId);
+    if (verdict === undefined) {
+      systemLine(io, `/goal --auto: verifier unavailable \u2014 outcome not independently checked.
+`);
+    } else if (verdict.achieved) {
+      systemLine(io, `/goal --auto: verifier confirmed the goal is achieved.
+`);
+    } else {
       systemLine(io, `/goal --auto: verifier found the goal not fully achieved${verdict.gaps.length > 0 ? ` \u2014 ${verdict.gaps.join("; ")}` : " (no specific gaps reported)"}
 `);
       if (roundsLeft > 0) {
@@ -53414,7 +53545,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.55",
+  version: "0.2.57",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -54567,6 +54698,13 @@ function ensureHost(otui, chrome) {
     }
     const idx = state.tabs.findIndex((tab) => tab.id === state.active);
     const onStrip = focused !== null && containsNode(state.tabStrip, focused);
+    const claimArrow = (direction) => state.input?.onArrowKeys?.(key, direction) === true;
+    if (key.name === "left" && claimArrow("left")) {
+      return;
+    }
+    if (key.name === "right" && claimArrow("right")) {
+      return;
+    }
     if (key.name === "left" || onStrip && key.name === "tab" && key.shift === true) {
       const prev = idx > 0 ? state.tabs[idx - 1] : undefined;
       if (prev !== undefined) {
@@ -54674,7 +54812,7 @@ init_store3();
 init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID24 } from "crypto";
-import { readdir as readdir26 } from "fs/promises";
+import { readdir as readdir26, stat as stat8 } from "fs/promises";
 import path150 from "path";
 
 // src/sac/lifecycle-flag.ts
@@ -54725,14 +54863,18 @@ async function computeLifecycleFlags(cwd, now = () => new Date) {
 
 // src/sac/catch-up.ts
 init_proposal_evidence();
+init_collect();
+init_store();
 async function buildCatchUp(input2) {
-  const [proposals, sessionCategories, lifecycleFlagsAll] = await Promise.all([
+  const [proposals, sessionCategories, lifecycleFlagsAll, unreviewedPathsAll] = await Promise.all([
     collectProposals(input2.cwd, input2.workspaceId),
     collectSessionCategories(input2.cwd),
-    computeLifecycleFlags(input2.cwd)
+    computeLifecycleFlags(input2.cwd),
+    detectUnreviewedSacPathChanges(input2.cwd, listSessions(input2.cwd))
   ]);
   const lifecycleFlags = input2.workspaceId === undefined ? lifecycleFlagsAll : lifecycleFlagsAll.filter((flag) => flag.kind !== "workspace" || flag.ref === input2.workspaceId);
-  return { proposals, ...sessionCategories, lifecycleFlags };
+  const unreviewedPaths = input2.workspaceId === undefined ? unreviewedPathsAll : unreviewedPathsAll.filter((item) => item.workspaceId === input2.workspaceId);
+  return { proposals, ...sessionCategories, lifecycleFlags, unreviewedPaths };
 }
 async function collectProposals(cwd, workspaceId) {
   const authorizationServer = localWorkspaceAuthorizationServer();
@@ -54795,8 +54937,82 @@ async function classifySession(session) {
   const workspaceId = (await safeReadSlate(dir))?.workspaceId;
   return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
 }
+async function readExternalUnboundCandidates(cwd) {
+  const extDir = externalSlatesDir(cwd);
+  let externalIds;
+  try {
+    const entries = await readdir26(extDir);
+    externalIds = entries.filter((name) => name.endsWith(".json")).map((name) => name.slice(0, -".json".length));
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  for (const id of externalIds) {
+    const slate = await readExternalSlate(cwd, id);
+    if (!slate)
+      continue;
+    if (slate.closedAt === undefined || slate.workspaceId !== undefined)
+      continue;
+    const unbound2 = await readNewestUnboundCandidateForExternal(cwd, id);
+    if (unbound2) {
+      candidates.push({
+        type: "unbound-candidate",
+        externalSessionId: id,
+        evidencePath: unbound2.evidencePath,
+        summary: unbound2.summary
+      });
+    } else {
+      const summary = summarizeUnboundCandidate((slate.seeds ?? []).reduce((groups, seed) => {
