@mrciphersmith/keryx 0.3.52 → 0.3.54

package/dist/core.js

@@ -7414,6 +7414,7 @@ async function worktreeFileIsClean(projectRoot, relativePath) {
 }
 
 // src/lib/git-worktrees.ts
+import { readdir as readdir8, readFile as readFile15, realpath as realpath7, stat as stat7 } from "fs/promises";
 import path32 from "path";
 async function resolveGitCommonDir(cwd) {
   try {
@@ -7422,7 +7423,12 @@ async function resolveGitCommonDir(cwd) {
     if (await proc.exited !== 0 || out.length === 0) {
       return;
     }
-    return path32.isAbsolute(out) ? out : path32.resolve(cwd, out);
+    const absolute = path32.isAbsolute(out) ? out : path32.resolve(cwd, out);
+    try {
+      return path32.join(await realpath7(path32.dirname(absolute)), path32.basename(absolute));
+    } catch {
+      return absolute;
+    }
   } catch {
     return;
   }
@@ -7605,7 +7611,7 @@ var init_entrypoint_targets = __esm(() => {
 });
 
 // src/rules/export-render.ts
-import { readFile as readFile15, readdir as readdir8 } from "fs/promises";
+import { readFile as readFile16, readdir as readdir9 } from "fs/promises";
 import path33 from "path";
 function isUnsafeRulePath(relativePath) {
   return UNSAFE_RULE_PATH_PATTERN.test(relativePath) || relativePath.includes("<!--") || relativePath.includes("-->");
@@ -7670,7 +7676,7 @@ async function collectCanonicalRules(root) {
   async function walk(dirAbsolute, dirRelative) {
     let dirents;
     try {
-      dirents = await readdir8(dirAbsolute, { withFileTypes: true });
+      dirents = await readdir9(dirAbsolute, { withFileTypes: true });
     } catch {
       return;
     }
@@ -7698,7 +7704,7 @@ async function collectCanonicalRules(root) {
       }
       let content;
       try {
-        content = await readFile15(childAbsolute, "utf8");
+        content = await readFile16(childAbsolute, "utf8");
       } catch {
         continue;
       }
@@ -8384,7 +8390,7 @@ var init_surfaces = __esm(() => {
 });
 
 // src/integrations/markdown-block.ts
-import { readFile as readFile16 } from "fs/promises";
+import { readFile as readFile17 } from "fs/promises";
 import path36 from "path";
 function dominantEol(content) {
   const crlf = (content.match(/\r\n/g) ?? []).length;
@@ -8538,7 +8544,7 @@ async function installMarkdownBlock(root, relativePath, frontMatter, spec = INST
     await writeContained(root, relativePath, `${frontMatter ?? ""}${spec.render()}`);
     return [];
   }
-  const raw = await readFile16(file, "utf8");
+  const raw = await readFile17(file, "utf8");
   const eol = dominantEol(raw);
   let blocks;
   try {
@@ -8563,7 +8569,7 @@ async function uninstallMarkdownBlock(root, relativePath, frontMatter, spec = IN
   const file = fileFor(root, relativePath);
   if (!await pathExists(file))
     return false;
-  const raw = await readFile16(file, "utf8");
+  const raw = await readFile17(file, "utf8");
   const blocks = parseBlocks(raw, relativePath, spec);
   if (blocks.length === 0)
     return false;
@@ -8585,7 +8591,7 @@ async function inspectMarkdownBlock(root, relativePath, spec = INSTRUCTIONS_BLOC
   const file = fileFor(root, relativePath);
   if (!await pathExists(file))
     return { state: "absent-file" };
-  const raw = await readFile16(file, "utf8");
+  const raw = await readFile17(file, "utf8");
   let blocks;
   try {
     blocks = parseBlocks(raw, relativePath, spec);
@@ -9780,6 +9786,7 @@ function isModelTier(value) {
 var MODEL_TIERS, TIER_ALIASES, SKILL_TIER_KEY = "model_tier", TIER_DECLARATION;
 var init_model_tier = __esm(() => {
   init_model_version();
+  init_skill_frontmatter();
   MODEL_TIERS = ["light", "standard", "deep"];
   TIER_ALIASES = new Map([["cheap", "light"]]);
   TIER_DECLARATION = new RegExp(`^\\s*(?:[-*]\\s*)?"?(?:${SKILL_TIER_KEY}|model-tier|modelTier)"?\\s*[:=]\\s*(.+?)\\s*,?\\s*$`, "i");
@@ -9789,7 +9796,7 @@ var init_model_tier = __esm(() => {
 var CEILINGS_BY_KEY, SKILL_LENGTH_CEILINGS;
 var init_skill_length_ceilings = __esm(() => {
   CEILINGS_BY_KEY = {
-    "core/reviewer-skill-creator": 280,
+    "core/reviewer-skill-creator": 279,
     "orchestration/code-verifier": 339,
     "orchestration/context-collector": 671,
     "orchestration/feature-analyzer": 447,
@@ -11260,7 +11267,7 @@ var init_compile = __esm(() => {
 });
 
 // src/agents/export.ts
-import { readFile as readFile17, readdir as readdir9, lstat as lstat6, realpath as realpath7 } from "fs/promises";
+import { readFile as readFile18, readdir as readdir10, lstat as lstat6, realpath as realpath8 } from "fs/promises";
 import path41 from "path";
 function matrixStateToExportLevel(state) {
   return state === "native" || state === "adapter" ? state : "instruction-only";
@@ -11275,7 +11282,7 @@ function proseExportRelativePath(runtime, name) {
 async function readExistingFileContent(projectRoot, relativePath) {
   const absolute = path41.join(projectRoot, ...relativePath.split("/"));
   try {
-    return await readFile17(absolute, "utf8");
+    return await readFile18(absolute, "utf8");
   } catch (error) {
     if (isNotFound(error))
       return;
@@ -11307,7 +11314,7 @@ async function checkExportPathSafety(projectRoot, relativePath) {
     ancestor = parent;
   }
   try {
-    const [resolvedRoot, resolvedAncestor] = await Promise.all([realpath7(projectRoot), realpath7(ancestor)]);
+    const [resolvedRoot, resolvedAncestor] = await Promise.all([realpath8(projectRoot), realpath8(ancestor)]);
     if (!isPathInside(resolvedRoot, resolvedAncestor)) {
       return `refusing to write ${relativePath} \u2014 its resolved directory is outside the project root`;
     }
@@ -11487,7 +11494,7 @@ async function scanManagedAgentExports(projectRoot, runtime) {
     return { verified: [], handEdited: [] };
   let entries;
   try {
-    entries = await readdir9(dirAbsolute, { withFileTypes: true });
+    entries = await readdir10(dirAbsolute, { withFileTypes: true });
   } catch {
     return { verified: [], handEdited: [] };
   }
@@ -11508,7 +11515,7 @@ async function scanManagedAgentExports(projectRoot, runtime) {
       continue;
     let content;
     try {
-      content = await readFile17(absolute, "utf8");
+      content = await readFile18(absolute, "utf8");
     } catch {
       continue;
     }
@@ -11681,7 +11688,7 @@ var init_surfaces_agents = __esm(() => {
 });
 
 // src/lib/git-local-ignore.ts
-import { lstat as lstat7, mkdir as mkdir9, readFile as readFile18, realpath as realpath8, writeFile as writeFile6 } from "fs/promises";
+import { lstat as lstat7, mkdir as mkdir9, readFile as readFile19, realpath as realpath9, writeFile as writeFile6 } from "fs/promises";
 import path42 from "path";
 async function isPathIgnored(projectRoot, relativePath) {
   if (await resolveGitCommonDir(projectRoot) === undefined)
@@ -11768,7 +11775,7 @@ async function explainIgnoredPaths(projectRoot, relativePaths) {
     return [];
   const excludePath = path42.join(commonDir, "info", "exclude");
   const block = findManagedBlock(await readExcludeFile(excludePath).catch(() => ""), location.prefix);
-  const excludeReal = await realpath8(excludePath).catch(() => excludePath);
+  const excludeReal = await realpath9(excludePath).catch(() => excludePath);
   let fields;
   try {
     const proc = Bun.spawn(["git", "check-ignore", "--verbose", "--non-matching", "--no-index", "-z", "--stdin"], {
@@ -11799,7 +11806,7 @@ async function explainIgnoredPaths(projectRoot, relativePaths) {
     let sourcePath = sourcePaths.get(source);
     if (sourcePath === undefined) {
       const resolved = path42.resolve(location.toplevel, source);
-      sourcePath = await realpath8(resolved).catch(() => resolved);
+      sourcePath = await realpath9(resolved).catch(() => resolved);
       sourcePaths.set(source, sourcePath);
     }
     const ignored = !pattern.startsWith("!");
@@ -11848,7 +11855,7 @@ async function resolveWorktreeLocation(projectRoot) {
   }
 }
 async function readExcludeFile(excludePath) {
-  return readFile18(excludePath, "utf8").catch((error) => {
+  return readFile19(excludePath, "utf8").catch((error) => {
     if (error.code === "ENOENT" || error.code === "ENOTDIR")
       return "";
     throw error;
@@ -11868,7 +11875,7 @@ function refuseUnsafeLines(lines) {
   return;
 }
 async function refuseUnsafeExcludePath(commonDir, infoDir, excludePath) {
-  const commonDirReal = await realpath8(commonDir).catch(() => commonDir);
+  const commonDirReal = await realpath9(commonDir).catch(() => commonDir);
   for (const [target, label] of [
     [infoDir, "the git info directory"],
     [excludePath, "the git exclude file"]
@@ -11877,7 +11884,7 @@ async function refuseUnsafeExcludePath(commonDir, infoDir, excludePath) {
     if (stats === null)
       continue;
     if (stats.isSymbolicLink()) {
-      const real = await realpath8(target).catch(() => {
+      const real = await realpath9(target).catch(() => {
         return;
       });
       if (real === undefined)
@@ -11904,7 +11911,7 @@ var init_git_local_ignore = __esm(() => {
 });
 
 // src/lib/metaproject-gitignore.ts
-import { readFile as readFile19 } from "fs/promises";
+import { readFile as readFile20 } from "fs/promises";
 import path43 from "path";
 async function syncMetaprojectIgnoreRules(projectRoot, options = {}) {
   const notice = options.onNotice ?? (() => {});
@@ -11958,7 +11965,7 @@ async function moveBlockOutOfGitignore(projectRoot, notice) {
   const gitignorePath = path43.join(projectRoot, GITIGNORE);
   if (!await pathExists(gitignorePath))
     return false;
-  const content = await readFile19(gitignorePath, "utf8");
+  const content = await readFile20(gitignorePath, "utf8");
   if (!managedBlockPattern().test(content))
     return false;
   const head = await readHeadBlob(projectRoot, GITIGNORE);
@@ -12261,7 +12268,7 @@ var init_rules_export_target = __esm(() => {
 
 // src/integrations/surfaces-rules.ts
 import { readFileSync as readFileSync7 } from "fs";
-import { readFile as readFile20 } from "fs/promises";
+import { readFile as readFile21 } from "fs/promises";
 import path45 from "path";
 async function rulesSpec(root) {
   const { rules, skipped } = await collectCanonicalRules(root);
@@ -12389,7 +12396,7 @@ async function installIntoOverride(root, relativePath) {
   const refusal = await refuseEscapingSymlink(root, relativePath);
   if (refusal !== undefined)
     return { errors: [refusal], warnings };
-  const content = await readFile20(path45.join(root, ...relativePath.split("/")), "utf8");
+  const content = await readFile21(path45.join(root, ...relativePath.split("/")), "utf8");
   let next;
   try {
     next = withOverrideRulesSlot(content, spec.render());
@@ -12447,7 +12454,7 @@ async function inspectOverrideSlot(root, relativePath) {
 }
 async function readTextIfPresent(root, relativePath) {
   try {
-    return await readFile20(path45.join(root, ...relativePath.split("/")), "utf8");
+    return await readFile21(path45.join(root, ...relativePath.split("/")), "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -13118,11 +13125,11 @@ var init_integrations = __esm(() => {
 
