@mrciphersmith/keryx 0.3.31 → 0.3.32

package/dist/core.js

@@ -3390,16 +3390,16 @@ var init_exfil = __esm(() => {
 // src/lib/contained-path.ts
 import { lstat as lstat2, realpath } from "fs/promises";
 import { existsSync, lstatSync, realpathSync } from "fs";
-import path16 from "path";
+import path17 from "path";
 function resolveProjectRoot(startDir) {
-  let current = path16.resolve(startDir);
+  let current = path17.resolve(startDir);
   for (;; ) {
-    if (existsSync(path16.join(current, ".metaproject")) || existsSync(path16.join(current, ".git"))) {
+    if (existsSync(path17.join(current, ".metaproject")) || existsSync(path17.join(current, ".git"))) {
       return current;
     }
-    const parent = path16.dirname(current);
+    const parent = path17.dirname(current);
     if (parent === current) {
-      return path16.resolve(startDir);
+      return path17.resolve(startDir);
     }
     current = parent;
   }
@@ -3408,11 +3408,11 @@ function isInside(root, candidate) {
   if (candidate === root) {
     return true;
   }
-  const relative = path16.relative(root, candidate);
-  if (relative.length === 0 || path16.isAbsolute(relative)) {
+  const relative = path17.relative(root, candidate);
+  if (relative.length === 0 || path17.isAbsolute(relative)) {
     return false;
   }
-  return relative !== ".." && !relative.startsWith(`..${path16.sep}`);
+  return relative !== ".." && !relative.startsWith(`..${path17.sep}`);
 }
 async function resolveContainedPath(projectRoot, candidate) {
   try {
@@ -3423,8 +3423,8 @@ async function resolveContainedPath(projectRoot, candidate) {
   } catch {
     return { ok: false, reason: "not-found", message: `no such file or directory: ${candidate}` };
   }
-  const rootReal = await realpath(projectRoot).catch(() => path16.resolve(projectRoot));
-  const absolute = path16.resolve(rootReal, candidate);
+  const rootReal = await realpath(projectRoot).catch(() => path17.resolve(projectRoot));
+  const absolute = path17.resolve(rootReal, candidate);
   const real = await realpath(absolute).catch(() => null);
   const effective = real ?? absolute;
   if (!isInside(rootReal, effective)) {
@@ -3764,16 +3764,16 @@ var init_schemas = __esm(() => {
 });
 
 // src/security/config.ts
-import path17 from "path";
+import path18 from "path";
 import { createHash as createHash3 } from "crypto";
 function securityProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
 }
 function securityDataRoot(cwd) {
-  return path17.join(securityProjectRoot(cwd), ".metaproject", "data", "security");
+  return path18.join(securityProjectRoot(cwd), ".metaproject", "data", "security");
 }
 function configPath(cwd) {
-  return path17.join(securityProjectRoot(cwd), ".metaproject", "security.config.json");
+  return path18.join(securityProjectRoot(cwd), ".metaproject", "security.config.json");
 }
 function mergePolicy(base, override) {
   const merged = {
@@ -4381,7 +4381,7 @@ var init_entropy_gate = __esm(() => {
 });
 
 // src/security/redact.ts
-import path18 from "path";
+import path19 from "path";
 import { createHmac, randomBytes as randomBytes2 } from "crypto";
 import { mkdir as mkdir4, readFile as readFile11, writeFile as writeFile3, chmod as chmod2 } from "fs/promises";
 function maskFor(match) {
@@ -4461,11 +4461,11 @@ function redactSensitiveText(text) {
   return applyRedaction(text, matches);
 }
 function keyDir(cwd) {
-  return path18.join(securityDataRoot(cwd), "raw");
+  return path19.join(securityDataRoot(cwd), "raw");
 }
 async function getHmacKey(cwd) {
   const dir = keyDir(cwd);
-  const file = path18.join(dir, KEY_FILE);
+  const file = path19.join(dir, KEY_FILE);
   if (await pathExists(file)) {
     const existing = (await readFile11(file, "utf8")).trim();
     if (existing.length > 0) {
@@ -5033,9 +5033,9 @@ var init_output_validation = __esm(() => {
 });
 
 // src/assets/lock.ts
-import path19 from "path";
+import path20 from "path";
 function lockPath(cwd) {
-  return path19.join(cwd, ".metaproject", "assets.lock.json");
+  return path20.join(cwd, ".metaproject", "assets.lock.json");
 }
 function normalizeLock(parsed) {
   const assets = {};
@@ -5090,16 +5090,16 @@ var init_lock = __esm(() => {
 import { createHash as createHash4 } from "crypto";
 import { readFile as readFile12 } from "fs/promises";
 import os2 from "os";
-import path20 from "path";
+import path21 from "path";
 function assetCacheDir() {
   const override = process.env.KERYX_ASSET_CACHE;
   if (override && override.length > 0) {
     return override;
   }
-  return path20.join(os2.homedir(), ".cache", "keryx", "assets");
+  return path21.join(os2.homedir(), ".cache", "keryx", "assets");
 }
 function cacheAssetPath(id) {
-  return path20.join(assetCacheDir(), id);
+  return path21.join(assetCacheDir(), id);
 }
 async function sha256File(file) {
   const buffer = await readFile12(file);
@@ -5151,9 +5151,9 @@ var init_warn_once = __esm(() => {
 });
 
 // src/capability/seam.ts
-import path21 from "path";
+import path22 from "path";
 async function isCapabilityEnabled(cwd, id) {
-  const manifestPath = path21.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path22.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return false;
   }
@@ -5792,7 +5792,7 @@ var init_resolve = __esm(() => {
 });
 
 // src/security/report.ts
-import path22 from "path";
+import path23 from "path";
 import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
 function tally(values) {
   const counts = {};
@@ -5912,26 +5912,26 @@ function renderFindings(findings) {
 `);
 }
 function artifactsDir(cwd) {
-  return path22.join(securityDataRoot(cwd), "artifacts");
+  return path23.join(securityDataRoot(cwd), "artifacts");
 }
 async function writeSecurityArtifacts(cwd, report, config) {
   const dir = artifactsDir(cwd);
   await mkdir5(dir, { recursive: true });
   const committable = toCommittableReport(report);
-  const markdown = path22.join(dir, "latest.md");
-  const json = path22.join(dir, "latest.json");
+  const markdown = path23.join(dir, "latest.md");
+  const json = path23.join(dir, "latest.json");
   await writeFile4(markdown, renderReportMarkdown(committable), "utf8");
   await writeFile4(json, `${JSON.stringify(committable, null, 2)}
 `, "utf8");
   if (config.storeHashes) {
-    const rawDir = path22.join(securityDataRoot(cwd), "raw");
+    const rawDir = path23.join(securityDataRoot(cwd), "raw");
     await mkdir5(rawDir, { recursive: true });
-    await writeFile4(path22.join(rawDir, "report.local.json"), `${JSON.stringify(report, null, 2)}
+    await writeFile4(path23.join(rawDir, "report.local.json"), `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   return {
-    markdownPath: path22.relative(cwd, markdown),
-    jsonPath: path22.relative(cwd, json)
+    markdownPath: path23.relative(cwd, markdown),
+    jsonPath: path23.relative(cwd, json)
   };
 }
 var SCHEMA_VERSION = 1;
@@ -5940,13 +5940,13 @@ var init_report2 = __esm(() => {
 });
 
 // src/security/incidents.ts
-import path23 from "path";
+import path24 from "path";
 import { appendFile as appendFile2, mkdir as mkdir6, readFile as readFile13 } from "fs/promises";
 function incidentsDir(cwd) {
-  return path23.join(securityDataRoot(cwd), "incidents");
+  return path24.join(securityDataRoot(cwd), "incidents");
 }
 function incidentsFile(cwd) {
-  return path23.join(incidentsDir(cwd), "incidents.jsonl");
+  return path24.join(incidentsDir(cwd), "incidents.jsonl");
 }
 async function appendIncident(cwd, entry) {
   const dir = incidentsDir(cwd);
@@ -5965,7 +5965,7 @@ var init_incidents = __esm(() => {
 });
 
 // src/security/self-protect.ts
-import path24 from "path";
+import path25 from "path";
 import { mkdir as mkdir7, readFile as readFile14, writeFile as writeFile5 } from "fs/promises";
 function currentState(config) {
   const policies = {};
@@ -6024,7 +6024,7 @@ function evaluateSelfProtection(config, previous, now = new Date().toISOString()
   return { warnings, incidents, findings, checksumMatch: checksum.match };
 }
 function stateFile(cwd) {
-  return path24.join(securityDataRoot(cwd), "raw", "state.json");
+  return path25.join(securityDataRoot(cwd), "raw", "state.json");
 }
 async function readState(cwd) {
   const file = stateFile(cwd);
@@ -6039,7 +6039,7 @@ async function readState(cwd) {
 }
 async function writeState(cwd, state) {
   const file = stateFile(cwd);
-  await mkdir7(path24.dirname(file), { recursive: true });
+  await mkdir7(path25.dirname(file), { recursive: true });
   await writeFile5(file, `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -6057,12 +6057,12 @@ var init_self_protect = __esm(() => {
 
 // src/lib/descriptor-read.ts
 import { constants, fstatSync, lstatSync as lstatSync2, statSync } from "fs";
-import path25 from "path";
+import path26 from "path";
 import { dlopen, FFIType, ptr } from "bun:ffi";
 function readDescriptorChain(workspaceRoot, absolutePath, options = {}) {
-  const relativePath = path25.relative(workspaceRoot, absolutePath);
-  const components = relativePath.split(path25.sep);
-  if (!relativePath || path25.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
+  const relativePath = path26.relative(workspaceRoot, absolutePath);
+  const components = relativePath.split(path26.sep);
+  if (!relativePath || path26.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
     throw new DescriptorReadError("invalid-path", "safe source path is not workspace-relative");
   }
   if (options.maxBytes !== undefined && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0)) {
@@ -6185,7 +6185,7 @@ var init_descriptor_read = __esm(() => {
 
 // src/lib/contained-read.ts
 import { lstat as lstat3, realpath as realpath2, stat as stat3 } from "fs/promises";
-import path26 from "path";
+import path27 from "path";
 async function readContainedFile(ownerRoot, candidatePath, options = {}) {
   if (options.backend === "unsupported") {
     throw new ContainedReadError("CONTAINED_READ_UNAVAILABLE", "safe descriptor source reads are unavailable on this platform");
@@ -6234,8 +6234,8 @@ async function readContainedFile(ownerRoot, candidatePath, options = {}) {
   }
 }
 function isInside2(root, candidate) {
-  const relative = path26.relative(root, candidate);
-  return relative === "" || !path26.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path26.sep}`);
+  const relative = path27.relative(root, candidate);
+  return relative === "" || !path27.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path27.sep}`);
 }
 function mapDescriptorError(error) {
   if (!(error instanceof DescriptorReadError))
@@ -6260,16 +6260,16 @@ var init_contained_read = __esm(() => {
 
 // src/security/path-scan.ts
 import { readdir as readdir6, realpath as realpath3, stat as stat4 } from "fs/promises";
-import path27 from "path";
+import path28 from "path";
 function isInside3(root, candidate) {
-  const relative = path27.relative(root, candidate);
-  return relative === "" || !path27.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path27.sep}`);
+  const relative = path28.relative(root, candidate);
+  return relative === "" || !path28.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path28.sep}`);
 }
 function identityFor(value) {
   return `${String(value.dev)}:${String(value.ino)}`;
 }
 function relativePath(root, candidate) {
-  const relative = path27.relative(root, candidate);
+  const relative = path28.relative(root, candidate);
   return relative === "" ? "." : relative;
 }
 function safeReason(error) {
@@ -6298,7 +6298,7 @@ async function secretBearingFilesIn(dirAbsolute, remainingDepth) {
   }
   const matches = [];
   for (const entry of entries) {
-    const entryPath = path27.join(dirAbsolute, entry);
+    const entryPath = path28.join(dirAbsolute, entry);
     let entryStat;
     try {
       entryStat = await stat4(entryPath);
@@ -6362,14 +6362,14 @@ async function scanContainedPath(input) {
     throw new Error("security scan target is outside the project root");
   }
   const exclusions = (input.exclusions ?? []).map((entry) => {
-    const absolute = path27.resolve(ownerRoot, entry);
+    const absolute = path28.resolve(ownerRoot, entry);
     return isInside3(ownerRoot, absolute) ? absolute : null;
   }).filter((entry) => entry !== null);
   const scope = {
     path: relativePath(ownerRoot, targetReal),
     recursive: input.recursive ?? true,
     exclusions: (input.exclusions ?? []).map((entry) => {
-      const absolute = path27.resolve(ownerRoot, entry);
+      const absolute = path28.resolve(ownerRoot, entry);
       return isInside3(ownerRoot, absolute) ? relativePath(ownerRoot, absolute) : "[external exclusion omitted]";
     }),
     limits
@@ -6390,15 +6390,15 @@ async function scanContainedPath(input) {
     if (!coverage.reasons.includes(reason))
       coverage.reasons.push(reason);
   };
-  const excluded = (candidate) => exclusions.some((entry) => candidate === entry || candidate.startsWith(`${entry}${path27.sep}`));
+  const excluded = (candidate) => exclusions.some((entry) => candidate === entry || candidate.startsWith(`${entry}${path28.sep}`));
   const visit = async (candidate, depth) => {
     if (stoppedByLimit)
       return;
     const displayPath = relativePath(ownerRoot, candidate);
     if (respectIgnoreRules) {
-      const normalized = displayPath.split(path27.sep).join("/");
+      const normalized = displayPath.split(path28.sep).join("/");
       if (isIgnoredPath(ignoredPaths, normalized)) {
-        const basename = path27.basename(displayPath);
+        const basename = path28.basename(displayPath);
         const inHardcodedIgnore = ALWAYS_IGNORED_RELATIVE_DIRS.some((dir) => normalized === dir || normalized.startsWith(`${dir}/`));
         if (!inHardcodedIgnore && looksSecretBearingByName(basename)) {} else {
           if (!inHardcodedIgnore) {
@@ -6480,7 +6480,7 @@ async function scanContainedPath(input) {
         return;
       }
       for (const entry of entries) {
-        await visit(path27.join(canonical, entry), depth + 1);
+        await visit(path28.join(canonical, entry), depth + 1);
         if (stoppedByLimit)
           break;
       }
@@ -6555,7 +6555,7 @@ var init_path_scan = __esm(() => {
 
 // src/security/read-source.ts
 import { realpath as realpath4, stat as stat5 } from "fs/promises";
-import path28 from "path";
+import path29 from "path";
 async function sourceForFileRead(cwd, absolutePath) {
   const projectRoot = resolveProjectRoot(cwd);
   const contained = await resolveContainedPath(projectRoot, absolutePath);
@@ -6563,8 +6563,8 @@ async function sourceForFileRead(cwd, absolutePath) {
     return "untrusted-external";
   }
   const projectRootReal = await realpath4(projectRoot).catch(() => projectRoot);
-  const relativePath = path28.relative(projectRootReal, contained.path);
-  if (relativePath.length === 0 || path28.isAbsolute(relativePath)) {
+  const relativePath = path29.relative(projectRootReal, contained.path);
+  if (relativePath.length === 0 || path29.isAbsolute(relativePath)) {
     return "untrusted-external";
   }
   const fileStat = await stat5(contained.path).catch(() => null);
@@ -6931,9 +6931,9 @@ var SUBSYSTEM_INSTRUCTIONS = "instructions", SUBSYSTEM_ACP_PERMISSION = "acp-per
 
 // src/lib/symlink-safety.ts
 import { lstat as lstat4, realpath as realpath5 } from "fs/promises";
-import path29 from "path";
+import path30 from "path";
 async function refuseEscapingSymlink(root, relativePath) {
-  const rootResolved = path29.resolve(root);
+  const rootResolved = path30.resolve(root);
   let rootReal;
   try {
     rootReal = await realpath5(rootResolved);
@@ -6943,7 +6943,7 @@ async function refuseEscapingSymlink(root, relativePath) {
   const segments = relativePath.split("/").filter((s) => s.length > 0);
   let current = rootResolved;
   for (const segment of segments) {
-    current = path29.join(current, segment);
+    current = path30.join(current, segment);
     let stats;
     try {
       stats = await lstat4(current);
@@ -6956,21 +6956,21 @@ async function refuseEscapingSymlink(root, relativePath) {
     try {
       real = await realpath5(current);
     } catch {
-      return `${relativePath}: refuses to write through a broken symlink at ${path29.relative(rootResolved, current) || "."}`;
+      return `${relativePath}: refuses to write through a broken symlink at ${path30.relative(rootResolved, current) || "."}`;
     }
-    const rel = path29.relative(rootReal, real);
-    const escapes = rel === ".." || rel.startsWith(`..${path29.sep}`) || path29.isAbsolute(rel);
+    const rel = path30.relative(rootReal, real);
+    const escapes = rel === ".." || rel.startsWith(`..${path30.sep}`) || path30.isAbsolute(rel);
     if (escapes) {
-      return `${relativePath}: refuses to write through a symlink at ${path29.relative(rootResolved, current) || "."} that resolves outside the project root`;
+      return `${relativePath}: refuses to write through a symlink at ${path30.relative(rootResolved, current) || "."} that resolves outside the project root`;
     }
     if (hasGitSegment(rel)) {
-      return `${relativePath}: refuses to write through a symlink at ${path29.relative(rootResolved, current) || "."} that resolves through a .git directory`;
+      return `${relativePath}: refuses to write through a symlink at ${path30.relative(rootResolved, current) || "."} that resolves through a .git directory`;
     }
   }
   return;
 }
 function hasGitSegment(rel) {
-  return rel.split(path29.sep).some((segment) => segment.toLowerCase() === ".git");
+  return rel.split(path30.sep).some((segment) => segment.toLowerCase() === ".git");
 }
 var SymlinkRefusedError;
 var init_symlink_safety = __esm(() => {
@@ -6982,12 +6982,12 @@ var init_symlink_safety = __esm(() => {
 import { chmod as chmod3, lstat as lstat5, mkdir as mkdir8, open, readdir as readdir7, realpath as realpath6, rename as rename4, rm as rm3, rmdir, stat as stat6 } from "fs/promises";
 import { constants as fsConstants } from "fs";
 import { randomBytes as randomBytes3 } from "crypto";
-import path30 from "path";
+import path31 from "path";
 function splitRel(rel) {
   return rel.split("/").filter((s) => s.length > 0);
 }
 function assertSafeRel(rel) {
-  if (path30.isAbsolute(rel)) {
+  if (path31.isAbsolute(rel)) {
     throw new ContainedWriteError("absolute-path", `${rel}: refuses an absolute path`);
   }
   const segments = splitRel(rel);
@@ -7006,10 +7006,10 @@ function assertSafeRel(rel) {
   return nonDotSegments;
 }
 async function assertNoCycleOrDangling(root, rel, segments) {
-  const rootResolved = path30.resolve(root);
+  const rootResolved = path31.resolve(root);
   let current = rootResolved;
   for (const segment of segments) {
-    current = path30.join(current, segment);
+    current = path31.join(current, segment);
     let stats;
     try {
       stats = await lstat5(current);
@@ -7022,7 +7022,7 @@ async function assertNoCycleOrDangling(root, rel, segments) {
       await realpath6(current);
     } catch (error) {
       const code = error.code;
-      const at = path30.relative(rootResolved, current) || ".";
+      const at = path31.relative(rootResolved, current) || ".";
       if (code === "ELOOP") {
         throw new ContainedWriteError("symlink-cycle", `${rel}: refuses a symlink cycle at ${at}`);
       }
@@ -7037,13 +7037,13 @@ async function assertContained(root, rel, opts = {}) {
   if (refusal) {
     throw new ContainedWriteError("escaping-symlink", refusal);
   }
-  const rootResolved = path30.resolve(root);
-  const targetPath = path30.join(rootResolved, ...segments);
+  const rootResolved = path31.resolve(root);
+  const targetPath = path31.join(rootResolved, ...segments);
   const rootReal = await realpath6(rootResolved).catch(() => rootResolved);
   const targetReal = await realpath6(targetPath).catch(() => null);
   if (targetReal !== null) {
-    const relToRoot = path30.relative(rootReal, targetReal);
-    const escapes = relToRoot === ".." || relToRoot.startsWith(`..${path30.sep}`) || path30.isAbsolute(relToRoot);
+    const relToRoot = path31.relative(rootReal, targetReal);
+    const escapes = relToRoot === ".." || relToRoot.startsWith(`..${path31.sep}`) || path31.isAbsolute(relToRoot);
     if (escapes) {
       throw new ContainedWriteError("not-contained", `${rel}: resolves outside ${rootReal}`);
     }
@@ -7065,7 +7065,7 @@ async function assertContained(root, rel, opts = {}) {
     }
   }
   const resolvedPath = targetReal ?? targetPath;
-  return { targetPath, dir: path30.dirname(targetPath), resolvedPath, resolvedDir: path30.dirname(resolvedPath) };
+  return { targetPath, dir: path31.dirname(targetPath), resolvedPath, resolvedDir: path31.dirname(resolvedPath) };
 }
 async function pathExistsLstat(p) {
   try {
@@ -7102,7 +7102,7 @@ async function writeContained(root, rel, data, opts = {}) {
   } catch {
     existingMode = undefined;
   }
-  const tmp = path30.join(resolvedDir, `.${path30.basename(resolvedPath)}.tmp-${randomBytes3(6).toString("hex")}`);
+  const tmp = path31.join(resolvedDir, `.${path31.basename(resolvedPath)}.tmp-${randomBytes3(6).toString("hex")}`);
   try {
     const handle = await open(tmp, "wx", opts.mode);
     try {
@@ -7371,7 +7371,7 @@ var init_codecs = __esm(() => {
 });
 
 // src/integrations/surfaces.ts
-import path31 from "path";
+import path32 from "path";
 function ctxHookCommand(id) {
   return `keryx ctx hook ${id}`;
 }
@@ -7416,7 +7416,7 @@ function nestedCtxSurface(opts) {
     confidence,
     sourceDocs,
     ...riskNotes !== undefined ? { riskNotes } : {},
-    settingsFile: (root) => path31.join(root, ...relativePath.split("/")),
+    settingsFile: (root) => path32.join(root, ...relativePath.split("/")),
     relativePath,
     slots: [
       { key: container ?? "hooks", type: "object", access: "owns" },
@@ -7530,7 +7530,7 @@ function flatSecuritySurface(harnessId, on, relativePath) {
       "`securityHooks` matches no documented hook contract for this harness; it is keryx's own invention (tracked as OQ-3)."
     ],
     sourceDocs: ["src/security/agent-hooks/runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ...relativePath.split("/")),
+    settingsFile: (root) => path32.join(root, ...relativePath.split("/")),
     relativePath,
     slots: [
       { key: SECURITY_HOOKS_KEY, type: "array", access: "owns" },
@@ -7609,7 +7609,7 @@ var init_surfaces = __esm(() => {
     sentinel: CTX_HOOK_SENTINEL,
     confidence: "verified",
     sourceDocs: ["src/ctx/runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".cursor", "hooks.json"),
+    settingsFile: (root) => path32.join(root, ".cursor", "hooks.json"),
     relativePath: ".cursor/hooks.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -7636,7 +7636,7 @@ var init_surfaces = __esm(() => {
     sentinel: CTX_HOOK_SENTINEL,
     confidence: "verified",
     sourceDocs: ["src/ctx/runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".windsurf", "hooks.json"),
+    settingsFile: (root) => path32.join(root, ".windsurf", "hooks.json"),
     relativePath: ".windsurf/hooks.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -7660,7 +7660,7 @@ var init_surfaces = __esm(() => {
     confidence: "experimental",
     riskNotes: ["No first-party docs confirm this hook contract; verify on a live install."],
     sourceDocs: ["src/ctx/runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".agents", "hooks.json"),
+    settingsFile: (root) => path32.join(root, ".agents", "hooks.json"),
     relativePath: ".agents/hooks.json",
     slots: [
       { key: ANTIGRAVITY_CONTAINER, type: "object", access: "owns" },
@@ -7713,7 +7713,7 @@ var init_surfaces = __esm(() => {
     confidence: "experimental",
     riskNotes: ["Bridged via a generated plugin file rather than a documented hook config."],
     sourceDocs: ["src/ctx/runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ...OPENCODE_PLUGIN_RELATIVE_PATH.split("/")),
+    settingsFile: (root) => path32.join(root, ...OPENCODE_PLUGIN_RELATIVE_PATH.split("/")),
     relativePath: OPENCODE_PLUGIN_RELATIVE_PATH,
     slots: [],
     label: OPENCODE_PLUGIN_RELATIVE_PATH,
@@ -7750,7 +7750,7 @@ var init_surfaces = __esm(() => {
     sentinel: ORIENT_SENTINEL,
     confidence: "verified",
     sourceDocs: ["src/ctx/orient-runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".claude", "settings.json"),
+    settingsFile: (root) => path32.join(root, ".claude", "settings.json"),
     relativePath: ".claude/settings.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -7771,7 +7771,7 @@ var init_surfaces = __esm(() => {
     sentinel: ORIENT_SENTINEL,
     confidence: "verified",
     sourceDocs: ["src/ctx/orient-runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".codex", "hooks.json"),
+    settingsFile: (root) => path32.join(root, ".codex", "hooks.json"),
     relativePath: ".codex/hooks.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -7792,7 +7792,7 @@ var init_surfaces = __esm(() => {
     sentinel: ORIENT_SENTINEL,
     confidence: "verified",
     sourceDocs: ["src/ctx/orient-runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".cursor", "hooks.json"),
+    settingsFile: (root) => path32.join(root, ".cursor", "hooks.json"),
     relativePath: ".cursor/hooks.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -7823,7 +7823,7 @@ var init_surfaces = __esm(() => {
     sentinel: AGENT_HOOKS_SENTINEL,
     confidence: "verified",
     sourceDocs: ["src/security/agent-hooks/runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".claude", "settings.json"),
+    settingsFile: (root) => path32.join(root, ".claude", "settings.json"),
     relativePath: ".claude/settings.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -7843,7 +7843,7 @@ var init_surfaces = __esm(() => {
     sentinel: AGENT_HOOKS_SENTINEL,
     confidence: "verified",
     sourceDocs: ["src/security/agent-hooks/runtimes.ts"],
-    settingsFile: (root) => path31.join(root, ".claude", "settings.json"),
+    settingsFile: (root) => path32.join(root, ".claude", "settings.json"),
     relativePath: ".claude/settings.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -7870,7 +7870,7 @@ var init_surfaces = __esm(() => {
 
 // src/integrations/markdown-block.ts
 import { readFile as readFile15 } from "fs/promises";
-import path32 from "path";
+import path33 from "path";
 function dominantEol(content) {
   const crlf = (content.match(/\r\n/g) ?? []).length;
   const totalLf = (content.match(/\n/g) ?? []).length;
@@ -8012,7 +8012,7 @@ function appendBlock(content, block, eol) {
   return endsWithEol(content) ? `${content}${eol}${block}` : `${content}${eol}${eol}${block}`;
 }
 function fileFor(root, relativePath) {
-  return path32.join(root, ...relativePath.split("/"));
+  return path33.join(root, ...relativePath.split("/"));
 }
 async function installMarkdownBlock(root, relativePath, frontMatter, spec = INSTRUCTIONS_BLOCK_SPEC) {
   const symlinkRefusal = await refuseEscapingSymlink(root, relativePath);
@@ -8124,7 +8124,7 @@ var init_markdown_block = __esm(() => {
 });
 