+        const kind2 = seed.kind ?? "follow-up";
+        const existing = groups.find((g) => g.kind === kind2);
+        if (existing) {
+          existing.seeds = (existing.seeds ?? []).concat([{ text: seed.text }]);
+        } else {
+          groups.push({ kind: kind2, seeds: [{ text: seed.text }] });
+        }
+        return groups;
+      }, []));
+      candidates.push({
+        type: "unbound-candidate",
+        externalSessionId: id,
+        evidencePath: path150.join(extDir, `${id}.json`),
+        summary
+      });
+    }
+  }
+  return candidates;
+}
+async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
+  const evidenceDir = path150.join(externalSlatesDir(cwd), externalSessionId);
+  let entries;
+  try {
+    entries = (await readdir26(evidenceDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+  } catch {
+    return;
+  }
+  entries.sort();
+  for (let i = entries.length - 1;i >= 0; i--) {
+    const evidencePath = path150.join(evidenceDir, entries[i]);
+    const result = readConfigFile(evidencePath);
+    if (!result.ok) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(result.text);
+      if (parsed.recordType !== "unbound-candidate")
+        continue;
+      return { evidencePath, summary: summarizeUnboundCandidate(parsed.groups) };
+    } catch {
+      continue;
+    }
+  }
+  return;
+}
 async function collectSessionCategories(cwd) {
-  const classified = await Promise.all(listSessions(cwd).map((session) => classifySession(session)));
+  const [classified, externalUnboundCandidates] = await Promise.all([
+    Promise.all(listSessions(cwd).map((session) => classifySession(session))),
+    readExternalUnboundCandidates(cwd)
+  ]);
   const blocked2 = [];
   const unboundCandidates = [];
   const unknown = [];
@@ -54810,8 +55026,151 @@ async function collectSessionCategories(cwd) {
     else
       unknown.push(category.item);
   }
+  unboundCandidates.push(...externalUnboundCandidates);
   return { blocked: blocked2, unboundCandidates, unknown };
 }
+var SESSION_ATTRIBUTION_SLACK_MS = 5 * 60000;
+var MTIME_CLOCK_SKEW_TOLERANCE_MS = 5000;
+async function collectReceiptTargets(cwd, owner) {
+  const targets = new Set;
+  const workspacesDir = path150.join(cwd, ".metaproject", "workspaces");
+  let workspaceIds;
+  try {
+    workspaceIds = (await readdir26(workspacesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return targets;
+  }
+  for (const workspaceId of workspaceIds) {
+    const receiptsDir = path150.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
+    let files;
+    try {
+      files = (await readdir26(receiptsDir)).filter((name) => name.endsWith(".json"));
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const result = readConfigFile(path150.join(receiptsDir, file));
+      if (!result.ok)
+        continue;
+      try {
+        const receipt = JSON.parse(result.text);
+        if (typeof receipt.targetRef === "string") {
+          targets.add(receipt.targetRef.replace(/^\.\//, ""));
+        }
+      } catch {
+        continue;
+      }
+    }
+  }
+  return targets;
+}
+async function attributeToSession(absolutePath, sessionsNewestFirst) {
+  let mtimeMs;
+  try {
+    mtimeMs = (await stat8(absolutePath)).mtimeMs;
+  } catch {
+    return;
+  }
+  for (const session of sessionsNewestFirst) {
+    const start = Date.parse(session.createdAt);
+    const end = Date.parse(session.updatedAt);
+    if (Number.isNaN(start) || Number.isNaN(end))
+      continue;
+    if (mtimeMs >= start - MTIME_CLOCK_SKEW_TOLERANCE_MS && mtimeMs <= end + SESSION_ATTRIBUTION_SLACK_MS) {
+      const workspaceId = (await safeReadSlate(sessionDir(session.projectPath, session.id)))?.workspaceId;
+      return { sessionId: session.id, workspaceId, changedAt: new Date(mtimeMs).toISOString() };
+    }
+  }
+  return;
+}
+async function findSkillFiles(dir) {
+  let entries;
+  try {
+    entries = await readdir26(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const found = [];