 // src/security/audit-harness/surfaces.ts
 import path47 from "path";
-import { lstat as lstat8, readdir as readdir10, realpath as realpath9, stat as stat7 } from "fs/promises";
+import { lstat as lstat8, readdir as readdir11, realpath as realpath10, stat as stat8 } from "fs/promises";
 async function resolvesInsideRoot(root, absolute) {
   try {
-    const rootReal = await realpath9(root).catch(() => path47.resolve(root));
-    const real = await realpath9(absolute);
+    const rootReal = await realpath10(root).catch(() => path47.resolve(root));
+    const real = await realpath10(absolute);
     return isPathInside(rootReal, real);
   } catch {
     return false;
@@ -13160,7 +13167,7 @@ async function listFilesByExtensions(root, dirRelative, extensions) {
   }
   let entries;
   try {
-    entries = await readdir10(dirAbsolute, { withFileTypes: true });
+    entries = await readdir11(dirAbsolute, { withFileTypes: true });
   } catch {
     return { found: [], unreadable: [toPosix(dirRelative)] };
   }
@@ -13222,7 +13229,7 @@ async function walkScripts(root, dirRelative, depth, visited, acc) {
     acc.unreadable.push(toPosix(dirRelative));
     return;
   }
-  const dirReal = await realpath9(dirAbsolute).catch(() => {
+  const dirReal = await realpath10(dirAbsolute).catch(() => {
     return;
   });
   if (dirReal !== undefined) {
@@ -13232,7 +13239,7 @@ async function walkScripts(root, dirRelative, depth, visited, acc) {
   }
   let entries;
   try {
-    entries = await readdir10(dirAbsolute, { withFileTypes: true });
+    entries = await readdir11(dirAbsolute, { withFileTypes: true });
   } catch {
     acc.unreadable.push(toPosix(dirRelative));
     return;
@@ -13253,7 +13260,7 @@ async function walkScripts(root, dirRelative, depth, visited, acc) {
         acc.unreadable.push(toPosix(childRelative));
         continue;
       }
-      const stats = await stat7(absolute).catch(() => {
+      const stats = await stat8(absolute).catch(() => {
         return;
       });
       if (stats?.isDirectory()) {
@@ -14787,7 +14794,7 @@ var init_checks = __esm(() => {
 
 // src/security/audit-harness/baseline.ts
 import path48 from "path";
-import { readFile as readFile21 } from "fs/promises";
+import { readFile as readFile22 } from "fs/promises";
 function defaultBaselinePath(root) {
   return path48.join(root, ".metaproject", "security-audit-baseline.json");
 }
@@ -14862,7 +14869,7 @@ function indefiniteSuppressionFindings(applicableEntries) {
 }
 async function readRawBaselineFindingIds(filePath) {
   try {
-    const text = await readFile21(filePath, "utf8");
+    const text = await readFile22(filePath, "utf8");
     const parsed = JSON.parse(text);
     if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.entries)) {
       return [];
@@ -14887,7 +14894,7 @@ async function addBaselineEntry(root, entry, options = {}) {
       }
       const now = options.now ? options.now() : new Date;
       backupPath = `${filePath}.bak-${now.toISOString().replace(/[:.]/g, "-")}`;
-      const preResealBytes = await readFile21(filePath);
+      const preResealBytes = await readFile22(filePath);
       await writeContained(root, path48.relative(root, backupPath), preResealBytes);
       entries = loaded.state.entries;
       const rawIds = await readRawBaselineFindingIds(filePath);
@@ -14994,12 +15001,12 @@ var init_types2 = __esm(() => {
 
 // src/security/audit-harness/proposals.ts
 import path49 from "path";
-import { readFile as readFile22, realpath as realpath10 } from "fs/promises";
+import { readFile as readFile23, realpath as realpath11 } from "fs/promises";
 async function assertContained2(rootReal, absolute, label) {
   if (!isPathInside(rootReal, absolute)) {
     throw new Error(`Refusing to write ${label}: path escapes project root ${rootReal}.`);
   }
-  const real = await realpath10(absolute).catch(() => {
+  const real = await realpath11(absolute).catch(() => {
     return;
   });
   if (real !== undefined) {
@@ -15010,7 +15017,7 @@ async function assertContained2(rootReal, absolute, label) {
   }
   let dir = path49.dirname(absolute);
   for (;; ) {
-    const dirReal = await realpath10(dir).catch(() => {
+    const dirReal = await realpath11(dir).catch(() => {
       return;
     });
     if (dirReal !== undefined) {
@@ -15108,7 +15115,7 @@ function countOccurrences(haystack, needle) {
 async function applyTextEdit(rootReal, edit) {
   const absolute = path49.resolve(rootReal, edit.path);
   await assertContained2(rootReal, absolute, `target file "${edit.path}"`);
-  const content = await readFile22(absolute, "utf8");
+  const content = await readFile23(absolute, "utf8");
   const occurrences = countOccurrences(content, edit.from);
   if (occurrences === 0) {
     throw new Error(`Cannot apply proposal: expected text not found in ${edit.path}.`);
@@ -15133,7 +15140,7 @@ async function applyAuditProposal(root, proposalId, options = {}) {
   if (!PROPOSAL_ID_RE.test(proposalId)) {
     throw new Error(`Invalid proposal id: ${proposalId}`);
   }
-  const rootReal = await realpath10(root).catch(() => {
+  const rootReal = await realpath11(root).catch(() => {
     return;
   }) ?? path49.resolve(root);
   return withFileLock(lockPath2(rootReal), async () => {
@@ -15189,7 +15196,7 @@ var init_proposals = __esm(() => {
 // src/security/audit-harness/index.ts
 import { createHash as createHash7 } from "crypto";
 import path50 from "path";
-import { readFile as readFile23 } from "fs/promises";
+import { readFile as readFile24 } from "fs/promises";
 function findingId(f) {
   const pointerOrLine = f.location?.pointer ?? (f.location?.line !== undefined ? `line:${f.location.line}` : "");
   const policyId = f.evidence.policyId ?? "";
@@ -15214,14 +15221,14 @@ function compareFindings(a, b) {
 }
 async function safeReadText(absolute) {
   try {
-    return await readFile23(absolute, "utf8");
+    return await readFile24(absolute, "utf8");
   } catch {
     return;
   }
 }
 async function safeReadBuffer(absolute) {
   try {
-    return await readFile23(absolute);
+    return await readFile24(absolute);
   } catch {
     return;
   }
@@ -15819,7 +15826,7 @@ __export(exports_service, {
   verifyConfigChecksum: () => verifyConfigChecksum
 });
 import path51 from "path";
-import { readFile as readFile24 } from "fs/promises";
+import { readFile as readFile25 } from "fs/promises";
 import { randomBytes as randomBytes4 } from "crypto";
 function validateSerializedOutput(content, exemptExfil) {
   return validateSerializedContentForTransport(content, exemptExfil);
@@ -15952,7 +15959,7 @@ async function readLatestReport(cwd) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(await readFile24(file, "utf8"));
+    parsed = JSON.parse(await readFile25(file, "utf8"));
   } catch {
     return { kind: "unusable" };
   }
@@ -16072,9 +16079,9 @@ var init_service2 = __esm(() => {
 });
 
 // src/gdgraph/config.ts
-import path56 from "path";
+import path57 from "path";
 function gdgraphConfigPath(cwd) {
-  return path56.join(cwd, ".metaproject", "gdgraph.config.json");
+  return path57.join(cwd, ".metaproject", "gdgraph.config.json");
 }
 function mergeGdgraphConfig(parsed) {
   const base = DEFAULT_GDGRAPH_CONFIG;
@@ -16679,7 +16686,7 @@ var init_extract = __esm(() => {
 });
 
 // src/gdgraph/treesitter/grammars.ts
-import path57 from "path";
+import path58 from "path";
 function grammarAssetId(language) {
   return `tree-sitter-${language}`;
 }
@@ -16695,7 +16702,7 @@ function symbolLanguage(language) {
 async function resolveGrammar(cwd, language, grammarsPath) {
   const id = grammarAssetId(language);
   const lock = await loadAssetsLock(cwd);
-  const overrides = grammarsPath ? { [id]: { path: path57.join(grammarsPath, `${id}.wasm`) } } : undefined;
+  const overrides = grammarsPath ? { [id]: { path: path58.join(grammarsPath, `${id}.wasm`) } } : undefined;
   const registry = registryFromLock(lock, overrides);
   const resolved = await resolveAsset(registry, id);
   if (!resolved) {
@@ -16725,7 +16732,7 @@ function toGrammarLanguages(languages) {
   return out;
 }
 function grammarForFile(file, available) {
-  const ext = path57.extname(file);
+  const ext = path58.extname(file);
   const preference = ext === ".tsx" ? ["tsx", "typescript"] : ext === ".ts" ? ["typescript"] : ext === ".jsx" || ext === ".js" || ext === ".mjs" || ext === ".cjs" ? ["javascript"] : ext === ".java" ? ["java"] : ext === ".py" ? ["python"] : [];
   for (const language of preference) {
     if (available.includes(language)) {
@@ -16987,7 +16994,7 @@ var init_adapter = __esm(() => {
 
 // src/gdgraph/enrich.ts
 import { mkdir as mkdir13, writeFile as writeFile7 } from "fs/promises";
-import path58 from "path";
+import path59 from "path";
 async function enrichBuildWithSymbols(cwd, files, resolve) {
   const config = await loadGdgraphConfig(cwd);
   const treesitterConfig = {
@@ -17003,12 +17010,12 @@ async function enrichBuildWithSymbols(cwd, files, resolve) {
   return { enriched: true, symbols: layer.symbols.length, calls: layer.calls.length };
 }
 async function writeSymbolLayer(cwd, layer) {
-  const storageDir = path58.join(cwd, ".metaproject", "data", "gdgraph", "storage");
+  const storageDir = path59.join(cwd, ".metaproject", "data", "gdgraph", "storage");
   await mkdir13(storageDir, { recursive: true });
-  await writeFile7(path58.join(storageDir, "symbols.jsonl"), layer.symbols.map((symbol) => JSON.stringify(symbol)).join(`
+  await writeFile7(path59.join(storageDir, "symbols.jsonl"), layer.symbols.map((symbol) => JSON.stringify(symbol)).join(`
 `) + `
 `, "utf8");
-  await writeFile7(path58.join(storageDir, "calls.jsonl"), layer.calls.map((call) => JSON.stringify(call)).join(`
+  await writeFile7(path59.join(storageDir, "calls.jsonl"), layer.calls.map((call) => JSON.stringify(call)).join(`
 `) + `
 `, "utf8");
 }
@@ -17200,11 +17207,11 @@ var NOT_CODE_SCOPED = "none";
 var init_describes = () => {};
 
 // src/sync/provenance.ts
-import { mkdir as mkdir14, readFile as readFile28, writeFile as writeFile8 } from "fs/promises";
-import path59 from "path";
+import { mkdir as mkdir14, readFile as readFile29, writeFile as writeFile8 } from "fs/promises";
+import path60 from "path";
 import { spawn } from "child_process";
 function provenancePath(cwd, module) {
-  return path59.join(cwd, ".metaproject", "data", module, ".provenance.json");
+  return path60.join(cwd, ".metaproject", "data", module, ".provenance.json");
 }
 function gitCmdResult(cwd, args) {
   return new Promise((resolve) => {
@@ -17249,7 +17256,7 @@ async function recordProvenance(cwd, module, at) {
   if (!head)
     return;
   const file = provenancePath(cwd, module);
-  await mkdir14(path59.dirname(file), { recursive: true });
+  await mkdir14(path60.dirname(file), { recursive: true });
   const provenance = { commit: head.commit, branch: head.branch, builtAt: at };
   await writeFile8(file, `${JSON.stringify(provenance, null, 2)}
 `, "utf8");
@@ -17260,7 +17267,7 @@ async function readProvenance(cwd, module) {
     return null;
   }
   try {
-    const parsed = JSON.parse(await readFile28(file, "utf8"));
+    const parsed = JSON.parse(await readFile29(file, "utf8"));
     if (parsed && typeof parsed === "object" && typeof parsed.commit === "string") {
       return parsed;
     }
@@ -17273,8 +17280,8 @@ var init_provenance = __esm(() => {
 