 // src/integrations/surfaces-w5b.ts
-import path33 from "path";
+import path34 from "path";
 function kiroHookEntry() {
   return {
     name: KIRO_HOOK_ID,
@@ -8151,7 +8151,7 @@ function copilotHookEntry() {
   };
 }
 async function agentsMdHasKeryxBlock(root) {
-  const file = path33.join(root, "AGENTS.md");
+  const file = path34.join(root, "AGENTS.md");
   if (!await pathExists(file))
     return false;
   const { readFile } = await import("fs/promises");
@@ -8209,7 +8209,7 @@ var init_surfaces_w5b = __esm(() => {
     confidence: "experimental",
     riskNotes: ["Whether Gemini CLI actually reads GEMINI.md end-to-end (beyond the documented context.fileName option) is not independently confirmed here."],
     sourceDocs: ["https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/gemini-md.md"],
-    settingsFile: (root) => path33.join(root, "GEMINI.md"),
+    settingsFile: (root) => path34.join(root, "GEMINI.md"),
     relativePath: "GEMINI.md",
     slots: [],
     customInstall: (root) => installMarkdownBlock(root, "GEMINI.md"),
@@ -8233,7 +8233,7 @@ var init_surfaces_w5b = __esm(() => {
       "Kiro's hook stdin field names and its shell tool's name are third-party-reported only, not confirmed by first-party docs \u2014 the matcher above is a best guess and may gate nothing on a real install; verify before relying on it."
     ],
     sourceDocs: KIRO_SOURCE_DOCS,
-    settingsFile: (root) => path33.join(root, ".kiro", "hooks", "keryx-ctx-guard.json"),
+    settingsFile: (root) => path34.join(root, ".kiro", "hooks", "keryx-ctx-guard.json"),
     relativePath: ".kiro/hooks/keryx-ctx-guard.json",
     slots: [
       { key: "version", type: "string", access: "owns" },
@@ -8278,7 +8278,7 @@ var init_surfaces_w5b = __esm(() => {
       "Open Kiro issues report that steering file `inclusion` modes are not always honoured, even with `inclusion: always` set \u2014 verify on a live install."
     ],
     sourceDocs: ["https://kiro.dev/docs/steering/"],
-    settingsFile: (root) => path33.join(root, ".kiro", "steering", "keryx.md"),
+    settingsFile: (root) => path34.join(root, ".kiro", "steering", "keryx.md"),
     relativePath: ".kiro/steering/keryx.md",
     slots: [],
     customInstall: (root) => installMarkdownBlock(root, ".kiro/steering/keryx.md", KIRO_STEERING_FRONT_MATTER),
@@ -8301,7 +8301,7 @@ var init_surfaces_w5b = __esm(() => {
       "The shell tool's name Copilot's hook payload carries is not documented; this guard parses any tool call whose payload carries `toolArgs.command`, whatever `toolName` is."
     ],
     sourceDocs: COPILOT_SOURCE_DOCS,
-    settingsFile: (root) => path33.join(root, ".github", "hooks", "keryx-ctx-guard.json"),
+    settingsFile: (root) => path34.join(root, ".github", "hooks", "keryx-ctx-guard.json"),
     relativePath: ".github/hooks/keryx-ctx-guard.json",
     slots: [
       { key: "version", type: "number", access: "owns" },
@@ -8345,7 +8345,7 @@ var init_surfaces_w5b = __esm(() => {
       "https://docs.github.com/en/copilot/how-tos/configure-custom-instructions-in-your-ide/add-repository-instructions-in-your-ide",
       "https://github.blog/changelog/2025-08-28-copilot-coding-agent-now-supports-agents-md-custom-instructions/"
     ],
-    settingsFile: (root) => path33.join(root, ".github", "copilot-instructions.md"),
+    settingsFile: (root) => path34.join(root, ".github", "copilot-instructions.md"),
     relativePath: ".github/copilot-instructions.md",
     slots: [],
     customInstall: (root) => installMarkdownBlock(root, ".github/copilot-instructions.md"),
@@ -8384,7 +8384,7 @@ var init_surfaces_w5b = __esm(() => {
       `Zed uses the first matching rules file among ${ZED_SHADOWING_RULES_FILES.join(", ")}, AGENT.md, AGENTS.md, CLAUDE.md, GEMINI.md, ... \u2014 an earlier file in that list shadows AGENTS.md even when AGENTS.md itself carries Keryx's block.`
     ],
     sourceDocs: ["https://github.com/zed-industries/zed/blob/main/docs/src/ai/rules.md"],
-    settingsFile: (root) => path33.join(root, "AGENTS.md"),
+    settingsFile: (root) => path34.join(root, "AGENTS.md"),
     relativePath: "AGENTS.md",
     slots: [],
     probe: async (root) => await agentsMdHasKeryxBlock(root) ? [] : ["zed: AGENTS.md is missing or missing Keryx's block \u2014 run `keryx update`"]
@@ -8614,7 +8614,7 @@ function parseSkillFrontmatter(content) {
 
 // src/gdskills/catalog.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import path34 from "path";
+import path35 from "path";
 import { fileURLToPath } from "url";
 function skill(name, category, profiles, purpose, workflow) {
   let routing;
@@ -8637,10 +8637,10 @@ function renderedSkill(name, category, profiles, purpose, workflow, triggers, de
   return { name, category, description, purpose, workflow, triggers, profiles };
 }
 function bundledSkillMarkdownPath(category, name) {
-  const here = path34.dirname(fileURLToPath(import.meta.url));
+  const here = path35.dirname(fileURLToPath(import.meta.url));
   return [
-    path34.join(here, "bundled", "skills", category, name, "SKILL.md"),
-    path34.join(here, "..", "src", "gdskills", "bundled", "skills", category, name, "SKILL.md")
+    path35.join(here, "bundled", "skills", category, name, "SKILL.md"),
+    path35.join(here, "..", "src", "gdskills", "bundled", "skills", category, name, "SKILL.md")
   ].find((candidate) => existsSync2(candidate));
 }
 function readBundledSkillRouting(category, name) {
@@ -9150,7 +9150,7 @@ var init_catalog = __esm(() => {
       "Sync only selected skills and report changed files."
     ], ["sync skills", "install runtime skills", "global skill sync"], "Use when already-exported runtime skills need pushing to configured local runtimes, and only when sync is explicitly enabled. NOT for: producing the runtime export itself (see skill-runtime-exporter).")
   ];
-  BUNDLED_TREE_MARKER = path34.join("src", "gdskills", "bundled");
+  BUNDLED_TREE_MARKER = path35.join("src", "gdskills", "bundled");
 });
 
 // src/gdskills/resolve.ts
@@ -9284,12 +9284,12 @@ var init_skill_length_ceilings = __esm(() => {
 
 // src/gdskills/bundled-eval.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync } from "fs";
-import path35 from "path";
+import path36 from "path";
 function defaultBundledRoot() {
-  const directPath = path35.join(import.meta.dir, "bundled");
+  const directPath = path36.join(import.meta.dir, "bundled");
   if (existsSync3(directPath))
     return directPath;
-  const packagedPath = path35.join(import.meta.dir, "..", "src", "gdskills", "bundled");
+  const packagedPath = path36.join(import.meta.dir, "..", "src", "gdskills", "bundled");
   if (existsSync3(packagedPath))
     return packagedPath;
   return directPath;
@@ -9806,12 +9806,12 @@ var init_schema = __esm(() => {
 
 // src/agents/catalog.ts
 import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import path36 from "path";
+import path37 from "path";
 function agentDefinitionFiles(dir) {
   if (!existsSync4(dir)) {
     return [];
   }
-  return readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => path36.join(dir, entry.name)).sort();
+  return readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => path37.join(dir, entry.name)).sort();
 }
 function loadOne(filePath, kind) {
   let raw;
@@ -9843,7 +9843,7 @@ function loadOne(filePath, kind) {
     };
   }
   const definition = buildAgentDefinition(parsed.result.data, parsed.result.body);
-  const stem = path36.basename(filePath, ".md");
+  const stem = path37.basename(filePath, ".md");
   if (stem !== definition.name) {
     return {
       error: {
@@ -9877,8 +9877,8 @@ function loadSource(dir, kind, byName, errors) {
   }
 }
 function loadAgentCatalog(projectRoot, options = {}) {
-  const bundledRoot = options.bundledRoot ?? path36.join(defaultBundledRoot(), "agents");
-  const projectDir = path36.join(projectRoot, ".metaproject", "agents");
+  const bundledRoot = options.bundledRoot ?? path37.join(defaultBundledRoot(), "agents");
+  const projectDir = path37.join(projectRoot, ".metaproject", "agents");
   const byName = new Map;
   const errors = [];
   loadSource(bundledRoot, "bundled", byName, errors);
@@ -10671,7 +10671,7 @@ var init_compile = __esm(() => {
 
 // src/agents/export.ts
 import { readFile as readFile16, readdir as readdir8, lstat as lstat6, realpath as realpath7 } from "fs/promises";
-import path37 from "path";
+import path38 from "path";
 function matrixStateToExportLevel(state) {
   return state === "native" || state === "adapter" ? state : "instruction-only";
 }
@@ -10683,7 +10683,7 @@ function proseExportRelativePath(runtime, name) {
   return `${PROSE_EXPORT_ROOT}/${runtime}/${name}.md`;
 }
 async function readExistingFileContent(projectRoot, relativePath) {
-  const absolute = path37.join(projectRoot, ...relativePath.split("/"));
+  const absolute = path38.join(projectRoot, ...relativePath.split("/"));
   try {
     return await readFile16(absolute, "utf8");
   } catch (error) {
@@ -10696,7 +10696,7 @@ async function checkExportPathSafety(projectRoot, relativePath) {
   const segments = relativePath.split("/");
   let current = projectRoot;
   for (const segment of segments) {
-    current = path37.join(current, segment);
+    current = path38.join(current, segment);
     let stats;
     try {
       stats = await lstat6(current);
@@ -10706,12 +10706,12 @@ async function checkExportPathSafety(projectRoot, relativePath) {
       throw error;
     }
     if (stats.isSymbolicLink()) {
-      return `refusing to write ${relativePath} \u2014 ${path37.relative(projectRoot, current) || "."} is a symlink; this exporter never writes through a symlink`;
+      return `refusing to write ${relativePath} \u2014 ${path38.relative(projectRoot, current) || "."} is a symlink; this exporter never writes through a symlink`;
     }
   }
-  let ancestor = path37.dirname(path37.join(projectRoot, ...segments));
+  let ancestor = path38.dirname(path38.join(projectRoot, ...segments));
   for (let guard = 0;guard < segments.length + 1 && !await pathExists(ancestor); guard += 1) {
-    const parent = path37.dirname(ancestor);
+    const parent = path38.dirname(ancestor);
     if (parent === ancestor)
       break;
     ancestor = parent;
@@ -10744,7 +10744,7 @@ function decideAction(existing, generated, format, expectedName) {
   return { action: "update" };
 }
 async function readClaudeSubagentAliasesConfig(projectRoot) {
-  const file = path37.join(projectRoot, CLAUDE_SUBAGENT_ALIASES_CONFIG_PATH);
+  const file = path38.join(projectRoot, CLAUDE_SUBAGENT_ALIASES_CONFIG_PATH);
   if (!await pathExists(file)) {
     return { enabled: true };
   }
@@ -10886,7 +10886,7 @@ async function writeAgentExport(projectRoot, plan, opts = {}) {
 }
 async function scanManagedAgentExports(projectRoot, runtime) {
   const dirRelative = HOST_AGENTS_DIR[runtime];
-  const dirAbsolute = path37.join(projectRoot, ...dirRelative.split("/"));
+  const dirAbsolute = path38.join(projectRoot, ...dirRelative.split("/"));
   let dirStats;
   try {
     dirStats = await lstat6(dirAbsolute);
@@ -10907,7 +10907,7 @@ async function scanManagedAgentExports(projectRoot, runtime) {
     if (!entry.isFile())
       continue;
     const relativePath = `${dirRelative}/${entry.name}`;
-    const absolute = path37.join(projectRoot, ...relativePath.split("/"));
+    const absolute = path38.join(projectRoot, ...relativePath.split("/"));
     let entryStats;
     try {
       entryStats = await lstat6(absolute);
@@ -10922,7 +10922,7 @@ async function scanManagedAgentExports(projectRoot, runtime) {
     } catch {
       continue;
     }
-    const stem = entry.name.slice(0, entry.name.length - path37.extname(entry.name).length);
+    const stem = entry.name.slice(0, entry.name.length - path38.extname(entry.name).length);
     const format = agentSentinelFormatOf(relativePath);
     if (!isStructurallyManaged(content, format, stem))
       continue;
@@ -11092,7 +11092,7 @@ var init_surfaces_agents = __esm(() => {
 
 // src/rules/export-render.ts
 import { readFile as readFile17, readdir as readdir9 } from "fs/promises";
-import path38 from "path";
+import path39 from "path";
 function isUnsafeRulePath(relativePath) {
   return UNSAFE_RULE_PATH_PATTERN.test(relativePath) || relativePath.includes("<!--") || relativePath.includes("-->");
 }
@@ -11135,7 +11135,7 @@ function firstHeading(body) {
   return match ? match[1].trim() : undefined;
 }
 function titleFromFileName(relativePath) {
-  const base = path38.basename(relativePath).replace(/\.(mdc|md)$/i, "");
+  const base = path39.basename(relativePath).replace(/\.(mdc|md)$/i, "");
   return base.split(/[-_]+/).filter((part) => part.length > 0).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 function parseRuleFile(fileName, content) {
@@ -11148,7 +11148,7 @@ function parseRuleFile(fileName, content) {
   return { title: neutralise(collapseSingleLine(title, 120)), description };
 }
 async function collectCanonicalRules(root) {
-  const rulesDir = path38.join(root, ".metaproject", "rules");
+  const rulesDir = path39.join(root, ".metaproject", "rules");
   if (!await pathExists(rulesDir))
     return { rules: [], skipped: [] };
   const rules = [];
@@ -11162,14 +11162,14 @@ async function collectCanonicalRules(root) {
     }
     for (const dirent of dirents) {
       const childRelative = dirRelative ? `${dirRelative}/${dirent.name}` : dirent.name;
-      const childAbsolute = path38.join(dirAbsolute, dirent.name);
+      const childAbsolute = path39.join(dirAbsolute, dirent.name);
       if (dirent.isDirectory()) {
         await walk(childAbsolute, childRelative);
         continue;
       }
       if (!dirent.isFile())
         continue;
-      const ext = path38.extname(dirent.name).toLowerCase();
+      const ext = path39.extname(dirent.name).toLowerCase();
       if (!RULE_EXTENSIONS.has(ext))
         continue;
       if (dirent.name.toLowerCase() === README_BASENAME)
@@ -11220,7 +11220,7 @@ var init_export_render = __esm(() => {
 });
 
 // src/integrations/surfaces-rules.ts
-import path39 from "path";
+import path40 from "path";
 async function rulesSpec(root) {
   const { rules, skipped } = await collectCanonicalRules(root);
   const body = renderRulesBlockBody(rules);
@@ -11265,7 +11265,7 @@ function rulesExportSurface(params) {
     ...riskNotes !== undefined ? { riskNotes } : {},
     sourceDocs,
     optIn: true,
-    settingsFile: (root) => path39.join(root, ...relativePath.split("/")),
+    settingsFile: (root) => path40.join(root, ...relativePath.split("/")),
     relativePath,
     label: relativePath,
     slots: [],
@@ -11348,7 +11348,7 @@ var init_surfaces_rules = __esm(() => {
 });
 
 // src/integrations/surfaces-learning.ts
-import path40 from "path";
+import path41 from "path";
 function learningObserverCommand() {
   return "keryx learn observe --hook claude";
 }
@@ -11403,7 +11403,7 @@ var init_surfaces_learning = __esm(() => {
       "docs/requirements/keryx-agent-platform-expansion/workstreams/W3-self-learning.md",
       "src/learning/observe.ts"
     ],
-    settingsFile: (root) => path40.join(root, ".claude", "settings.json"),
+    settingsFile: (root) => path41.join(root, ".claude", "settings.json"),
     relativePath: ".claude/settings.json",
     slots: [
       { key: "hooks", type: "object", access: "owns" },
@@ -11752,13 +11752,13 @@ var init_registry = __esm(() => {
 var init_package = () => {};
 
 // src/lib/install-plan.ts
-import path41 from "path";
+import path42 from "path";
 var INSTALL_JOURNAL_RELATIVE_PATH;
 var init_install_plan = __esm(() => {
   init_package();
   init_fs();
   init_contained_write();
-  INSTALL_JOURNAL_RELATIVE_PATH = path41.join("runtime", "install", "journal.json");
+  INSTALL_JOURNAL_RELATIVE_PATH = path42.join("runtime", "install", "journal.json");
 });
 
 // src/integrations/install-state.ts
@@ -11813,11 +11813,11 @@ var init_integrations = __esm(() => {
 });
 
 // src/security/audit-harness/surfaces.ts
-import path42 from "path";
+import path43 from "path";
 import { lstat as lstat7, readdir as readdir10, realpath as realpath8, stat as stat7 } from "fs/promises";
 async function resolvesInsideRoot(root, absolute) {
   try {
-    const rootReal = await realpath8(root).catch(() => path42.resolve(root));
+    const rootReal = await realpath8(root).catch(() => path43.resolve(root));
     const real = await realpath8(absolute);
     return isPathInside(rootReal, real);
   } catch {
@@ -11827,7 +11827,7 @@ async function resolvesInsideRoot(root, absolute) {
 async function existingFiles(root, relativePaths) {
   const found = [];
   for (const relativePath of relativePaths) {
-    const absolute = path42.join(root, relativePath);
+    const absolute = path43.join(root, relativePath);
     if (await pathExists(absolute)) {
       found.push(toPosix(relativePath));
     }
@@ -11850,7 +11850,7 @@ async function discoverHookSurfaceFiles(root) {
   return existingFiles(root, [...NON_JSON_HOOK_SURFACE_PATHS, ".metaproject/hooks.json"]);
 }
 async function listFilesByExtensions(root, dirRelative, extensions) {
-  const dirAbsolute = path42.join(root, dirRelative);
+  const dirAbsolute = path43.join(root, dirRelative);
   if (!await pathExists(dirAbsolute)) {
     return { found: [], unreadable: [] };
   }
@@ -11863,15 +11863,15 @@ async function listFilesByExtensions(root, dirRelative, extensions) {
   const found = [];
   const unreadable = [];
   for (const entry of entries) {
-    if (!extensions.has(path42.extname(entry.name)))
+    if (!extensions.has(path43.extname(entry.name)))
       continue;
-    const childRelative = path42.join(dirRelative, entry.name);
+    const childRelative = path43.join(dirRelative, entry.name);
     if (entry.isFile()) {
       found.push(toPosix(childRelative));
       continue;
     }
     if (entry.isSymbolicLink()) {
-      const absolute = path42.join(root, childRelative);
+      const absolute = path43.join(root, childRelative);
       if (await resolvesInsideRoot(root, absolute)) {
         found.push(toPosix(childRelative));
       } else {
@@ -11907,7 +11907,7 @@ async function walkScripts(root, dirRelative, depth, visited, acc) {
     acc.reasons.add(`skills: walk truncated at depth ${depth} (${toPosix(dirRelative)})`);
     return;
   }
-  const dirAbsolute = path42.join(root, dirRelative);
+  const dirAbsolute = path43.join(root, dirRelative);
   if (!await pathExists(dirAbsolute)) {
     return;
   }
@@ -11934,17 +11934,17 @@ async function walkScripts(root, dirRelative, depth, visited, acc) {
     return;
   }
   for (const entry of entries) {
-    const childRelative = path42.join(dirRelative, entry.name);
+    const childRelative = path43.join(dirRelative, entry.name);
     if (entry.isDirectory()) {
       await walkScripts(root, childRelative, depth + 1, visited, acc);
       continue;
     }
-    if (entry.isFile() && SCRIPT_EXTENSIONS.has(path42.extname(entry.name))) {
+    if (entry.isFile() && SCRIPT_EXTENSIONS.has(path43.extname(entry.name))) {
       acc.found.push(toPosix(childRelative));
       continue;
     }
     if (entry.isSymbolicLink()) {
-      const absolute = path42.join(root, childRelative);
+      const absolute = path43.join(root, childRelative);
       if (!await resolvesInsideRoot(root, absolute)) {
         acc.unreadable.push(toPosix(childRelative));
         continue;
@@ -11954,7 +11954,7 @@ async function walkScripts(root, dirRelative, depth, visited, acc) {
       });
       if (stats?.isDirectory()) {
         await walkScripts(root, childRelative, depth + 1, visited, acc);
-      } else if (stats?.isFile() && SCRIPT_EXTENSIONS.has(path42.extname(entry.name))) {
+      } else if (stats?.isFile() && SCRIPT_EXTENSIONS.has(path43.extname(entry.name))) {
         acc.found.push(toPosix(childRelative));
       } else if (stats === undefined) {
         acc.unreadable.push(toPosix(childRelative));
@@ -13480,10 +13480,10 @@ var init_checks = __esm(() => {
 });
 
 // src/security/audit-harness/baseline.ts
-import path43 from "path";
+import path44 from "path";
 import { readFile as readFile18 } from "fs/promises";
 function defaultBaselinePath(root) {
-  return path43.join(root, ".metaproject", "security-audit-baseline.json");
+  return path44.join(root, ".metaproject", "security-audit-baseline.json");
 }
 async function readBaseline(baselinePath) {
   if (!await pathExists(baselinePath)) {
@@ -13582,7 +13582,7 @@ async function addBaselineEntry(root, entry, options = {}) {
       const now = options.now ? options.now() : new Date;
       backupPath = `${filePath}.bak-${now.toISOString().replace(/[:.]/g, "-")}`;
       const preResealBytes = await readFile18(filePath);
-      await writeContained(root, path43.relative(root, backupPath), preResealBytes);
+      await writeContained(root, path44.relative(root, backupPath), preResealBytes);
       entries = loaded.state.entries;
       const rawIds = await readRawBaselineFindingIds(filePath);
       const keptIds = new Set(entries.map((e) => e.findingId));
@@ -13596,7 +13596,7 @@ async function addBaselineEntry(root, entry, options = {}) {
   const next = [...entries.filter((existing) => existing.findingId !== entry.findingId), entry];
   const checksum = computeObjectChecksum(next);
   const payload = { schemaVersion: 1, entries: next, checksum };
-  await writeContained(root, path43.relative(root, filePath), `${JSON.stringify(payload, null, 2)}
+  await writeContained(root, path44.relative(root, filePath), `${JSON.stringify(payload, null, 2)}
 `);
   return { resealed, carriedOver, discarded, ...backupPath ? { backupPath } : {} };
 }
@@ -13687,7 +13687,7 @@ var init_types2 = __esm(() => {
 });
 
 // src/security/audit-harness/proposals.ts
-import path44 from "path";
+import path45 from "path";
 import { readFile as readFile19, realpath as realpath9 } from "fs/promises";
 async function assertContained2(rootReal, absolute, label) {
   if (!isPathInside(rootReal, absolute)) {
@@ -13702,7 +13702,7 @@ async function assertContained2(rootReal, absolute, label) {
     }
     return;
   }
-  let dir = path44.dirname(absolute);
+  let dir = path45.dirname(absolute);
   for (;; ) {
     const dirReal = await realpath9(dir).catch(() => {
       return;
@@ -13713,23 +13713,23 @@ async function assertContained2(rootReal, absolute, label) {
       }
       return;
     }
-    const parent = path44.dirname(dir);
+    const parent = path45.dirname(dir);
     if (parent === dir)
       return;
     dir = parent;
   }
 }
 function dataRoot(root) {
-  return path44.join(root, ".metaproject", "data", "security", "audit-harness");
+  return path45.join(root, ".metaproject", "data", "security", "audit-harness");
 }
 function lockPath2(root) {
-  return path44.join(dataRoot(root), "apply.lock");
+  return path45.join(dataRoot(root), "apply.lock");
 }
 function changelogPath(root) {
-  return path44.join(dataRoot(root), "changelog.jsonl");
+  return path45.join(dataRoot(root), "changelog.jsonl");
 }
 function appliedMarkerPath(root, proposalId) {
-  return path44.join(dataRoot(root), `${proposalId}.applied.json`);
+  return path45.join(dataRoot(root), `${proposalId}.applied.json`);
 }
 function setPointer(target, pointer, mutate) {
   const segments = pointer.split("/").filter((s) => s.length > 0).map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
@@ -13751,7 +13751,7 @@ function setPointer(target, pointer, mutate) {
   return target;
 }
 async function applyJsonEdit(rootReal, edit) {
-  const absolute = path44.resolve(rootReal, edit.path);
+  const absolute = path45.resolve(rootReal, edit.path);
   await assertContained2(rootReal, absolute, `target file "${edit.path}"`);
   const read = await readJsonObjectFile(absolute);
   if (read.state !== "object") {
@@ -13784,7 +13784,7 @@ async function applyJsonEdit(rootReal, edit) {
   } catch {
     throw new Error(`Cannot apply proposal: result is not valid JSON for ${edit.path}; refusing to write.`);
   }
-  await writeContained(rootReal, path44.relative(rootReal, absolute), serialized);
+  await writeContained(rootReal, path45.relative(rootReal, absolute), serialized);
 }
 function countOccurrences(haystack, needle) {
   if (needle.length === 0)
@@ -13800,7 +13800,7 @@ function countOccurrences(haystack, needle) {
   }
 }
 async function applyTextEdit(rootReal, edit) {
-  const absolute = path44.resolve(rootReal, edit.path);
+  const absolute = path45.resolve(rootReal, edit.path);
   await assertContained2(rootReal, absolute, `target file "${edit.path}"`);
   const content = await readFile19(absolute, "utf8");
   const occurrences = countOccurrences(content, edit.from);
@@ -13821,7 +13821,7 @@ async function applyTextEdit(rootReal, edit) {
       throw new Error(`Cannot apply proposal: result is not valid JSON for ${edit.path}; refusing to write.`);
     }
   }
-  await writeContained(rootReal, path44.relative(rootReal, absolute), next);
+  await writeContained(rootReal, path45.relative(rootReal, absolute), next);
 }
 async function applyAuditProposal(root, proposalId, options = {}) {
   if (!PROPOSAL_ID_RE.test(proposalId)) {
@@ -13829,7 +13829,7 @@ async function applyAuditProposal(root, proposalId, options = {}) {
   }
   const rootReal = await realpath9(root).catch(() => {
     return;
-  }) ?? path44.resolve(root);
+  }) ?? path45.resolve(root);
   return withFileLock(lockPath2(rootReal), async () => {
     const marker = appliedMarkerPath(rootReal, proposalId);
     await assertContained2(rootReal, marker, "applied-marker file");
@@ -13864,9 +13864,9 @@ async function applyAuditProposal(root, proposalId, options = {}) {
     };
     const changelog = changelogPath(rootReal);
     await assertContained2(rootReal, changelog, "changelog file");
-    await appendContained(rootReal, path44.relative(rootReal, changelog), `${JSON.stringify(result)}
+    await appendContained(rootReal, path45.relative(rootReal, changelog), `${JSON.stringify(result)}
 `);
-    await writeContained(rootReal, path44.relative(rootReal, marker), `${JSON.stringify(result, null, 2)}
+    await writeContained(rootReal, path45.relative(rootReal, marker), `${JSON.stringify(result, null, 2)}
 `);
     return result;
   });
@@ -13882,7 +13882,7 @@ var init_proposals = __esm(() => {
 