+  for (const entry of entries) {
+    const full = path150.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      found.push(...await findSkillFiles(full));
+    } else if (entry.isFile() && entry.name === "SKILL.md") {
+      found.push(full);
+    }
+  }
+  return found;
+}
+async function detectUnreviewedSacPathChanges(cwd, sessions) {
+  const scoped = [...sessions].filter((session) => session.projectPath === cwd).sort((a, b) => Date.parse(b.updatedAt) - Date.parse(a.updatedAt));
+  if (scoped.length === 0)
+    return [];
+  const [wikiReceipts, memoryReceipts, skillReceipts] = await Promise.all([
+    collectReceiptTargets(cwd, "wiki"),
+    collectReceiptTargets(cwd, "memory"),
+    collectReceiptTargets(cwd, "skill")
+  ]);
+  const items = [];
+  const wikiPages = await collectPages(cwd).catch(() => []);
+  for (const page of wikiPages) {
+    if ((page.status ?? "").toLowerCase() !== "accepted")
+      continue;
+    const targetRef = `wiki/${page.relativePath}`;
+    if (wikiReceipts.has(targetRef))
+      continue;
+    const attribution = await attributeToSession(page.absolutePath, scoped);
+    if (attribution === undefined)
+      continue;
+    items.push({
+      type: "unreviewed-sac-path",
+      sessionId: attribution.sessionId,
+      ...attribution.workspaceId !== undefined ? { workspaceId: attribution.workspaceId } : {},
+      owner: "wiki",
+      path: targetRef,
+      ...page.status !== null ? { status: page.status } : {},
+      changedAt: attribution.changedAt
+    });
+  }
+  const memoryEntries = await collectEntries(cwd).catch(() => []);
+  for (const entry of memoryEntries) {
+    if (entry.status !== "accepted")
+      continue;
+    const targetRef = `memory/${entry.relativePath}`;
+    if (memoryReceipts.has(targetRef))
+      continue;
+    const attribution = await attributeToSession(entry.absolutePath, scoped);
+    if (attribution === undefined)
+      continue;
+    items.push({
+      type: "unreviewed-sac-path",
+      sessionId: attribution.sessionId,
+      ...attribution.workspaceId !== undefined ? { workspaceId: attribution.workspaceId } : {},
+      owner: "memory",
+      path: targetRef,
+      status: entry.status,
+      changedAt: attribution.changedAt
+    });
+  }
+  const sacSkillsDir = path150.join(cwd, ".metaproject", "project-skills", "sac");
+  const skillFiles = await findSkillFiles(sacSkillsDir);
+  for (const absolutePath of skillFiles) {
+    const targetRef = path150.relative(path150.join(cwd, ".metaproject"), absolutePath).split(path150.sep).join("/");
+    if (skillReceipts.has(targetRef))
+      continue;
+    const attribution = await attributeToSession(absolutePath, scoped);
+    if (attribution === undefined)
+      continue;
+    items.push({
+      type: "unreviewed-sac-path",
+      sessionId: attribution.sessionId,
+      ...attribution.workspaceId !== undefined ? { workspaceId: attribution.workspaceId } : {},
+      owner: "skill",
+      path: targetRef,
+      changedAt: attribution.changedAt
+    });
+  }
+  return items;
+}
 async function isSlateEngaged(dir) {
   if (await pathExists(path150.join(dir, "slate.json")))
     return true;
@@ -55078,7 +55437,7 @@ async function loadInspectorCatchUp(cwd) {
   try {
     return await buildCatchUp({ cwd });
   } catch {
-    return { proposals: [], blocked: [], unboundCandidates: [], unknown: [], lifecycleFlags: [] };
+    return { proposals: [], blocked: [], unboundCandidates: [], unknown: [], lifecycleFlags: [], unreviewedPaths: [] };
   }
 }
 function catchUpItems(report) {
@@ -55617,10 +55976,9 @@ function openWorkspace(otui, chrome, options) {
 var REVIEW_COMMAND = "/review";
 var REVIEW_FOOTER = [
   { key: "[/]", label: "item" },
-  { key: "a y", label: "accept proposal" },
-  { key: "d y", label: "decline proposal" },
+  { key: "\u2190/\u2192 a d", label: "accept/decline" },
+  { key: "enter y", label: "arm \u2192 confirm" },
   { key: "\u2191/\u2193", label: "scroll" },