 // src/gdgraph/staleness.ts
 import { spawn as spawn2 } from "child_process";
-import { stat as stat8 } from "fs/promises";
-import path60 from "path";
+import { stat as stat9 } from "fs/promises";
+import path61 from "path";
 function gitStatusPorcelain(cwd) {
   return new Promise((resolve) => {
     try {
@@ -17297,10 +17304,10 @@ function gitStatusPorcelain(cwd) {
   });
 }
 function nodesJsonlPath(cwd) {
-  return path60.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  return path61.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
 }
 function gdgraphConfigPath2(cwd) {
-  return path60.join(cwd, ".metaproject", "gdgraph.config.json");
+  return path61.join(cwd, ".metaproject", "gdgraph.config.json");
 }
 function categorizeStatusEntries(entries, rootPrefix) {
   const metaprojectPrefix = `${rootPrefix}.metaproject/`;
@@ -17360,7 +17367,7 @@ async function committedChangedFiles(cwd, fromCommit, toCommit, rootPrefix) {
   return diff.split("\x00").filter((entry) => entry.length > 0 && !entry.startsWith(metaprojectPrefix));
 }
 async function checkGraphStaleness(cwd) {
-  const nodesStat = await stat8(nodesJsonlPath(cwd)).catch(() => null);
+  const nodesStat = await stat9(nodesJsonlPath(cwd)).catch(() => null);
   if (!nodesStat) {
     return { status: "stale", reasons: ["graph has not been built yet (no nodes.jsonl)"] };
   }
@@ -17381,7 +17388,7 @@ async function checkGraphStaleness(cwd) {
       }
     } else {
       provenanceMissing = true;
-      const logsHeadStat = await stat8(path60.join(cwd, ".git", "logs", "HEAD")).catch(() => null);
+      const logsHeadStat = await stat9(path61.join(cwd, ".git", "logs", "HEAD")).catch(() => null);
       if (logsHeadStat && logsHeadStat.mtimeMs > nodesStat.mtimeMs) {
         reasons.push("repo HEAD moved since the graph was built (no build provenance recorded; inferred from .git/logs/HEAD)");
       }
@@ -17410,7 +17417,7 @@ async function checkGraphStaleness(cwd) {
         if (projectRelative === null) {
           continue;
         }
-        const fileStat = await stat8(path60.join(cwd, projectRelative)).catch(() => null);
+        const fileStat = await stat9(path61.join(cwd, projectRelative)).catch(() => null);
         if (fileStat && fileStat.mtimeMs > nodesStat.mtimeMs) {
           postBuildEdits.push(displayPath);
         }
@@ -17420,7 +17427,7 @@ async function checkGraphStaleness(cwd) {
       }
     }
   }
-  const configStat = await stat8(gdgraphConfigPath2(cwd)).catch(() => null);
+  const configStat = await stat9(gdgraphConfigPath2(cwd)).catch(() => null);
   if (configStat && configStat.mtimeMs > nodesStat.mtimeMs) {
     reasons.push("gdgraph.config.json changed since the graph was built");
   }
@@ -17545,19 +17552,19 @@ var init_types3 = __esm(() => {
 });
 
 // src/wiki/collect.ts
-import { readFile as readFile29, readdir as readdir11 } from "fs/promises";
-import path61 from "path";
+import { readFile as readFile30, readdir as readdir12 } from "fs/promises";
+import path62 from "path";
 function wikiRootPath(cwd) {
-  return path61.join(cwd, ".metaproject", "wiki");
+  return path62.join(cwd, ".metaproject", "wiki");
 }
 async function collectPages(cwd) {
   const root = wikiRootPath(cwd);
   const pages = [];
   for (const { type, folder } of WIKI_PAGE_TYPES) {
-    const dir = path61.join(root, folder);
+    const dir = path62.join(root, folder);
     let names;
     try {
-      names = await readdir11(dir);
+      names = await readdir12(dir);
     } catch (error) {
       if (isNotFound(error)) {
         continue;
@@ -17569,10 +17576,10 @@ async function collectPages(cwd) {
       if (!entry.endsWith(".md")) {
         continue;
       }
-      const absolutePath = path61.join(dir, entry);
+      const absolutePath = path62.join(dir, entry);
       let content;
       try {
-        content = await readFile29(absolutePath, "utf8");
+        content = await readFile30(absolutePath, "utf8");
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         throw new WikiCollectionError(absolutePath, `the wiki store could not be read (${message}). This is not the same as "no pages": ` + `${absolutePath} exists but could not be read.`);
@@ -18379,7 +18386,7 @@ var init_section_index = __esm(() => {
 });
 
 // src/security/guard.ts
-import path62 from "path";
+import path63 from "path";
 function prepareOutputForPersistence(guard, original) {
   if (!guard.allowed) {
     return { allowed: false, reason: guard.reason ?? "security gate blocked" };
@@ -18397,7 +18404,7 @@ function prepareOutputForPersistence(guard, original) {
   };
 }
 async function resolveManifestSecurityState(cwd) {
-  const manifestPath = path62.join(securityProjectRoot(cwd), ".metaproject", "metaproject.json");
+  const manifestPath = path63.join(securityProjectRoot(cwd), ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return { enabled: false, manifestUnreadable: false };
   }
@@ -18603,10 +18610,10 @@ var MEMORY_EMBEDDING_ID = "memory.embedding", DEFAULT_EMBED_DIMS = 96;
 
 // src/memory/embedding/index.ts
 import { createHash as createHash10 } from "crypto";
-import { mkdir as mkdir15, readFile as readFile30, writeFile as writeFile9 } from "fs/promises";
-import path63 from "path";
+import { mkdir as mkdir15, readFile as readFile31, writeFile as writeFile9 } from "fs/promises";
+import path64 from "path";
 function embeddingsDir(cwd) {
-  return path63.join(cwd, ".metaproject", "data", "memory", "embeddings");
+  return path64.join(cwd, ".metaproject", "data", "memory", "embeddings");
 }
 function entryText(entry) {
   return `${entry.title}
@@ -18635,24 +18642,24 @@ async function buildEmbeddingIndex(cwd, entries, embedder, model, now) {
   };
   const dir = embeddingsDir(cwd);
   await mkdir15(dir, { recursive: true });
-  await writeFile9(path63.join(dir, "index.meta.json"), `${JSON.stringify(meta, null, 2)}
+  await writeFile9(path64.join(dir, "index.meta.json"), `${JSON.stringify(meta, null, 2)}
 `, "utf8");
-  await writeFile9(path63.join(dir, "vectors.jsonl"), records.map((record) => JSON.stringify(record)).join(`
+  await writeFile9(path64.join(dir, "vectors.jsonl"), records.map((record) => JSON.stringify(record)).join(`
 `) + (records.length > 0 ? `
 ` : ""), "utf8");
   return toIndex(meta, records);
 }
 async function loadEmbeddingIndex(cwd) {
   const dir = embeddingsDir(cwd);
-  const metaPath = path63.join(dir, "index.meta.json");
-  const vectorsPath = path63.join(dir, "vectors.jsonl");
+  const metaPath = path64.join(dir, "index.meta.json");
+  const vectorsPath = path64.join(dir, "vectors.jsonl");
   if (!await pathExists(metaPath) || !await pathExists(vectorsPath)) {
     return null;
   }
   try {
-    const meta = JSON.parse(await readFile30(metaPath, "utf8"));
+    const meta = JSON.parse(await readFile31(metaPath, "utf8"));
     const records = [];
-    for (const line of (await readFile30(vectorsPath, "utf8")).split(`
+    for (const line of (await readFile31(vectorsPath, "utf8")).split(`
 `)) {
       if (line.trim().length === 0) {
         continue;
@@ -18726,10 +18733,10 @@ var init_embedding = __esm(() => {
 });
 
 // src/wiki/section-tombstone.ts
-import path64 from "path";
-import { stat as stat9 } from "fs/promises";
+import path65 from "path";
+import { stat as stat10 } from "fs/promises";
 function sectionRegistryPath(cwd) {
-  return path64.join(cwd, ".metaproject", "wiki", ".sections.json");
+  return path65.join(cwd, ".metaproject", "wiki", ".sections.json");
 }
 function emptySectionRegistry() {
   return { version: SECTION_REGISTRY_VERSION, entries: [], tombstones: [], lifted: [] };
@@ -18810,7 +18817,7 @@ function parseLifted(value) {
 async function readSectionRegistryState(cwd) {
   const file = sectionRegistryPath(cwd);
   try {
-    await stat9(file);
+    await stat10(file);
   } catch (error) {
     if (isNotFound(error)) {
       return { state: "absent", path: file };
@@ -19030,11 +19037,11 @@ var init_section_tombstone = __esm(() => {
 });
 
 // src/memory/cross-layer.ts
-import { readFile as readFile31 } from "fs/promises";
-import path65 from "path";
+import { readFile as readFile32 } from "fs/promises";
+import path66 from "path";
 function extractWikiReferences(entryRelativePath, entryAbsolutePath, content, wikiRoot) {
   const references = [];
-  const entryDir = path65.dirname(entryAbsolutePath);
+  const entryDir = path66.dirname(entryAbsolutePath);
   const lines = content.split(`
 `);
   for (let index = 0;index < lines.length; index += 1) {
@@ -19049,16 +19056,16 @@ function extractWikiReferences(entryRelativePath, entryAbsolutePath, content, wi
       if (withoutAnchor.length === 0) {
         continue;
       }
-      const absolute = path65.resolve(entryDir, withoutAnchor);
-      const relativeToWiki = path65.relative(wikiRoot, absolute);
-      if (relativeToWiki.startsWith("..") || path65.isAbsolute(relativeToWiki)) {
+      const absolute = path66.resolve(entryDir, withoutAnchor);
+      const relativeToWiki = path66.relative(wikiRoot, absolute);
+      if (relativeToWiki.startsWith("..") || path66.isAbsolute(relativeToWiki)) {
         continue;
       }
       references.push({
         entry: entryRelativePath,
         kind: "page-path",
         raw: href,
-        target: relativeToWiki.split(path65.sep).join("/"),
+        target: relativeToWiki.split(path66.sep).join("/"),
         line
       });
     }
@@ -19078,11 +19085,11 @@ function isDangling(finding) {
   return finding.state !== "intact";
 }
 async function loadWikiKnowledgeView(cwd) {
-  const wikiRoot = path65.join(cwd, ".metaproject", "wiki");
+  const wikiRoot = path66.join(cwd, ".metaproject", "wiki");
   const pages = await collectPages(cwd);
   const index = buildSectionIndex(await Promise.all(pages.map(async (page) => ({
     page,
-    content: await readFile31(page.absolutePath, "utf8").catch(() => "")
+    content: await readFile32(page.absolutePath, "utf8").catch(() => "")
   }))));
   return {
     index,
@@ -19195,7 +19202,7 @@ async function checkMemoryCrossLayer(cwd, entries, view) {
   const resolved = view ?? await loadWikiKnowledgeView(cwd);
   const findings = [];
   for (const entry of entries) {
-    const content = await readFile31(entry.absolutePath, "utf8").catch(() => null);
+    const content = await readFile32(entry.absolutePath, "utf8").catch(() => null);
     if (content === null) {
       findings.push({
         reference: {
@@ -19296,7 +19303,7 @@ function round2(value) {
 var init_dedup = () => {};
 
 // src/memory/check.ts
-import path66 from "path";
+import path67 from "path";
 async function checkMemory(cwd, config) {
   const entries = await collectEntries(cwd);
   const issues = [];
@@ -19312,7 +19319,7 @@ async function checkMemory(cwd, config) {
     }
     for (const file of entry.scopes.files) {
       const clean = file.replace(/^`|`$/g, "");
-      if (!await pathExists(path66.resolve(cwd, clean))) {
+      if (!await pathExists(path67.resolve(cwd, clean))) {
         issues.push({ path: entry.relativePath, kind: "link", message: `related file not found: ${clean}` });
       }
     }
@@ -19366,13 +19373,13 @@ var init_check = __esm(() => {
 });
 