 // src/security/audit-harness/index.ts
 import { createHash as createHash7 } from "crypto";
-import path45 from "path";
+import path46 from "path";
 import { readFile as readFile20 } from "fs/promises";
 function findingId(f) {
   const pointerOrLine = f.location?.pointer ?? (f.location?.line !== undefined ? `line:${f.location.line}` : "");
@@ -14057,7 +14057,7 @@ function asBundleFindings(findings, bundleCheck) {
 function isSafeBundleEntryPath(relativePath) {
   if (relativePath.length === 0)
     return false;
-  if (path45.isAbsolute(relativePath))
+  if (path46.isAbsolute(relativePath))
     return false;
   if (relativePath.includes("\\"))
     return false;
@@ -14074,7 +14074,7 @@ async function scanImportedBundle(root, entries) {
       unreadable.push(entry.path);
       continue;
     }
-    const absolute = path45.join(root, entry.path);
+    const absolute = path46.join(root, entry.path);
     if (!isPathInside(root, absolute)) {
       unreadable.push(entry.path);
       continue;
@@ -14183,7 +14183,7 @@ async function scanImportedBundle(root, entries) {
   return { raw, surface: surfaceResult("imported-bundles", scanned, unreadable), notes };
 }
 async function mcpBaselineTools(root) {
-  const file = path45.join(securityDataRoot(root), "mcp-baseline.json");
+  const file = path46.join(securityDataRoot(root), "mcp-baseline.json");
   if (!await pathExists(file)) {
     return { tools: {}, state: "absent" };
   }
@@ -14202,7 +14202,7 @@ async function computeAuditInternal(root, options = {}) {
     const files = await discoverInstructions(root);
     const unreadable = [];
     for (const relativePath of files) {
-      const content = await safeReadText(path45.join(root, relativePath));
+      const content = await safeReadText(path46.join(root, relativePath));
       if (content === undefined) {
         unreadable.push(relativePath);
         continue;
@@ -14222,7 +14222,7 @@ async function computeAuditInternal(root, options = {}) {
       if (relativePath.endsWith(".toml")) {
         continue;
       }
-      const read = await readJsonObjectFile(path45.join(root, relativePath));
+      const read = await readJsonObjectFile(path46.join(root, relativePath));
       if (read.state !== "object") {
         unreadable.push(relativePath);
         continue;
@@ -14250,7 +14250,7 @@ async function computeAuditInternal(root, options = {}) {
     const { tools: baselineTools, state: baselineState } = await mcpBaselineTools(root);
     for (const relativePath of uniqueFiles) {
       if (relativePath.endsWith(".toml")) {
-        const content = await safeReadText(path45.join(root, relativePath));
+        const content = await safeReadText(path46.join(root, relativePath));
         if (content === undefined) {
           unreadable.push(relativePath);
           continue;
@@ -14272,7 +14272,7 @@ async function computeAuditInternal(root, options = {}) {
       }
       let record = settingsJsonByPath.get(relativePath);
       if (record === undefined) {
-        const read = await readJsonObjectFile(path45.join(root, relativePath));
+        const read = await readJsonObjectFile(path46.join(root, relativePath));
         record = read.state === "object" ? read.value : undefined;
       }
       if (!record) {
@@ -14334,7 +14334,7 @@ async function computeAuditInternal(root, options = {}) {
       }
     }
     for (const relativePath of nonJsonFiles) {
-      const content = await safeReadText(path45.join(root, relativePath));
+      const content = await safeReadText(path46.join(root, relativePath));
       if (content === undefined) {
         unreadable.push(relativePath);
         continue;
@@ -14348,7 +14348,7 @@ async function computeAuditInternal(root, options = {}) {
     const { found: files, unreadable: discoveryUnreadable } = await discoverAgentDefinitions(root);
     const unreadable = [...discoveryUnreadable];
     for (const relativePath of files) {
-      const buffer = await safeReadBuffer(path45.join(root, relativePath));
+      const buffer = await safeReadBuffer(path46.join(root, relativePath));
       if (buffer === undefined) {
         unreadable.push(relativePath);
         continue;
@@ -14365,7 +14365,7 @@ async function computeAuditInternal(root, options = {}) {
     const { found: files, unreadable: discoveryUnreadable, reasons: skillReasons } = await discoverSkillScripts(root);
     const unreadable = [...discoveryUnreadable];
     for (const relativePath of files) {
-      const content = await safeReadText(path45.join(root, relativePath));
+      const content = await safeReadText(path46.join(root, relativePath));
       if (content === undefined) {
         unreadable.push(relativePath);
         continue;
@@ -14512,7 +14512,7 @@ __export(exports_service, {
   validateSerializedOutput: () => validateSerializedOutput,
   verifyConfigChecksum: () => verifyConfigChecksum
 });
-import path46 from "path";
+import path47 from "path";
 import { readFile as readFile21 } from "fs/promises";
 import { randomBytes as randomBytes4 } from "crypto";
 function validateSerializedOutput(content, exemptExfil) {
@@ -14640,7 +14640,7 @@ function hasRecognizedGate(value) {
   return typeof gate === "string" && RECOGNIZED_GATES.has(gate);
 }
 async function readLatestReport(cwd) {
-  const file = path46.join(artifactsDir(cwd), "latest.json");
+  const file = path47.join(artifactsDir(cwd), "latest.json");
   if (!await pathExists(file)) {
     return { kind: "absent" };
   }
@@ -14766,9 +14766,9 @@ var init_service2 = __esm(() => {
 });
 
 // src/gdgraph/config.ts
-import path51 from "path";
+import path52 from "path";
 function gdgraphConfigPath(cwd) {
-  return path51.join(cwd, ".metaproject", "gdgraph.config.json");
+  return path52.join(cwd, ".metaproject", "gdgraph.config.json");
 }
 function mergeGdgraphConfig(parsed) {
   const base = DEFAULT_GDGRAPH_CONFIG;
@@ -15373,7 +15373,7 @@ var init_extract = __esm(() => {
 });
 
 // src/gdgraph/treesitter/grammars.ts
-import path52 from "path";
+import path53 from "path";
 function grammarAssetId(language) {
   return `tree-sitter-${language}`;
 }
@@ -15389,7 +15389,7 @@ function symbolLanguage(language) {
 async function resolveGrammar(cwd, language, grammarsPath) {
   const id = grammarAssetId(language);
   const lock = await loadAssetsLock(cwd);
-  const overrides = grammarsPath ? { [id]: { path: path52.join(grammarsPath, `${id}.wasm`) } } : undefined;
+  const overrides = grammarsPath ? { [id]: { path: path53.join(grammarsPath, `${id}.wasm`) } } : undefined;
   const registry = registryFromLock(lock, overrides);
   const resolved = await resolveAsset(registry, id);
   if (!resolved) {
@@ -15419,7 +15419,7 @@ function toGrammarLanguages(languages) {
   return out;
 }
 function grammarForFile(file, available) {
-  const ext = path52.extname(file);
+  const ext = path53.extname(file);
   const preference = ext === ".tsx" ? ["tsx", "typescript"] : ext === ".ts" ? ["typescript"] : ext === ".jsx" || ext === ".js" || ext === ".mjs" || ext === ".cjs" ? ["javascript"] : ext === ".java" ? ["java"] : ext === ".py" ? ["python"] : [];
   for (const language of preference) {
     if (available.includes(language)) {
@@ -15681,7 +15681,7 @@ var init_adapter = __esm(() => {
 
 // src/gdgraph/enrich.ts
 import { mkdir as mkdir12, writeFile as writeFile6 } from "fs/promises";
-import path53 from "path";
+import path54 from "path";
 async function enrichBuildWithSymbols(cwd, files, resolve) {
   const config = await loadGdgraphConfig(cwd);
   const treesitterConfig = {
@@ -15697,12 +15697,12 @@ async function enrichBuildWithSymbols(cwd, files, resolve) {
   return { enriched: true, symbols: layer.symbols.length, calls: layer.calls.length };
 }
 async function writeSymbolLayer(cwd, layer) {
-  const storageDir = path53.join(cwd, ".metaproject", "data", "gdgraph", "storage");
+  const storageDir = path54.join(cwd, ".metaproject", "data", "gdgraph", "storage");
   await mkdir12(storageDir, { recursive: true });
-  await writeFile6(path53.join(storageDir, "symbols.jsonl"), layer.symbols.map((symbol) => JSON.stringify(symbol)).join(`
+  await writeFile6(path54.join(storageDir, "symbols.jsonl"), layer.symbols.map((symbol) => JSON.stringify(symbol)).join(`
 `) + `
 `, "utf8");
-  await writeFile6(path53.join(storageDir, "calls.jsonl"), layer.calls.map((call) => JSON.stringify(call)).join(`
+  await writeFile6(path54.join(storageDir, "calls.jsonl"), layer.calls.map((call) => JSON.stringify(call)).join(`
 `) + `
 `, "utf8");
 }
@@ -15895,10 +15895,10 @@ var init_describes = () => {};
 
 // src/sync/provenance.ts
 import { mkdir as mkdir13, readFile as readFile25, writeFile as writeFile7 } from "fs/promises";
-import path54 from "path";
+import path55 from "path";
 import { spawn } from "child_process";
 function provenancePath(cwd, module) {
-  return path54.join(cwd, ".metaproject", "data", module, ".provenance.json");
+  return path55.join(cwd, ".metaproject", "data", module, ".provenance.json");
 }
 function gitCmdResult(cwd, args) {
   return new Promise((resolve) => {
@@ -15943,7 +15943,7 @@ async function recordProvenance(cwd, module, at) {
   if (!head)
     return;
   const file = provenancePath(cwd, module);
-  await mkdir13(path54.dirname(file), { recursive: true });
+  await mkdir13(path55.dirname(file), { recursive: true });
   const provenance = { commit: head.commit, branch: head.branch, builtAt: at };
   await writeFile7(file, `${JSON.stringify(provenance, null, 2)}
 `, "utf8");
@@ -15968,7 +15968,7 @@ var init_provenance = __esm(() => {
 // src/gdgraph/staleness.ts
 import { spawn as spawn2 } from "child_process";
 import { stat as stat8 } from "fs/promises";
-import path55 from "path";
+import path56 from "path";
 function gitStatusPorcelain(cwd) {
   return new Promise((resolve) => {
     try {
@@ -15991,10 +15991,10 @@ function gitStatusPorcelain(cwd) {
   });
 }
 function nodesJsonlPath(cwd) {
-  return path55.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  return path56.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
 }
 function gdgraphConfigPath2(cwd) {
-  return path55.join(cwd, ".metaproject", "gdgraph.config.json");
+  return path56.join(cwd, ".metaproject", "gdgraph.config.json");
 }
 function categorizeStatusEntries(entries, rootPrefix) {
   const metaprojectPrefix = `${rootPrefix}.metaproject/`;
@@ -16075,7 +16075,7 @@ async function checkGraphStaleness(cwd) {
       }
     } else {
       provenanceMissing = true;
-      const logsHeadStat = await stat8(path55.join(cwd, ".git", "logs", "HEAD")).catch(() => null);
+      const logsHeadStat = await stat8(path56.join(cwd, ".git", "logs", "HEAD")).catch(() => null);
       if (logsHeadStat && logsHeadStat.mtimeMs > nodesStat.mtimeMs) {
         reasons.push("repo HEAD moved since the graph was built (no build provenance recorded; inferred from .git/logs/HEAD)");
       }
@@ -16104,7 +16104,7 @@ async function checkGraphStaleness(cwd) {
         if (projectRelative === null) {
           continue;
         }
-        const fileStat = await stat8(path55.join(cwd, projectRelative)).catch(() => null);
+        const fileStat = await stat8(path56.join(cwd, projectRelative)).catch(() => null);
         if (fileStat && fileStat.mtimeMs > nodesStat.mtimeMs) {
           postBuildEdits.push(displayPath);
         }
@@ -16240,15 +16240,15 @@ var init_types3 = __esm(() => {
 
 // src/wiki/collect.ts
 import { readFile as readFile26, readdir as readdir11 } from "fs/promises";
-import path56 from "path";
+import path57 from "path";
 function wikiRootPath(cwd) {
-  return path56.join(cwd, ".metaproject", "wiki");
+  return path57.join(cwd, ".metaproject", "wiki");
 }
 async function collectPages(cwd) {
   const root = wikiRootPath(cwd);
   const pages = [];
   for (const { type, folder } of WIKI_PAGE_TYPES) {
-    const dir = path56.join(root, folder);
+    const dir = path57.join(root, folder);
     let names;
     try {
       names = await readdir11(dir);
@@ -16263,7 +16263,7 @@ async function collectPages(cwd) {
       if (!entry.endsWith(".md")) {
         continue;
       }
-      const absolutePath = path56.join(dir, entry);
+      const absolutePath = path57.join(dir, entry);
       let content;
       try {
         content = await readFile26(absolutePath, "utf8");
@@ -17073,7 +17073,7 @@ var init_section_index = __esm(() => {
 });
 
 // src/security/guard.ts
-import path57 from "path";
+import path58 from "path";
 function prepareOutputForPersistence(guard, original) {
   if (!guard.allowed) {
     return { allowed: false, reason: guard.reason ?? "security gate blocked" };
@@ -17091,7 +17091,7 @@ function prepareOutputForPersistence(guard, original) {
   };
 }
 async function resolveManifestSecurityState(cwd) {
-  const manifestPath = path57.join(securityProjectRoot(cwd), ".metaproject", "metaproject.json");
+  const manifestPath = path58.join(securityProjectRoot(cwd), ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return { enabled: false, manifestUnreadable: false };
   }
@@ -17298,9 +17298,9 @@ var MEMORY_EMBEDDING_ID = "memory.embedding", DEFAULT_EMBED_DIMS = 96;
 // src/memory/embedding/index.ts
 import { createHash as createHash10 } from "crypto";
 import { mkdir as mkdir14, readFile as readFile27, writeFile as writeFile8 } from "fs/promises";
-import path58 from "path";
+import path59 from "path";
 function embeddingsDir(cwd) {
-  return path58.join(cwd, ".metaproject", "data", "memory", "embeddings");
+  return path59.join(cwd, ".metaproject", "data", "memory", "embeddings");
 }
 function entryText(entry) {
   return `${entry.title}
@@ -17329,17 +17329,17 @@ async function buildEmbeddingIndex(cwd, entries, embedder, model, now) {
   };
   const dir = embeddingsDir(cwd);
   await mkdir14(dir, { recursive: true });
-  await writeFile8(path58.join(dir, "index.meta.json"), `${JSON.stringify(meta, null, 2)}
+  await writeFile8(path59.join(dir, "index.meta.json"), `${JSON.stringify(meta, null, 2)}
 `, "utf8");
-  await writeFile8(path58.join(dir, "vectors.jsonl"), records.map((record) => JSON.stringify(record)).join(`
+  await writeFile8(path59.join(dir, "vectors.jsonl"), records.map((record) => JSON.stringify(record)).join(`
 `) + (records.length > 0 ? `
 ` : ""), "utf8");
   return toIndex(meta, records);
 }
 async function loadEmbeddingIndex(cwd) {
   const dir = embeddingsDir(cwd);
-  const metaPath = path58.join(dir, "index.meta.json");
-  const vectorsPath = path58.join(dir, "vectors.jsonl");
+  const metaPath = path59.join(dir, "index.meta.json");
+  const vectorsPath = path59.join(dir, "vectors.jsonl");
   if (!await pathExists(metaPath) || !await pathExists(vectorsPath)) {
     return null;
   }
@@ -17420,10 +17420,10 @@ var init_embedding = __esm(() => {
 });
 
 // src/wiki/section-tombstone.ts
-import path59 from "path";
+import path60 from "path";
 import { stat as stat9 } from "fs/promises";
 function sectionRegistryPath(cwd) {
-  return path59.join(cwd, ".metaproject", "wiki", ".sections.json");
+  return path60.join(cwd, ".metaproject", "wiki", ".sections.json");
 }
 function emptySectionRegistry() {
   return { version: SECTION_REGISTRY_VERSION, entries: [], tombstones: [], lifted: [] };
@@ -17725,10 +17725,10 @@ var init_section_tombstone = __esm(() => {
 
 // src/memory/cross-layer.ts
 import { readFile as readFile28 } from "fs/promises";
-import path60 from "path";
+import path61 from "path";
 function extractWikiReferences(entryRelativePath, entryAbsolutePath, content, wikiRoot) {
   const references = [];
-  const entryDir = path60.dirname(entryAbsolutePath);
+  const entryDir = path61.dirname(entryAbsolutePath);
   const lines = content.split(`
 `);
   for (let index = 0;index < lines.length; index += 1) {
@@ -17743,16 +17743,16 @@ function extractWikiReferences(entryRelativePath, entryAbsolutePath, content, wi
       if (withoutAnchor.length === 0) {
         continue;
       }
-      const absolute = path60.resolve(entryDir, withoutAnchor);
-      const relativeToWiki = path60.relative(wikiRoot, absolute);
-      if (relativeToWiki.startsWith("..") || path60.isAbsolute(relativeToWiki)) {
+      const absolute = path61.resolve(entryDir, withoutAnchor);
+      const relativeToWiki = path61.relative(wikiRoot, absolute);
+      if (relativeToWiki.startsWith("..") || path61.isAbsolute(relativeToWiki)) {
         continue;
       }
       references.push({
         entry: entryRelativePath,
         kind: "page-path",
         raw: href,
-        target: relativeToWiki.split(path60.sep).join("/"),
+        target: relativeToWiki.split(path61.sep).join("/"),
         line
       });
     }
@@ -17772,7 +17772,7 @@ function isDangling(finding) {
   return finding.state !== "intact";
 }
 async function loadWikiKnowledgeView(cwd) {
-  const wikiRoot = path60.join(cwd, ".metaproject", "wiki");
+  const wikiRoot = path61.join(cwd, ".metaproject", "wiki");
   const pages = await collectPages(cwd);
   const index = buildSectionIndex(await Promise.all(pages.map(async (page) => ({
     page,
@@ -17990,7 +17990,7 @@ function round2(value) {
 var init_dedup = () => {};
 
 // src/memory/check.ts
-import path61 from "path";
+import path62 from "path";
 async function checkMemory(cwd, config) {
   const entries = await collectEntries(cwd);
   const issues = [];
@@ -18006,7 +18006,7 @@ async function checkMemory(cwd, config) {
     }
     for (const file of entry.scopes.files) {
       const clean = file.replace(/^`|`$/g, "");
-      if (!await pathExists(path61.resolve(cwd, clean))) {
+      if (!await pathExists(path62.resolve(cwd, clean))) {
         issues.push({ path: entry.relativePath, kind: "link", message: `related file not found: ${clean}` });
       }
     }
@@ -18061,12 +18061,12 @@ var init_check = __esm(() => {
 
 // src/memory/write.ts
 import { mkdir as mkdir15, open as open2, readFile as readFile29, rename as rename5, rm as rm4, writeFile as writeFile9 } from "fs/promises";
-import path62 from "path";
+import path63 from "path";
 async function resolveCanonicalEntryPath(cwd, relativePath) {
-  const root = path62.resolve(memoryRoot(cwd));
-  const absolutePath = path62.resolve(root, relativePath);
-  const normalized = toPosix2(path62.relative(root, absolutePath));
-  if (!normalized || normalized.startsWith("../") || path62.isAbsolute(normalized) || !normalized.endsWith(".md")) {
+  const root = path63.resolve(memoryRoot(cwd));
+  const absolutePath = path63.resolve(root, relativePath);
+  const normalized = toPosix2(path63.relative(root, absolutePath));
+  if (!normalized || normalized.startsWith("../") || path63.isAbsolute(normalized) || !normalized.endsWith(".md")) {
     return null;
   }
   return { absolutePath, relativePath: normalized };
@@ -18162,9 +18162,9 @@ function validateNextEntry(relativePath, content) {
   return null;
 }
 async function replaceAtomically(target, content) {
-  const dir = path62.dirname(target);
+  const dir = path63.dirname(target);
   await mkdir15(dir, { recursive: true });
-  const tmp = path62.join(dir, `.${path62.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
+  const tmp = path63.join(dir, `.${path63.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
   try {
     await writeFile9(tmp, content, "utf8");
     const file = await open2(tmp, "r");
@@ -18200,7 +18200,7 @@ function header(content, name) {
   return content.match(new RegExp(`^${name}:\\s*(.+)$`, "mi"))?.[1]?.trim() ?? null;
 }
 function toPosix2(value) {
-  return value.split(path62.sep).join("/");
+  return value.split(path63.sep).join("/");
 }
 function message(cause) {
   return cause instanceof Error ? cause.message : String(cause);
@@ -18214,9 +18214,9 @@ var init_write = __esm(() => {
 // src/memory/ingest.ts
 import { existsSync as existsSync5 } from "fs";
 import { readFile as readFile30 } from "fs/promises";
-import path63 from "path";
+import path64 from "path";
 async function ingestMemory(cwd, source, filePath, config, now) {
-  const absolute = path63.resolve(cwd, filePath);
+  const absolute = path64.resolve(cwd, filePath);
   if (!await pathExists(absolute)) {
     throw new Error(`Ingest source not found: ${filePath}`);
   }
@@ -18233,8 +18233,8 @@ async function ingestMemory(cwd, source, filePath, config, now) {
   const securityWarnings = [];
   const securitySkipped = [];
   let skippedDuplicates = 0;
-  const dir = path63.join(memoryRoot(cwd), folder);
-  const link = path63.relative(cwd, absolute);
+  const dir = path64.join(memoryRoot(cwd), folder);
+  const link = path64.relative(cwd, absolute);
   const date = dateString(now);
   for (const text of candidates) {
     const title = toTitle(text);
@@ -18415,7 +18415,7 @@ function uniqueSlug(dir, title) {
   const base = slugify2(title) || "entry";
   let slug = base;
   let counter = 2;
-  while (existsSync5(path63.join(dir, `${slug}.md`))) {
+  while (existsSync5(path64.join(dir, `${slug}.md`))) {
     slug = `${base}-${counter}`;
     counter += 1;
   }
@@ -18450,7 +18450,7 @@ var init_ingest = __esm(() => {
 
 // src/memory/supersede.ts
 import { readFile as readFile31 } from "fs/promises";
-import path64 from "path";
+import path65 from "path";
 async function supersedeEntry(input, now) {
   const date = input.date ?? now.toISOString().slice(0, 10);
   const today = now.toISOString().slice(0, 10);
@@ -18510,12 +18510,12 @@ async function supersedeEntry(input, now) {
 async function resolveEntryPath(cwd, raw) {
   const root = memoryRoot(cwd);
   const candidates = [
-    path64.resolve(cwd, raw),
-    path64.resolve(root, raw),
-    path64.isAbsolute(raw) ? raw : path64.join(cwd, raw)
+    path65.resolve(cwd, raw),
+    path65.resolve(root, raw),
+    path65.isAbsolute(raw) ? raw : path65.join(cwd, raw)
   ];
   for (const absolute of candidates) {
-    const confined = await resolveCanonicalEntryPath(cwd, path64.relative(root, absolute));
+    const confined = await resolveCanonicalEntryPath(cwd, path65.relative(root, absolute));
     if (confined && await pathExists(confined.absolutePath)) {
       return { absolute: confined.absolutePath, relative: confined.relativePath };
     }
@@ -18711,9 +18711,9 @@ __export(exports_service3, {
 });
 import { createHash as createHash11 } from "crypto";
 import { mkdir as mkdir16, readFile as readFile32, writeFile as writeFile10 } from "fs/promises";
-import path65 from "path";
+import path66 from "path";
 function dataRoot2(cwd) {
-  return path65.join(cwd, ".metaproject", "data", "memory");
+  return path66.join(cwd, ".metaproject", "data", "memory");
 }
 function createMemoryService() {
   const reportStore = createMemoryReportStore();
@@ -18728,9 +18728,9 @@ function createMemoryService() {
       if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
         throw new Error(`Invalid slug: ${slug}. Use lowercase letters, digits, and hyphens.`);
       }
-      const dir = path65.join(memoryRoot(input.cwd), typeConfig.folder);
-      const filePath = path65.join(dir, `${slug}.md`);
-      const relativePath = path65.relative(input.cwd, filePath);
+      const dir = path66.join(memoryRoot(input.cwd), typeConfig.folder);
+      const filePath = path66.join(dir, `${slug}.md`);
+      const relativePath = path66.relative(input.cwd, filePath);
       if (await pathExists(filePath) && !input.force) {
         throw new Error(`Entry already exists: ${relativePath}. Use --force to overwrite.`);
       }
@@ -18761,9 +18761,9 @@ function createMemoryService() {
     async index(input) {
       const entries = await collectEntries(input.cwd);
       const generatedAt = new Date().toISOString();
-      const indexDir = path65.join(dataRoot2(input.cwd), "index");
+      const indexDir = path66.join(dataRoot2(input.cwd), "index");
       await mkdir16(indexDir, { recursive: true });
-      const indexPath = path65.join(indexDir, "index.json");
+      const indexPath = path66.join(indexDir, "index.json");
       await writeFile10(indexPath, `${JSON.stringify({
         catalogVersion: 1,
         sourceFingerprint: createHash11("sha256").update(JSON.stringify(entries.map((e) => ({
@@ -18784,7 +18784,7 @@ function createMemoryService() {
       }, null, 2)}
 `, "utf8");
       const result = {
-        path: path65.relative(input.cwd, indexPath),
+        path: path66.relative(input.cwd, indexPath),
         entryCount: entries.length,
         generatedAt
       };
@@ -18797,7 +18797,7 @@ function createMemoryService() {
           const built = await buildEmbeddingIndex(input.cwd, entries, embedder.embed, embedder.model, new Date);
           result.embeddings = {
             built: true,
-            path: path65.relative(input.cwd, embeddingsDir(input.cwd)),
+            path: path66.relative(input.cwd, embeddingsDir(input.cwd)),
             vectorCount: built.meta.entryCount,
             model: built.meta.model
           };
@@ -19399,7 +19399,7 @@ var init_ask = __esm(() => {
 });
 