-  { key: "\u2190/\u2192", label: "tabs" },
   { key: "esc", label: "close" }
 ];
 function isReviewCommand(line) {
@@ -55804,14 +56162,58 @@ function paintLines3(otui, renderer, body, lines, width) {
   parent.add(node);
   return node;
 }
+function paintActionButtons(otui, renderer, body, callbacks) {
+  if (otui === undefined || otui === null || body === undefined || body === null) {
+    return;
+  }
+  const parent = body;
+  const boxCtor = otui.BoxRenderable;
+  const textCtor = otui.TextRenderable;
+  if (parent.add === undefined || boxCtor === undefined || textCtor === undefined) {
+    return;
+  }
+  const BoxCtor = boxCtor;
+  const TextCtor = textCtor;
+  const addChild = (child) => parent.add?.(child);
+  const theme = getTheme();
+  const make = (label, id, color, onClick) => {
+    const box = new BoxCtor(renderer, {
+      id,
+      flexShrink: 0,
+      marginLeft: 1,
+      paddingLeft: 1,
+      paddingRight: 1,
+      onMouseDown: (event) => {
+        event.stopPropagation();
+        onClick();
+      }
+    });
+    const text = new TextCtor(renderer, { id: `${id}-t`, content: `[${label}]` });
+    text.fg = color;
+    box.add(text);
+    addChild(box);
+    const setActive = (active) => {
+      box.backgroundColor = active ? theme.highlight : undefined;
+      text.content = `[${label}]`;
+      text.fg = color;
+    };
+    return { setActive };
+  };
+  return {
+    accept: make("Accept", "review-accept", theme.ok, callbacks.onAccept),
+    decline: make("Decline", "review-decline", theme.error, callbacks.onDecline)
+  };
+}
 function presentReview(openModal2, otui, chrome, options) {
   const items = [...options.items];
   let selected = 0;
   let listScroll = 0;
   let detailScroll = 0;
   let status = { kind: "idle" };
+  let focusedAction = "accept";
   let listNode;
   let detailNode;
+  let actionButtons;
   let unsubscribeKey;
   const rendererHint = options.renderer ?? chrome?.renderer;
   const bodyRows = options.visibleRows ?? (typeof rendererHint?.width === "number" && typeof rendererHint.height === "number" ? modalBodyRows(resolveModalPanelSize(rendererHint.width, rendererHint.height).height) : 13);
@@ -55832,6 +56234,7 @@ function presentReview(openModal2, otui, chrome, options) {
       detailNode.content = windowLines3(detailLines(), detailScroll, bodyRows).join(`
 `);
     }
+    updateButtons();
   };
   const moveSelection = (next) => {
     if (items.length === 0) {
@@ -55847,6 +56250,22 @@ function presentReview(openModal2, otui, chrome, options) {
     paintSelection();
   };
   const handlerFor = (decision) => decision === "accept" ? options.acceptProposal : options.declineProposal;
+  const updateButtons = () => {
+    if (actionButtons === undefined) {
+      return;
+    }
+    const onProposal = items[selected]?.type === "proposal" && status.kind !== "done";
+    const highlighted = status.kind === "armed" ? status.decision : focusedAction;
+    actionButtons.accept.setActive(onProposal && highlighted === "accept");
+    actionButtons.decline.setActive(onProposal && highlighted === "decline");
+  };
+  const armDecision = (decision) => {
+    if (status.kind === "running") {
+      return;
+    }
+    status = items[selected]?.type === "proposal" && handlerFor(decision) !== undefined ? { kind: "armed", decision } : { kind: "unavailable", decision };
+    paintSelection();
+  };
   const runDecision = (decision) => {
     const item = items[selected];
     const run = handlerFor(decision);
@@ -55871,16 +56290,43 @@ function presentReview(openModal2, otui, chrome, options) {
     ],
     initialTab: "list",
     footer: REVIEW_FOOTER,
+    onArrowKeys: (key, direction) => {
+      if (items[selected]?.type === "proposal" && status.kind !== "running" && status.kind !== "done" && handle?.activeTab() === "detail") {
+        focusedAction = direction === "left" ? "accept" : "decline";
+        status = { kind: "idle" };
+        paintSelection();
+        return true;
+      }