 // src/memory/write.ts
-import { mkdir as mkdir16, open as open2, readFile as readFile32, rename as rename5, rm as rm4, writeFile as writeFile10 } from "fs/promises";
-import path67 from "path";
+import { mkdir as mkdir16, open as open2, readFile as readFile33, rename as rename5, rm as rm4, writeFile as writeFile10 } from "fs/promises";
+import path68 from "path";
 async function resolveCanonicalEntryPath(cwd, relativePath) {
-  const root = path67.resolve(memoryRoot(cwd));
-  const absolutePath = path67.resolve(root, relativePath);
-  const normalized = toPosix2(path67.relative(root, absolutePath));
-  if (!normalized || normalized.startsWith("../") || path67.isAbsolute(normalized) || !normalized.endsWith(".md")) {
+  const root = path68.resolve(memoryRoot(cwd));
+  const absolutePath = path68.resolve(root, relativePath);
+  const normalized = toPosix2(path68.relative(root, absolutePath));
+  if (!normalized || normalized.startsWith("../") || path68.isAbsolute(normalized) || !normalized.endsWith(".md")) {
     return null;
   }
   return { absolutePath, relativePath: normalized };
@@ -19407,7 +19414,7 @@ async function writeCanonicalPair(input) {
     return asPair(secondGuard.result, [first.value.relativePath]);
   const prepared = [firstGuard.value, secondGuard.value];
   const warnings = prepared.flatMap((entry) => entry.warnings);
-  const [originalFirst, originalSecond] = await Promise.all(prepared.map((entry) => readFile32(entry.absolutePath, "utf8")));
+  const [originalFirst, originalSecond] = await Promise.all(prepared.map((entry) => readFile33(entry.absolutePath, "utf8")));
   try {
     await replaceAtomically(prepared[0].absolutePath, prepared[0].content);
     if (input.failReplaceAt === 2)
@@ -19468,9 +19475,9 @@ function validateNextEntry(relativePath, content) {
   return null;
 }
 async function replaceAtomically(target, content) {
-  const dir = path67.dirname(target);
+  const dir = path68.dirname(target);
   await mkdir16(dir, { recursive: true });
-  const tmp = path67.join(dir, `.${path67.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
+  const tmp = path68.join(dir, `.${path68.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
   try {
     await writeFile10(tmp, content, "utf8");
     const file = await open2(tmp, "r");
@@ -19506,7 +19513,7 @@ function header(content, name) {
   return content.match(new RegExp(`^${name}:\\s*(.+)$`, "mi"))?.[1]?.trim() ?? null;
 }
 function toPosix2(value) {
-  return value.split(path67.sep).join("/");
+  return value.split(path68.sep).join("/");
 }
 function message(cause) {
   return cause instanceof Error ? cause.message : String(cause);
@@ -19519,14 +19526,14 @@ var init_write = __esm(() => {
 
 // src/memory/ingest.ts
 import { existsSync as existsSync6 } from "fs";
-import { readFile as readFile33 } from "fs/promises";
-import path68 from "path";
+import { readFile as readFile34 } from "fs/promises";
+import path69 from "path";
 async function ingestMemory(cwd, source, filePath, config, now) {
-  const absolute = path68.resolve(cwd, filePath);
+  const absolute = path69.resolve(cwd, filePath);
   if (!await pathExists(absolute)) {
     throw new Error(`Ingest source not found: ${filePath}`);
   }
-  const content = await readFile33(absolute, "utf8");
+  const content = await readFile34(absolute, "utf8");
   const candidates = extractCandidates2(content);
   const type = SOURCE_TYPE[source] ?? "lesson";
   const confidence = SOURCE_CONFIDENCE[source] ?? "low";
@@ -19539,8 +19546,8 @@ async function ingestMemory(cwd, source, filePath, config, now) {
   const securityWarnings = [];
   const securitySkipped = [];
   let skippedDuplicates = 0;
-  const dir = path68.join(memoryRoot(cwd), folder);
-  const link = path68.relative(cwd, absolute);
+  const dir = path69.join(memoryRoot(cwd), folder);
+  const link = path69.relative(cwd, absolute);
   const date = dateString(now);
   for (const text of candidates) {
     const title = toTitle(text);
@@ -19606,7 +19613,7 @@ async function ingestMemory(cwd, source, filePath, config, now) {
   return result;
 }
 async function reconcileEntry(cwd, relativePath, absolutePath, source, link, date) {
-  const content = await readFile33(absolutePath, "utf8");
+  const content = await readFile34(absolutePath, "utf8");
   const note = `- Reconciled: ${source} ${date}${link ? ` (${link})` : ""}`;
   if (content.includes(note)) {
     return { changed: false };
@@ -19721,7 +19728,7 @@ function uniqueSlug(dir, title) {
   const base = slugify2(title) || "entry";
   let slug = base;
   let counter = 2;
-  while (existsSync6(path68.join(dir, `${slug}.md`))) {
+  while (existsSync6(path69.join(dir, `${slug}.md`))) {
     slug = `${base}-${counter}`;
     counter += 1;
   }
@@ -19755,8 +19762,8 @@ var init_ingest = __esm(() => {
 });
 
 // src/memory/supersede.ts
-import { readFile as readFile34 } from "fs/promises";
-import path69 from "path";
+import { readFile as readFile35 } from "fs/promises";
+import path70 from "path";
 async function supersedeEntry(input, now) {
   const date = input.date ?? now.toISOString().slice(0, 10);
   const today = now.toISOString().slice(0, 10);
@@ -19768,8 +19775,8 @@ async function supersedeEntry(input, now) {
   if (!newResolved) {
     throw new Error(`Superseding entry not found: ${input.newPath}`);
   }
-  const oldContent = await readFile34(oldResolved.absolute, "utf8");
-  const newContent = await readFile34(newResolved.absolute, "utf8");
+  const oldContent = await readFile35(oldResolved.absolute, "utf8");
+  const newContent = await readFile35(newResolved.absolute, "utf8");
   if (headerValue(oldContent, "Superseded-By") === newResolved.relative && headerValue(newContent, "Supersedes") === oldResolved.relative) {
     return {
       superseded: oldResolved.relative,
@@ -19816,12 +19823,12 @@ async function supersedeEntry(input, now) {
 async function resolveEntryPath(cwd, raw) {
   const root = memoryRoot(cwd);
   const candidates = [
-    path69.resolve(cwd, raw),
-    path69.resolve(root, raw),
-    path69.isAbsolute(raw) ? raw : path69.join(cwd, raw)
+    path70.resolve(cwd, raw),
+    path70.resolve(root, raw),
+    path70.isAbsolute(raw) ? raw : path70.join(cwd, raw)
   ];
   for (const absolute of candidates) {
-    const confined = await resolveCanonicalEntryPath(cwd, path69.relative(root, absolute));
+    const confined = await resolveCanonicalEntryPath(cwd, path70.relative(root, absolute));
     if (confined && await pathExists(confined.absolutePath)) {
       return { absolute: confined.absolutePath, relative: confined.relativePath };
     }
@@ -20016,10 +20023,10 @@ __export(exports_service3, {
   selectHandoffEntries: () => selectHandoffEntries
 });
 import { createHash as createHash11 } from "crypto";
-import { mkdir as mkdir17, readFile as readFile35, writeFile as writeFile11 } from "fs/promises";
-import path70 from "path";
+import { mkdir as mkdir17, readFile as readFile36, writeFile as writeFile11 } from "fs/promises";
+import path71 from "path";
 function dataRoot2(cwd) {
-  return path70.join(cwd, ".metaproject", "data", "memory");
+  return path71.join(cwd, ".metaproject", "data", "memory");
 }
 function createMemoryService() {
   const reportStore = createMemoryReportStore();
@@ -20034,9 +20041,9 @@ function createMemoryService() {
       if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
         throw new Error(`Invalid slug: ${slug}. Use lowercase letters, digits, and hyphens.`);
       }
-      const dir = path70.join(memoryRoot(input.cwd), typeConfig.folder);
-      const filePath = path70.join(dir, `${slug}.md`);
-      const relativePath = path70.relative(input.cwd, filePath);
+      const dir = path71.join(memoryRoot(input.cwd), typeConfig.folder);
+      const filePath = path71.join(dir, `${slug}.md`);
+      const relativePath = path71.relative(input.cwd, filePath);
       if (await pathExists(filePath) && !input.force) {
         throw new Error(`Entry already exists: ${relativePath}. Use --force to overwrite.`);
       }
@@ -20067,9 +20074,9 @@ function createMemoryService() {
     async index(input) {
       const entries = await collectEntries(input.cwd);
       const generatedAt = new Date().toISOString();
-      const indexDir = path70.join(dataRoot2(input.cwd), "index");
+      const indexDir = path71.join(dataRoot2(input.cwd), "index");
       await mkdir17(indexDir, { recursive: true });
-      const indexPath = path70.join(indexDir, "index.json");
+      const indexPath = path71.join(indexDir, "index.json");
       await writeFile11(indexPath, `${JSON.stringify({
         catalogVersion: 1,
         sourceFingerprint: createHash11("sha256").update(JSON.stringify(entries.map((e) => ({
@@ -20090,7 +20097,7 @@ function createMemoryService() {
       }, null, 2)}
 `, "utf8");
       const result = {
-        path: path70.relative(input.cwd, indexPath),
+        path: path71.relative(input.cwd, indexPath),
         entryCount: entries.length,
         generatedAt
       };
@@ -20103,7 +20110,7 @@ function createMemoryService() {
           const built = await buildEmbeddingIndex(input.cwd, entries, embedder.embed, embedder.model, new Date);
           result.embeddings = {
             built: true,
-            path: path70.relative(input.cwd, embeddingsDir(input.cwd)),
+            path: path71.relative(input.cwd, embeddingsDir(input.cwd)),
             vectorCount: built.meta.entryCount,
             model: built.meta.model
           };
@@ -20143,7 +20150,7 @@ function createMemoryService() {
       }
       let content;
       try {
-        content = await readFile35(resolved.absolutePath, "utf8");
+        content = await readFile36(resolved.absolutePath, "utf8");
       } catch {
         return { path: resolved.relativePath, from: "draft", to: input.to, changed: false, error: { code: "not-found", message: `Memory entry not found: ${resolved.relativePath}` } };
       }
@@ -20334,7 +20341,7 @@ var init_service3 = __esm(() => {
 });
 
 // src/wiki/ask.ts
-import { readFile as readFile36 } from "fs/promises";
+import { readFile as readFile37 } from "fs/promises";
 async function wikiAsk(input) {
   const k = input.k && input.k > 0 ? input.k : DEFAULT_K;
   const asOf = input.asOf ? validateAsOf(input.asOf, new Date) : undefined;
@@ -20501,7 +20508,7 @@ async function wikiCandidates(cwd, observedAt, historicalMode, asOf) {
   }
   const index = buildSectionIndex(await Promise.all(admitted.map(async (page) => ({
     page,
-    content: await readFile36(page.absolutePath, "utf8").catch(() => "")
+    content: await readFile37(page.absolutePath, "utf8").catch(() => "")
   }))));
   const result = [];
   for (const section of index.sections) {
@@ -20705,7 +20712,7 @@ var init_ask = __esm(() => {
 });
 