 // src/wiki/backlinks.ts
-import path66 from "path";
+import path67 from "path";
 function extractCodePaths(content) {
   const out = [];
   let match;
@@ -19429,8 +19429,8 @@ function resolveLink(fromRepoPath, raw) {
   const clean = (raw.split("#")[0] ?? "").trim();
   if (!clean)
     return "";
-  const fromDir = path66.posix.dirname(fromRepoPath.split(path66.sep).join("/"));
-  return path66.posix.normalize(path66.posix.join(fromDir, clean));
+  const fromDir = path67.posix.dirname(fromRepoPath.split(path67.sep).join("/"));
+  return path67.posix.normalize(path67.posix.join(fromDir, clean));
 }
 function buildBacklinkIndex(pages) {
   const index = new Map;
@@ -19444,18 +19444,18 @@ function buildBacklinkIndex(pages) {
     }
   };
   for (const page of pages) {
-    const from = page.repoPath.split(path66.sep).join("/");
+    const from = page.repoPath.split(path67.sep).join("/");
     for (const raw of extractLinks(page.content))
       add(resolveLink(from, raw), from);
     for (const raw of extractCodePaths(page.content))
-      add(path66.posix.normalize(raw), from);
+      add(path67.posix.normalize(raw), from);
   }
   for (const list of index.values())
     list.sort();
   return index;
 }
 function backlinksFor(index, targetRepoPath) {
-  const key = path66.posix.normalize(targetRepoPath.split(path66.sep).join("/"));
+  const key = path67.posix.normalize(targetRepoPath.split(path67.sep).join("/"));
   return index.get(key) ?? [];
 }
 var LINK, CODE_SPAN, FILE_LIKE;
@@ -19468,7 +19468,7 @@ var init_backlinks = __esm(() => {
 // src/ctx/assembly.ts
 import { createHash as createHash12 } from "crypto";
 import { mkdir as mkdir17, rename as rename6, writeFile as writeFile11 } from "fs/promises";
-import path67 from "path";
+import path68 from "path";
 function assembleContext(input) {
   let items = 0;
   let tokens = 0;
@@ -19512,9 +19512,9 @@ async function recordNoContentContext(input) {
   return assembly;
 }
 async function recordContextAssembly(input) {
-  const directory = path67.join(input.workspaceRoot, ".metaproject", "context-operations", "traces");
+  const directory = path68.join(input.workspaceRoot, ".metaproject", "context-operations", "traces");
   await mkdir17(directory, { recursive: true });
-  const target = path67.join(directory, path67.basename(input.assembly.traceRef));
+  const target = path68.join(directory, path68.basename(input.assembly.traceRef));
   const temporary = `${target}.${process.pid}.tmp`;
   await writeFile11(temporary, `${JSON.stringify({ schemaVersion: "1.0", correlationId: input.correlationId, outcome: input.outcome, configurationRevision: input.assembly.configurationRevision, policy: { ref: input.assembly.policyRef, revision: input.assembly.policyRevision }, selected: input.assembly.selected, omittedOptional: input.assembly.omittedOptional, partial: input.assembly.partial })}
 `, { mode: 384 });
@@ -20365,15 +20365,15 @@ __export(exports_service4, {
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash14 } from "crypto";
 import { mkdir as mkdir18, readFile as readFile34, readdir as readdir12, rm as rm5, writeFile as writeFile12 } from "fs/promises";
-import path68 from "path";
+import path69 from "path";
 function wikiRootPath2(cwd) {
-  return path68.join(cwd, ".metaproject", "wiki");
+  return path69.join(cwd, ".metaproject", "wiki");
 }
 function dataRootPath(cwd) {
-  return path68.join(cwd, ".metaproject", "data", "gdwiki");
+  return path69.join(cwd, ".metaproject", "data", "gdwiki");
 }
 function linkCheckReportPath(cwd) {
-  return path68.join(dataRootPath(cwd), "link-check", "latest.md");
+  return path69.join(dataRootPath(cwd), "link-check", "latest.md");
 }
 async function wikiStatus(cwd) {
   const root = wikiRootPath2(cwd);
@@ -20381,7 +20381,7 @@ async function wikiStatus(cwd) {
   const pages = enabled ? await collectPages(cwd) : [];
   return {
     enabled,
-    wikiRoot: path68.relative(cwd, root),
+    wikiRoot: path69.relative(cwd, root),
     totalPages: pages.length,
     countsByType: WIKI_PAGE_TYPES.map(({ type }) => ({
       type,
@@ -20412,9 +20412,9 @@ async function wikiCreatePage(input) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(input.slug)) {
     throw new Error(`Invalid slug: ${input.slug}. Use lowercase letters, digits, and hyphens.`);
   }
-  const dir = path68.join(wikiRootPath2(input.cwd), typeConfig.folder);
-  const filePath = path68.join(dir, `${input.slug}.md`);
-  const relativePath = path68.relative(input.cwd, filePath);
+  const dir = path69.join(wikiRootPath2(input.cwd), typeConfig.folder);
+  const filePath = path69.join(dir, `${input.slug}.md`);
+  const relativePath = path69.relative(input.cwd, filePath);
   if (await pathExists(filePath) && !input.force) {
     throw new Error(`Page already exists: ${relativePath}. Use --force to overwrite.`);
   }
@@ -20425,7 +20425,7 @@ async function wikiCreatePage(input) {
 }
 async function wikiGenerateIndex(cwd) {
   const root = wikiRootPath2(cwd);
-  const indexPath = path68.join(root, "index.md");
+  const indexPath = path69.join(root, "index.md");
   const pages = await collectPages(cwd);
   const generatedAt = new Date().toISOString();
   const managedBlock = `${WIKI_INDEX_BEGIN}
@@ -20443,7 +20443,7 @@ ${managedBlock}
   await mkdir18(root, { recursive: true });
   await writeFile12(indexPath, next, "utf8");
   return {
-    path: path68.relative(cwd, indexPath),
+    path: path69.relative(cwd, indexPath),
     pageCount: pages.length,
     generatedAt
   };
@@ -20451,13 +20451,13 @@ ${managedBlock}
 async function wikiCheckLinks(cwd) {
   const root = wikiRootPath2(cwd);
   const allFiles = await pathExists(root) ? await walkMarkdown(root) : [];
-  const files = allFiles.filter((absolutePath) => !path68.relative(root, absolutePath).startsWith(`templates${path68.sep}`));
+  const files = allFiles.filter((absolutePath) => !path69.relative(root, absolutePath).startsWith(`templates${path69.sep}`));
   const broken = [];
   let checkedLinks = 0;
   let skippedExternal = 0;
   for (const absolutePath of files) {
     const content = await readFile34(absolutePath, "utf8");
-    const pageRelative = path68.relative(cwd, absolutePath);
+    const pageRelative = path69.relative(cwd, absolutePath);
     for (const target of extractLinkTargets(content)) {
       if (EXTERNAL_LINK.test(target)) {
         skippedExternal += 1;
@@ -20468,7 +20468,7 @@ async function wikiCheckLinks(cwd) {
         continue;
       }
       checkedLinks += 1;
-      const resolved = path68.resolve(path68.dirname(absolutePath), filePart);
+      const resolved = path69.resolve(path69.dirname(absolutePath), filePart);
       if (!await pathExists(resolved)) {
         broken.push({
           page: pageRelative,
@@ -20480,7 +20480,7 @@ async function wikiCheckLinks(cwd) {
   }
   const generatedAt = new Date().toISOString();
   const reportPath = linkCheckReportPath(cwd);
-  await mkdir18(path68.dirname(reportPath), { recursive: true });
+  await mkdir18(path69.dirname(reportPath), { recursive: true });
   await writeFile12(reportPath, renderLinkCheckReport({
     generatedAt,
     checkedPages: files.length,
@@ -20489,7 +20489,7 @@ async function wikiCheckLinks(cwd) {
     broken
   }), "utf8");
   return {
-    reportPath: path68.relative(cwd, reportPath),
+    reportPath: path69.relative(cwd, reportPath),
     checkedPages: files.length,
     checkedLinks,
     skippedExternal,
@@ -20539,7 +20539,7 @@ async function wikiValidate(cwd) {
   }
   if (await isIndexStale(cwd, pages)) {
     issues.push({
-      page: path68.join(path68.relative(cwd, wikiRootPath2(cwd)), "index.md"),
+      page: path69.join(path69.relative(cwd, wikiRootPath2(cwd)), "index.md"),
       kind: "index",
       message: "index out of date, run `keryx wiki index`"
     });
@@ -20576,7 +20576,7 @@ async function wikiCollect(input) {
   };
 }
 async function wikiPruneOrphans(cwd) {
-  const componentsDir = path68.join(wikiRootPath2(cwd), "components");
+  const componentsDir = path69.join(wikiRootPath2(cwd), "components");
   if (!await pathExists(componentsDir)) {
     return { pruned: [], orphanedAccepted: [] };
   }
@@ -20593,20 +20593,20 @@ async function wikiPruneOrphans(cwd) {
     if (validSlugs.has(slug)) {
       continue;
     }
-    const filePath = path68.join(componentsDir, entry);
+    const filePath = path69.join(componentsDir, entry);
     const current = await readFile34(filePath, "utf8");
     const isUnmodifiedDraft = /\nStatus:\s*draft\s*\n/.test(current) && current.includes("Generated by `keryx wiki collect`");
     if (isUnmodifiedDraft) {
       await rm5(filePath);
-      pruned.push(path68.relative(cwd, filePath));
+      pruned.push(path69.relative(cwd, filePath));
     } else {
-      orphanedAccepted.push(path68.relative(cwd, filePath));
+      orphanedAccepted.push(path69.relative(cwd, filePath));
     }
   }
   return { pruned, orphanedAccepted };
 }
 async function validModuleNames(cwd) {
-  const nodesPath = path68.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  const nodesPath = path69.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
   if (!await pathExists(nodesPath)) {
     return;
   }
@@ -20676,9 +20676,9 @@ async function wikiEvidence(input) {
   });
 }
 function resolveEvidenceScope(cwd, override) {
-  const absolute = path68.resolve(cwd);
+  const absolute = path69.resolve(cwd);
   return {
-    projectId: override?.projectId ?? (path68.basename(absolute) || "project"),
+    projectId: override?.projectId ?? (path69.basename(absolute) || "project"),
     checkoutId: override?.checkoutId ?? `checkout:${createHash14("sha256").update(absolute).digest("hex").slice(0, 16)}`,
     ...override?.workspaceId ? { workspaceId: override.workspaceId } : {},
     ...override?.taskId ? { taskId: override.taskId } : {}
@@ -20693,7 +20693,7 @@ function isMachineAuthoredPage(pageType, relativePath, content) {
   if (source === null) {
     return false;
   }
-  const normalised = relativePath.split(path68.sep).join("/").replace(/^wiki\//, "");
+  const normalised = relativePath.split(path69.sep).join("/").replace(/^wiki\//, "");
   return WIKI_PAGE_PRODUCERS.some((producer) => producer.source === source && producer.pageType === pageType && producer.path.test(normalised) && /^-[ \t]+Link:.*\bsha256\b/m.test(content));
 }
 function createGdWikiService() {
@@ -20709,8 +20709,8 @@ function createGdWikiService() {
   };
 }
 async function collectGraphWikiCandidates(cwd, generatedAt, limit, onlyModules) {
-  const nodesPath = path68.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path68.join(cwd, ".metaproject", "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path69.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path69.join(cwd, ".metaproject", "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return [];
   }
@@ -20894,7 +20894,7 @@ function topCounts(bucket, limit) {
   return [...bucket.entries()].sort((a, b) => b[1] - a[1]).slice(0, limit);
 }
 async function readModuleReadme(cwd, moduleName) {
-  const readmePath = path68.join(cwd, ...moduleName.split("/"), "README.md");
+  const readmePath = path69.join(cwd, ...moduleName.split("/"), "README.md");
   if (!await pathExists(readmePath)) {
     return null;
   }
@@ -20915,7 +20915,7 @@ async function extractModuleExports(cwd, files) {
   const declRe = /export\s+(?:async\s+)?(?:default\s+)?(?:const|let|var|function|class|type|interface|enum)\s+([A-Za-z_$][\w$]*)/g;
   const braceRe = /export\s*\{([^}]+)\}/g;
   for (const file of files.slice(0, 4)) {
-    const filePath = path68.join(cwd, ...file.split("/"));
+    const filePath = path69.join(cwd, ...file.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -20946,7 +20946,7 @@ async function extractModuleExports(cwd, files) {
 }
 async function extractModuleApi(cwd, files) {
   const names = await extractModuleExports(cwd, files);
-  const symbolsPath = path68.join(cwd, ".metaproject", "data", "gdgraph", "storage", "symbols.jsonl");
+  const symbolsPath = path69.join(cwd, ".metaproject", "data", "gdgraph", "storage", "symbols.jsonl");
   if (names.length === 0 || !await pathExists(symbolsPath)) {
     return names.map((name) => "`" + name + "`");
   }
@@ -20972,7 +20972,7 @@ async function extractModuleApi(cwd, files) {
   });
 }
 async function collectHealthWikiCandidates(cwd, generatedAt) {
-  const healthPath = path68.join(cwd, ".metaproject", "data", "health", "artifacts", "latest.json");
+  const healthPath = path69.join(cwd, ".metaproject", "data", "health", "artifacts", "latest.json");
   if (!await pathExists(healthPath)) {
     return [];
   }
@@ -21014,7 +21014,7 @@ async function collectHealthWikiCandidates(cwd, generatedAt) {
   }];
 }
 async function collectTestingWikiCandidates(cwd, generatedAt) {
-  const contextPath = path68.join(cwd, ".metaproject", "data", "testing", "context.md");
+  const contextPath = path69.join(cwd, ".metaproject", "data", "testing", "context.md");
   if (!await pathExists(contextPath)) {
     return [];
   }
@@ -21045,8 +21045,8 @@ async function writeCollectedPage(cwd, candidate, force) {
   if (!folder) {
     throw new Error(`Unsupported collected wiki type: ${candidate.type}`);
   }
-  const filePath = path68.join(wikiRootPath2(cwd), folder, `${candidate.slug}.md`);
-  const relativePath = path68.relative(cwd, filePath);
+  const filePath = path69.join(wikiRootPath2(cwd), folder, `${candidate.slug}.md`);
+  const relativePath = path69.relative(cwd, filePath);
   const exists = await pathExists(filePath);
   if (exists && !force) {
     return { path: relativePath, type: candidate.type, source: candidate.source, action: "skipped" };
@@ -21074,7 +21074,7 @@ async function writeCollectedPage(cwd, candidate, force) {
       securityReason: output.reason
     };
   }
-  await mkdir18(path68.dirname(filePath), { recursive: true });
+  await mkdir18(path69.dirname(filePath), { recursive: true });
   await writeFile12(filePath, output.content, "utf8");
   return {
     path: relativePath,
@@ -21086,7 +21086,7 @@ async function writeCollectedPage(cwd, candidate, force) {
 async function wikiPagesForFile(cwd, targetRepoPath) {
   const pages = await collectPages(cwd);
   const refs = await Promise.all(pages.map(async (page) => ({
-    repoPath: path68.relative(cwd, page.absolutePath).split(path68.sep).join("/"),
+    repoPath: path69.relative(cwd, page.absolutePath).split(path69.sep).join("/"),
     content: await readFile34(page.absolutePath, "utf8")
   })));
   return backlinksFor(buildBacklinkIndex(refs), targetRepoPath);
@@ -21125,7 +21125,7 @@ function renderIndexBody(pages, generatedAt) {
 `).trimEnd();
 }
 async function isIndexStale(cwd, pages) {
-  const indexPath = path68.join(wikiRootPath2(cwd), "index.md");
+  const indexPath = path69.join(wikiRootPath2(cwd), "index.md");
   if (!await pathExists(indexPath)) {
     return true;
   }
@@ -21143,7 +21143,7 @@ async function walkMarkdown(root) {
   const results = [];
   const entries = await readdir12(root, { withFileTypes: true });
   for (const entry of entries) {
-    const absolutePath = path68.join(root, entry.name);
+    const absolutePath = path69.join(root, entry.name);
     if (entry.isDirectory()) {
       results.push(...await walkMarkdown(absolutePath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -21200,7 +21200,7 @@ ${JSON.stringify(state, null, 2)}
 `;
 }
 async function readIndexGeneratedAt(cwd) {
-  const indexPath = path68.join(wikiRootPath2(cwd), "index.md");
+  const indexPath = path69.join(wikiRootPath2(cwd), "index.md");
   if (!await pathExists(indexPath)) {
     return null;
   }
@@ -21437,7 +21437,7 @@ async function validateStructure(cwd, pages, issues) {
       if (pattern.includes("*")) {
         continue;
       }
-      if (!await pathExists(path68.join(cwd, pattern))) {
+      if (!await pathExists(path69.join(cwd, pattern))) {
         issues.push({
           page: page.relativePath,
           kind: "describes",
@@ -21508,9 +21508,9 @@ var init_service4 = __esm(() => {
 // src/gdgraph/wiki-layer.ts
 import { createHash as createHash15 } from "crypto";
 import { mkdir as mkdir19, stat as stat10, writeFile as writeFile13 } from "fs/promises";
-import path69 from "path";
+import path70 from "path";
 function storageDir(projectRoot) {
-  return path69.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  return path70.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
 }
 function wikiPageId(relativePath) {
   return `wiki:${relativePath}`;
@@ -21576,11 +21576,11 @@ async function enrichBuildWithWikiLayer(input) {
   const mtimes = new Map;
   for (const record of input.fileRecords) {
     try {
-      const info = await stat10(path69.join(input.projectRoot, record.path));
+      const info = await stat10(path70.join(input.projectRoot, record.path));
       mtimes.set(record.path, info.mtimeMs);
     } catch {}
   }
-  await writeFile13(path69.join(dir, BUILD_MANIFEST_FILE), `${JSON.stringify({ version: 1, files: computeFingerprints(input.fileRecords, mtimes) }, null, 2)}
+  await writeFile13(path70.join(dir, BUILD_MANIFEST_FILE), `${JSON.stringify({ version: 1, files: computeFingerprints(input.fileRecords, mtimes) }, null, 2)}
 `, "utf8");
   const validModules = input.validModules !== undefined ? input.validModules : await (input.loadValidModules ?? defaultLoadValidModules)(input.projectRoot);
   const wikiPages = await collectPages(input.projectRoot);
@@ -21605,8 +21605,8 @@ async function enrichBuildWithWikiLayer(input) {
       version: page.version
     }))
   });
-  await writeJsonl(path69.join(dir, WIKI_PAGES_FILE), layer.pages);
-  await writeJsonl(path69.join(dir, DESCRIBES_FILE), layer.describes);
+  await writeJsonl(path70.join(dir, WIKI_PAGES_FILE), layer.pages);
+  await writeJsonl(path70.join(dir, DESCRIBES_FILE), layer.describes);
   return layer;
 }
 async function defaultLoadValidModules(projectRoot) {
@@ -21671,11 +21671,13 @@ __export(exports_service2, {
   statusLabel: () => statusLabel,
   stripVerifyMarker: () => stripVerifyMarker,
   summarizeVerdicts: () => summarizeVerdicts,
+  uncommittedFlowStateNote: () => uncommittedFlowStateNote,
+  uncommittedFlowStateNotes: () => uncommittedFlowStateNotes,
   validateCriterionName: () => validateCriterionName,
   writeAcCheckCache: () => writeAcCheckCache
 });
 import { mkdir as mkdir11, readFile as readFile24 } from "fs/promises";
-import path50 from "path";
+import path51 from "path";
 
 // src/flow/machine.ts
 var TRANSITIONS = {
@@ -23994,6 +23996,108 @@ async function readRequireConfirmationDefault(cwd) {
     return false;
   }
 }
+// src/flow/uncommitted-state.ts
+import path15 from "path";
+var UNCOMMITTED_LIST_CAP = 5;
+var READ_ONLY_GIT_FLAGS = ["--no-optional-locks"];
+var GIT_TIMEOUT_MS = 5000;
+var spawnGit = async (cwd, args) => {
+  const proc = Bun.spawn(["git", ...args], {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    timeout: GIT_TIMEOUT_MS
+  });
+  const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+  return { code: proc.signalCode === null ? code : -1, out };
+};
+var FLOW_PATH = /(?:^|\/)\.metaproject\/flows\/([^/]+)\/(.+)$/;
+function groupByFlowDir(listing, porcelain) {
+  const groups = new Map;
+  for (const line of listing.split(`
+`)) {
+    let file = porcelain ? line.length < 4 ? "" : line.slice(3) : line;
+    const renamed = porcelain ? file.indexOf(" -> ") : -1;
+    if (renamed !== -1)
+      file = file.slice(renamed + 4);
+    file = file.replace(/^"|"$/g, "");
+    const match = FLOW_PATH.exec(file);
+    if (match === null)
+      continue;
+    const [, dir, inside] = match;
+    if (dir === undefined || inside === undefined)
+      continue;
+    const list = groups.get(dir);
+    if (list === undefined)
+      groups.set(dir, [inside]);
+    else
+      list.push(inside);
+  }
+  return groups;
+}
+function noteFor(flowId, dir, listings) {
+  if ((listings.tracked.get(dir) ?? []).length === 0)
+    return null;
+  const seen = new Set;
+  for (const inside of listings.status.get(dir) ?? []) {
+    const slash = inside.indexOf("/");
+    seen.add(slash === -1 ? inside : `${inside.slice(0, slash)}/`);
+  }
+  const entries = [...seen];
+  if (entries.length === 0)
+    return null;
+  const shown = entries.slice(0, UNCOMMITTED_LIST_CAP);
+  const more = entries.length - shown.length;
+  const list = `${shown.join(", ")}${more > 0 ? `, +${more} more` : ""}`;
+  return `flow ${flowId} has uncommitted changes in .metaproject/flows/${dir}: ${list} \u2014 ` + "a common cause is the closing state `flow complete` writes after the merge; commit it (nothing gates on this)";
+}
+async function readGit(cwd, scope, git) {
+  const tracked = await git(cwd, [...READ_ONLY_GIT_FLAGS, "ls-files", "--", scope]);
+  if (tracked.code !== 0)
+    return null;
+  const empty = { tracked: new Map, status: new Map };
+  if (tracked.out.trim().length === 0)
+    return empty;
+  const status = await git(cwd, [
+    ...READ_ONLY_GIT_FLAGS,
+    "-c",
+    "core.quotepath=off",
+    "status",
+    "--porcelain",
+    "--untracked-files=all",
+    "--",
+    scope
+  ]);
+  if (status.code !== 0)
+    return null;
+  return { tracked: groupByFlowDir(tracked.out, false), status: groupByFlowDir(status.out, true) };
+}
+async function uncommittedFlowStateNote(cwd, flowId, dir, git = spawnGit) {
+  try {
+    const read = await readGit(cwd, path15.join(flowsRoot(cwd), dir), git);
+    return read === null ? null : noteFor(flowId, dir, read);
+  } catch {
+    return null;
+  }
+}
+async function uncommittedFlowStateNotes(cwd, flows, git = spawnGit) {
+  const notes = new Map;
+  if (flows.length === 0)
+    return notes;
+  try {
+    const read = await readGit(cwd, flowsRoot(cwd), git);
+    if (read === null)
+      return notes;
+    for (const flow of flows) {
+      const text = noteFor(flow.id, flow.dir, read);
+      if (text !== null)
+        notes.set(flow.dir, text);
+    }
+  } catch {
+    return new Map;
+  }
+  return notes;
+}
 // src/flow/ac-kinds.ts
 var AC_KINDS = ["exec", "invariant", "judged", "none", "unclassified"];
 var AC_LINE = /^\s*[-*]\s*(AC\d+)\s*:\s?(.*)$/i;
@@ -24151,7 +24255,7 @@ function readAcKindRecords(value) {
 }
 // src/flow/description-intent.ts
 import { readFile as readFile10 } from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 var OUTCOME_HINT = 'State an outcome criterion: what you would look at afterwards to see this helped, as a bullet. Or write "- not measured \u2014 <reason>".';
 var PLACEHOLDERS = ["Describe the problem precisely", "What must be true when this flow is done"];
 var FLOW_STATEMENT_HEADINGS = [/^problem$/i, /^expected outcome$/i];
@@ -24238,7 +24342,7 @@ function initIntentNote(description) {
 }
 async function intentNoteForNewFlow(cwd, dir) {
   try {
-    return initIntentNote(await readFile10(path15.join(cwd, dir, "description.md"), "utf8"));
+    return initIntentNote(await readFile10(path16.join(cwd, dir, "description.md"), "utf8"));
   } catch {
     return null;
   }
@@ -24246,7 +24350,7 @@ async function intentNoteForNewFlow(cwd, dir) {
 // src/flow/check-ac.ts
 import { createHash as createHash8 } from "crypto";
 import { chmod as chmod4, mkdir as mkdir9, readFile as readFile22 } from "fs/promises";
-import path47 from "path";
+import path48 from "path";
 
 // src/review/cost.ts
 function estimateTokens(text) {
@@ -24434,7 +24538,7 @@ function factsOnlyVerdict(item) {
 }
 async function readAcCheckEnabled(cwd) {
   try {
-    const parsed = JSON.parse(await readFile22(path47.join(cwd, REVIEW_GATE_CONFIG_PATH), "utf8"));
+    const parsed = JSON.parse(await readFile22(path48.join(cwd, REVIEW_GATE_CONFIG_PATH), "utf8"));
     if (typeof parsed !== "object" || parsed === null)
       return false;
     const review = parsed["review"];
@@ -24455,7 +24559,7 @@ function acCheckCacheKey(criteriaChecksum, diffText) {
   return `${criteriaChecksum}:${hashDiff(diffText)}`;
 }
 function acCheckCachePath(cwd, flowDir) {
-  return path47.join(cwd, ".metaproject", "data", "ac-check", `${flowDir}.json`);
+  return path48.join(cwd, ".metaproject", "data", "ac-check", `${flowDir}.json`);
 }
 async function readAcCheckCache(cachePath) {
   if (!await pathExists(cachePath))
@@ -24467,7 +24571,7 @@ async function readAcCheckCache(cachePath) {
   }
 }
 async function writeAcCheckCache(cachePath, record) {
-  await mkdir9(path47.dirname(cachePath), { recursive: true });
+  await mkdir9(path48.dirname(cachePath), { recursive: true });
   await writeFileAtomic(cachePath, `${JSON.stringify(record, null, 2)}
 `, { mode: 384 });
   if (process.platform !== "win32") {
@@ -24525,10 +24629,10 @@ function renderAcCheckAdvisoryNotice(verdicts) {
 }
 // src/flow/allocation.ts
 import { appendFile as appendFile3, mkdir as mkdir10, readFile as readFile23 } from "fs/promises";
-import path49 from "path";
+import path50 from "path";
 
 // src/lib/clone-scope.ts
-import path48 from "path";
+import path49 from "path";
 async function gitCommonDir(cwd) {
   try {
     const proc = Bun.spawn(["git", "rev-parse", "--git-common-dir"], {
@@ -24540,7 +24644,7 @@ async function gitCommonDir(cwd) {
     if (await proc.exited !== 0 || output.length === 0) {
       return null;
     }
-    return path48.isAbsolute(output) ? output : path48.resolve(cwd, output);
+    return path49.isAbsolute(output) ? output : path49.resolve(cwd, output);
   } catch {
     return null;
   }
@@ -24565,23 +24669,23 @@ function projectKey(toplevel, cwd) {
   if (!toplevel) {
     return "root";
   }
-  const relative = path49.relative(toplevel, cwd);
+  const relative = path50.relative(toplevel, cwd);
   return relative === "" ? "root" : slugify(relative);
 }
 async function resolveAllocationScope(cwd) {
   const commonDir = await gitCommonDir(cwd);
   if (!commonDir) {
     return {
-      lockPath: path49.join(flowsRoot(cwd), ".flow-init.lock"),
+      lockPath: path50.join(flowsRoot(cwd), ".flow-init.lock"),
       ledgerPath: null,
       project: "root"
     };
   }
   const key = projectKey(await gitToplevel(cwd), cwd);
-  const dir = path49.join(commonDir, "keryx", "flow-ids");
+  const dir = path50.join(commonDir, "keryx", "flow-ids");
   return {
-    lockPath: path49.join(dir, `${key}.lock`),
-    ledgerPath: path49.join(dir, `${key}.jsonl`),
+    lockPath: path50.join(dir, `${key}.lock`),
+    ledgerPath: path50.join(dir, `${key}.jsonl`),
     project: key
   };
 }
@@ -24614,7 +24718,7 @@ async function recordAllocation(scope, record) {
   if (!scope.ledgerPath) {
     return;
   }
-  await mkdir10(path49.dirname(scope.ledgerPath), { recursive: true });
+  await mkdir10(path50.dirname(scope.ledgerPath), { recursive: true });
   await appendFile3(scope.ledgerPath, `${JSON.stringify(record)}
 `, "utf8");
 }
@@ -24808,7 +24912,7 @@ function createFlowService(deps) {
         const date = now().slice(0, 10);
         const slug = slugify(input.slug ?? title);
         const dir = `${id}-${date}-${slug}`;
-        const absolute = path50.join(flowsRoot(input.cwd), dir);
+        const absolute = path51.join(flowsRoot(input.cwd), dir);
         if (await pathExists(absolute)) {
           throw new Error(`Flow directory already exists: ${dir}`);
         }
@@ -24841,15 +24945,15 @@ function createFlowService(deps) {
           history: [{ at: createdAt, event: "created" }]
         };
         const sourceLabel = input.issue ?? "user description";
-        await writeFileAtomic(path50.join(absolute, "description.md"), renderDescription(title, sourceLabel));
-        await writeFileAtomic(path50.join(absolute, "context.md"), context.markdown);
-        await writeFileAtomic(path50.join(absolute, "plan.md"), renderPlan());
-        await writeFileAtomic(path50.join(absolute, "tasks.md"), renderTasksDoc());
-        await writeFileAtomic(path50.join(absolute, "acceptance-criteria.md"), renderAcceptanceCriteria());
-        await writeFileAtomic(path50.join(absolute, "journal.md"), renderJournal(createdAt));
+        await writeFileAtomic(path51.join(absolute, "description.md"), renderDescription(title, sourceLabel));
+        await writeFileAtomic(path51.join(absolute, "context.md"), context.markdown);
+        await writeFileAtomic(path51.join(absolute, "plan.md"), renderPlan());
+        await writeFileAtomic(path51.join(absolute, "tasks.md"), renderTasksDoc());
+        await writeFileAtomic(path51.join(absolute, "acceptance-criteria.md"), renderAcceptanceCriteria());
+        await writeFileAtomic(path51.join(absolute, "journal.md"), renderJournal(createdAt));
         await writeFlow(input.cwd, dir, flow);
         await recordAllocation(scope, { id, dir, at: createdAt, project: scope.project });
-        return { flow, dir: path50.relative(input.cwd, absolute), contextNotes: context.notes };
+        return { flow, dir: path51.relative(input.cwd, absolute), contextNotes: context.notes };
       });
     },
     async list({ cwd }) {
@@ -25433,7 +25537,7 @@ function createFlowService(deps) {
           issues.push({ flow: dir, kind: "schema", message: `unknown schemaVersion ${flow.schemaVersion}` });
         }
         try {
-          const raw = JSON.parse(await Bun.file(path50.join(flowsRoot(cwd), dir, "flow.json")).text());
+          const raw = JSON.parse(await Bun.file(path51.join(flowsRoot(cwd), dir, "flow.json")).text());
           const validation = validateAgainstSchemaObject(flowStateSchema(), raw);
           if (!validation.valid) {
             issues.push({
@@ -25444,7 +25548,7 @@ function createFlowService(deps) {
           }
         } catch {}
         for (const file of ["description.md", "context.md", "plan.md", "tasks.md", "acceptance-criteria.md", "journal.md"]) {
-          if (!await pathExists(path50.join(flowsRoot(cwd), dir, file))) {
+          if (!await pathExists(path51.join(flowsRoot(cwd), dir, file))) {
             issues.push({ flow: dir, kind: "structure", message: `missing ${file}` });
           }
         }
@@ -25483,7 +25587,7 @@ function createFlowService(deps) {
   };
 }
 async function appendIdMap(cwd, entry) {
-  const file = path50.join(flowsRoot(cwd), "id-map.json");
+  const file = path51.join(flowsRoot(cwd), "id-map.json");
   let entries = [];
   if (await pathExists(file)) {
     const raw = await readFile24(file, "utf8");
@@ -25494,7 +25598,7 @@ async function appendIdMap(cwd, entry) {
       }
       entries = parsed;
     } catch (error) {
-      throw new Error(`Cannot read ${path50.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`);
+      throw new Error(`Cannot read ${path51.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
   entries.push(entry);
@@ -25747,7 +25851,7 @@ __export(exports_service5, {
 // src/gdgraph/build.ts
 import { mkdir as mkdir20, readdir as readdir13, readFile as readFile35, writeFile as writeFile14 } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
-import path70 from "path";
+import path71 from "path";
 