+      return false;
+    },
     renderTab: (tabId, body, ctx) => {
       const renderer = options.renderer ?? chrome?.renderer;
       tabWidth = ctx?.width;
       if (tabId === "list") {
+        detailNode = undefined;
+        actionButtons = undefined;
         listScroll = scrollToReveal3(selected, listScroll, bodyRows);
         listNode = paintLines3(otui, renderer, body, windowLines3(listLines(), listScroll, bodyRows));
         return;
       }
+      listNode = undefined;
       detailScroll = clampScroll3(detailScroll, detailLines().length, bodyRows);
       detailNode = paintLines3(otui, renderer, body, windowLines3(detailLines(), detailScroll, bodyRows), tabWidth);
+      if (items[selected]?.type === "proposal") {
+        actionButtons = paintActionButtons(otui, renderer, body, {
+          onAccept: () => {
+            focusedAction = "accept";
+            armDecision("accept");
+          },
+          onDecline: () => {
+            focusedAction = "decline";
+            armDecision("decline");
+          }
+        });
+        updateButtons();
+      } else {
+        actionButtons = undefined;
+      }
     },
     onClose: () => {
       unsubscribeKey?.();
@@ -55897,7 +56343,7 @@ function presentReview(openModal2, otui, chrome, options) {
       }
       const onDetail = handle.activeTab() === "detail";
       if (onDetail && status.kind === "armed") {
-        if (token === "y") {
+        if (token === "y" || token === "return" || token === "enter") {
           runDecision(status.decision);
         } else {
           status = { kind: "idle" };
@@ -55914,15 +56360,29 @@ function presentReview(openModal2, otui, chrome, options) {
         return;
       }
       if (token === "return" || token === "enter") {
+        if (onDetail && items[selected]?.type === "proposal" && status.kind !== "running" && status.kind !== "done") {
+          if (status.kind === "armed") {
+            runDecision(status.decision);
+          } else {
+            armDecision(focusedAction);
+          }
+          return;
+        }
         handle.setTab("detail");
         return;
       }
-      if (onDetail && (token === "a" || token === "d") && status.kind !== "running") {
-        const decision = token === "a" ? "accept" : "decline";
-        status = items[selected]?.type === "proposal" && handlerFor(decision) !== undefined ? { kind: "armed", decision } : { kind: "unavailable", decision };
+      if (onDetail && (token === "left" || token === "right") && status.kind !== "running" && status.kind !== "done") {
+        focusedAction = token === "left" ? "accept" : "decline";
+        status = { kind: "idle" };
         paintSelection();
         return;
       }
+      if (onDetail && (token === "a" || token === "d") && status.kind !== "running" && status.kind !== "done") {
+        const decision = token === "a" ? "accept" : "decline";
+        focusedAction = decision;
+        armDecision(decision);
+        return;
+      }
       if (token === "up" || token === "k") {
         if (onDetail) {
           detailScroll = clampScroll3(detailScroll - 1, detailLines().length, bodyRows);
@@ -65153,6 +65613,22 @@ New session ${shortSessionId(live.summary.id)}.
           slateSession,
           mintAttemptId: mintTimestampAttemptId
         });
+      } else if (command === "/theme") {
+        const wanted = rest.trim();
+        if (wanted.length === 0) {
+          agentIo.onSystem?.(formatThemeList(getThemeId()));
+        } else {
+          const next = parseThemeId(wanted);
+          if (next === undefined) {
+            agentIo.onSystem?.(`Unknown theme '${wanted}'.
+${formatThemeList(getThemeId())}`);
+          } else {
+            applyThemeId(next);
+            persistThemeId(next);
+            agentIo.onSystem?.(`Theme: ${themeLabel(next)}
+`);
+          }
+        }
       } else {
         agentIo.onSystem?.(describeUnavailableCommand(command, "agent") ?? `Unknown command: ${command}. Type /help.