 // src/wiki/backlinks.ts
-import path71 from "path";
+import path72 from "path";
 function extractCodePaths(content) {
   const out = [];
   let match;
@@ -20735,8 +20742,8 @@ function resolveLink(fromRepoPath, raw) {
   const clean = (raw.split("#")[0] ?? "").trim();
   if (!clean)
     return "";
-  const fromDir = path71.posix.dirname(fromRepoPath.split(path71.sep).join("/"));
-  return path71.posix.normalize(path71.posix.join(fromDir, clean));
+  const fromDir = path72.posix.dirname(fromRepoPath.split(path72.sep).join("/"));
+  return path72.posix.normalize(path72.posix.join(fromDir, clean));
 }
 function buildBacklinkIndex(pages) {
   const index = new Map;
@@ -20750,18 +20757,18 @@ function buildBacklinkIndex(pages) {
     }
   };
   for (const page of pages) {
-    const from = page.repoPath.split(path71.sep).join("/");
+    const from = page.repoPath.split(path72.sep).join("/");
     for (const raw of extractLinks(page.content))
       add(resolveLink(from, raw), from);
     for (const raw of extractCodePaths(page.content))
-      add(path71.posix.normalize(raw), from);
+      add(path72.posix.normalize(raw), from);
   }
   for (const list of index.values())
     list.sort();
   return index;
 }
 function backlinksFor(index, targetRepoPath) {
-  const key = path71.posix.normalize(targetRepoPath.split(path71.sep).join("/"));
+  const key = path72.posix.normalize(targetRepoPath.split(path72.sep).join("/"));
   return index.get(key) ?? [];
 }
 var LINK, CODE_SPAN, FILE_LIKE;
@@ -20774,7 +20781,7 @@ var init_backlinks = __esm(() => {
 // src/ctx/assembly.ts
 import { createHash as createHash12 } from "crypto";
 import { mkdir as mkdir18, rename as rename6, writeFile as writeFile12 } from "fs/promises";
-import path72 from "path";
+import path73 from "path";
 function assembleContext(input) {
   let items = 0;
   let tokens = 0;
@@ -20818,9 +20825,9 @@ async function recordNoContentContext(input) {
   return assembly;
 }
 async function recordContextAssembly(input) {
-  const directory = path72.join(input.workspaceRoot, ".metaproject", "context-operations", "traces");
+  const directory = path73.join(input.workspaceRoot, ".metaproject", "context-operations", "traces");
   await mkdir18(directory, { recursive: true });
-  const target = path72.join(directory, path72.basename(input.assembly.traceRef));
+  const target = path73.join(directory, path73.basename(input.assembly.traceRef));
   const temporary = `${target}.${process.pid}.tmp`;
   await writeFile12(temporary, `${JSON.stringify({ schemaVersion: "1.0", correlationId: input.correlationId, outcome: input.outcome, configurationRevision: input.assembly.configurationRevision, policy: { ref: input.assembly.policyRef, revision: input.assembly.policyRevision }, selected: input.assembly.selected, omittedOptional: input.assembly.omittedOptional, partial: input.assembly.partial })}
 `, { mode: 384 });
@@ -21670,16 +21677,16 @@ __export(exports_service4, {
 });
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash14 } from "crypto";
-import { mkdir as mkdir19, readFile as readFile37, readdir as readdir12, rm as rm5, writeFile as writeFile13 } from "fs/promises";
-import path73 from "path";
+import { mkdir as mkdir19, readFile as readFile38, readdir as readdir13, rm as rm5, writeFile as writeFile13 } from "fs/promises";
+import path74 from "path";
 function wikiRootPath2(cwd) {
-  return path73.join(cwd, ".metaproject", "wiki");
+  return path74.join(cwd, ".metaproject", "wiki");
 }
 function dataRootPath(cwd) {
-  return path73.join(cwd, ".metaproject", "data", "gdwiki");
+  return path74.join(cwd, ".metaproject", "data", "gdwiki");
 }
 function linkCheckReportPath(cwd) {
-  return path73.join(dataRootPath(cwd), "link-check", "latest.md");
+  return path74.join(dataRootPath(cwd), "link-check", "latest.md");
 }
 async function wikiStatus(cwd) {
   const root = wikiRootPath2(cwd);
@@ -21687,7 +21694,7 @@ async function wikiStatus(cwd) {
   const pages = enabled ? await collectPages(cwd) : [];
   return {
     enabled,
-    wikiRoot: path73.relative(cwd, root),
+    wikiRoot: path74.relative(cwd, root),
     totalPages: pages.length,
     countsByType: WIKI_PAGE_TYPES.map(({ type }) => ({
       type,
@@ -21702,7 +21709,7 @@ async function findPagesWithThinkTags(pages) {
   const flagged = [];
   for (const page of pages) {
     try {
-      const content = await readFile37(page.absolutePath, "utf8");
+      const content = await readFile38(page.absolutePath, "utf8");
       if (containsThinkTags(content)) {
         flagged.push(page.relativePath);
       }
@@ -21718,9 +21725,9 @@ async function wikiCreatePage(input) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(input.slug)) {
     throw new Error(`Invalid slug: ${input.slug}. Use lowercase letters, digits, and hyphens.`);
   }
-  const dir = path73.join(wikiRootPath2(input.cwd), typeConfig.folder);
-  const filePath = path73.join(dir, `${input.slug}.md`);
-  const relativePath = path73.relative(input.cwd, filePath);
+  const dir = path74.join(wikiRootPath2(input.cwd), typeConfig.folder);
+  const filePath = path74.join(dir, `${input.slug}.md`);
+  const relativePath = path74.relative(input.cwd, filePath);
   if (await pathExists(filePath) && !input.force) {
     throw new Error(`Page already exists: ${relativePath}. Use --force to overwrite.`);
   }
@@ -21731,13 +21738,13 @@ async function wikiCreatePage(input) {
 }
 async function wikiGenerateIndex(cwd) {
   const root = wikiRootPath2(cwd);
-  const indexPath = path73.join(root, "index.md");
+  const indexPath = path74.join(root, "index.md");
   const pages = await collectPages(cwd);
   const generatedAt = new Date().toISOString();
   const managedBlock = `${WIKI_INDEX_BEGIN}
 ${renderIndexBody(pages, generatedAt)}
 ${WIKI_INDEX_END}`;
-  const existing = await pathExists(indexPath) ? await readFile37(indexPath, "utf8") : renderWikiIndexScaffold();
+  const existing = await pathExists(indexPath) ? await readFile38(indexPath, "utf8") : renderWikiIndexScaffold();
   const pattern = new RegExp(`${escapeRegExp3(WIKI_INDEX_BEGIN)}[\\s\\S]*?${escapeRegExp3(WIKI_INDEX_END)}`);
   const replaced = pattern.test(existing) ? existing.replace(pattern, managedBlock) : `${existing.trimEnd()}
 