 // src/gdgraph/types.ts
 var UNKNOWN_IMPORT_KIND = "unknown-static";
@@ -25812,7 +25916,7 @@ async function buildGraph(projectRoot) {
   const assetNodes = new Map;
   const fileRecords = [];
   for (const file of files) {
-    const absolutePath = path70.join(projectRoot, file);
+    const absolutePath = path71.join(projectRoot, file);
     const content = await readFile35(absolutePath, "utf8");
     fileRecords.push({ path: file, content });
     const language = getLanguage(file);
@@ -25865,24 +25969,24 @@ async function collectSourceFiles(projectRoot) {
   const result = [];
   const skippedDirectories = [];
   async function walk(relativeDir) {
-    const absoluteDir = path70.join(projectRoot, relativeDir);
+    const absoluteDir = path71.join(projectRoot, relativeDir);
     const entries = await readdir13(absoluteDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (IGNORE_DIRS.has(entry.name)) {
-          skippedDirectories.push(normalizePath2(path70.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
+          skippedDirectories.push(normalizePath2(path71.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
           continue;
         }
-        await walk(normalizePath2(path70.posix.join(relativeDir, entry.name)));
+        await walk(normalizePath2(path71.posix.join(relativeDir, entry.name)));
         continue;
       }
       if (!entry.isFile()) {
         continue;
       }
-      if (!SOURCE_EXTENSIONS.includes(path70.extname(entry.name))) {
+      if (!SOURCE_EXTENSIONS.includes(path71.extname(entry.name))) {
         continue;
       }
-      result.push(normalizePath2(path70.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
+      result.push(normalizePath2(path71.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
     }
   }
   await walk(".");
@@ -25964,8 +26068,8 @@ function resolveImport(projectRoot, fromFile, specifier, fileSet, resolver) {
 }
 function resolveAssetImport(projectRoot, fromFile, specifier, resolver) {
   for (const candidate of importCandidateBases(projectRoot, fromFile, specifier, resolver)) {
-    const extension = path70.posix.extname(candidate);
-    if (ASSET_EXTENSIONS.includes(extension) && existsSync6(path70.join(projectRoot, candidate))) {
+    const extension = path71.posix.extname(candidate);
+    if (ASSET_EXTENSIONS.includes(extension) && existsSync6(path71.join(projectRoot, candidate))) {
       return candidate;
     }
   }
@@ -25974,17 +26078,17 @@ function resolveAssetImport(projectRoot, fromFile, specifier, resolver) {
 function importCandidateBases(projectRoot, fromFile, specifier, resolver) {
   const normalizedSpecifier = stripImportSuffix(specifier);
   if (normalizedSpecifier.startsWith(".") && getLanguage(fromFile) !== "python") {
-    const fromDir = path70.posix.dirname(fromFile);
-    return [normalizePath2(path70.posix.normalize(path70.posix.join(fromDir, normalizedSpecifier)))];
+    const fromDir = path71.posix.dirname(fromFile);
+    return [normalizePath2(path71.posix.normalize(path71.posix.join(fromDir, normalizedSpecifier)))];
   }
-  return resolver.candidateBases(normalizedSpecifier, fromFile).map((candidate) => normalizePath2(path70.relative(projectRoot, path70.join(projectRoot, candidate))));
+  return resolver.candidateBases(normalizedSpecifier, fromFile).map((candidate) => normalizePath2(path71.relative(projectRoot, path71.join(projectRoot, candidate))));
 }
 function resolveSourceCandidate(base, fileSet) {
   const candidates = [
     base,
     ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => `${base}${extension}`),
-    ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => path70.posix.join(base, `index${extension}`)),
-    path70.posix.join(base, "__init__.py")
+    ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => path71.posix.join(base, `index${extension}`)),
+    path71.posix.join(base, "__init__.py")
   ];
   return candidates.find((candidate) => fileSet.has(candidate)) ?? null;
 }
@@ -26014,7 +26118,7 @@ async function loadJavaResolver(projectRoot) {
   return createJavaResolver(roots);
 }
 async function discoverJavaSourceRoots(projectRoot) {
-  const pomPath = path70.join(projectRoot, "pom.xml");
+  const pomPath = path71.join(projectRoot, "pom.xml");
   if (existsSync6(pomPath)) {
     try {
       const roots = parseMavenSourceRoots(await readFile35(pomPath, "utf8"));
@@ -26024,7 +26128,7 @@ async function discoverJavaSourceRoots(projectRoot) {
     } catch {}
   }
   for (const gradleName of ["build.gradle", "build.gradle.kts"]) {
-    const gradlePath = path70.join(projectRoot, gradleName);
+    const gradlePath = path71.join(projectRoot, gradleName);
     if (existsSync6(gradlePath)) {
       try {
         const roots = parseGradleSourceRoots(await readFile35(gradlePath, "utf8"));
@@ -26046,12 +26150,12 @@ function createJavaResolver(sourceRoots) {
         return [];
       }
       const relative = specifier.split(".").join("/");
-      return sourceRoots.map((root) => normalizePath2(path70.posix.join(root, relative)));
+      return sourceRoots.map((root) => normalizePath2(path71.posix.join(root, relative)));
     }
   };
 }
 function loadPythonResolver(projectRoot) {
-  const hasSrc = existsSync6(path70.join(projectRoot, "src"));
+  const hasSrc = existsSync6(path71.join(projectRoot, "src"));
   return createPythonResolver(hasSrc);
 }
 function createPythonResolver(hasSrc) {
@@ -26064,16 +26168,16 @@ function createPythonResolver(hasSrc) {
       if (specifier.startsWith(".")) {
         const dots = /^\.+/.exec(specifier)?.[0].length ?? 0;
         const rest = specifier.slice(dots);
-        let baseDir = path70.posix.dirname(fromFile);
+        let baseDir = path71.posix.dirname(fromFile);
         for (let level = 1;level < dots; level += 1) {
-          baseDir = path70.posix.dirname(baseDir);
+          baseDir = path71.posix.dirname(baseDir);
         }
         const suffix = rest ? rest.split(".").join("/") : "";
-        const base = suffix ? path70.posix.join(baseDir, suffix) : baseDir;
+        const base = suffix ? path71.posix.join(baseDir, suffix) : baseDir;
         return [normalizePath2(base)];
       }
       const relative = specifier.split(".").join("/");
-      return roots.map((root) => normalizePath2(root ? path70.posix.join(root, relative) : relative));
+      return roots.map((root) => normalizePath2(root ? path71.posix.join(root, relative) : relative));
     }
   };
 }
@@ -26082,8 +26186,8 @@ function parseMavenSourceRoots(pomXml) {
   for (const match of pomXml.matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
     const moduleDir = match[1]?.trim();
     if (moduleDir && !moduleDir.includes("${")) {
-      roots.add(normalizePath2(path70.posix.join(moduleDir, "src/main/java")));
-      roots.add(normalizePath2(path70.posix.join(moduleDir, "src/test/java")));
+      roots.add(normalizePath2(path71.posix.join(moduleDir, "src/main/java")));
+      roots.add(normalizePath2(path71.posix.join(moduleDir, "src/test/java")));
     }
   }
   for (const tag of ["sourceDirectory", "testSourceDirectory"]) {
@@ -26116,7 +26220,7 @@ function parseGradleSourceRoots(buildGradle) {
 var TSCONFIG_EXTENDS_MAX_DEPTH = 10;
 async function loadTsconfigResolver(projectRoot) {
   const empty = createTsconfigResolver(null, []);
-  const tsconfigPath = path70.join(projectRoot, "tsconfig.json");
+  const tsconfigPath = path71.join(projectRoot, "tsconfig.json");
   if (!existsSync6(tsconfigPath)) {
     return empty;
   }
@@ -26129,7 +26233,7 @@ async function loadTsconfigResolver(projectRoot) {
   return createTsconfigResolver(resolved.baseUrl, paths);
 }
 function toProjectRelativeDir(projectRoot, absoluteDir) {
-  const relative = normalizePath2(path70.relative(projectRoot, absoluteDir)).replace(/^\.\//, "");
+  const relative = normalizePath2(path71.relative(projectRoot, absoluteDir)).replace(/^\.\//, "");
   return relative === "." ? "" : relative;
 }
 async function readTsconfigJson(configPath) {
@@ -26144,11 +26248,11 @@ function resolveTsconfigExtendsPath(configDir, extendsSpecifier) {
   if (!extendsSpecifier.startsWith(".") && !extendsSpecifier.startsWith("/")) {
     return null;
   }
-  const resolved = path70.resolve(configDir, extendsSpecifier);
+  const resolved = path71.resolve(configDir, extendsSpecifier);
   return resolved.endsWith(".json") ? resolved : `${resolved}.json`;
 }
 async function resolveTsconfigOptions(configPath, visited, depth, projectRoot) {
-  const resolvedPath = path70.resolve(configPath);
+  const resolvedPath = path71.resolve(configPath);
   if (depth > TSCONFIG_EXTENDS_MAX_DEPTH || visited.has(resolvedPath)) {
     return null;
   }
@@ -26159,15 +26263,15 @@ async function resolveTsconfigOptions(configPath, visited, depth, projectRoot) {
   }
   let inherited = null;
   if (typeof parsed.extends === "string") {
-    const basePath = resolveTsconfigExtendsPath(path70.dirname(resolvedPath), parsed.extends);
+    const basePath = resolveTsconfigExtendsPath(path71.dirname(resolvedPath), parsed.extends);
     if (basePath) {
       inherited = await resolveTsconfigOptions(basePath, visited, depth + 1, projectRoot);
     }
   }
-  const configDir = path70.dirname(resolvedPath);
+  const configDir = path71.dirname(resolvedPath);
   const declaringDir = toProjectRelativeDir(projectRoot, configDir);
   const options = parsed.compilerOptions ?? {};
-  const ownBaseUrl = typeof options.baseUrl === "string" ? toProjectRelativeDir(projectRoot, path70.resolve(configDir, options.baseUrl)) : null;
+  const ownBaseUrl = typeof options.baseUrl === "string" ? toProjectRelativeDir(projectRoot, path71.resolve(configDir, options.baseUrl)) : null;
   const baseUrl = ownBaseUrl ?? inherited?.baseUrl ?? null;
   const ownPaths = isRecord2(options.paths) ? Object.entries(options.paths).filter((entry) => Array.isArray(entry[1])).map(([pattern, targets]) => ({
     pattern,
@@ -26196,7 +26300,7 @@ function createTsconfigResolver(baseUrl, mappings) {
         }
       }
       if (baseUrl !== null) {
-        candidates.push(normalizePath2(path70.posix.join(baseUrl, normalizedSpecifier)));
+        candidates.push(normalizePath2(path71.posix.join(baseUrl, normalizedSpecifier)));
       }
       return [...new Set(candidates.map((candidate) => candidate.replace(/^\.\//, "")))];
     }
@@ -26216,7 +26320,7 @@ function matchPathPattern(pattern, specifier) {
 }
 function applyPathTarget(base, target, wildcard) {
   const replaced = target.includes("*") ? target.replace("*", wildcard) : target;
-  return normalizePath2(path70.posix.normalize(path70.posix.join(base, replaced)));
+  return normalizePath2(path71.posix.normalize(path71.posix.join(base, replaced)));
 }
 function stripJsonComments(source) {
   let out = "";
@@ -26269,21 +26373,21 @@ function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function writeGraph(projectRoot, graph) {
-  const storageDir = path70.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
-  const artifactsDir = path70.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
+  const storageDir = path71.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  const artifactsDir = path71.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
   await mkdir20(storageDir, { recursive: true });
   await mkdir20(artifactsDir, { recursive: true });
-  await writeFile14(path70.join(storageDir, "nodes.jsonl"), graph.nodes.map((node) => JSON.stringify(node)).join(`
+  await writeFile14(path71.join(storageDir, "nodes.jsonl"), graph.nodes.map((node) => JSON.stringify(node)).join(`
 `) + `
 `, "utf8");
-  await writeFile14(path70.join(storageDir, "edges.jsonl"), graph.edges.map((edge) => JSON.stringify(edge)).join(`
+  await writeFile14(path71.join(storageDir, "edges.jsonl"), graph.edges.map((edge) => JSON.stringify(edge)).join(`
 `) + `
 `, "utf8");
-  await writeFile14(path70.join(artifactsDir, "module-map.json"), JSON.stringify(buildModuleMap(graph), null, 2) + `
+  await writeFile14(path71.join(artifactsDir, "module-map.json"), JSON.stringify(buildModuleMap(graph), null, 2) + `
 `, "utf8");
 }
 async function writeSummary(projectRoot, graph, collection) {
-  const artifactsDir = path70.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
+  const artifactsDir = path71.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
   await mkdir20(artifactsDir, { recursive: true });
   const unresolved = graph.edges.filter((edge) => edge.kind === "unresolved");
   const imports = graph.edges.filter((edge) => edge.kind === "imports");
@@ -26298,7 +26402,7 @@ async function writeSummary(projectRoot, graph, collection) {
 `);
   const skippedList = collection.skippedDirectories.length > 0 ? collection.skippedDirectories.slice(0, 30).map((dir) => `- \`${dir}\``).join(`
 `) : "- none";
-  const summaryPath = path70.join(artifactsDir, "summary.md");
+  const summaryPath = path71.join(artifactsDir, "summary.md");
   const content = `# gdgraph Summary
 
 ## Stats
@@ -26379,7 +26483,7 @@ function groupBy(items, getKey) {
 }
 function unresolvedType(specifier) {
   const stripped = stripImportSuffix(specifier);
-  const extension = path70.posix.extname(stripped);
+  const extension = path71.posix.extname(stripped);
   if (extension) {
     return extension;
   }
@@ -26389,13 +26493,13 @@ function unresolvedType(specifier) {
   return "package";
 }
 function normalizePath2(value) {
-  return value.split(path70.sep).join("/");
+  return value.split(path71.sep).join("/");
 }
 
 // src/gdgraph/target.ts
-import path71 from "path";
+import path72 from "path";
 function normalizeTarget(target) {
-  return target.replace(/^\.\//, "").split(path71.sep).join("/");
+  return target.replace(/^\.\//, "").split(path72.sep).join("/");
 }
 function resolveGraphTarget(graph, target) {
   const normalized = normalizeTarget(target);
@@ -26488,15 +26592,15 @@ init_config3();
 
 // src/gdgraph/query.ts
 import { readFile as readFile36 } from "fs/promises";
-import path72 from "path";
+import path73 from "path";
 async function loadGraph(projectRoot) {
-  const storageDir = path72.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
-  const nodes = await readJsonl(path72.join(storageDir, "nodes.jsonl"));
-  const edges = await readJsonl(path72.join(storageDir, "edges.jsonl"));
-  const symbols = await readJsonl(path72.join(storageDir, "symbols.jsonl"));
-  const calls = await readJsonl(path72.join(storageDir, "calls.jsonl"));
-  const wikiPages = await readJsonl(path72.join(storageDir, "wiki-pages.jsonl"));
-  const describes = await readJsonl(path72.join(storageDir, "describes.jsonl"));
+  const storageDir = path73.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  const nodes = await readJsonl(path73.join(storageDir, "nodes.jsonl"));
+  const edges = await readJsonl(path73.join(storageDir, "edges.jsonl"));
+  const symbols = await readJsonl(path73.join(storageDir, "symbols.jsonl"));
+  const calls = await readJsonl(path73.join(storageDir, "calls.jsonl"));
+  const wikiPages = await readJsonl(path73.join(storageDir, "wiki-pages.jsonl"));
+  const describes = await readJsonl(path73.join(storageDir, "describes.jsonl"));
   const graph = { nodes, edges };
   if (symbols.length > 0) {
     graph.symbols = symbols;
@@ -26556,7 +26660,7 @@ async function bunfigPreloadRoots(projectRoot) {
   const roots = new Set;
   let text;
   try {
-    text = await readFile36(path72.join(projectRoot, "bunfig.toml"), "utf8");
+    text = await readFile36(path73.join(projectRoot, "bunfig.toml"), "utf8");
   } catch {
     return roots;
   }
@@ -26570,8 +26674,8 @@ async function bunfigPreloadRoots(projectRoot) {
       if (raw.length === 0) {
         continue;
       }
-      const absolute = path72.resolve(projectRoot, raw);
-      const relative = path72.relative(projectRoot, absolute).split(path72.sep).join("/");
+      const absolute = path73.resolve(projectRoot, raw);
+      const relative = path73.relative(projectRoot, absolute).split(path73.sep).join("/");
       roots.add(relative);
     }
   }
@@ -26644,7 +26748,7 @@ function canonicalCycle(cycle) {
 
 // src/gdgraph/repomap.ts
 import { mkdir as mkdir21, writeFile as writeFile15 } from "fs/promises";
-import path73 from "path";
+import path74 from "path";
 
 // src/gdgraph/pagerank.ts
 function personalizedPageRank(nodes, edges, options) {
@@ -26755,7 +26859,7 @@ function overflowContent(required, missing, budget) {
 `);
 }
 function repomapArtifactPath(cwd) {
-  return path73.join(cwd, ".metaproject", "data", "gdgraph", "artifacts", "repomap.md");
+  return path74.join(cwd, ".metaproject", "data", "gdgraph", "artifacts", "repomap.md");
 }
 function buildRankEdges(graph, config) {
   const edges = [];
@@ -26900,7 +27004,7 @@ function computeRepomap(graph, config, options = {}) {
 async function writeRepomap(cwd, graph, config, options = {}) {
   const result = computeRepomap(graph, config, options);
   const artifactPath = repomapArtifactPath(cwd);
-  await mkdir21(path73.dirname(artifactPath), { recursive: true });
+  await mkdir21(path74.dirname(artifactPath), { recursive: true });
   await writeFile15(artifactPath, result.content, "utf8");
   return { ...result, path: artifactPath };
 }
@@ -26983,12 +27087,12 @@ init_section_tombstone();
 // src/forgetting/journal.ts
 init_fs();
 import { appendFile as appendFile4, mkdir as mkdir22, readFile as readFile37, stat as stat11 } from "fs/promises";
-import path74 from "path";
+import path75 from "path";
 function forgettingDataDir(cwd) {
-  return path74.join(cwd, ".metaproject", "data", "forgetting");
+  return path75.join(cwd, ".metaproject", "data", "forgetting");
 }
 function deletionJournalPath(cwd) {
-  return path74.join(forgettingDataDir(cwd), "journal.jsonl");
+  return path75.join(forgettingDataDir(cwd), "journal.jsonl");
 }
 async function readDeletionJournal(cwd) {
   const file = deletionJournalPath(cwd);
@@ -27407,12 +27511,12 @@ __export(exports_service7, {
   gateExitCode: () => gateExitCode,
   readWikiFreshnessMetric: () => readWikiFreshnessMetric
 });
-import path94 from "path";
+import path95 from "path";
 
 // src/health/config.ts
 init_fs();
 init_json();
-import path75 from "path";
+import path76 from "path";
 var DEFAULT_HEALTH_CONFIG = {
   schemaVersion: 2,
   ignore: {
@@ -27468,7 +27572,7 @@ var DEFAULT_HEALTH_CONFIG = {
   }
 };
 function configPath2(cwd) {
-  return path75.join(cwd, ".metaproject", "health.config.json");
+  return path76.join(cwd, ".metaproject", "health.config.json");
 }
 var STRICTEST_GATE = {
   failOnPriorities: ["P0", "P1", "P2", "P3"],
@@ -27519,7 +27623,7 @@ async function loadHealthConfig(cwd) {
 // src/health/run.ts
 init_fs();
 import { mkdir as mkdir26, writeFile as writeFile19 } from "fs/promises";
-import path93 from "path";
+import path94 from "path";
 
 // src/metrics/provenance.ts
 async function collectGitProvenance(cwd) {
@@ -27619,12 +27723,12 @@ function computeGate2(input) {
 }
 
 // src/health/scopes.ts
-import path78 from "path";
+import path79 from "path";
 
 // src/health/util.ts
 init_fs();
 import { mkdir as mkdir23, readFile as readFile38, readdir as readdir14, writeFile as writeFile16 } from "fs/promises";
-import path76 from "path";
+import path77 from "path";
 var IGNORED_DIRS = new Set([
   "node_modules",
   ".git",
@@ -27668,14 +27772,14 @@ async function toolVersion(command, cwd) {
   }
 }
 function dataRoot3(cwd) {
-  return path76.join(cwd, ".metaproject", "data", "health");
+  return path77.join(cwd, ".metaproject", "data", "health");
 }
 async function writeRaw(cwd, source, content, stamp) {
-  const dir = path76.join(dataRoot3(cwd), "raw", source);
+  const dir = path77.join(dataRoot3(cwd), "raw", source);
   await mkdir23(dir, { recursive: true });
-  const file = path76.join(dir, `${stamp}.log`);
+  const file = path77.join(dir, `${stamp}.log`);
   await writeFile16(file, content, "utf8");
-  return path76.relative(cwd, file);
+  return path77.relative(cwd, file);
 }
 async function listSourceFiles(cwd, ignorePaths = []) {
   const { files } = await listSourceFilesWithReasons(cwd, ignorePaths);
@@ -27695,7 +27799,7 @@ async function walk2(root, dir, out, incompleteReasons) {
   try {
     entries = await readdir14(dir, { withFileTypes: true });
   } catch (error) {
-    incompleteReasons.push(`${path76.relative(root, dir) || "."}: ${error instanceof Error ? error.message : String(error)}`);
+    incompleteReasons.push(`${path77.relative(root, dir) || "."}: ${error instanceof Error ? error.message : String(error)}`);
     return;
   }
   for (const entry of entries) {
@@ -27703,14 +27807,14 @@ async function walk2(root, dir, out, incompleteReasons) {
       if (entry.isDirectory() && !IGNORED_DIRS.has(entry.name)) {}
       continue;
     }
-    const abs = path76.join(dir, entry.name);
+    const abs = path77.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) {
         continue;
       }
       await walk2(root, abs, out, incompleteReasons);
-    } else if (entry.isFile() && SOURCE_EXT.has(path76.extname(entry.name))) {
-      out.push(path76.relative(root, abs));
+    } else if (entry.isFile() && SOURCE_EXT.has(path77.extname(entry.name))) {
+      out.push(path77.relative(root, abs));
     }
   }
 }
@@ -27725,7 +27829,7 @@ function moduleOfFile(file) {
   return null;
 }
 function isSourceFile(file) {
-  return SOURCE_EXT.has(path76.extname(file));
+  return SOURCE_EXT.has(path77.extname(file));
 }
 function matchesAnyPattern(file, patterns) {
   const normalized = file.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -27825,7 +27929,7 @@ function rankHotspots(files, churn, sourceAnalysis) {
 // src/health/source-analysis.ts
 init_fs();
 import { readFile as readFile39 } from "fs/promises";
-import path77 from "path";
+import path78 from "path";
 
 // src/health/metrics/complexity.ts
 var CONTROL_KEYWORDS = new Set([
@@ -28059,7 +28163,7 @@ async function analyzeSourceFiles(cwd, sourceFiles) {
   return new Map(entries.filter((entry) => entry !== null));
 }
 async function analyzeSourceFile(cwd, file) {
-  const abs = path77.join(cwd, file);
+  const abs = path78.join(cwd, file);
   if (!await pathExists(abs)) {
     return null;
   }
@@ -28132,14 +28236,14 @@ async function computeMetrics(input) {
   }
   const components = new Map;
   for (const file of sourceFiles) {
-    const dir = path78.posix.dirname(file);
+    const dir = path79.posix.dirname(file);
     if (dir === "." || dir === moduleOfFile(file)) {
       continue;
     }
     components.set(dir, [...components.get(dir) ?? [], file]);
   }
   for (const [name, files] of [...components.entries()].sort()) {
-    const compFindings = findings.filter((f) => f.file && path78.posix.dirname(f.file) === name);
+    const compFindings = findings.filter((f) => f.file && path79.posix.dirname(f.file) === name);
     scopes.push(build("component", `component:${name}`, name, files, compFindings, averageCoverage(files, coverage)));
   }
   const findingFiles = findings.map((f) => f.file).filter((f) => Boolean(f));
@@ -28184,9 +28288,9 @@ function tally2(values) {
 // src/health/baseline.ts
 init_fs();
 import { mkdir as mkdir24, readFile as readFile40, writeFile as writeFile17 } from "fs/promises";
-import path79 from "path";
+import path80 from "path";
 function baselinePath(cwd) {
-  return path79.join(cwd, ".metaproject", "health", "baselines", "scores.json");
+  return path80.join(cwd, ".metaproject", "health", "baselines", "scores.json");
 }
 async function loadBaseline(cwd) {
   const file = baselinePath(cwd);
@@ -28218,7 +28322,7 @@ async function writeBaseline(cwd, metrics, generatedAt, selector) {
     scopes[key] = value;
   }
   const file = baselinePath(cwd);
-  await mkdir24(path79.dirname(file), { recursive: true });
+  await mkdir24(path80.dirname(file), { recursive: true });
   await writeFile17(file, `${JSON.stringify({ generatedAt, scopes }, null, 2)}
 `, "utf8");
   return updated;
@@ -28272,10 +28376,10 @@ async function getChurn(cwd, windowDays) {
 
 // src/health/metrics/wiki-freshness.ts
 import { readFile as readFile41, stat as stat12 } from "fs/promises";
-import path80 from "path";
+import path81 from "path";
 var DEFAULT_STALE_EVIDENCE_DAYS = 7;
 function freshnessReportPath(cwd) {
-  return path80.join(cwd, ".metaproject", "data", "wiki", "freshness", "latest.json");
+  return path81.join(cwd, ".metaproject", "data", "wiki", "freshness", "latest.json");
 }
 async function readWikiFreshnessMetric(cwd, options = {}) {
   const file = freshnessReportPath(cwd);
@@ -28296,7 +28400,7 @@ async function readWikiFreshnessMetric(cwd, options = {}) {
   } catch {
     return {
       status: "unreadable-report",
-      reason: `${path80.relative(cwd, file)} is not valid JSON; re-run \`keryx wiki freshness\`.`
+      reason: `${path81.relative(cwd, file)} is not valid JSON; re-run \`keryx wiki freshness\`.`
     };
   }
   const report = parsed;
@@ -28306,7 +28410,7 @@ async function readWikiFreshnessMetric(cwd, options = {}) {
   if (pagesTotal === null || pagesFresh === null) {
     return {
       status: "unreadable-report",
-      reason: `${path80.relative(cwd, file)} is missing its totals; re-run \`keryx wiki freshness\`.`
+      reason: `${path81.relative(cwd, file)} is missing its totals; re-run \`keryx wiki freshness\`.`
     };
   }
   const pagesUndecidable = numberOr2(totals.pagesUndecidable) ?? 0;
@@ -28360,12 +28464,12 @@ function renderWikiFreshnessLine(metric) {
 }
 
 // src/health/sources/helpers.ts
-import path81 from "path";
+import path82 from "path";
 import { existsSync as existsSync7 } from "fs";
 class NoImportError extends Error {
 }
 function resolveBin(cwd, name) {
-  const local = path81.join(cwd, "node_modules", ".bin", name);
+  const local = path82.join(cwd, "node_modules", ".bin", name);
   if (existsSync7(local)) {
     return local;
   }
@@ -28446,13 +28550,13 @@ async function getComplexityFindings(cwd, sourceFiles, config, sourceAnalysis) {
 