 `);
@@ -65417,6 +65893,12 @@ async function shellCommand(args2, runtime = {}) {
     }
   }
   const rl = readline2.createInterface({ input: process.stdin });
+  if (!process.stdin.isTTY) {
+    process.on("SIGINT", () => {
+      rl.close();
+      process.exit(130);
+    });
+  }
   const lineIterator = rl[Symbol.asyncIterator]();
   const sharedLines = { [Symbol.asyncIterator]: () => lineIterator };
   const { io, emitSystem, printHeader, printPrompt, destroy } = createRichIo(sharedLines, versionCheck);
@@ -65683,7 +66165,7 @@ Shell:
 
 // src/commands/modules.ts
 init_fs();
-import { readFile as readFile79 } from "fs/promises";
+import { readFile as readFile80 } from "fs/promises";
 import { stdin } from "process";
 import path153 from "path";
 var MODULES = [
@@ -65745,7 +66227,7 @@ async function modulesCommand(args2 = []) {
   }
   let manifest = {};
   try {
-    manifest = JSON.parse(await readFile79(manifestPath, "utf8"));
+    manifest = JSON.parse(await readFile80(manifestPath, "utf8"));
   } catch {}
   const enabled = new Set(MODULES.filter((module) => manifest.modules?.[module.name]?.enabled === true).map((module) => module.name));
   if (wantsJson) {
@@ -67719,7 +68201,7 @@ function printHelp17() {
 
 // src/commands/update.ts
 import { spawn as spawn5 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir56, readFile as readFile80, readdir as readdir27, writeFile as writeFile49 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir56, readFile as readFile81, readdir as readdir27, writeFile as writeFile49 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync30 } from "fs";
 import path158 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
@@ -68030,7 +68512,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (!await pathExists(hookPath)) {
     return false;
   }
-  return (await readFile80(hookPath, "utf8")).includes("# keryx:");
+  return (await readFile81(hookPath, "utf8")).includes("# keryx:");
 }
 async function collectDashboardData(metaprojectRoot) {
   const data = {};
@@ -68082,12 +68564,12 @@ async function collectTasksDashboardData(metaprojectRoot) {
       continue;
     }
     try {
-      const flow = JSON.parse(await readFile80(flowPath, "utf8"));
+      const flow = JSON.parse(await readFile81(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
       const acPath2 = path158.join(flowsRoot2, dir, "acceptance-criteria.md");
       if (await pathExists(acPath2)) {
-        const acContent = await readFile80(acPath2, "utf8");
+        const acContent = await readFile81(acPath2, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
       }
       flows.push({
@@ -68143,7 +68625,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     if (!await pathExists(filePath)) {
       continue;
     }
-    const content = await readFile80(filePath, "utf8");
+    const content = await readFile81(filePath, "utf8");
     docs[href] = content.length > 40000 ? `${content.slice(0, 40000)}
 
 \u2026truncated\u2026` : content;
@@ -68160,7 +68642,7 @@ async function collectHealthDashboardData(metaprojectRoot) {
   if (!await pathExists(reportPath2)) {
     return;
   }
-  const report = JSON.parse(await readFile80(reportPath2, "utf8"));
+  const report = JSON.parse(await readFile81(reportPath2, "utf8"));
   const metrics = Array.isArray(report.metrics) ? report.metrics : [];
   const findings = Array.isArray(report.findings) ? report.findings : [];
   const project = metrics.find((metric) => metric.key === "project") ?? {};
@@ -68274,7 +68756,7 @@ async function collectGraphDashboardData(metaprojectRoot) {
   let nodes = 0;
   let files = 0;
   let assets = 0;
-  for (const node of parseJsonl2(await readFile80(nodesPath, "utf8"))) {
+  for (const node of parseJsonl2(await readFile81(nodesPath, "utf8"))) {
     nodes += 1;
     if (node.kind === "asset") {
       assets += 1;
@@ -68290,7 +68772,7 @@ async function collectGraphDashboardData(metaprojectRoot) {
   let imports = 0;
   let assetEdges = 0;
   let unresolved = 0;
-  for (const edge of parseJsonl2(await readFile80(edgesPath, "utf8"))) {
+  for (const edge of parseJsonl2(await readFile81(edgesPath, "utf8"))) {
     edges += 1;
     if (edge.kind === "imports") {
       imports += 1;
@@ -68320,7 +68802,7 @@ async function collectTestingDashboardData(metaprojectRoot) {
   const reportPath2 = path158.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
   const contextPath = path158.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath2)) {
-    const report = JSON.parse(await readFile80(reportPath2, "utf8"));
+    const report = JSON.parse(await readFile81(reportPath2, "utf8"));
     const totalTests = numberOrUndefined(report.total);
     const failedTests = Array.isArray(report.failures) ? report.failures.length : numberOrUndefined(report.failed);
     return {
@@ -68351,7 +68833,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
-    const content = await readFile80(filePath, "utf8");
+    const content = await readFile81(filePath, "utf8");
     const embedded = content.length > 24000 ? `${content.slice(0, 24000)}
 