@@ -21749,7 +21756,7 @@ ${managedBlock}
   await mkdir19(root, { recursive: true });
   await writeFile13(indexPath, next, "utf8");
   return {
-    path: path73.relative(cwd, indexPath),
+    path: path74.relative(cwd, indexPath),
     pageCount: pages.length,
     generatedAt
   };
@@ -21757,13 +21764,13 @@ ${managedBlock}
 async function wikiCheckLinks(cwd) {
   const root = wikiRootPath2(cwd);
   const allFiles = await pathExists(root) ? await walkMarkdown(root) : [];
-  const files = allFiles.filter((absolutePath) => !path73.relative(root, absolutePath).startsWith(`templates${path73.sep}`));
+  const files = allFiles.filter((absolutePath) => !path74.relative(root, absolutePath).startsWith(`templates${path74.sep}`));
   const broken = [];
   let checkedLinks = 0;
   let skippedExternal = 0;
   for (const absolutePath of files) {
-    const content = await readFile37(absolutePath, "utf8");
-    const pageRelative = path73.relative(cwd, absolutePath);
+    const content = await readFile38(absolutePath, "utf8");
+    const pageRelative = path74.relative(cwd, absolutePath);
     for (const target of extractLinkTargets(content)) {
       if (EXTERNAL_LINK.test(target)) {
         skippedExternal += 1;
@@ -21774,7 +21781,7 @@ async function wikiCheckLinks(cwd) {
         continue;
       }
       checkedLinks += 1;
-      const resolved = path73.resolve(path73.dirname(absolutePath), filePart);
+      const resolved = path74.resolve(path74.dirname(absolutePath), filePart);
       if (!await pathExists(resolved)) {
         broken.push({
           page: pageRelative,
@@ -21786,7 +21793,7 @@ async function wikiCheckLinks(cwd) {
   }
   const generatedAt = new Date().toISOString();
   const reportPath = linkCheckReportPath(cwd);
-  await mkdir19(path73.dirname(reportPath), { recursive: true });
+  await mkdir19(path74.dirname(reportPath), { recursive: true });
   await writeFile13(reportPath, renderLinkCheckReport({
     generatedAt,
     checkedPages: files.length,
@@ -21795,7 +21802,7 @@ async function wikiCheckLinks(cwd) {
     broken
   }), "utf8");
   return {
-    reportPath: path73.relative(cwd, reportPath),
+    reportPath: path74.relative(cwd, reportPath),
     checkedPages: files.length,
     checkedLinks,
     skippedExternal,
@@ -21845,7 +21852,7 @@ async function wikiValidate(cwd) {
   }
   if (await isIndexStale(cwd, pages)) {
     issues.push({
-      page: path73.join(path73.relative(cwd, wikiRootPath2(cwd)), "index.md"),
+      page: path74.join(path74.relative(cwd, wikiRootPath2(cwd)), "index.md"),
       kind: "index",
       message: "index out of date, run `keryx wiki index`"
     });
@@ -21882,7 +21889,7 @@ async function wikiCollect(input) {
   };
 }
 async function wikiPruneOrphans(cwd) {
-  const componentsDir = path73.join(wikiRootPath2(cwd), "components");
+  const componentsDir = path74.join(wikiRootPath2(cwd), "components");
   if (!await pathExists(componentsDir)) {
     return { pruned: [], orphanedAccepted: [] };
   }
@@ -21891,7 +21898,7 @@ async function wikiPruneOrphans(cwd) {
   const validSlugs = new Set(candidates.filter((candidate) => candidate.type === "component").map((candidate) => candidate.slug));
   const pruned = [];
   const orphanedAccepted = [];
-  for (const entry of await readdir12(componentsDir)) {
+  for (const entry of await readdir13(componentsDir)) {
     if (!entry.endsWith(".md")) {
       continue;
     }
@@ -21899,25 +21906,25 @@ async function wikiPruneOrphans(cwd) {
     if (validSlugs.has(slug)) {
       continue;
     }
-    const filePath = path73.join(componentsDir, entry);
-    const current = await readFile37(filePath, "utf8");
+    const filePath = path74.join(componentsDir, entry);
+    const current = await readFile38(filePath, "utf8");
     const isUnmodifiedDraft = /\nStatus:\s*draft\s*\n/.test(current) && current.includes("Generated by `keryx wiki collect`");
     if (isUnmodifiedDraft) {
       await rm5(filePath);
-      pruned.push(path73.relative(cwd, filePath));
+      pruned.push(path74.relative(cwd, filePath));
     } else {
-      orphanedAccepted.push(path73.relative(cwd, filePath));
+      orphanedAccepted.push(path74.relative(cwd, filePath));
     }
   }
   return { pruned, orphanedAccepted };
 }
 async function validModuleNames(cwd) {
-  const nodesPath = path73.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  const nodesPath = path74.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
   if (!await pathExists(nodesPath)) {
     return;
   }
   const modules = new Set;
-  for (const node of parseJsonl(await readFile37(nodesPath, "utf8"))) {
+  for (const node of parseJsonl(await readFile38(nodesPath, "utf8"))) {
     if (node.kind === "asset")
       continue;
     const nodePath = String(node.path ?? node.id ?? "unknown");
@@ -21948,7 +21955,7 @@ async function wikiEvidence(input) {
   const pages = await collectPages(input.cwd);
   const index = buildSectionIndex(await Promise.all(pages.map(async (page) => ({
     page,
-    content: await readFile37(page.absolutePath, "utf8").catch(() => "")
+    content: await readFile38(page.absolutePath, "utf8").catch(() => "")
   }))));
   const registry = await readSectionRegistryState(input.cwd);
   const pageStatus = {};
@@ -21982,9 +21989,9 @@ async function wikiEvidence(input) {
   });
 }
 function resolveEvidenceScope(cwd, override) {
-  const absolute = path73.resolve(cwd);
+  const absolute = path74.resolve(cwd);
   return {
-    projectId: override?.projectId ?? (path73.basename(absolute) || "project"),
+    projectId: override?.projectId ?? (path74.basename(absolute) || "project"),
     checkoutId: override?.checkoutId ?? `checkout:${createHash14("sha256").update(absolute).digest("hex").slice(0, 16)}`,
     ...override?.workspaceId ? { workspaceId: override.workspaceId } : {},
     ...override?.taskId ? { taskId: override.taskId } : {}
@@ -21999,7 +22006,7 @@ function isMachineAuthoredPage(pageType, relativePath, content) {
   if (source === null) {
     return false;
   }
-  const normalised = relativePath.split(path73.sep).join("/").replace(/^wiki\//, "");
+  const normalised = relativePath.split(path74.sep).join("/").replace(/^wiki\//, "");
   return WIKI_PAGE_PRODUCERS.some((producer) => producer.source === source && producer.pageType === pageType && producer.path.test(normalised) && /^-[ \t]+Link:.*\bsha256\b/m.test(content));
 }
 function createGdWikiService() {
@@ -22015,8 +22022,8 @@ function createGdWikiService() {
   };
 }
 async function collectGraphWikiCandidates(cwd, generatedAt, limit, onlyModules) {
-  const nodesPath = path73.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path73.join(cwd, ".metaproject", "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path74.join(cwd, ".metaproject", "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path74.join(cwd, ".metaproject", "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return [];
   }
@@ -22025,7 +22032,7 @@ async function collectGraphWikiCandidates(cwd, generatedAt, limit, onlyModules)
   let nodes = 0;
   let files = 0;
   let assets = 0;
-  for (const node of parseJsonl(await readFile37(nodesPath, "utf8"))) {
+  for (const node of parseJsonl(await readFile38(nodesPath, "utf8"))) {
     nodes += 1;
     const nodePath = String(node.path ?? node.id ?? "unknown");
     if (node.kind === "asset") {
@@ -22047,7 +22054,7 @@ async function collectGraphWikiCandidates(cwd, generatedAt, limit, onlyModules)
   let edges = 0;
   let imports = 0;
   let unresolved = 0;
-  for (const edge of parseJsonl(await readFile37(edgesPath, "utf8"))) {
+  for (const edge of parseJsonl(await readFile38(edgesPath, "utf8"))) {
     edges += 1;
     const kind = String(edge.kind ?? "");
     if (kind === "unresolved") {
@@ -22200,12 +22207,12 @@ function topCounts(bucket, limit) {
   return [...bucket.entries()].sort((a, b) => b[1] - a[1]).slice(0, limit);
 }
 async function readModuleReadme(cwd, moduleName) {
-  const readmePath = path73.join(cwd, ...moduleName.split("/"), "README.md");
+  const readmePath = path74.join(cwd, ...moduleName.split("/"), "README.md");
   if (!await pathExists(readmePath)) {
     return null;
   }
   try {
-    const content = await readFile37(readmePath, "utf8");
+    const content = await readFile38(readmePath, "utf8");
     const paragraph = content.split(/\n\s*\n/).map((block) => block.trim()).find((block) => block.length > 0 && !block.startsWith("#"));
     if (!paragraph) {
       return null;
@@ -22221,12 +22228,12 @@ async function extractModuleExports(cwd, files) {
   const declRe = /export\s+(?:async\s+)?(?:default\s+)?(?:const|let|var|function|class|type|interface|enum)\s+([A-Za-z_$][\w$]*)/g;
   const braceRe = /export\s*\{([^}]+)\}/g;
   for (const file of files.slice(0, 4)) {
-    const filePath = path73.join(cwd, ...file.split("/"));
+    const filePath = path74.join(cwd, ...file.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
     try {
-      const content = (await readFile37(filePath, "utf8")).slice(0, 40000);
+      const content = (await readFile38(filePath, "utf8")).slice(0, 40000);
       let match;
       while ((match = declRe.exec(content)) !== null) {
         if (match[1]) {
@@ -22252,14 +22259,14 @@ async function extractModuleExports(cwd, files) {
 }
 async function extractModuleApi(cwd, files) {
   const names = await extractModuleExports(cwd, files);
-  const symbolsPath = path73.join(cwd, ".metaproject", "data", "gdgraph", "storage", "symbols.jsonl");
+  const symbolsPath = path74.join(cwd, ".metaproject", "data", "gdgraph", "storage", "symbols.jsonl");
   if (names.length === 0 || !await pathExists(symbolsPath)) {
     return names.map((name) => "`" + name + "`");
   }
   const fileSet = new Set(files);
   const kindByName = new Map;
   try {
-    for (const raw of parseJsonl(await readFile37(symbolsPath, "utf8"))) {
+    for (const raw of parseJsonl(await readFile38(symbolsPath, "utf8"))) {
       const symbol = raw;
       if (!symbol.name || !symbol.path || symbol.container != null)
         continue;
@@ -22278,11 +22285,11 @@ async function extractModuleApi(cwd, files) {
   });
 }
 async function collectHealthWikiCandidates(cwd, generatedAt) {
-  const healthPath = path73.join(cwd, ".metaproject", "data", "health", "artifacts", "latest.json");
+  const healthPath = path74.join(cwd, ".metaproject", "data", "health", "artifacts", "latest.json");
   if (!await pathExists(healthPath)) {
     return [];
   }
-  const report = JSON.parse(await readFile37(healthPath, "utf8"));
+  const report = JSON.parse(await readFile38(healthPath, "utf8"));
   const metrics = Array.isArray(report.metrics) ? report.metrics : [];
   const project = metrics.find((metric) => metric.key === "project") ?? {};
   const counts = project.findingCounts ?? {};
@@ -22320,11 +22327,11 @@ async function collectHealthWikiCandidates(cwd, generatedAt) {
   }];
 }
 async function collectTestingWikiCandidates(cwd, generatedAt) {
-  const contextPath = path73.join(cwd, ".metaproject", "data", "testing", "context.md");
+  const contextPath = path74.join(cwd, ".metaproject", "data", "testing", "context.md");
   if (!await pathExists(contextPath)) {
     return [];
   }
-  const context = await readFile37(contextPath, "utf8");
+  const context = await readFile38(contextPath, "utf8");
   const summary = firstMeaningfulLine(context) ?? "Generated from testing context.";
   return [{
     type: "architecture",
@@ -22351,14 +22358,14 @@ async function writeCollectedPage(cwd, candidate, force) {
   if (!folder) {
     throw new Error(`Unsupported collected wiki type: ${candidate.type}`);
   }
-  const filePath = path73.join(wikiRootPath2(cwd), folder, `${candidate.slug}.md`);
-  const relativePath = path73.relative(cwd, filePath);
+  const filePath = path74.join(wikiRootPath2(cwd), folder, `${candidate.slug}.md`);
+  const relativePath = path74.relative(cwd, filePath);
   const exists = await pathExists(filePath);
   if (exists && !force) {
     return { path: relativePath, type: candidate.type, source: candidate.source, action: "skipped" };
   }
   if (exists && force) {
-    const current = await readFile37(filePath, "utf8");
+    const current = await readFile38(filePath, "utf8");
     const isUnmodifiedDraft = /\nStatus:\s*draft\s*\n/.test(current) && current.includes("Generated by `keryx wiki collect`");
     if (!isUnmodifiedDraft) {
       return { path: relativePath, type: candidate.type, source: candidate.source, action: "skipped" };
@@ -22380,7 +22387,7 @@ async function writeCollectedPage(cwd, candidate, force) {
       securityReason: output.reason
     };
   }
-  await mkdir19(path73.dirname(filePath), { recursive: true });
+  await mkdir19(path74.dirname(filePath), { recursive: true });
   await writeFile13(filePath, output.content, "utf8");
   return {
     path: relativePath,
@@ -22392,8 +22399,8 @@ async function writeCollectedPage(cwd, candidate, force) {
 async function wikiPagesForFile(cwd, targetRepoPath) {
   const pages = await collectPages(cwd);
   const refs = await Promise.all(pages.map(async (page) => ({
-    repoPath: path73.relative(cwd, page.absolutePath).split(path73.sep).join("/"),
-    content: await readFile37(page.absolutePath, "utf8")
+    repoPath: path74.relative(cwd, page.absolutePath).split(path74.sep).join("/"),
+    content: await readFile38(page.absolutePath, "utf8")
   })));
   return backlinksFor(buildBacklinkIndex(refs), targetRepoPath);
 }
@@ -22431,11 +22438,11 @@ function renderIndexBody(pages, generatedAt) {
 `).trimEnd();
 }
 async function isIndexStale(cwd, pages) {
-  const indexPath = path73.join(wikiRootPath2(cwd), "index.md");
+  const indexPath = path74.join(wikiRootPath2(cwd), "index.md");
   if (!await pathExists(indexPath)) {
     return true;
   }
-  const content = await readFile37(indexPath, "utf8");
+  const content = await readFile38(indexPath, "utf8");
   const managed = content.match(new RegExp(`${escapeRegExp3(WIKI_INDEX_BEGIN)}([\\s\\S]*?)${escapeRegExp3(WIKI_INDEX_END)}`));
   if (!managed?.[1]) {
     return true;
@@ -22447,9 +22454,9 @@ function stripStamp(body) {
 }
 async function walkMarkdown(root) {
   const results = [];
-  const entries = await readdir12(root, { withFileTypes: true });
+  const entries = await readdir13(root, { withFileTypes: true });
   for (const entry of entries) {
-    const absolutePath = path73.join(root, entry.name);
+    const absolutePath = path74.join(root, entry.name);
     if (entry.isDirectory()) {
       results.push(...await walkMarkdown(absolutePath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -22506,11 +22513,11 @@ ${JSON.stringify(state, null, 2)}
 `;
 }
 async function readIndexGeneratedAt(cwd) {
-  const indexPath = path73.join(wikiRootPath2(cwd), "index.md");
+  const indexPath = path74.join(wikiRootPath2(cwd), "index.md");
   if (!await pathExists(indexPath)) {
     return null;
   }
-  const content = await readFile37(indexPath, "utf8");
+  const content = await readFile38(indexPath, "utf8");
   const match = content.match(/<!--\s*generated:\s*([^|]+?)\s*\|/);
   const value = match?.[1]?.trim();
   return value && value !== "never" ? value : null;
@@ -22520,7 +22527,7 @@ async function readLinkCheckState(cwd) {
   if (!await pathExists(reportPath)) {
     return null;
   }
-  const content = await readFile37(reportPath, "utf8");
+  const content = await readFile38(reportPath, "utf8");
   const matches = [...content.matchAll(/```json\n([\s\S]*?)```/g)];
   const last = matches.at(-1);
   if (!last?.[1]) {
@@ -22718,7 +22725,7 @@ async function validateStructure(cwd, pages, issues) {
   for (const page of pages) {
     let content;
     try {
-      content = await readFile37(page.absolutePath, "utf8");
+      content = await readFile38(page.absolutePath, "utf8");
     } catch {
       continue;
     }
@@ -22743,7 +22750,7 @@ async function validateStructure(cwd, pages, issues) {
       if (pattern.includes("*")) {
         continue;
       }
-      if (!await pathExists(path73.join(cwd, pattern))) {
+      if (!await pathExists(path74.join(cwd, pattern))) {
         issues.push({
           page: page.relativePath,
           kind: "describes",
@@ -22813,10 +22820,10 @@ var init_service4 = __esm(() => {
 
 // src/gdgraph/wiki-layer.ts
 import { createHash as createHash15 } from "crypto";
-import { mkdir as mkdir20, stat as stat10, writeFile as writeFile14 } from "fs/promises";
-import path74 from "path";
+import { mkdir as mkdir20, stat as stat11, writeFile as writeFile14 } from "fs/promises";
+import path75 from "path";
 function storageDir(projectRoot) {
-  return path74.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  return path75.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
 }
 function wikiPageId(relativePath) {
   return `wiki:${relativePath}`;
@@ -22882,11 +22889,11 @@ async function enrichBuildWithWikiLayer(input) {
   const mtimes = new Map;
   for (const record of input.fileRecords) {
     try {
-      const info = await stat10(path74.join(input.projectRoot, record.path));
+      const info = await stat11(path75.join(input.projectRoot, record.path));
       mtimes.set(record.path, info.mtimeMs);
     } catch {}
   }
-  await writeFile14(path74.join(dir, BUILD_MANIFEST_FILE), `${JSON.stringify({ version: 1, files: computeFingerprints(input.fileRecords, mtimes) }, null, 2)}
+  await writeFile14(path75.join(dir, BUILD_MANIFEST_FILE), `${JSON.stringify({ version: 1, files: computeFingerprints(input.fileRecords, mtimes) }, null, 2)}
 `, "utf8");
   const validModules = input.validModules !== undefined ? input.validModules : await (input.loadValidModules ?? defaultLoadValidModules)(input.projectRoot);
   const wikiPages = await collectPages(input.projectRoot);
@@ -22911,8 +22918,8 @@ async function enrichBuildWithWikiLayer(input) {
       version: page.version
     }))
   });
-  await writeJsonl(path74.join(dir, WIKI_PAGES_FILE), layer.pages);
-  await writeJsonl(path74.join(dir, DESCRIBES_FILE), layer.describes);
+  await writeJsonl(path75.join(dir, WIKI_PAGES_FILE), layer.pages);
+  await writeJsonl(path75.join(dir, DESCRIBES_FILE), layer.describes);
   return layer;
 }
 async function defaultLoadValidModules(projectRoot) {
@@ -22928,23 +22935,23 @@ var init_wiki_layer = __esm(() => {
 });
 