 // src/health/metrics/coverage.ts
 import { existsSync as existsSync8 } from "fs";
-import path82 from "path";
+import path83 from "path";
 var SUMMARY_PATHS = [
   "coverage/coverage-summary.json",
   "coverage/coverage-final.json"
 ];
 async function getCoverage(cwd) {
-  const summary = SUMMARY_PATHS.map((rel) => path82.join(cwd, rel)).find((abs) => existsSync8(abs));
+  const summary = SUMMARY_PATHS.map((rel) => path83.join(cwd, rel)).find((abs) => existsSync8(abs));
   if (!summary) {
     return { status: "missing", total: null, byFile: new Map };
   }
@@ -28473,7 +28577,7 @@ async function getCoverage(cwd) {
       total = pct;
       continue;
     }
-    const relative = path82.isAbsolute(key) ? path82.relative(cwd, key) : key;
+    const relative = path83.isAbsolute(key) ? path83.relative(cwd, key) : key;
     byFile.set(relative.replace(/\\/g, "/"), pct);
   }
   return { status: "available", total, byFile };
@@ -28606,10 +28710,10 @@ function renderWikiFreshness(metric) {
 // src/health/skills.ts
 init_fs();
 import { readFile as readFile42 } from "fs/promises";
-import path83 from "path";
+import path84 from "path";
 var EMPTY = { skills: [], skillForFile: () => null };
 async function loadSkillOwnership(cwd) {
-  const manifestPath = path83.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path84.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return EMPTY;
   }
@@ -28647,7 +28751,7 @@ function normalize(value) {
 
 // src/health/sources/eslint.ts
 import { existsSync as existsSync9 } from "fs";
-import path84 from "path";
+import path85 from "path";
 var CONFIG_FILES = [
   ".eslintrc",
   ".eslintrc.js",
@@ -28661,7 +28765,7 @@ var CONFIG_FILES = [
   "eslint.config.ts"
 ];
 function hasConfig(cwd) {
-  return CONFIG_FILES.some((file) => existsSync9(path84.join(cwd, file)));
+  return CONFIG_FILES.some((file) => existsSync9(path85.join(cwd, file)));
 }
 var eslintAdapter = {
   id: "eslint",
@@ -28686,7 +28790,7 @@ var eslintAdapter = {
     };
   },
   async import(ctx) {
-    const report = path84.join(ctx.cwd, "eslint-report.json");
+    const report = path85.join(ctx.cwd, "eslint-report.json");
     if (!existsSync9(report)) {
       throw new NoImportError("no eslint-report.json");
     }
@@ -28713,7 +28817,7 @@ var eslintAdapter = {
     }
     const findings = [];
     for (const file of data) {
-      const relative = path84.isAbsolute(file.filePath) ? path84.relative(ctx.cwd, file.filePath) : file.filePath;
+      const relative = path85.isAbsolute(file.filePath) ? path85.relative(ctx.cwd, file.filePath) : file.filePath;
       for (const message of file.messages ?? []) {
         const isError = message.severity === 2;
         findings.push(makeFinding({
@@ -28745,9 +28849,9 @@ var eslintAdapter = {
 
 // src/health/sources/typescript.ts
 import { existsSync as existsSync10 } from "fs";
-import path85 from "path";
+import path86 from "path";
 function hasTsconfig(cwd) {
-  return existsSync10(path85.join(cwd, "tsconfig.json"));
+  return existsSync10(path86.join(cwd, "tsconfig.json"));
 }
 var typescriptAdapter = {
   id: "typescript",
@@ -28823,7 +28927,7 @@ __export(exports_service6, {
 });
 import { existsSync as existsSync11 } from "fs";
 import { readFile as readFile45, readdir as readdir15 } from "fs/promises";
-import path90 from "path";
+import path91 from "path";
 
 // src/lib/git-env.ts
 var GIT_DISCOVERY_OVERRIDE_VARS = [
@@ -28848,7 +28952,7 @@ function withoutGitDiscoveryOverrides(env) {
 init_fs();
 init_guard();
 import { readFile as readFile43 } from "fs/promises";
-import path86 from "path";
+import path87 from "path";
 
 // src/metrics/record.ts
 var RELIABILITIES = new Set(["exact", "estimated", "unknown"]);
@@ -28863,7 +28967,7 @@ var RETRY_TYPES = new Set([
 
 // src/metrics/lifecycle.ts
 async function readArtifactPointer(root, expected) {
-  const pointerFile = path86.join(root, "latest.json");
+  const pointerFile = path87.join(root, "latest.json");
   if (!await pathExists(pointerFile))
     return { status: "missing", pointer: null };
   let pointer;
@@ -28872,7 +28976,7 @@ async function readArtifactPointer(root, expected) {
   } catch {
     return { status: "stale", pointer: null, reason: "latest pointer is invalid JSON" };
   }
-  const recordFile = pointer.record ? path86.join(root, pointer.record) : null;
+  const recordFile = pointer.record ? path87.join(root, pointer.record) : null;
   if (!recordFile || !isPathInside(root, recordFile) || !await pathExists(recordFile)) {
     return { status: "stale", pointer, reason: "pointer record is missing" };
   }
@@ -28888,9 +28992,9 @@ init_guard();
 // src/testing/capability.ts
 init_fs();
 init_json();
-import path87 from "path";
+import path88 from "path";
 async function isTestingCapabilityEnabled(cwd, capability) {
-  const manifestPath = path87.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path88.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return false;
   }
@@ -28916,10 +29020,10 @@ async function isTestingCapabilityEnabled(cwd, capability) {
 init_fs();
 init_guard();
 import { readFile as readFile44, mkdir as mkdir25, writeFile as writeFile18 } from "fs/promises";
-import path88 from "path";
+import path89 from "path";
 var COVERAGE_MAP_SCHEMA_VERSION = 1;
 function coverageMapPath(cwd, cfg) {
-  return path88.isAbsolute(cfg.coverageMap.artifact) ? cfg.coverageMap.artifact : path88.join(cwd, cfg.coverageMap.artifact);
+  return path89.isAbsolute(cfg.coverageMap.artifact) ? cfg.coverageMap.artifact : path89.join(cwd, cfg.coverageMap.artifact);
 }
 async function loadCoverageMap(cwd, cfg) {
   const file = coverageMapPath(cwd, cfg);
@@ -28993,20 +29097,20 @@ function normalizePath4(file) {
 }
 
 // src/testing/selection.ts
-import path89 from "path";
+import path90 from "path";
 var TEST_FILE_RE = /(^|\/)(__tests__\/.*|.*\.(test|spec)\.[cm]?[tj]sx?$|e2e\/.*\.[cm]?[tj]sx?$|tests\/.*\.[cm]?[tj]sx?$)/;
 function normalizePath5(file) {
   return file.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function relatedByNamingAndDirectory(target, testFiles) {
   const normalized = normalizePath5(target);
-  const ext = path89.extname(normalized);
+  const ext = path90.extname(normalized);
   const withoutExt = ext ? normalized.slice(0, -ext.length) : normalized;
-  const base = path89.basename(withoutExt);
-  const dir = path89.dirname(normalized);
+  const base = path90.basename(withoutExt);
+  const dir = path90.dirname(normalized);
   return testFiles.filter((file) => {
-    const fileDir = path89.dirname(file);
-    const fileBase = path89.basename(file);
+    const fileDir = path90.dirname(file);
+    const fileBase = path90.basename(file);
     return file.startsWith(`${withoutExt}.`) || file.includes(`${withoutExt}.`) || fileDir === dir && fileBase.startsWith(`${base}.`) || fileDir.startsWith(dir) && fileBase.includes(base);
   }).sort();
 }
@@ -29136,7 +29240,7 @@ var DEFAULT_TESTING_CONFIG = {
   }
 };
 function testingDataRoot(cwd) {
-  return path90.join(cwd, ".metaproject", "data", "testing");
+  return path91.join(cwd, ".metaproject", "data", "testing");
 }
 async function computeTestingContext(cwd) {
   const { files, incompleteReasons } = await listProjectFiles(cwd);
@@ -29311,7 +29415,7 @@ async function runTesting(input) {
   return runResult;
 }
 async function loadTestingContext(cwd) {
-  const file = path90.join(testingDataRoot(cwd), "context.json");
+  const file = path91.join(testingDataRoot(cwd), "context.json");
   if (!await pathExists(file)) {
     return null;
   }
@@ -29322,18 +29426,18 @@ async function loadTestingContext(cwd) {
   }
 }
 async function loadTestingReport(cwd) {
-  const file = path90.join(testingDataRoot(cwd), "artifacts", "latest.json");
+  const file = path91.join(testingDataRoot(cwd), "artifacts", "latest.json");
   if (!await pathExists(file)) {
     return null;
   }
   try {
     const latest = JSON.parse(await readFile45(file, "utf8"));
     if (typeof latest.record === "string") {
-      const pointer = await readArtifactPointer(path90.join(testingDataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
+      const pointer = await readArtifactPointer(path91.join(testingDataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
       if (pointer.status !== "fresh")
         return null;
-      const recordFile = path90.join(testingDataRoot(cwd), "artifacts", latest.record);
-      if (!isPathInside(path90.join(testingDataRoot(cwd), "artifacts"), recordFile))
+      const recordFile = path91.join(testingDataRoot(cwd), "artifacts", latest.record);
+      if (!isPathInside(path91.join(testingDataRoot(cwd), "artifacts"), recordFile))
         return null;
       if (!await pathExists(recordFile))
         return null;
@@ -29380,28 +29484,28 @@ async function ensureContext(cwd) {
 }
 async function writeContext(cwd, context) {
   const root = testingDataRoot(cwd);
-  const rel = (p) => path90.relative(cwd, p);
+  const rel = (p) => path91.relative(cwd, p);
   await mkdirContained(cwd, rel(root));
-  await writeContained(cwd, rel(path90.join(root, "context.json")), `${JSON.stringify(context, null, 2)}
+  await writeContained(cwd, rel(path91.join(root, "context.json")), `${JSON.stringify(context, null, 2)}
 `);
-  await writeContained(cwd, rel(path90.join(root, "context.md")), renderContextMarkdown(context));
-  await writeContained(cwd, rel(path90.join(root, "recommendations.md")), renderRecommendationsMarkdown(context));
+  await writeContained(cwd, rel(path91.join(root, "context.md")), renderContextMarkdown(context));
+  await writeContained(cwd, rel(path91.join(root, "recommendations.md")), renderRecommendationsMarkdown(context));
 }
 async function writeReport(cwd, report) {
   const root = testingDataRoot(cwd);
-  const artifacts = path90.join(root, "artifacts");
-  const history = path90.join(root, "history");
-  const rel = (p) => path90.relative(cwd, p);
+  const artifacts = path91.join(root, "artifacts");
+  const history = path91.join(root, "history");
+  const rel = (p) => path91.relative(cwd, p);
   await mkdirContained(cwd, rel(artifacts));
   await mkdirContained(cwd, rel(history));
   const stamp = report.generatedAt.replace(/[:.]/g, "-");
-  const json = path90.join(artifacts, "latest.json");
-  const markdown = path90.join(artifacts, "latest.md");
+  const json = path91.join(artifacts, "latest.json");
+  const markdown = path91.join(artifacts, "latest.md");
   const serialized = `${JSON.stringify(report, null, 2)}
 `;
   if (report.runId) {
-    const runJson = path90.join(artifacts, "runs", `${report.runId}.json`);
-    const runMarkdown = path90.join(artifacts, "runs", `${report.runId}.md`);
+    const runJson = path91.join(artifacts, "runs", `${report.runId}.json`);
+    const runMarkdown = path91.join(artifacts, "runs", `${report.runId}.md`);
     if (await pathExists(runJson))
       throw new Error(`immutable testing run already exists: ${report.runId}`);
     await writeContained(cwd, rel(runJson), serialized);
@@ -29412,26 +29516,26 @@ async function writeReport(cwd, report) {
       branch: report.provenance?.branch ?? null,
       worktree: report.provenance?.worktree ?? null,
       generated_at: report.generatedAt,
-      record: path90.posix.join("runs", `${report.runId}.json`)
+      record: path91.posix.join("runs", `${report.runId}.json`)
     }, null, 2)}
 `);
   } else {
     await writeContained(cwd, rel(json), serialized);
   }
   await writeContained(cwd, rel(markdown), renderReportMarkdown3(report));
-  await writeContained(cwd, rel(path90.join(history, `${stamp}.json`)), serialized);
+  await writeContained(cwd, rel(path91.join(history, `${stamp}.json`)), serialized);
   return {
-    markdownPath: path90.relative(cwd, markdown),
-    jsonPath: path90.relative(cwd, json)
+    markdownPath: path91.relative(cwd, markdown),
+    jsonPath: path91.relative(cwd, json)
   };
 }
 async function writeRawLog(cwd, raw) {
-  const logs = path90.join(testingDataRoot(cwd), "logs");
-  const rel = (p) => path90.relative(cwd, p);
+  const logs = path91.join(testingDataRoot(cwd), "logs");
+  const rel = (p) => path91.relative(cwd, p);
   await mkdirContained(cwd, rel(logs));
-  const latest = path90.join(logs, "latest.raw.log");
+  const latest = path91.join(logs, "latest.raw.log");
   await writeContained(cwd, rel(latest), raw);
-  return path90.relative(cwd, latest);
+  return path91.relative(cwd, latest);
 }
 async function listProjectFiles(cwd) {
   const out = [];
@@ -29444,11 +29548,11 @@ async function walk3(root, dir, out, incompleteReasons) {
   try {
     entries = await readdir15(dir, { withFileTypes: true });
   } catch (error) {
-    incompleteReasons.push(`${normalizePath6(path90.relative(root, dir)) || "."}: ${error instanceof Error ? error.message : String(error)}`);
+    incompleteReasons.push(`${normalizePath6(path91.relative(root, dir)) || "."}: ${error instanceof Error ? error.message : String(error)}`);
     return;
   }
   for (const entry of entries) {
-    const abs = path90.join(dir, entry.name);
+    const abs = path91.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (IGNORED_DIRS2.has(entry.name) || entry.name.startsWith(".tmp-")) {
         continue;
@@ -29457,12 +29561,12 @@ async function walk3(root, dir, out, incompleteReasons) {
       continue;
     }
     if (entry.isFile()) {
-      out.push(normalizePath6(path90.relative(root, abs)));
+      out.push(normalizePath6(path91.relative(root, abs)));
     }
   }
 }
 async function readPackageJson(cwd) {
-  const file = path90.join(cwd, "package.json");
+  const file = path91.join(cwd, "package.json");
   if (!await pathExists(file)) {
     return null;
   }
@@ -29473,7 +29577,7 @@ async function readPackageJson(cwd) {
   }
 }
 async function loadTestingConfig(cwd) {
-  const file = path90.join(cwd, ".metaproject", "testing.config.json");
+  const file = path91.join(cwd, ".metaproject", "testing.config.json");
   if (!await pathExists(file)) {
     return DEFAULT_TESTING_CONFIG;
   }
@@ -29538,7 +29642,7 @@ function detectFrameworks(input) {
 async function extractConventions(cwd, files) {
   const conventions = new Set;
   for (const file of files.slice(0, 40)) {
-    const abs = path90.join(cwd, file);
+    const abs = path91.join(cwd, file);
     if (!await pathExists(abs)) {
       continue;
     }
@@ -29668,7 +29772,7 @@ async function findTestsByImportedTargets(cwd, targets, testFiles) {
   const targetKeys = new Set(targets.map((target) => modulePathKey(normalizePath6(target))));
   const selected = new Set;
   for (const testFile of testFiles) {
-    const absoluteTest = path90.join(cwd, testFile);
+    const absoluteTest = path91.join(cwd, testFile);
     if (!await pathExists(absoluteTest)) {
       continue;
     }
@@ -29702,10 +29806,10 @@ function resolveImportPath(cwd, testFile, importPath) {
   if (!importPath.startsWith(".")) {
     return null;
   }
-  const importerDir = path90.dirname(testFile);
-  const absoluteResolved = path90.resolve(path90.join(cwd, importerDir), importPath);
-  const relative = path90.relative(cwd, absoluteResolved);
-  if (relative.startsWith(`..${path90.sep}`) || relative === "..") {
+  const importerDir = path91.dirname(testFile);
+  const absoluteResolved = path91.resolve(path91.join(cwd, importerDir), importPath);
+  const relative = path91.relative(cwd, absoluteResolved);
+  if (relative.startsWith(`..${path91.sep}`) || relative === "..") {
     return null;
   }
   const relativeNormalized = normalizePath6(relative);
@@ -29757,13 +29861,13 @@ function resolveTestCommand(cwd, context, input) {
 }
 var BUN_LOCKFILES = ["bun.lock", "bun.lockb"];
 function detectPackageManager(cwd) {
-  if (resolveBunBin() && BUN_LOCKFILES.some((name) => pathExistsSync(path90.join(cwd, name)))) {
+  if (resolveBunBin() && BUN_LOCKFILES.some((name) => pathExistsSync(path91.join(cwd, name)))) {
     return "bun";
   }
-  if (Bun.which("pnpm") && pathExistsSync(path90.join(cwd, "pnpm-lock.yaml"))) {
+  if (Bun.which("pnpm") && pathExistsSync(path91.join(cwd, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (Bun.which("yarn") && pathExistsSync(path90.join(cwd, "yarn.lock"))) {
+  if (Bun.which("yarn") && pathExistsSync(path91.join(cwd, "yarn.lock"))) {
     return "yarn";
   }
   return "npm";
@@ -30103,7 +30207,7 @@ async function compatibleReportForHealth(ctx) {
 
 // src/health/sources/dependency-audit.ts
 import { existsSync as existsSync12 } from "fs";
-import path91 from "path";
+import path92 from "path";
 function auditSeverityToPriority(severity) {
   if (severity === "critical" || severity === "high")
     return "P0";
@@ -30222,7 +30326,7 @@ var LOCKFILE_COMMANDS = [
 ];
 function auditCommand(cwd) {
   for (const entry of LOCKFILE_COMMANDS) {
-    if (!entry.lockfiles.some((name) => existsSync12(path91.join(cwd, name))))
+    if (!entry.lockfiles.some((name) => existsSync12(path92.join(cwd, name))))
       continue;
     const bin = resolveBin(cwd, entry.bin);
     if (bin)
@@ -30281,13 +30385,13 @@ var dependencyAuditAdapter = {
 
 // src/health/sources/sonarqube.ts
 import { existsSync as existsSync13 } from "fs";
-import path92 from "path";
+import path93 from "path";
 var REPORT_FILES = ["sonar-issues.json", ".metaproject/data/health/sonar-issues.json"];
 function reportPath(cwd) {
   const fromEnv = process.env.SONAR_ISSUES_FILE;
   const candidates = fromEnv ? [fromEnv, ...REPORT_FILES] : REPORT_FILES;
   for (const rel of candidates) {
-    const abs = path92.isAbsolute(rel) ? rel : path92.join(cwd, rel);
+    const abs = path93.isAbsolute(rel) ? rel : path93.join(cwd, rel);
     if (existsSync13(abs)) {
       return abs;
     }
@@ -30371,7 +30475,7 @@ var sonarqubeAdapter = {
 function relativizeComponent(component, cwd) {
   const colon = component.indexOf(":");
   const value = colon >= 0 ? component.slice(colon + 1) : component;
-  return path92.isAbsolute(value) ? path92.relative(cwd, value) : value;
+  return path93.isAbsolute(value) ? path93.relative(cwd, value) : value;
 }
 
 // src/health/sources/index.ts
@@ -30708,19 +30812,19 @@ function filteredInfo(source, cfg) {
   };
 }
 async function writeOutputs(cwd, report, config, stamp) {
-  const artifacts = path93.join(dataRoot3(cwd), "artifacts");
-  const history = path93.join(dataRoot3(cwd), "history");
+  const artifacts = path94.join(dataRoot3(cwd), "artifacts");
+  const history = path94.join(dataRoot3(cwd), "history");
   await mkdir26(artifacts, { recursive: true });
   await mkdir26(history, { recursive: true });
-  const markdown = path93.join(artifacts, "latest.md");
-  const json = path93.join(artifacts, "latest.json");
-  const historyJson = path93.join(history, `${stamp}.json`);
+  const markdown = path94.join(artifacts, "latest.md");
+  const json = path94.join(artifacts, "latest.json");
+  const historyJson = path94.join(history, `${stamp}.json`);
   const serialized = `${JSON.stringify(report, null, 2)}
 `;
   await writeFile19(markdown, renderReportMarkdown2(report, config), "utf8");
   if (report.runId) {
-    const runJson = path93.join(artifacts, "runs", `${report.runId}.json`);
-    const runMarkdown = path93.join(artifacts, "runs", `${report.runId}.md`);
+    const runJson = path94.join(artifacts, "runs", `${report.runId}.json`);
+    const runMarkdown = path94.join(artifacts, "runs", `${report.runId}.md`);
     if (await pathExists(runJson))
       throw new Error(`immutable health run already exists: ${report.runId}`);
     await writeFileAtomic(runJson, serialized);
@@ -30731,7 +30835,7 @@ async function writeOutputs(cwd, report, config, stamp) {
       branch: report.provenance?.branch ?? null,
       worktree: report.provenance?.worktree ?? null,
       generated_at: report.generatedAt,
-      record: path93.posix.join("runs", `${report.runId}.json`)
+      record: path94.posix.join("runs", `${report.runId}.json`)
     }, null, 2)}
 `);
   } else {
@@ -30739,8 +30843,8 @@ async function writeOutputs(cwd, report, config, stamp) {
   }
   await writeFile19(historyJson, serialized, "utf8");
   return {
-    markdownPath: path93.relative(cwd, markdown),
-    jsonPath: path93.relative(cwd, json)
+    markdownPath: path94.relative(cwd, markdown),
+    jsonPath: path94.relative(cwd, json)
   };
 }
 async function resolveChanged(cwd, selector) {
@@ -30793,7 +30897,7 @@ function hasGateShape(value) {
   return Array.isArray(report.metrics) && Array.isArray(report.sources) && Array.isArray(report.findings);
 }
 async function readLatest(cwd) {
-  const file = path94.join(dataRoot3(cwd), "artifacts", "latest.json");
+  const file = path95.join(dataRoot3(cwd), "artifacts", "latest.json");
   if (!await pathExists(file)) {
     return null;
   }
@@ -30804,11 +30908,11 @@ async function readLatest(cwd) {
     const latest = read.value;
     const record = latest.record;
     if (typeof record === "string") {
-      const pointer = await readArtifactPointer(path94.join(dataRoot3(cwd), "artifacts"), await collectGitProvenance(cwd));
+      const pointer = await readArtifactPointer(path95.join(dataRoot3(cwd), "artifacts"), await collectGitProvenance(cwd));
       if (pointer.status !== "fresh")
         return null;
-      const recordFile = path94.join(dataRoot3(cwd), "artifacts", record);
-      if (!isPathInside(path94.join(dataRoot3(cwd), "artifacts"), recordFile))
+      const recordFile = path95.join(dataRoot3(cwd), "artifacts", record);
+      if (!isPathInside(path95.join(dataRoot3(cwd), "artifacts"), recordFile))
         return null;
       if (!await pathExists(recordFile))
         return null;
@@ -30881,7 +30985,7 @@ function createCodeHealthService() {
   return {
     run: (input) => runHealth(input),
     async status(input) {
-      const enabled = await pathExists(path94.join(input.cwd, ".metaproject", "health.config.json"));
+      const enabled = await pathExists(path95.join(input.cwd, ".metaproject", "health.config.json"));
       const latest = await readLatest(input.cwd);
       const project = latest?.metrics.find((m) => m.key === "project") ?? null;
       const decliningScopes = latest ? latest.metrics.filter((m) => m.regression_score > 0).length : 0;
@@ -31039,10 +31143,10 @@ function renderEvidenceBlock(evidences, siblings) {
 init_fs();
 init_contained_write();
 init_json();
-import path95 from "path";
+import path96 from "path";
 import { createHash as createHash16 } from "crypto";
 function impactEvidenceDataRoot(root) {
-  return path95.join(root, ".metaproject", "data", "security", "impact-evidence");
+  return path96.join(root, ".metaproject", "data", "security", "impact-evidence");
 }
 function sanitizeSessionId(sessionId) {
   const cleaned = sessionId.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -31054,7 +31158,7 @@ function sessionStateFilename(sessionId) {
   return `${sanitized}-${suffix}.json`;
 }
 function sessionStatePath(root, sessionId) {
-  return path95.join(impactEvidenceDataRoot(root), "sessions", sessionStateFilename(sessionId));
+  return path96.join(impactEvidenceDataRoot(root), "sessions", sessionStateFilename(sessionId));
 }
 async function loadSessionState(root, sessionId) {
   const file = sessionStatePath(root, sessionId);
@@ -31073,11 +31177,11 @@ async function loadSessionState(root, sessionId) {
 }
 async function saveSessionState(root, sessionId, state) {
   const file = sessionStatePath(root, sessionId);
-  await writeContained(root, path95.relative(root, file), `${JSON.stringify(state, null, 2)}
+  await writeContained(root, path96.relative(root, file), `${JSON.stringify(state, null, 2)}
 `);
 }
 function logPath(root) {
-  return path95.join(impactEvidenceDataRoot(root), "log.jsonl");
+  return path96.join(impactEvidenceDataRoot(root), "log.jsonl");
 }
 async function appendLogRecord(root, record) {
   const full = {
@@ -31088,7 +31192,7 @@ async function appendLogRecord(root, record) {
     ...record.detail !== undefined ? { detail: record.detail } : {}
   };
   const file = logPath(root);
-  await appendContained(root, path95.relative(root, file), `${JSON.stringify(full)}
+  await appendContained(root, path96.relative(root, file), `${JSON.stringify(full)}
 `);
   return full;
 }
@@ -31115,7 +31219,7 @@ init_command_risk();
 init_shell_syntax();
 init_fs();
 init_service2();
-import path96 from "path";
+import path97 from "path";
 import { createHash as createHash17 } from "crypto";
 import { realpathSync as realpathSync2 } from "fs";
 function impactEvidenceHookClass(strict) {
@@ -31131,29 +31235,29 @@ function realpathNearestExisting(p) {
   for (;; ) {
     try {
       const real = realpathSync2(current);
-      return tail.length > 0 ? path96.join(real, ...tail) : real;
+      return tail.length > 0 ? path97.join(real, ...tail) : real;
     } catch {
-      const parent = path96.dirname(current);
+      const parent = path97.dirname(current);
       if (parent === current) {
-        return tail.length > 0 ? path96.join(current, ...tail) : current;
+        return tail.length > 0 ? path97.join(current, ...tail) : current;
       }
-      tail.unshift(path96.basename(current));
+      tail.unshift(path97.basename(current));
       current = parent;
     }
   }
 }
 function normalizeRequestFiles(root, files) {
-  const rootReal = realpathNearestExisting(path96.resolve(root));
+  const rootReal = realpathNearestExisting(path97.resolve(root));
   const normalized = [];
   const rejected = [];
   for (const file of files) {
-    const lexicalAbsolute = path96.isAbsolute(file) ? path96.resolve(file) : path96.resolve(rootReal, toPosix(file).replace(/^\.\//, ""));
+    const lexicalAbsolute = path97.isAbsolute(file) ? path97.resolve(file) : path97.resolve(rootReal, toPosix(file).replace(/^\.\//, ""));
     const effective = realpathNearestExisting(lexicalAbsolute);
     if (!isPathInside(rootReal, effective)) {
       rejected.push(file);
       continue;
     }
-    normalized.push(toPosix(path96.relative(rootReal, effective)));
+    normalized.push(toPosix(path97.relative(rootReal, effective)));
   }
   return { files: [...new Set(normalized)], rejected };
 }
@@ -31439,7 +31543,7 @@ __export(exports_service8, {
   createJobService: () => createJobService
 });
 import { copyFile, mkdir as mkdir28 } from "fs/promises";
-import path99 from "path";
+import path100 from "path";
 
 // src/job/types.ts
 var JOB_INTENTS = ["implement", "analyze", "review", "custom"];
@@ -31578,12 +31682,12 @@ function defaultPlan(intent) {
 // src/job/store.ts
 init_validator();
 import { appendFile as appendFile5, mkdir as mkdir27, readFile as readFile47, readdir as readdir16 } from "fs/promises";
-import path98 from "path";
+import path99 from "path";
 