 \u2026truncated\u2026` : content;
@@ -68527,7 +69009,7 @@ async function enableTasksInManifest(metaprojectRoot) {
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile80(manifestPath, "utf8"));
+    raw = JSON.parse(await readFile81(manifestPath, "utf8"));
   } catch {
     return;
   }
@@ -68550,7 +69032,7 @@ async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile80(manifestPath, "utf8"));
+    raw = JSON.parse(await readFile81(manifestPath, "utf8"));
   } catch {
     return;
   }
@@ -68659,7 +69141,7 @@ async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const managedBlock = `${blockStart}
 ${content.trim()}
 ${blockEnd}`;
-  const existing = await pathExists(hookPath) ? await readFile80(hookPath, "utf8") : `#!/usr/bin/env sh
+  const existing = await pathExists(hookPath) ? await readFile81(hookPath, "utf8") : `#!/usr/bin/env sh
 `;
   const blockPattern = new RegExp(`${escapeRegExp6(blockStart)}[\\s\\S]*?${escapeRegExp6(blockEnd)}`);
   const next = blockPattern.test(existing) ? existing.replace(blockPattern, managedBlock) : `${existing.trimEnd()}
@@ -68678,7 +69160,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!await pathExists(hookPath)) {
     return;
   }
-  const existing = await readFile80(hookPath, "utf8");
+  const existing = await readFile81(hookPath, "utf8");
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const blockPattern = new RegExp(`\\n*${escapeRegExp6(blockStart)}[\\s\\S]*?${escapeRegExp6(blockEnd)}\\n*`);
@@ -68700,7 +69182,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!await pathExists(hookPath)) {
     return false;
   }
-  const hook = await readFile80(hookPath, "utf8");
+  const hook = await readFile81(hookPath, "utf8");
   return hook.includes("# keryx:security-pre-push:begin");
 }
 async function agentSettingsHasSecuritySentinel2(projectRoot) {
@@ -68708,7 +69190,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   if (!await pathExists(file)) {
     return false;
   }
-  return (await readFile80(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
+  return (await readFile81(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
   const manifestPath = path158.join(metaprojectRoot, "metaproject.json");
@@ -68721,7 +69203,7 @@ async function readManifest5(metaprojectRoot) {
     };
   }
   try {
-    const manifest = JSON.parse(await readFile80(manifestPath, "utf8"));
+    const manifest = JSON.parse(await readFile81(manifestPath, "utf8"));
     const normalized = normalizeManifest(manifest);
     return {
       exists: true,
@@ -68845,7 +69327,7 @@ async function run(command, args2, cwd) {
   });
 }
 async function writeTextIfChanged4(filePath, content) {
-  if (await pathExists(filePath) && await readFile80(filePath, "utf8") === content) {
+  if (await pathExists(filePath) && await readFile81(filePath, "utf8") === content) {
     return;
   }
   await mkdir56(path158.dirname(filePath), { recursive: true });
@@ -68859,8 +69341,8 @@ async function writeTextIfMissing4(filePath, content) {
   await writeFile49(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
-  const next = await readFile80(from, "utf8");
-  if (await pathExists(to) && await readFile80(to, "utf8") === next) {
+  const next = await readFile81(from, "utf8");
+  if (await pathExists(to) && await readFile81(to, "utf8") === next) {
     return;
   }
   await mkdir56(path158.dirname(to), { recursive: true });
@@ -68970,7 +69452,7 @@ function printHelp19() {
 import { readFileSync as readFileSync10 } from "fs";
 
 // src/agents/bootstrap.ts
-import { mkdir as mkdir57, readFile as readFile81, writeFile as writeFile50 } from "fs/promises";
+import { mkdir as mkdir57, readFile as readFile82, writeFile as writeFile50 } from "fs/promises";
 import { homedir as homedir7 } from "os";
 import path160 from "path";
 init_fs();
@@ -69043,7 +69525,7 @@ function resolveAgentBootstrapRuntimes(ids) {
 async function agentBootstrapStatus(runtime, homeRoot = homedir7()) {
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const content = exists2 ? await readFile81(filePath, "utf8") : "";
+  const content = exists2 ? await readFile82(filePath, "utf8") : "";
   const expected = renderAgentBootstrapBlock(runtime.fileName).trim();
   const installed = content.includes(AGENT_BOOTSTRAP_START);
   const current = installed && extractManagedBlock(content)?.trim() === expected;
@@ -69053,7 +69535,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const homeRoot = options.homeRoot ?? homedir7();
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const current = exists2 ? await readFile81(filePath, "utf8") : "";
+  const current = exists2 ? await readFile82(filePath, "utf8") : "";
   const next = upsertManagedBlock(current || defaultAgentFile(runtime), renderAgentBootstrapBlock(runtime.fileName));
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
@@ -69068,7 +69550,7 @@ async function uninstallAgentBootstrap(runtime, options = {}) {
   const homeRoot = options.homeRoot ?? homedir7();
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const current = exists2 ? await readFile81(filePath, "utf8") : "";