 // src/gdskills/contracts.ts
-import { readFile as readFile49 } from "fs/promises";
+import { readFile as readFile50 } from "fs/promises";
 import { existsSync as existsSync15 } from "fs";
-import path102 from "path";
+import path103 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 async function loadSchema(name) {
   const contract = CONTRACTS.find((entry) => entry.name === name);
   if (!contract) {
     throw new Error(`Unknown contract schema: ${name}`);
   }
-  const raw = await readFile49(contractPath(contract), "utf8");
+  const raw = await readFile50(contractPath(contract), "utf8");
   return JSON.parse(raw);
 }
 function contractPath(contract) {
-  const here = path102.dirname(fileURLToPath2(import.meta.url));
+  const here = path103.dirname(fileURLToPath2(import.meta.url));
   if (contract.sourcePath) {
-    for (const root of [path102.join(here, "..", ".."), path102.join(here, ".."), here]) {
-      const candidate = path102.resolve(root, contract.sourcePath);
+    for (const root of [path103.join(here, "..", ".."), path103.join(here, ".."), here]) {
+      const candidate = path103.resolve(root, contract.sourcePath);
       if (existsSync15(candidate)) {
         return candidate;
       }
@@ -22954,7 +22961,7 @@ function contractPath(contract) {
   if (existsSync15(directPath)) {
     return directPath;
   }
-  const packagedSourcePath = path102.join(here, "..", "src", "gdskills", "contracts", contract.fileName);
+  const packagedSourcePath = path103.join(here, "..", "src", "gdskills", "contracts", contract.fileName);
   if (existsSync15(packagedSourcePath)) {
     return packagedSourcePath;
   }
@@ -23185,8 +23192,8 @@ __export(exports_service2, {
   validateCriterionName: () => validateCriterionName,
   writeAcCheckCache: () => writeAcCheckCache
 });
-import { mkdir as mkdir12, readFile as readFile27 } from "fs/promises";
-import path55 from "path";
+import { mkdir as mkdir12, readFile as readFile28 } from "fs/promises";
+import path56 from "path";
 
 // src/flow/machine.ts
 var TRANSITIONS = {
@@ -24920,6 +24927,10 @@ function flowStateSchema() {
             type: "boolean",
             description: "Written by `flow init`. When true, `flow complete` fails the owner gate with a named reason while no owner is set, and passes it once one is. Absent on packages created before the gate existed, which report the gate `skipped` rather than `fail`."
           },
+          folderCommitted: {
+            type: "boolean",
+            description: "flow 384: written by `flow init`. When true, `flow complete` fails the folder-committed gate while the flow folder's flow.json is not in HEAD, and passes it once it is. Absent on packages created before the gate existed, which report the gate `skipped` rather than `fail`."
+          },
           confirmation: {
             type: "boolean",
             description: "flow 299: written by `flow init --require-confirmation`, or by `flow init` when `.metaproject/tasks.config.json` has `completion.require_confirmation: true`. When true, `flow complete` fails the confirmation gate unless `--confirm-token` carries a valid, unexpired, unspent token minted by `keryx flow confirm` for this flow and its current criteria checksum. Absent on every other flow, which reports the gate `skipped`."
@@ -25162,6 +25173,7 @@ function flowStateSchema() {
               "review",
               "base-branch",
               "owner",
+              "folder-committed",
               "confirmation"
             ]
           },
@@ -25895,7 +25907,7 @@ async function intentNoteForNewFlow(cwd, dir) {
 }
 // src/flow/check-ac.ts
 import { createHash as createHash8 } from "crypto";
-import { chmod as chmod4, mkdir as mkdir10, readFile as readFile25 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir10, readFile as readFile26 } from "fs/promises";
 import path52 from "path";
 
 // src/review/cost.ts
@@ -26084,7 +26096,7 @@ function factsOnlyVerdict(item) {
 }
 async function readAcCheckEnabled(cwd) {
   try {
-    const parsed = JSON.parse(await readFile25(path52.join(cwd, REVIEW_GATE_CONFIG_PATH), "utf8"));
+    const parsed = JSON.parse(await readFile26(path52.join(cwd, REVIEW_GATE_CONFIG_PATH), "utf8"));
     if (typeof parsed !== "object" || parsed === null)
       return false;
     const review = parsed["review"];
@@ -26111,7 +26123,7 @@ async function readAcCheckCache(cachePath) {
   if (!await pathExists(cachePath))
     return;
   try {
-    return JSON.parse(await readFile25(cachePath, "utf8"));
+    return JSON.parse(await readFile26(cachePath, "utf8"));
   } catch {
     return;
   }
@@ -26174,7 +26186,7 @@ function renderAcCheckAdvisoryNotice(verdicts) {
   return `acceptance-criteria check (advisory): ${counts.likelyMet} likely met, ${counts.notEvident} not evident, ${counts.notCheckable} not checkable` + (inDoubt.length > 0 ? ` \u2014 in doubt: ${inDoubt.join(", ")}` : "") + ` (\`keryx flow check-ac\` for detail)`;
 }
 // src/flow/allocation.ts
-import { appendFile as appendFile3, mkdir as mkdir11, readFile as readFile26 } from "fs/promises";
+import { appendFile as appendFile3, mkdir as mkdir11, readFile as readFile27 } from "fs/promises";
 import path54 from "path";
 
 // src/lib/clone-scope.ts
@@ -26239,7 +26251,7 @@ async function readAllocationLedger(scope) {
   if (!scope.ledgerPath || !await pathExists(scope.ledgerPath)) {
     return [];
   }
-  const content = await readFile26(scope.ledgerPath, "utf8");
+  const content = await readFile27(scope.ledgerPath, "utf8");
   const records = [];
   for (const line of content.split(`
 `)) {
@@ -26269,6 +26281,179 @@ async function recordAllocation(scope, record) {
 `, "utf8");
 }
 
+// src/flow/remote-flows.ts
+import path55 from "path";
+var MAX_REFS = 500;
+var CONCURRENCY = 8;
+async function runGit2(cwd, args) {
+  try {
+    const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "ignore" });
+    const stdout = await new Response(proc.stdout).text();
+    return { code: await proc.exited, stdout };
+  } catch {
+    return;
+  }
+}
+function lines(text) {
+  return text.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0);
+}
+function nulSplit(text) {
+  return text.split("\x00").filter((entry) => entry.length > 0);
+}
+function safeDirName(dir) {
+  let out = "";
+  for (const char of dir) {
+    const code = char.codePointAt(0) ?? 0;
+    if (code > 31 && (code < 127 || code > 159)) {
+      out += char;
+    }
+  }
+  return out;
+}
+async function showPrefix(cwd) {
+  const result = await runGit2(cwd, ["rev-parse", "--show-prefix"]);
+  if (result === undefined || result.code !== 0) {
+    return null;
+  }
+  return result.stdout.trim();
+}
+function rankOfRef(ref, headTargets) {
+  if (/^refs\/remotes\/[^/]+\/(main|master)$/.test(ref)) {
+    return 0;
+  }
+  return headTargets.has(ref) ? 1 : 2;
+}
+function orderRemoteRefs(entries, max = MAX_REFS) {
+  const headTargets = new Set(entries.map((entry) => entry.symref).filter((symref) => symref.length > 0));
+  const rank = (ref) => rankOfRef(ref, headTargets);
+  const candidates = entries.filter((entry) => entry.ref.startsWith("refs/remotes/") && !entry.ref.endsWith("/HEAD") && entry.symref === "").sort((a, b) => rank(a.ref) - rank(b.ref) || (a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0));
+  const seenTips = new Set;
+  const refs = [];
+  for (const entry of candidates) {
+    if (seenTips.has(entry.tip)) {
+      continue;
+    }
+    seenTips.add(entry.tip);
+    refs.push(entry.ref);
+    if (refs.length >= max) {
+      break;
+    }
+  }
+  return refs;
+}
+async function remoteRefs(cwd) {
+  const result = await runGit2(cwd, ["for-each-ref", "--format=%(objectname) %(refname) %(symref)", "refs/remotes/"]);
+  if (result === undefined || result.code !== 0) {
+    return [];
+  }
+  const entries = [];
+  for (const line of lines(result.stdout)) {
+    const [tip, ref, symref] = line.split(" ");
+    if (tip === undefined || ref === undefined) {
+      continue;
+    }
+    entries.push({ tip, ref, symref: symref ?? "" });
+  }
+  const headTargets = new Set(entries.map((entry) => entry.symref).filter((symref) => symref.length > 0));
+  return orderRemoteRefs(entries).map((ref) => ({ ref, primary: rankOfRef(ref, headTargets) < 2 }));
+}
+async function flowDirsOnRef(cwd, ref, flowsPath) {
+  const result = await runGit2(cwd, ["ls-tree", "-z", "-d", "--name-only", "--full-tree", ref, "--", `${flowsPath}/`]);
+  if (result === undefined || result.code !== 0) {
+    return [];
+  }
+  return nulSplit(result.stdout).map((entry) => path55.posix.basename(entry)).filter((name) => /^\d{3}-/.test(name));
+}
+async function knownRemoteFlowDirs(cwd) {
+  try {
+    const prefix = await showPrefix(cwd);
+    if (prefix === null) {
+      return [];
+    }
+    const refs = await remoteRefs(cwd);
+    if (refs.length === 0) {
+      return [];
+    }
+    const flowsPath = `${prefix}.metaproject/flows`;
+    const found = new Array(refs.length).fill([]);
+    let next = 0;
+    const worker = async () => {
+      while (next < refs.length) {
+        const index = next;
+        next += 1;
+        const entry = refs[index];
+        if (entry === undefined) {
+          continue;
+        }
+        const short = entry.ref.slice("refs/remotes/".length);
+        found[index] = (await flowDirsOnRef(cwd, entry.ref, flowsPath)).map((dir) => ({
+          ref: short,
+          dir,
+          primary: entry.primary
+        }));
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(CONCURRENCY, refs.length) }, () => worker()));
+    return found.flat();
+  } catch {
+    return [];
+  }
+}
+function flowNumberOfDir(dir) {
+  const dash = dir.indexOf("-");
+  return dash > 0 ? Number(dir.slice(0, dash)) : Number.NaN;
+}
+async function remoteFlowNumbers(cwd) {
+  const dirs = await knownRemoteFlowDirs(cwd);
+  const numbers = new Set;
+  for (const { dir } of dirs) {
+    const value = flowNumberOfDir(dir);
+    if (!Number.isNaN(value)) {
+      numbers.add(value);
+    }
+  }
+  return [...numbers].sort((a, b) => a - b);
+}
+
+// src/flow/folder-committed.ts
+var BATCH = 100;
+async function flowFoldersInHead(cwd, dirs) {
+  const prefix = await showPrefix(cwd);
+  if (prefix === null) {
+    return null;
+  }
+  const committed = new Set;
+  if (dirs.length === 0) {
+    return committed;
+  }
+  const head = await runGit2(cwd, ["rev-parse", "--verify", "-q", "HEAD"]);
+  if (head === undefined) {
+    return null;
+  }
+  if (head.code !== 0) {
+    return committed;
+  }
+  for (let start = 0;start < dirs.length; start += BATCH) {
+    const batch = dirs.slice(start, start + BATCH);
+    const paths = batch.map((dir) => `${prefix}.metaproject/flows/${dir}/flow.json`);
+    const result = await runGit2(cwd, ["ls-tree", "-z", "--name-only", "--full-tree", "HEAD", "--", ...paths]);
+    if (result === undefined) {
+      return null;
+    }
+    if (result.code !== 0) {
+      throw new Error(`could not read HEAD tree (git ls-tree exited ${result.code}); not treating the flow folders as uncommitted`);
+    }
+    const found = new Set(nulSplit(result.stdout));
+    for (const [index, dir] of batch.entries()) {
+      if (found.has(paths[index] ?? "")) {
+        committed.add(dir);
+      }
+    }
+  }
+  return committed;
+}
+
 // src/flow/templates.ts
 function renderDescription(title, source) {
   return `# ${title}
@@ -26353,7 +26538,7 @@ function renderJournal(createdAt) {
 