 // src/gdskills/contracts.ts
 import { readFile as readFile46 } from "fs/promises";
 import { existsSync as existsSync14 } from "fs";
-import path97 from "path";
+import path98 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var CONTRACTS = [
   {
@@ -31706,10 +31810,10 @@ async function loadSchema(name) {
   return JSON.parse(raw);
 }
 function contractPath(contract) {
-  const here = path97.dirname(fileURLToPath2(import.meta.url));
+  const here = path98.dirname(fileURLToPath2(import.meta.url));
   if (contract.sourcePath) {
-    for (const root of [path97.join(here, "..", ".."), path97.join(here, ".."), here]) {
-      const candidate = path97.resolve(root, contract.sourcePath);
+    for (const root of [path98.join(here, "..", ".."), path98.join(here, ".."), here]) {
+      const candidate = path98.resolve(root, contract.sourcePath);
       if (existsSync14(candidate)) {
         return candidate;
       }
@@ -31719,7 +31823,7 @@ function contractPath(contract) {
   if (existsSync14(directPath)) {
     return directPath;
   }
-  const packagedSourcePath = path97.join(here, "..", "src", "gdskills", "contracts", contract.fileName);
+  const packagedSourcePath = path98.join(here, "..", "src", "gdskills", "contracts", contract.fileName);
   if (existsSync14(packagedSourcePath)) {
     return packagedSourcePath;
   }
@@ -31733,13 +31837,13 @@ var SCHEMA_ROOTS = [
 // src/job/store.ts
 init_fs();
 function jobsRoot(cwd) {
-  return path98.join(cwd, ".metaproject", "jobs");
+  return path99.join(cwd, ".metaproject", "jobs");
 }
 function jobDir(cwd, name) {
-  return path98.join(jobsRoot(cwd), name);
+  return path99.join(jobsRoot(cwd), name);
 }
 function jobStatePath(cwd, name) {
-  return path98.join(jobDir(cwd, name), "state.json");
+  return path99.join(jobDir(cwd, name), "state.json");
 }
 var JOB_NAME_PATTERN = /^[a-z0-9-]+$/;
 function assertJobName(name) {
@@ -31776,12 +31880,12 @@ async function writeJob(cwd, name, state) {
 `));
   }
   const file = jobStatePath(cwd, name);
-  await mkdir27(path98.dirname(file), { recursive: true });
+  await mkdir27(path99.dirname(file), { recursive: true });
   await writeFileAtomic(file, `${JSON.stringify(state, null, 2)}
 `);
 }
 async function appendJournal2(cwd, name, at, line) {
-  await appendFile5(path98.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
+  await appendFile5(path99.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
 `, "utf8");
 }
 function renderJournal2(name, at) {
@@ -31802,7 +31906,7 @@ function assertDocumentType(raw) {
   return raw;
 }
 function documentFileName(type, sourcePath) {
-  const extension = path98.extname(sourcePath) || ".md";
+  const extension = path99.extname(sourcePath) || ".md";
   return `${type}${extension}`;
 }
 
@@ -31810,7 +31914,7 @@ function documentFileName(type, sourcePath) {
 function createJobService(deps) {
   const now = () => deps.now().toISOString();
   function lockPath(cwd, name) {
-    return path99.join(jobsRoot(cwd), `.job-lock-${name}`);
+    return path100.join(jobsRoot(cwd), `.job-lock-${name}`);
   }
   async function mutate(cwd, name, run) {
     assertJobName(name);
@@ -31859,20 +31963,20 @@ function createJobService(deps) {
         },
         plan: { steps: defaultPlan(intent) },
         documentation: {
-          job_path: path99.join(".metaproject", "jobs", name),
+          job_path: path100.join(".metaproject", "jobs", name),
           documents_created: []
         },
         metrics: { steps: [] },
-        jobs_root: path99.join(".metaproject", "jobs"),
+        jobs_root: path100.join(".metaproject", "jobs"),
         updated_at: createdAt
       };
       const first = firstOpenStep(state.plan.steps);
       if (first) {
         state.plan.current_step = first.id;
       }
-      await writeFileAtomic(path99.join(absolute, "journal.md"), renderJournal2(name, createdAt));
+      await writeFileAtomic(path100.join(absolute, "journal.md"), renderJournal2(name, createdAt));
       await writeJob(input.cwd, name, state);
-      return { state, dir: path99.relative(input.cwd, absolute) };
+      return { state, dir: path100.relative(input.cwd, absolute) };
     },
     async status({ cwd, name }) {
       assertJobName(name);
@@ -31884,7 +31988,7 @@ function createJobService(deps) {
       }
       return {
         state,
-        dir: path99.join(".metaproject", "jobs", name),
+        dir: path100.join(".metaproject", "jobs", name),
         stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
         stepsTotal: state.plan.steps.length,
         nextStep: firstOpenStep(state.plan.steps),
@@ -31941,23 +32045,23 @@ function createJobService(deps) {
       if (!input.file) {
         throw new Error("Missing --file. Usage: keryx job document <name> --type <type> --file <path>");
       }
-      const source = path99.isAbsolute(input.file) ? input.file : path99.join(input.cwd, input.file);
+      const source = path100.isAbsolute(input.file) ? input.file : path100.join(input.cwd, input.file);
       if (!await pathExists(source)) {
         throw new Error(`--file not found: ${input.file}. Write the document first, then record it.`);
       }
       let recorded;
       await mutate(input.cwd, input.name, async (state) => {
         const fileName = documentFileName(type, source);
-        const target = path99.join(jobDir(input.cwd, state.job_name), fileName);
+        const target = path100.join(jobDir(input.cwd, state.job_name), fileName);
         await copyFile(source, target);
         state.documentation ??= {};
-        state.documentation.job_path ??= path99.join(".metaproject", "jobs", state.job_name);
+        state.documentation.job_path ??= path100.join(".metaproject", "jobs", state.job_name);
         const created = state.documentation.documents_created ?? [];
         state.documentation.documents_created = created.includes(fileName) ? created : [...created, fileName];
         recorded = {
           state,
           document: fileName,
-          path: path99.join(".metaproject", "jobs", state.job_name, fileName)
+          path: path100.join(".metaproject", "jobs", state.job_name, fileName)
         };
         return { state, event: "document", detail: `${type} -> ${fileName}` };
       });
@@ -31992,7 +32096,7 @@ function createJobService(deps) {
             name: state.job_name,
             phase: state.phase,
             intent: state.intent,
-            dir: path99.join(".metaproject", "jobs", name),
+            dir: path100.join(".metaproject", "jobs", name),
             stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
             stepsTotal: state.plan.steps.length,
             nextStep: firstOpenStep(state.plan.steps)?.id ?? null
@@ -32097,12 +32201,12 @@ function normalizeWorkspaceReference(raw) {
 // src/sac/fwk-service.ts
 init_assembly();
 import { appendFile as appendFile6, mkdir as mkdir30, open as open3, readFile as readFile50, rename as rename7, rm as rm6, stat as stat13, writeFile as writeFile20 } from "fs/promises";
-import path103 from "path";
+import path104 from "path";
 
 // src/sac/index.ts
 import { access as access3, readFile as readFile48, realpath as realpath10 } from "fs/promises";
 import { createHash as createHash18 } from "crypto";
-import path100 from "path";
+import path101 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var idPattern = /^[a-z][a-z0-9-]{2,63}$/;
 var subjectPattern = /^(?:user|team|service|agent):[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -32120,21 +32224,21 @@ var normativeSchemaFiles = {
   "review-decision": "review-decision.schema.json"
 };
 var normativeSchemas = new Map;
-var NORMATIVE_SCHEMA_DIR = path100.join("docs", "requirements", "shared-agent-context", "schemas");
+var NORMATIVE_SCHEMA_DIR = path101.join("docs", "requirements", "shared-agent-context", "schemas");
 async function resolveSacNormativeSchemaPath(fileName, searchFrom = [fileURLToPath3(new URL(".", import.meta.url)), process.cwd()]) {
   const seen = new Set;
   for (const start of searchFrom) {
-    let dir = path100.resolve(start);
+    let dir = path101.resolve(start);
     for (let i = 0;i < 10; i++) {
       if (seen.has(dir))
         break;
       seen.add(dir);
-      const candidate = path100.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
+      const candidate = path101.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
       try {
         await access3(candidate);
         return candidate;
       } catch {}
-      const parent = path100.dirname(dir);
+      const parent = path101.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -32803,12 +32907,12 @@ class SacReferenceError extends Error {
   code = "unsafe_workspace_reference";
 }
 async function resolveWorkspaceReference(input) {
-  if (!workspacePathPattern.test(input.uri) || path100.isAbsolute(input.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input.uri) || input.uri.includes("\\"))
+  if (!workspacePathPattern.test(input.uri) || path101.isAbsolute(input.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input.uri) || input.uri.includes("\\"))
     throw new SacReferenceError("unsafe workspace reference");
-  const lexicalRoot = path100.resolve(input.workspaceRoot);
+  const lexicalRoot = path101.resolve(input.workspaceRoot);
   const root = await realpath10(lexicalRoot);
-  const candidate = path100.resolve(lexicalRoot, input.uri.slice(2));
-  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path100.sep}`))
+  const candidate = path101.resolve(lexicalRoot, input.uri.slice(2));
+  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path101.sep}`))
     throw new SacReferenceError("workspace reference escapes root");
   let resolved;
   try {
@@ -32816,7 +32920,7 @@ async function resolveWorkspaceReference(input) {
   } catch {
     throw new SacReferenceError("workspace reference is not resolvable");
   }
-  if (resolved !== root && !resolved.startsWith(`${root}${path100.sep}`))
+  if (resolved !== root && !resolved.startsWith(`${root}${path101.sep}`))
     throw new SacReferenceError("workspace reference escapes root after realpath");
   return candidate;
 }
@@ -32872,16 +32976,16 @@ async function evaluateStrictSacGuard(input) {
 init_fs();
 import { mkdir as mkdir29, readdir as readdir17, readFile as readFile49 } from "fs/promises";
 import { createHash as createHash19, randomUUID as randomUUID3 } from "crypto";
-import path102 from "path";
+import path103 from "path";
 
 // src/sac/secure-resource-read.ts
 init_contained_read();
 init_descriptor_read();
-import path101 from "path";
+import path102 from "path";
 function readWorkspaceFileNoFollow(workspaceRoot, absolutePath) {
-  const relativePath = path101.relative(workspaceRoot, absolutePath);
-  const components = relativePath.split(path101.sep);
-  if (!relativePath || path101.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
+  const relativePath = path102.relative(workspaceRoot, absolutePath);
+  const components = relativePath.split(path102.sep);
+  if (!relativePath || path102.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
     throw new Error("safe source path is not workspace-relative");
   }
   return readDescriptorChain(workspaceRoot, absolutePath, {
@@ -32908,8 +33012,8 @@ class WorkspaceService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path102.resolve(options.workspaceRoot);
-    this.storageRoot = path102.resolve(options.storageRoot ?? path102.join(this.root, ".metaproject", "workspaces"));
+    this.root = path103.resolve(options.workspaceRoot);
+    this.storageRoot = path103.resolve(options.storageRoot ?? path103.join(this.root, ".metaproject", "workspaces"));
     this.now = options.now ?? (() => new Date);
   }
   async create(input) {
@@ -33234,13 +33338,13 @@ class WorkspaceService {
     return parsed;
   }
   workspaceDir(id) {
-    return path102.join(this.storageRoot, id);
+    return path103.join(this.storageRoot, id);
   }
   manifestPath(id) {
-    return path102.join(this.workspaceDir(id), "workspace.json");
+    return path103.join(this.workspaceDir(id), "workspace.json");
   }
   lockPath(id) {
-    return path102.join(this.storageRoot, `.${id}.lock`);
+    return path103.join(this.storageRoot, `.${id}.lock`);
   }
   timestamp() {
     return this.now().toISOString();
@@ -34029,7 +34133,7 @@ function hasReportIntegrity(report) {
   return reportHashPattern.test(reportDigest) && sha2564(body) === reportDigest;
 }
 async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
-  const configPath = path103.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path104.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile50(configPath, "utf8").catch((error) => {
@@ -34227,9 +34331,9 @@ class FwkReadService {
     const recordedAt = nowIso(now);
     const id = `receipt-${randomUUID4().replace(/-/g, "").slice(0, 16)}`;
     const base = { schemaVersion: "1.0", id, workspaceId, actor, action, decision, recordedAt, cost: { tokens: 0, toolCalls: 1, elapsedMs: 0 }, contextAssembly: { traceRef: assembly.traceRef, configurationRevision: assembly.configurationRevision, selected: assembly.selected.map((id) => `./ids/${id}`), omittedOptional: assembly.omittedOptional.map((id) => `./ids/${id}`) }, policy: { ref: assembly.policyRef, revision: assembly.policyRevision }, ...action === "resource" ? { resourceRef: `./ids/${resourceId ?? "unknown"}` } : {} };
-    const ledger = path103.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
-    const checkpointPath = path103.join(path103.dirname(ledger), "access-receipts.checkpoint.json");
-    await mkdir30(path103.dirname(ledger), { recursive: true, mode: 448 });
+    const ledger = path104.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
+    const checkpointPath = path104.join(path104.dirname(ledger), "access-receipts.checkpoint.json");
+    await mkdir30(path104.dirname(ledger), { recursive: true, mode: 448 });
     return withFileLock(`${ledger}.lock`, async () => {
       const state = await resolveLedgerState(ledger, checkpointPath, this.options.verifyReceiptLedger ?? verifyAccessReceiptLedger);
       const receipt = sealAccessReceipt(base, state.headHash);
@@ -34333,7 +34437,7 @@ function normalizeFwkResult(result) {
 init_fs();
 import { createHash as createHash29, randomUUID as randomUUID7 } from "crypto";
 import { appendFile as appendFile7, mkdir as mkdir34, readdir as readdir19, readFile as readFile59 } from "fs/promises";
-import path113 from "path";
+import path114 from "path";
 
 // src/sac/trusted-wrap-up.ts
 import { createHash as createHash23, randomUUID as randomUUID5 } from "crypto";
@@ -34405,7 +34509,7 @@ function bindingHash(owner, intent) {
 // src/sac/session-wrap-up.ts
 import { createHash as createHash25 } from "crypto";
 import { mkdir as mkdir32, writeFile as writeFile21 } from "fs/promises";
-import path107 from "path";
+import path108 from "path";
 
 // src/session/store.ts
 import {
@@ -34416,7 +34520,7 @@ import {
   renameSync as renameSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import path106 from "path";
+import path107 from "path";
 
 // src/lib/config-dir.ts
 import {
@@ -34461,7 +34565,7 @@ function readTranscriptFile(file) {
 // src/session/paths.ts
 import { existsSync as existsSync15 } from "fs";
 import { homedir } from "os";
-import path104 from "path";
+import path105 from "path";
 function keryxDataDir(override) {
   if (override !== undefined && override.length > 0) {
     return override;
@@ -34473,22 +34577,22 @@ function keryxDataDir(override) {
   const home = homedir();
   if (process.platform === "win32") {
     const appData = process.env.APPDATA;
-    const base = appData !== undefined && appData.length > 0 ? appData : path104.join(home, "AppData", "Roaming");
-    return path104.join(base, "keryx");
+    const base = appData !== undefined && appData.length > 0 ? appData : path105.join(home, "AppData", "Roaming");
+    return path105.join(base, "keryx");
   }
   const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg !== undefined && xdg.length > 0 ? xdg : path104.join(home, ".local", "share");
-  return path104.join(base, "keryx");
+  const base = xdg !== undefined && xdg.length > 0 ? xdg : path105.join(home, ".local", "share");
+  return path105.join(base, "keryx");
 }
 function resolveProjectRoot2(cwd) {
-  const abs = path104.resolve(cwd);
+  const abs = path105.resolve(cwd);
   let dir = abs;
   for (;; ) {
-    const gitPath = path104.join(dir, ".git");
+    const gitPath = path105.join(dir, ".git");
     if (existsSync15(gitPath)) {
       return dir;
     }
-    const parent = path104.dirname(dir);
+    const parent = path105.dirname(dir);
     if (parent === dir) {
       break;
     }
@@ -34497,12 +34601,12 @@ function resolveProjectRoot2(cwd) {
   return abs;
 }
 function projectKeyFromPath(projectPath) {
-  const abs = path104.resolve(projectPath);
+  const abs = path105.resolve(projectPath);
   const encoded = encodeURIComponent(abs);
   if (encoded.length <= 200) {
     return encoded;
   }
-  const base = path104.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40);
+  const base = path105.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40);
   let h = 0;
   for (let i = 0;i < abs.length; i++) {
     h = Math.imul(31, h) + abs.charCodeAt(i) | 0;
@@ -34512,17 +34616,17 @@ function projectKeyFromPath(projectPath) {
 }
 function projectSessionsDir(projectPath, dataDir) {
   const key = projectKeyFromPath(resolveProjectRoot2(projectPath));
-  return path104.join(keryxDataDir(dataDir), "sessions", key);
+  return path105.join(keryxDataDir(dataDir), "sessions", key);
 }
 function sessionDir(projectPath, sessionId, dataDir) {
-  return path104.join(projectSessionsDir(projectPath, dataDir), sessionId);
+  return path105.join(projectSessionsDir(projectPath, dataDir), sessionId);
 }
 
 // src/session/slate.ts
 init_fs();
 init_assembly();
 import { mkdir as mkdir31, readFile as readFile51, rm as rm7 } from "fs/promises";
-import path105 from "path";
+import path106 from "path";
 init_redact();
 var SLATE_SEED_KINDS = [
   "decision",
@@ -34537,7 +34641,7 @@ function isSlateSeedKind(value) {
 }
 var SEED_TEXT_MAX_LENGTH = 4000;
 function slatePath(dir) {
-  return path105.join(dir, "slate.json");
+  return path106.join(dir, "slate.json");
 }
 function slateLockPath(dir) {
   return `${slatePath(dir)}.lock`;
@@ -34740,11 +34844,11 @@ function listSessions(cwd, dataDir) {
     if (name.startsWith(".")) {
       continue;
     }
-    const summary = readSummaryFile(path106.join(root, name, "summary.json"));
+    const summary = readSummaryFile(path107.join(root, name, "summary.json"));
     if (summary === undefined) {
       continue;
     }
-    if (path106.resolve(summary.projectPath) !== path106.resolve(projectPath)) {
+    if (path107.resolve(summary.projectPath) !== path107.resolve(projectPath)) {
       continue;
     }
     out.push(summary);
@@ -34777,15 +34881,15 @@ async function readSessionSlate(cwd, sessionId, dataDir) {
 }
 function loadContext(cwd, sessionId, dataDir) {
   const dir = sessionDir(resolveProjectRoot2(cwd), sessionId, dataDir);
-  const contextPath = path106.join(dir, "context.jsonl");
+  const contextPath = path107.join(dir, "context.jsonl");
   if (existsSync16(contextPath)) {
     return readJsonl2(contextPath);
   }
-  return readJsonl2(path106.join(dir, "transcript.jsonl"));
+  return readJsonl2(path107.join(dir, "transcript.jsonl"));
 }
 function loadArchive(cwd, sessionId, dataDir, onDegraded) {
   const dir = sessionDir(resolveProjectRoot2(cwd), sessionId, dataDir);
-  const archivePath = path106.join(dir, "archive.jsonl");
+  const archivePath = path107.join(dir, "archive.jsonl");
   if (existsSync16(archivePath)) {
     try {
       const archive = readJsonl2(archivePath);
@@ -34969,7 +35073,7 @@ function sessionEvidenceRef(workspaceId, sessionId) {
 }
 async function resolveSessionWrapUp(input) {
   const now = input.now ?? (() => new Date);
-  const sessionId = path107.posix.basename(input.sourceRef, ".md");
+  const sessionId = path108.posix.basename(input.sourceRef, ".md");
   const summary = findSession(input.cwd, sessionId);
   if (summary === undefined || input.sourceRef !== sessionEvidenceRef(input.workspaceId, summary.id)) {
     throw new SessionWrapUpError("session_not_found", `no session matching "${input.sourceRef}" in this project \u2014 use \`keryx sessions list\``);
@@ -34986,7 +35090,7 @@ async function resolveSessionWrapUp(input) {
     throw new SessionWrapUpError("session_unreadable", `session "${summary.id}" could not be read: ${cause.message}`);
   }
   const relPath = sessionEvidenceRef(input.workspaceId, summary.id).slice(2);
-  const evidenceDir = path107.dirname(relPath);
+  const evidenceDir = path108.dirname(relPath);
   const slate = await readSessionSlate(input.cwd, summary.id);
   const diff = await gitDiff(input.cwd);
   const diffBody = diff.kind === "measured" ? diff.text : unmeasurableDiffBody(diff.detail);
@@ -35008,23 +35112,23 @@ async function resolveSessionWrapUp(input) {
     ""
   ].join(`
 `);
-  const wrapUpRelPath = path107.join(evidenceDir, `${summary.id}.wrap-up.md`);
-  const diffRelPath = path107.join(evidenceDir, `${summary.id}.diff.txt`);
-  const noticeRelPath = path107.join(evidenceDir, `${summary.id}.redaction.md`);
+  const wrapUpRelPath = path108.join(evidenceDir, `${summary.id}.wrap-up.md`);
+  const diffRelPath = path108.join(evidenceDir, `${summary.id}.diff.txt`);
+  const noticeRelPath = path108.join(evidenceDir, `${summary.id}.redaction.md`);
   const floor = await applyEvidenceRedactionFloor(input.cwd, [
-    { name: path107.basename(relPath), content: markdown, path: relPath, source: "generated" },
-    { name: path107.basename(wrapUpRelPath), content: wrapUpMarkdown, path: wrapUpRelPath, source: "generated" },
-    { name: path107.basename(diffRelPath), content: diffBody, path: diffRelPath, source: "tool-output" }
+    { name: path108.basename(relPath), content: markdown, path: relPath, source: "generated" },
+    { name: path108.basename(wrapUpRelPath), content: wrapUpMarkdown, path: wrapUpRelPath, source: "generated" },
+    { name: path108.basename(diffRelPath), content: diffBody, path: diffRelPath, source: "tool-output" }
   ]);
   if (!floor.ok)
     throw new SessionWrapUpError("security_denied", floor.reason);
   const [safeSession, safeWrapUp, safeDiff] = floor.bodies;
-  await mkdir32(path107.join(input.cwd, evidenceDir), { recursive: true });
-  await writeFile21(path107.join(input.cwd, relPath), safeSession.content, "utf8");
-  await writeFile21(path107.join(input.cwd, wrapUpRelPath), safeWrapUp.content, "utf8");
-  await writeFile21(path107.join(input.cwd, diffRelPath), safeDiff.content, "utf8");
+  await mkdir32(path108.join(input.cwd, evidenceDir), { recursive: true });
+  await writeFile21(path108.join(input.cwd, relPath), safeSession.content, "utf8");
+  await writeFile21(path108.join(input.cwd, wrapUpRelPath), safeWrapUp.content, "utf8");
+  await writeFile21(path108.join(input.cwd, diffRelPath), safeDiff.content, "utf8");
   if (floor.notice !== undefined)
-    await writeFile21(path107.join(input.cwd, noticeRelPath), floor.notice, "utf8");
+    await writeFile21(path108.join(input.cwd, noticeRelPath), floor.notice, "utf8");
   const observedAt = now().toISOString();
   const evidence = [
     { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash25("sha256").update(safeWrapUp.content).digest("hex"), observedAt },
@@ -35047,13 +35151,13 @@ async function resolveSessionWrapUp(input) {
 init_fs();
 import { createHash as createHash26, randomBytes as randomBytes5 } from "crypto";
 import { readFile as readFile52 } from "fs/promises";
-import path108 from "path";
+import path109 from "path";
 var CONFIRM_TOKEN_TTL_MS = 2 * 60000;
 function confirmTokenPath2(cwd, workspaceId, proposalId) {
-  return path108.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
+  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
 }
 function confirmReceiptPath(cwd, workspaceId, proposalId, idempotencyKey) {
-  return path108.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2565(idempotencyKey)}.confirm-receipt.json`);
+  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2565(idempotencyKey)}.confirm-receipt.json`);
 }
 function sha2565(text) {
   return createHash26("sha256").update(text).digest("hex");
@@ -35094,21 +35198,21 @@ init_store();
 init_config();
 import { readFile as readFile54, readdir as readdir18 } from "fs/promises";
 import { randomUUID as randomUUID6 } from "crypto";
-import path110 from "path";
+import path111 from "path";
 
 // src/sac/proposal-evidence.ts
 init_fs();
 import { createHash as createHash27 } from "crypto";
 import { readFile as readFile53, rm as rm8 } from "fs/promises";
-import path109 from "path";
+import path110 from "path";
 function proposalPath(cwd, workspaceId, proposalId) {
-  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+  return path110.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
 }
 function ownerReceiptPath(cwd, owner, workspaceId, idempotencyKey) {
-  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
+  return path110.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
 }
 function proposalNotePath(cwd, workspaceId, proposalId) {
-  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
+  return path110.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
 }
 async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
   let proposal;
@@ -35122,7 +35226,7 @@ async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
     return { ok: false, code: "no_evidence_to_write" };
   let content;
   try {
-    content = await readFile53(path109.join(cwd, evidence.uri), "utf8");
+    content = await readFile53(path110.join(cwd, evidence.uri), "utf8");
   } catch {
     return { ok: false, code: "evidence_file_unreadable" };
   }
@@ -35152,22 +35256,22 @@ function targetRelPath(targetRef) {
   return targetRef.replace(/^\.\//, "");
 }
 function targetAbsolutePath(cwd, targetRef) {
-  return path109.join(cwd, ".metaproject", targetRelPath(targetRef));
+  return path110.join(cwd, ".metaproject", targetRelPath(targetRef));
 }
 function targetKey(targetRef) {
   return digestOf2(targetRelPath(targetRef)).slice(0, 32);
 }
 function ownerTargetVersionPath(cwd, owner, workspaceId, targetRef) {
-  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-target-versions`, `${targetKey(targetRef)}.json`);
+  return path110.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-target-versions`, `${targetKey(targetRef)}.json`);
 }
 function ownerTargetLockPath(cwd, owner, targetRef) {
-  return path109.join(cwd, ".metaproject", "data", "sac", "target-locks", owner, `${targetKey(targetRef)}.lock`);
+  return path110.join(cwd, ".metaproject", "data", "sac", "target-locks", owner, `${targetKey(targetRef)}.lock`);
 }
 function ownerStagingDir(cwd, owner, workspaceId, idempotencyKey) {
-  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-staging`, digestOf2(idempotencyKey).slice(0, 32));
+  return path110.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-staging`, digestOf2(idempotencyKey).slice(0, 32));
 }
 function ownerConflictDir(cwd, owner, workspaceId, idempotencyKey) {
-  return path109.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-conflicts`, digestOf2(idempotencyKey).slice(0, 32));
+  return path110.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-conflicts`, digestOf2(idempotencyKey).slice(0, 32));
 }
 async function readJson2(file) {
   try {
@@ -35238,7 +35342,7 @@ async function applyGuardedTargetWrite(input) {
       staged: input.staged,
       stagedAt: receipt.completedAt
     };
-    await writeFileAtomic(path109.join(ownerStagingDir(cwd, owner, intent.workspaceId, intent.idempotencyKey), "plan.json"), `${JSON.stringify(staged, null, 2)}
+    await writeFileAtomic(path110.join(ownerStagingDir(cwd, owner, intent.workspaceId, intent.idempotencyKey), "plan.json"), `${JSON.stringify(staged, null, 2)}
 `);
     const applied = await input.apply(input.staged);
     if (!applied.ok) {
@@ -35264,15 +35368,15 @@ async function recoverStagedOwnerWrite(input) {
   });
 }
 async function readStagedOwnerWrite(cwd, owner, workspaceId, idempotencyKey) {
-  return readJson2(path109.join(ownerStagingDir(cwd, owner, workspaceId, idempotencyKey), "plan.json"));
+  return readJson2(path110.join(ownerStagingDir(cwd, owner, workspaceId, idempotencyKey), "plan.json"));
 }
 async function recordConflict(input) {
   const base = { targetRef: input.targetRef, expectedVersion: input.expectedVersion, currentVersion: input.currentVersion };
   if (input.proposedContent === undefined)
     return base;
   const dir = ownerConflictDir(input.cwd, input.owner, input.intent.workspaceId, input.intent.idempotencyKey);
-  await writeFileAtomic(path109.join(dir, "proposed"), input.proposedContent);
-  const diffRef = `./workspaces/${input.intent.workspaceId}/${input.owner}-write-conflicts/${path109.basename(dir)}/proposed`;
+  await writeFileAtomic(path110.join(dir, "proposed"), input.proposedContent);
+  const diffRef = `./workspaces/${input.intent.workspaceId}/${input.owner}-write-conflicts/${path110.basename(dir)}/proposed`;
   return { ...base, diffRef };
 }
 