+  const current = exists2 ? await readFile82(filePath, "utf8") : "";
   const next = removeManagedBlock(current);
   const dryRun = options.dryRun === true;
   const removed = next !== current;
@@ -69594,7 +70076,7 @@ function printBootstrapHelp() {
 
 // src/commands/metrics.ts
 init_args();
-import { readFile as readFile82 } from "fs/promises";
+import { readFile as readFile83 } from "fs/promises";
 import path162 from "path";
 
 // src/metrics/benchmark.ts
@@ -70870,7 +71352,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record2 = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+    const record2 = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record2);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error2 of result.errors)
@@ -70901,7 +71383,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    console.log(await readFile82(file, "utf8"));
+    console.log(await readFile83(file, "utf8"));
     return;
   }
   if (subcommand === "compare") {
@@ -70912,8 +71394,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile82(path162.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile82(path162.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile83(path162.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile83(path162.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -70962,7 +71444,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
     const input2 = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input2);
     console.log(stableJson(result));
@@ -70974,7 +71456,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -71045,7 +71527,7 @@ async function runHarnessLayer(projectRoot, args2, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71076,7 +71558,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71101,7 +71583,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71126,7 +71608,7 @@ async function runSafetyContainmentLayer(projectRoot, args2, ladder, caseClass)
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71217,7 +71699,7 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args2, ladder) {
@@ -71254,7 +71736,7 @@ async function runTestingLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args2, ladder) {
@@ -71291,11 +71773,11 @@ async function runMemoryLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -71351,7 +71833,7 @@ async function runWikiLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -71389,7 +71871,7 @@ async function collect(projectRoot, args2) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, eventFile), "utf8"));
   const events2 = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args2, "--started-at") ?? events2[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args2, "--finished-at") ?? events2.at(-1)?.timestamp_utc ?? startedAt;
@@ -71789,6 +72271,7 @@ function renderCatchUp(report, includeLifecycleFlags = true) {
   sections.push(renderSection("Blocked sessions (stopped unattended)", report.blocked, (item) => `- Session ${item.sessionId} stopped unattended (${item.terminalState.reason}) at ${item.terminalState.occurredAt}. Resume it, or archive and move on? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to resume and unblock it.`));
   sections.push(renderSection("Unbound candidates (wrap-up ran, no workspace bound)", report.unboundCandidates, (item) => `- Session ${item.sessionId} produced untriaged seeds with no workspace bound (${item.summary}). Bind to a workspace and propose, or discard? ` + `Recommendation: pick a workspace, then \`keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}\` (evidence: ${item.evidencePath}).`));
   sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt} with no proposal, terminal state, or unbound-candidate artifact recorded. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
+  sections.push(renderSection("Unreviewed SAC-owned changes (no proposal on record)", report.unreviewedPaths, (item) => `- Session ${item.sessionId} changed ${item.owner} path \`${item.path}\`${item.status !== undefined ? ` (Status: ${item.status})` : ""} at ${item.changedAt} with NO SAC proposal/receipt behind it \u2014 this looks like it bypassed review. Was this reviewed some other way, or should it be? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to see what happened; if the content is good, route it through a real proposal (\`keryx workspace propose ...\`) before trusting it as durable knowledge.`));
   if (includeLifecycleFlags) {
     sections.push(renderSection("Lifecycle flags (component no longer in the graph)", report.lifecycleFlags, (item) => `- ${item.kind} \`${item.ref}\` scopes to \`${item.missingComponent}\`, which is no longer in the code graph (flagged ${item.flaggedAt}). Still relevant, or safe to clean up? ` + `Recommendation: this is report-only \u2014 nothing was archived/edited/removed automatically; ${item.kind === "workspace" ? "`keryx workspace archive " + item.ref + "`" : item.kind === "memory-entry" ? "`keryx memory supersede` or edit the entry directly" : "edit or remove the wiki page directly"} if you decide it's actually stale.`));
   }