@@ -35322,7 +35426,7 @@ async function resolveWorkspaceModule(cwd, workspaceId) {
   }
 }
 async function collectWikiDecisionEntries(cwd) {
-  const dir = path110.join(cwd, ".metaproject", "wiki", "decisions");
+  const dir = path111.join(cwd, ".metaproject", "wiki", "decisions");
   let files;
   try {
     files = (await readdir18(dir)).filter((name) => name.endsWith(".md"));
@@ -35331,12 +35435,12 @@ async function collectWikiDecisionEntries(cwd) {
   }
   const entries = [];
   for (const file of files) {
-    const absolutePath = path110.join(dir, file);
+    const absolutePath = path111.join(dir, file);
     try {
       const content = await readFile54(absolutePath, "utf8");
       entries.push({
         absolutePath,
-        relativePath: path110.posix.join("decisions", file),
+        relativePath: path111.posix.join("decisions", file),
         type: extractHeaderField(content, "Type") ?? "decision",
         title: extractTitle(content),
         version: extractHeaderField(content, "Version") ?? null,
@@ -35558,7 +35662,7 @@ function createRealMemoryOwnerWriter(cwd, opts) {
 init_fs();
 init_guard();
 import { readFile as readFile56 } from "fs/promises";
-import path111 from "path";
+import path112 from "path";
 function renderWrapUpDecisionPage(input) {
   const note = input.note?.trim();
   return `# ${input.title}
@@ -35599,14 +35703,14 @@ export is the source of truth for what actually happened.
 `;
 }
 function wikiPageRelativePath(proposalId) {
-  return path111.posix.join("decisions", `sac-${proposalId}.md`);
+  return path112.posix.join("decisions", `sac-${proposalId}.md`);
 }
 function createRealWikiOwnerWriter(cwd, opts) {
   const now = opts?.now ?? (() => new Date);
   const applyStaged = async (staged) => {
     const relativePath = staged.relativePath;
     const content = staged.content;
-    await writeFileAtomic(path111.join(cwd, ".metaproject", "wiki", relativePath), content);
+    await writeFileAtomic(path112.join(cwd, ".metaproject", "wiki", relativePath), content);
     return { ok: true };
   };
   return {
@@ -35675,10 +35779,10 @@ init_guard();
 import { createHash as createHash28 } from "crypto";
 import { homedir as homedir2 } from "os";
 import { mkdir as mkdir33, readFile as readFile57, stat as stat14 } from "fs/promises";
-import path112 from "path";
+import path113 from "path";
 var VERSION = "0.1.0";
 async function createProjectSkill(projectRoot, options) {
-  const metaprojectRoot = path112.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path113.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
@@ -35688,8 +35792,8 @@ async function createProjectSkill(projectRoot, options) {
   const moduleName = slugify5(options.module ?? inferModule(options.target));
   const skillName = slugify5(options.name ?? inferSkillName(options.target));
   const format = options.format ?? "auto";
-  const packageRoot = path112.join(metaprojectRoot, "project-skills", moduleName, skillName);
-  const relativeSkillPath = toPosix(path112.relative(projectRoot, packageRoot));
+  const packageRoot = path113.join(metaprojectRoot, "project-skills", moduleName, skillName);
+  const relativeSkillPath = toPosix(path113.relative(projectRoot, packageRoot));
   const origin = options.origin ? options.originContent !== undefined ? {
     ref: options.origin.trim(),
     hash: hashOriginContent(options.originContent),
@@ -35699,7 +35803,7 @@ async function createProjectSkill(projectRoot, options) {
   const warnings = collectWarnings(evidence, format);
   const files = filesForPackage(packageRoot, format);
   if (!options.dryRun) {
-    await withFileLock(path112.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
+    await withFileLock(path113.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
       await writeProjectSkillPackage({
         projectRoot,
         packageRoot,
@@ -35728,7 +35832,7 @@ async function createProjectSkill(projectRoot, options) {
     name: skillName,
     target: options.target,
     skillPath: relativeSkillPath,
-    files: files.map((filePath) => toPosix(path112.relative(projectRoot, filePath))),
+    files: files.map((filePath) => toPosix(path113.relative(projectRoot, filePath))),
     warnings,
     dryRun: options.dryRun === true
   };
@@ -35737,9 +35841,9 @@ var MAX_SKILL_TARGET_LENGTH = 80;
 function resolveOriginPath(ref, projectRoot) {
   const trimmed = ref.trim();
   if (trimmed === "~" || trimmed.startsWith("~/")) {
-    return path112.join(homedir2(), trimmed.slice(1));
+    return path113.join(homedir2(), trimmed.slice(1));
   }
-  return path112.resolve(projectRoot, trimmed);
+  return path113.resolve(projectRoot, trimmed);
 }
 function hashOriginContent(content) {
   return `sha256:${createHash28("sha256").update(content).digest("hex")}`;
@@ -35777,32 +35881,32 @@ async function writeProjectSkillPackage({
 }) {
   const packageFormat = format === "single" ? "single" : "package";
   const skillContent = renderProjectSkill({ moduleName, skillName, target, note, origin, evidence, packageFormat });
-  const relativeSkillMdPath = toPosix(path112.join(path112.relative(projectRoot, packageRoot), "SKILL.md"));
+  const relativeSkillMdPath = toPosix(path113.join(path113.relative(projectRoot, packageRoot), "SKILL.md"));
   const guard = await guardOutput({ cwd: projectRoot, content: skillContent, target: "skill", source: "generated", path: relativeSkillMdPath });
   const output = prepareOutputForPersistence(guard, skillContent);
   if (!output.allowed) {
     throw new Error(`Project skill blocked by the security gate: ${output.reason}`);
   }
   await mkdir33(packageRoot, { recursive: true });
-  const skillPath = path112.join(packageRoot, "SKILL.md");
+  const skillPath = path113.join(packageRoot, "SKILL.md");
   await writeFileAtomic(skillPath, output.content);
-  const changelogPath = path112.join(packageRoot, "skill-changelog.md");
+  const changelogPath = path113.join(packageRoot, "skill-changelog.md");
   if (!await pathExists(changelogPath)) {
     await writeFileAtomic(changelogPath, renderSkillChangelog({ moduleName, skillName, target }));
   }
   if (packageFormat === "package") {
-    await mkdir33(path112.join(packageRoot, "references"), { recursive: true });
-    await mkdir33(path112.join(packageRoot, "templates"), { recursive: true });
-    await writeFileAtomic(path112.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
-    await writeFileAtomic(path112.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
-    await writeFileAtomic(path112.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
+    await mkdir33(path113.join(packageRoot, "references"), { recursive: true });
+    await mkdir33(path113.join(packageRoot, "templates"), { recursive: true });
+    await writeFileAtomic(path113.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
+    await writeFileAtomic(path113.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
+    await writeFileAtomic(path113.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
   }
 }
 async function collectEvidence(projectRoot, target) {
-  const absoluteTarget = path112.resolve(projectRoot, target);
+  const absoluteTarget = path113.resolve(projectRoot, target);
   const targetExists = await pathExists(absoluteTarget);
   const targetKind = await classifyTarget(absoluteTarget, targetExists);
-  const maybeRelativeTarget = targetExists ? toPosix(path112.relative(projectRoot, absoluteTarget)) : undefined;
+  const maybeRelativeTarget = targetExists ? toPosix(path113.relative(projectRoot, absoluteTarget)) : undefined;
   const graphArtifacts = await existingRelativePaths(projectRoot, [
     ".metaproject/data/gdgraph/artifacts/summary.md",
     ".metaproject/data/gdgraph/artifacts/module-map.json"
@@ -35832,7 +35936,7 @@ async function classifyTarget(absoluteTarget, targetExists) {
 async function existingRelativePaths(projectRoot, candidates) {
   const existing = [];
   for (const candidate of candidates) {
-    if (await pathExists(path112.join(projectRoot, candidate))) {
+    if (await pathExists(path113.join(projectRoot, candidate))) {
       existing.push(candidate);
     }
   }
@@ -35859,17 +35963,17 @@ function collectWarnings(evidence, format) {
 }
 function filesForPackage(packageRoot, format) {
   const base = [
-    path112.join(packageRoot, "SKILL.md"),
-    path112.join(packageRoot, "skill-changelog.md")
+    path113.join(packageRoot, "SKILL.md"),
+    path113.join(packageRoot, "skill-changelog.md")
   ];
   if (format === "single") {
     return base;
   }
   return [
     ...base,
-    path112.join(packageRoot, "verification.md"),
-    path112.join(packageRoot, "references", "context.md"),
-    path112.join(packageRoot, "templates", "README.md")
+    path113.join(packageRoot, "verification.md"),
+    path113.join(packageRoot, "references", "context.md"),
+    path113.join(packageRoot, "templates", "README.md")
   ];
 }
 function renderProjectSkill({
@@ -36097,7 +36201,7 @@ keryx skills verify ${moduleName}/${skillName}
 `;
 }
 async function updateManifest(projectRoot, entry) {
-  const manifestPath = path112.join(projectRoot, ".metaproject", "metaproject.json");
+  const manifestPath = path113.join(projectRoot, ".metaproject", "metaproject.json");
   const manifest = await readJsonFileOr(manifestPath, {});
   manifest.modules ??= {};
   manifest.modules.gdskills ??= {};
@@ -36111,8 +36215,8 @@ async function updateManifest(projectRoot, entry) {
 `);
 }
 async function updateSkillsCatalog(projectRoot) {
-  const manifestPath = path112.join(projectRoot, ".metaproject", "metaproject.json");
-  const catalogPath = path112.join(projectRoot, ".metaproject", "skills", "catalog.md");
+  const manifestPath = path113.join(projectRoot, ".metaproject", "metaproject.json");
+  const catalogPath = path113.join(projectRoot, ".metaproject", "skills", "catalog.md");
   const manifest = await readJsonFileOr(manifestPath, {});
   const registry = manifest.modules?.gdskills?.projectSkillRegistry ?? [];
   const rows = registry.length > 0 ? registry.map((entry) => `| ${entry.module} | ${entry.name} | \`${entry.target}\` | ${entry.path}/SKILL.md |`).join(`
@@ -36152,7 +36256,7 @@ function inferModule(target) {
 }
 function inferSkillName(target) {
   const normalized = target.trim().replace(/[#:]+/g, "/");
-  const base = path112.basename(normalized).replace(/\.[^.]+$/, "");
+  const base = path113.basename(normalized).replace(/\.[^.]+$/, "");
   return base || "entity";
 }
 function slugify5(value) {
@@ -36255,7 +36359,7 @@ class ProposalLifecycleService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path113.resolve(options.workspaceRoot);
+    this.root = path114.resolve(options.workspaceRoot);
     this.now = options.now ?? (() => new Date);
   }
   async create(input) {
@@ -36274,7 +36378,7 @@ class ProposalLifecycleService {
       if (manifest.status === "archived")
         throw new ProposalLifecycleError("guard_denied", "workspace is archived");
       const file = this.proposalPath(workspaceId, proposal.id);
-      await mkdir34(path113.dirname(file), { recursive: true, mode: 448 });
+      await mkdir34(path114.dirname(file), { recursive: true, mode: 448 });
       return withFileLock(`${file}.lock`, async () => {
         const consume = this.options.wrapUpAuthority.consume(input.wrapUp, { actor, workspaceId });
         if (consume !== "ok")
@@ -36302,7 +36406,7 @@ class ProposalLifecycleService {
     return this.options.workspaces.withAuthorizedActor({ actorContext: actor, workspaceId: input.workspaceId, action: "review", execute: async (manifest) => {
       const proposal = await this.loadProposal(input.workspaceId, input.proposalId);
       const ledger = this.ledgerPath(input.workspaceId);
-      await mkdir34(path113.dirname(ledger), { recursive: true, mode: 448 });
+      await mkdir34(path114.dirname(ledger), { recursive: true, mode: 448 });
       return withFileLock(`${ledger}.lock`, async () => {
         const records = (await this.records(ledger)).filter((record) => record.proposalId === proposal.id);
         const events = records.filter((record) => record.recordType === "proposal-transition");
@@ -36344,7 +36448,7 @@ class ProposalLifecycleService {
     } });
   }
   async listProposedProposals(workspaceId) {
-    const proposalsDir = path113.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
+    const proposalsDir = path114.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
     let entries;
     try {
       entries = (await readdir19(proposalsDir)).filter((name) => name.endsWith(".json"));
@@ -36356,7 +36460,7 @@ class ProposalLifecycleService {
     const proposals = [];
     for (const entry of entries) {
       try {
-        const parsed = JSON.parse(await readFile59(path113.join(proposalsDir, entry), "utf8"));
+        const parsed = JSON.parse(await readFile59(path114.join(proposalsDir, entry), "utf8"));
         if (parsed.recordType === "proposal-created")
           proposals.push(parsed);
       } catch {}
@@ -36622,31 +36726,31 @@ class ProposalLifecycleService {
     }
   }
   proposalPath(workspaceId, proposalId) {
-    return path113.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+    return path114.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
   }
   decisionRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.decision.json`;
   }
   decisionPath(workspaceId, proposalId, key) {
-    return path113.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
+    return path114.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
   }
   approvalRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.approval.json`;
   }
   approvalPath(workspaceId, proposalId, key) {
-    return path113.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
+    return path114.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
   }
   writeResultPath(workspaceId, proposalId, key) {
-    return path113.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
+    return path114.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
   }
   intentRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.write-intent.json`;
   }
   intentPath(workspaceId, proposalId, key) {
-    return path113.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
+    return path114.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
   }
   attemptPath(workspaceId, proposalId, key) {
-    return path113.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.owner-write-attempt.json`);
+    return path114.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.owner-write-attempt.json`);
   }
   async loadWriteResult(workspaceId, proposalId, key) {
     try {
@@ -36673,7 +36777,7 @@ class ProposalLifecycleService {
     }
   }
   ledgerPath(workspaceId) {
-    return path113.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
+    return path114.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
   }
   timestamp() {
     return this.now().toISOString();
@@ -36756,7 +36860,7 @@ function normalizeProposalLifecycleResult(value) {
 // src/sac/collaboration-service.ts
 import { appendFile as appendFile8, mkdir as mkdir35, readFile as readFile60 } from "fs/promises";
 import { randomUUID as randomUUID8 } from "crypto";
-import path114 from "path";
+import path115 from "path";
 class CollaborationServiceError extends Error {
   code;
   constructor(code, message) {
@@ -36771,7 +36875,7 @@ class CollaborationService {
     this.input = input;
   }
   file(id) {
-    return path114.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
+    return path115.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
   }
   async overview(input) {
     const manifest = await this.input.workspaces.show(input);
@@ -36808,7 +36912,7 @@ class CollaborationService {
         occurredAt: (this.input.now ?? (() => new Date))().toISOString(),
         ...suppliedHandoff ? { handoff: { ...suppliedHandoff, from: actor.subject } } : {}
       });
-      await mkdir35(path114.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
+      await mkdir35(path115.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
       await appendFile8(this.file(manifest.id), `${JSON.stringify(activity)}
 `, { mode: 384 });
       return normalizeCollaborationResult(activity);
@@ -36858,13 +36962,13 @@ function normalizeCollaborationResult(value) {
 // src/session/external-slate.ts
 init_fs();
 import { mkdir as mkdir37, readdir as readdir20, readFile as readFile61 } from "fs/promises";
-import path116 from "path";
+import path117 from "path";
 
 // src/sac/machine-wrap-up.ts
 init_fs();
 import { createHash as createHash30, randomUUID as randomUUID10 } from "crypto";
 import { mkdir as mkdir36 } from "fs/promises";
-import path115 from "path";
+import path116 from "path";
 
 // src/sac/workspace-resolve.ts
 init_redact();
@@ -37005,11 +37109,11 @@ async function resolveMachineWrapUp(input) {
 `;
   const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
 `;
-  const evidenceRelBase = path115.posix.join(".metaproject", "workspaces", input.workspaceId, "machine-evidence");
+  const evidenceRelBase = path116.posix.join(".metaproject", "workspaces", input.workspaceId, "machine-evidence");
   const floor = await applyEvidenceRedactionFloor(input.cwd, [
-    { name: `${input.kind}.diff.txt`, content: diffBody, path: path115.posix.join(evidenceRelBase, `${input.kind}.diff.txt`), source: "tool-output" },
-    { name: `${input.kind}.flow.json`, content: flowSnapshotJson, path: path115.posix.join(evidenceRelBase, `${input.kind}.flow.json`), source: "generated" },
-    { name: `${input.kind}.seeds.json`, content: seedsJson, path: path115.posix.join(evidenceRelBase, `${input.kind}.seeds.json`), source: "generated" }
+    { name: `${input.kind}.diff.txt`, content: diffBody, path: path116.posix.join(evidenceRelBase, `${input.kind}.diff.txt`), source: "tool-output" },
+    { name: `${input.kind}.flow.json`, content: flowSnapshotJson, path: path116.posix.join(evidenceRelBase, `${input.kind}.flow.json`), source: "generated" },
+    { name: `${input.kind}.seeds.json`, content: seedsJson, path: path116.posix.join(evidenceRelBase, `${input.kind}.seeds.json`), source: "generated" }
   ]);
   if (!floor.ok)
     return { ok: false, code: "security_denied", detail: floor.reason };
@@ -37063,14 +37167,14 @@ ${safeSeeds.content}`;
     }
     summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(summaryDiff, course);
   }
-  const evidenceDir = path115.join(input.cwd, ".metaproject", "workspaces", input.workspaceId, "machine-evidence");
+  const evidenceDir = path116.join(input.cwd, ".metaproject", "workspaces", input.workspaceId, "machine-evidence");
   await mkdir36(evidenceDir, { recursive: true });
   const diffFile = `${input.kind}.${shortHash}.diff.txt`;
   const flowFile = `${input.kind}.${shortHash}.flow.json`;
   const seedsFile = `${input.kind}.${shortHash}.seeds.json`;
-  await writeFileAtomic(path115.join(evidenceDir, diffFile), safeDiff.content);
-  await writeFileAtomic(path115.join(evidenceDir, flowFile), safeFlow.content);
-  await writeFileAtomic(path115.join(evidenceDir, seedsFile), safeSeeds.content);
+  await writeFileAtomic(path116.join(evidenceDir, diffFile), safeDiff.content);
+  await writeFileAtomic(path116.join(evidenceDir, flowFile), safeFlow.content);
+  await writeFileAtomic(path116.join(evidenceDir, seedsFile), safeSeeds.content);
   const observedAt = now().toISOString();
   const relBase = `./.metaproject/workspaces/${input.workspaceId}/machine-evidence`;
   const evidence = [
@@ -37080,7 +37184,7 @@ ${safeSeeds.content}`;
   ];
   if (floor.notice !== undefined) {
     const noticeFile = `${input.kind}.${shortHash}.redaction.md`;
-    await writeFileAtomic(path115.join(evidenceDir, noticeFile), floor.notice);
+    await writeFileAtomic(path116.join(evidenceDir, noticeFile), floor.notice);
     evidence.push({ kind: REDACTION_NOTICE_KIND, uri: `${relBase}/${noticeFile}`, revision: sha2566(floor.notice), observedAt });
   }
   return {
@@ -37099,18 +37203,18 @@ async function writeFlooredArchiveArtifact(params) {
     {
       name: params.filename,
       content: params.content,
-      path: path115.posix.join("slate-archive", params.filename),
+      path: path116.posix.join("slate-archive", params.filename),
       source: "generated"
     }
   ]);
   if (!floor.ok)
     return { ok: false, code: "security_denied", detail: floor.reason };
   const body = floor.bodies[0];
-  const archiveDir = path115.join(params.dir, "slate-archive");
+  const archiveDir = path116.join(params.dir, "slate-archive");
   await mkdir36(archiveDir, { recursive: true });
-  await writeFileAtomic(path115.join(archiveDir, params.filename), body.content);
+  await writeFileAtomic(path116.join(archiveDir, params.filename), body.content);
   if (floor.notice !== undefined) {
-    await writeFileAtomic(path115.join(archiveDir, `${params.filename}${ARCHIVE_REDACTION_NOTICE_SUFFIX}`), floor.notice);
+    await writeFileAtomic(path116.join(archiveDir, `${params.filename}${ARCHIVE_REDACTION_NOTICE_SUFFIX}`), floor.notice);
   }
   return { ok: true, altered: body.altered };
 }
@@ -37146,9 +37250,9 @@ async function writeWrapUpOutcomeArtifact(cwd, dir, trigger, now, groups) {
       return;
     const refusalIso = now().toISOString();
     const refusalFilename = `${refusalIso.replace(/[:.]/g, "-")}-wrap-up-outcome.json`;
-    const archiveDir = path115.join(dir, "slate-archive");
+    const archiveDir = path116.join(dir, "slate-archive");
     await mkdir36(archiveDir, { recursive: true });
-    await writeFileAtomic(path115.join(archiveDir, refusalFilename), `${JSON.stringify({
+    await writeFileAtomic(path116.join(archiveDir, refusalFilename), `${JSON.stringify({
       recordType: "wrap-up-outcome",
       trigger,
       generatedAt: refusalIso,
@@ -37284,7 +37388,7 @@ async function runWrapUp(input) {
 
 // src/session/external-slate.ts
 function externalSlatesDir(cwd) {
-  return path116.join(cwd, ".keryx", "external-slates");
+  return path117.join(cwd, ".keryx", "external-slates");
 }
 var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function assertValidExternalSessionId(externalSessionId) {
@@ -37294,14 +37398,14 @@ function assertValidExternalSessionId(externalSessionId) {
 }
 function externalSlatePath(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path116.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+  return path117.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
 }
 function externalSlateLockPath(cwd, externalSessionId) {
   return `${externalSlatePath(cwd, externalSessionId)}.lock`;
 }
 function externalSlateEvidenceDir(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path116.join(externalSlatesDir(cwd), externalSessionId);
+  return path117.join(externalSlatesDir(cwd), externalSessionId);
 }
 async function readExternalSlate(cwd, externalSessionId) {
   try {
@@ -37407,12 +37511,12 @@ __export(exports_service10, {
   runDoctor: () => runDoctor,
   runValidate: () => runValidate
 });
-import path119 from "path";
+import path120 from "path";
 import { readFile as readFile64 } from "fs/promises";
 
 // src/standard/validate.ts
 init_fs();
-import path118 from "path";
+import path119 from "path";
 import { readFile as readFile63 } from "fs/promises";
 
 // src/standard/schemas.ts
@@ -37541,7 +37645,7 @@ var SCHEMA_REGISTRY2 = {
 
 // src/standard/profiles.ts
 init_fs();
-import path117 from "path";
+import path118 from "path";
 import { readFile as readFile62 } from "fs/promises";
 var AGENT_MODULES = ["gdgraph", "gdctx", "gdskills", "gdwiki", "memory"];
 var CI_MODULES = ["health", "testing"];
@@ -37553,7 +37657,7 @@ function enabledModuleKeys(manifest) {
 }
 async function rootEntrypointLinksIndex(cwd) {
   for (const name of ROOT_ENTRYPOINTS) {
-    const filePath = path117.join(cwd, name);
+    const filePath = path118.join(cwd, name);
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -37565,16 +37669,16 @@ async function rootEntrypointLinksIndex(cwd) {
   return false;
 }
 async function minimalSatisfied(cwd) {
-  const metaprojectRoot = path117.join(cwd, ".metaproject");
+  const metaprojectRoot = path118.join(cwd, ".metaproject");
   const requiredFiles = ["index.md", "README.md", "metaproject.json"];
   const requiredDirs = ["modules", "rules", "skills", "data"];
   for (const file of requiredFiles) {
-    if (!await pathExists(path117.join(metaprojectRoot, file))) {
+    if (!await pathExists(path118.join(metaprojectRoot, file))) {
       return false;
     }
   }
   for (const dir of requiredDirs) {
-    if (!await pathExists(path117.join(metaprojectRoot, dir))) {
+    if (!await pathExists(path118.join(metaprojectRoot, dir))) {
       return false;
     }
   }
@@ -37587,7 +37691,7 @@ async function ciSatisfied(cwd, manifest) {
     return false;
   }
   for (const key of ciModules) {
-    if (await pathExists(path117.join(cwd, ".metaproject", "data", key, "artifacts"))) {
+    if (await pathExists(path118.join(cwd, ".metaproject", "data", key, "artifacts"))) {
       return true;
     }
   }
@@ -37600,7 +37704,7 @@ async function evaluateProfiles(cwd, manifest) {
     satisfied.push("minimal");
   }
   const hasAgentModule = AGENT_MODULES.some((key) => new Set(enabledModuleKeys(manifest)).has(key));
-  const agent = minimal && hasAgentModule && await rootEntrypointLinksIndex(cwd) && await pathExists(path117.join(cwd, ".metaproject", "rules"));
+  const agent = minimal && hasAgentModule && await rootEntrypointLinksIndex(cwd) && await pathExists(path118.join(cwd, ".metaproject", "rules"));
   if (agent) {
     satisfied.push("agent");
   }
@@ -37770,20 +37874,20 @@ var MANIFEST_TOP_LEVEL_SCHEMA = {
 async function validateWorkspace2(cwd) {
   const errors = [];
   const warnings = [];
-  const metaprojectRoot = path118.join(cwd, ".metaproject");
+  const metaprojectRoot = path119.join(cwd, ".metaproject");
   const requiredFiles = ["index.md", "README.md", "metaproject.json"];
   for (const file of requiredFiles) {
-    if (!await pathExists(path118.join(metaprojectRoot, file))) {
+    if (!await pathExists(path119.join(metaprojectRoot, file))) {
       errors.push(issue("missing-required-file", `Required file .metaproject/${file} is missing`, `Run \`keryx init\` to scaffold .metaproject/${file}.`));
     }
   }
   const requiredDirs = ["modules", "rules", "skills", "data"];
   for (const dir of requiredDirs) {
-    if (!await pathExists(path118.join(metaprojectRoot, dir))) {
+    if (!await pathExists(path119.join(metaprojectRoot, dir))) {
       errors.push(issue("missing-required-dir", `Required directory .metaproject/${dir}/ is missing`, `Run \`keryx init\` to create .metaproject/${dir}/.`));
     }
   }
-  const manifestPath = path118.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path119.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return { ok: errors.length === 0, errors, warnings };
   }
@@ -37815,7 +37919,7 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path118.join(cwd, value))) {
+      if (!await pathExists(path119.join(cwd, value))) {
         errors.push(issue("missing-declared-path", `Declared path paths.${key} -> ${value} does not exist`, `Create ${value} or remove paths.${key} from metaproject.json.`));
       }
     }
@@ -37825,7 +37929,7 @@ async function validateWorkspace2(cwd) {
       continue;
     }
     if (typeof entry.manifest === "string") {
-      if (!await pathExists(path118.join(cwd, entry.manifest))) {
+      if (!await pathExists(path119.join(cwd, entry.manifest))) {
         errors.push(issue("missing-module-manifest", `Enabled module "${key}" manifest ${entry.manifest} is missing`, `Create ${entry.manifest} or run \`keryx update\` to regenerate module manifests.`));
       }
     }
@@ -37834,14 +37938,14 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path118.join(cwd, value))) {
+      if (!await pathExists(path119.join(cwd, value))) {
         const sink = field === "data" ? warnings : errors;
         sink.push(issue("missing-module-path", `Module "${key}" declares ${String(field)} ${value}, which does not exist`, field === "data" ? `Run the module (e.g. \`keryx ${key} ...\`) to generate ${value}, or update modules.${key}.data in metaproject.json.` : `Create ${value} or update modules.${key}.${String(field)} in metaproject.json.`));
       }
     }
   }
   for (const name of ROOT_ENTRYPOINTS2) {
-    const filePath = path118.join(cwd, name);
+    const filePath = path119.join(cwd, name);
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -38685,7 +38789,7 @@ async function runDoctor(cwd) {
   return validateWorkspace2(cwd);
 }
 async function readManifest(cwd) {
-  const manifestPath = path119.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path120.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     throw new Error("Metaproject is not initialized (missing .metaproject/metaproject.json). Run `keryx init` first.");
   }