 // src/flow/service.ts
 async function deriveAcKinds(cwd, dir, flowId) {
-  const { report } = buildAcKindReport(flowId, await readFile27(acPath(cwd, dir), "utf8"));
+  const { report } = buildAcKindReport(flowId, await readFile28(acPath(cwd, dir), "utf8"));
   return { ...report.criteria };
 }
 function prMergeState(pr, gates) {
@@ -26384,6 +26569,7 @@ function prMergeState(pr, gates) {
 }
 var UNCONFIRMED_PREFIX = "unconfirmed: ";
 var NO_PR_DETAIL = "no PR recorded";
+var FOLDER_UNCOMMITTED_PREFIX = "flow folder ";
 function completionAdmitted(status, merged) {
   return canTransition(status, "completing") || merged && status === "in-progress";
 }
@@ -26409,6 +26595,10 @@ function completionFixHint(gate, flowId) {
       return "keryx health run";
     case "confirmation":
       return `keryx flow confirm ${flowId} (in a terminal)`;
+    case "folder-committed": {
+      const dir = gate.detail.startsWith(FOLDER_UNCOMMITTED_PREFIX) ? gate.detail.slice(FOLDER_UNCOMMITTED_PREFIX.length).split(" ")[0] : undefined;
+      return dir ? `git add .metaproject/flows/${dir} && git commit` : undefined;
+    }
     default:
       return;
   }
@@ -26541,6 +26731,11 @@ function createFlowService(deps) {
     }
     gates.push(taskGate(flow));
     gates.push(ownerGate(flow));
+    try {
+      gates.push(await folderCommittedGate(cwd, dir, flow));
+    } catch {
+      gates.push(unevaluableGate("folder-committed"));
+    }
     try {
       gates.push(await reviewGate({
         cwd,
@@ -26612,11 +26807,14 @@ function createFlowService(deps) {
       const title = input.title ?? context.issueTitle ?? provisionalTitle;
       const scope = await resolveAllocationScope(input.cwd);
       return withFileLock(scope.lockPath, async () => {
-        const id = await nextFlowId(input.cwd, await reservedIds(scope));
+        const id = await nextFlowId(input.cwd, [
+          ...await reservedIds(scope),
+          ...await remoteFlowNumbers(input.cwd)
+        ]);
         const date = now().slice(0, 10);
         const slug = slugify(input.slug ?? title);
         const dir = `${id}-${date}-${slug}`;
-        const absolute = path55.join(flowsRoot(input.cwd), dir);
+        const absolute = path56.join(flowsRoot(input.cwd), dir);
         if (await pathExists(absolute)) {
           throw new Error(`Flow directory already exists: ${dir}`);
         }
@@ -26628,6 +26826,7 @@ function createFlowService(deps) {
             tasks: true,
             review: true,
             owner: true,
+            folderCommitted: true,
             ...input.requireConfirmation === true || await readRequireConfirmationDefault(input.cwd) ? { confirmation: true } : {}
           },
           id,
@@ -26650,15 +26849,15 @@ function createFlowService(deps) {
           history: [{ at: createdAt, event: "created" }]
         };
         const sourceLabel = input.issue ?? "user description";
-        await writeFileAtomic(path55.join(absolute, "description.md"), renderDescription(title, sourceLabel));
-        await writeFileAtomic(path55.join(absolute, "context.md"), context.markdown);
-        await writeFileAtomic(path55.join(absolute, "plan.md"), renderPlan());
-        await writeFileAtomic(path55.join(absolute, "tasks.md"), renderTasksDoc());
-        await writeFileAtomic(path55.join(absolute, "acceptance-criteria.md"), renderAcceptanceCriteria());
-        await writeFileAtomic(path55.join(absolute, "journal.md"), renderJournal(createdAt));
+        await writeFileAtomic(path56.join(absolute, "description.md"), renderDescription(title, sourceLabel));
+        await writeFileAtomic(path56.join(absolute, "context.md"), context.markdown);
+        await writeFileAtomic(path56.join(absolute, "plan.md"), renderPlan());
+        await writeFileAtomic(path56.join(absolute, "tasks.md"), renderTasksDoc());
+        await writeFileAtomic(path56.join(absolute, "acceptance-criteria.md"), renderAcceptanceCriteria());
+        await writeFileAtomic(path56.join(absolute, "journal.md"), renderJournal(createdAt));
         await writeFlow(input.cwd, dir, flow);
         await recordAllocation(scope, { id, dir, at: createdAt, project: scope.project });
-        return { flow, dir: path55.relative(input.cwd, absolute), contextNotes: context.notes };
+        return { flow, dir: path56.relative(input.cwd, absolute), contextNotes: context.notes };
       });
     },
     async list({ cwd }) {
@@ -26883,7 +27082,7 @@ function createFlowService(deps) {
     },
     async acKinds({ cwd, id }) {
       const { dir, flow } = await load(cwd, id);
-      return buildAcKindReport(flow.id, await readFile27(acPath(cwd, dir), "utf8"));
+      return buildAcKindReport(flow.id, await readFile28(acPath(cwd, dir), "utf8"));
     },
     async acReseal({ cwd, id, reason }) {
       if (!reason?.trim()) {
@@ -27141,6 +27340,10 @@ function createFlowService(deps) {
         if ((await reservedIds(scope)).includes(Number(to))) {
           throw new Error(`Flow id ${to} was already used in this repository and cannot be reused. ` + "Pick a fresh number (see .metaproject/flows/id-map.json).");
         }
+        const remoteUse = (await knownRemoteFlowDirs(cwd)).find((entry) => flowNumberOfDir(entry.dir) === Number(to));
+        if (remoteUse) {
+          throw new Error(`Flow id ${to} is already used on ${remoteUse.ref} (${safeDirName(remoteUse.dir)}) and cannot be reused. ` + "Pick a fresh number.");
+        }
         const toDir = `${to}${fromDir.slice(3)}`;
         const { flow, reviewRecords } = await withFileLock(flowLockPath(cwd, fromDir), async () => {
           const reviewRecords = await moveFlowDirWithReviewRecords({ cwd, from, to, fromDir, toDir });
@@ -27176,6 +27379,42 @@ function createFlowService(deps) {
           });
         }
       }
+      const warnings = [];
+      const remoteDirs = await knownRemoteFlowDirs(cwd);
+      if (remoteDirs.length > 0) {
+        for (const dir of allDirs) {
+          const clashes = remoteDirs.filter((entry) => entry.dir !== dir && flowNumberOfDir(entry.dir) === Number(flowIdOf(dir)));
+          const primary = clashes.find((entry) => entry.primary);
+          const other = clashes[0];
+          if (primary) {
+            issues.push({
+              flow: dir,
+              kind: "duplicate-id",
+              message: `flow id ${flowIdOf(dir)} is also used on ${primary.ref} by a different flow (${safeDirName(primary.dir)})` + ` \u2014 repair with: keryx flow renumber ${dir} --to <free id> --reason "<why>"`
+            });
+          } else if (other) {
+            warnings.push({
+              flow: dir,
+              kind: "branch-duplicate-id",
+              message: `flow id ${flowIdOf(dir)} is also used on ${other.ref} by a different flow (${safeDirName(other.dir)});` + ` ignore it if that branch is stale, otherwise renumber one of them before it merges`
+            });
+          }
+        }
+      }
+      const inHead = await flowFoldersInHead(cwd, allDirs).catch(() => {
+        return null;
+      });
+      if (inHead !== null) {
+        for (const dir of allDirs) {
+          if (!inHead.has(dir)) {
+            warnings.push({
+              flow: dir,
+              kind: "untracked",
+              message: `flow folder ${dir} is not committed: commit it in the same PR as the code`
+            });
+          }
+        }
+      }
       for (const dir of allDirs) {
         let flow;
         try {
@@ -27192,7 +27431,7 @@ function createFlowService(deps) {
           issues.push({ flow: dir, kind: "schema", message: `unknown schemaVersion ${flow.schemaVersion}` });
         }
         try {
-          const raw = JSON.parse(await Bun.file(path55.join(flowsRoot(cwd), dir, "flow.json")).text());
+          const raw = JSON.parse(await Bun.file(path56.join(flowsRoot(cwd), dir, "flow.json")).text());
           const validation = validateAgainstSchemaObject(flowStateSchema(), raw);
           if (!validation.valid) {
             issues.push({
@@ -27203,7 +27442,7 @@ function createFlowService(deps) {
           }
         } catch {}
         for (const file of ["description.md", "context.md", "plan.md", "tasks.md", "acceptance-criteria.md", "journal.md"]) {
-          if (!await pathExists(path55.join(flowsRoot(cwd), dir, file))) {
+          if (!await pathExists(path56.join(flowsRoot(cwd), dir, file))) {
             issues.push({ flow: dir, kind: "structure", message: `missing ${file}` });
           }
         }
@@ -27237,15 +27476,15 @@ function createFlowService(deps) {
           });
         }
       }
-      return { ok: issues.length === 0, issues };
+      return { ok: issues.length === 0, issues, warnings };
     }
   };
 }
 async function appendIdMap(cwd, entry) {
-  const file = path55.join(flowsRoot(cwd), "id-map.json");
+  const file = path56.join(flowsRoot(cwd), "id-map.json");
   let entries = [];
   if (await pathExists(file)) {
-    const raw = await readFile27(file, "utf8");
+    const raw = await readFile28(file, "utf8");
     try {
       const parsed = JSON.parse(raw);
       if (!Array.isArray(parsed)) {
@@ -27253,7 +27492,7 @@ async function appendIdMap(cwd, entry) {
       }
       entries = parsed;
     } catch (error) {
-      throw new Error(`Cannot read ${path55.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`);
+      throw new Error(`Cannot read ${path56.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
   entries.push(entry);
@@ -27347,6 +27586,27 @@ function ownerGate(flow) {
   }
   return { name: "owner", status: "pass", detail: `owner: ${flow.owner.value}` };
 }
+async function folderCommittedGate(cwd, dir, flow) {
+  if (!flow.gates?.folderCommitted) {
+    return {
+      name: "folder-committed",
+      status: "skipped",
+      detail: "folder-committed gate not enabled for this package (created before the gate); " + "flows created by this keryx version opt in automatically"
+    };
+  }
+  const committed = await flowFoldersInHead(cwd, [dir]);
+  if (committed === null) {
+    return { name: "folder-committed", status: "skipped", detail: "not a git repository; nothing to compare the flow folder with" };
+  }
+  if (!committed.has(dir)) {
+    return {
+      name: "folder-committed",
+      status: "fail",
+      detail: `${FOLDER_UNCOMMITTED_PREFIX}${dir} is not committed. Commit it (git add .metaproject/flows/${dir} && git commit) ` + "in the PR that carries the code, then run flow complete again"
+    };
+  }
+  return { name: "folder-committed", status: "pass", detail: `${dir} is committed in HEAD` };
+}
 function confirmPreconditionError(flow, merged) {
   const confirmable = flow.status === "implemented" || flow.status === "in-progress" && merged;
   if (!confirmable) {
@@ -27504,9 +27764,9 @@ __export(exports_service5, {
 });
 
 // src/gdgraph/build.ts
-import { mkdir as mkdir21, readdir as readdir13, readFile as readFile38, writeFile as writeFile15 } from "fs/promises";
+import { mkdir as mkdir21, readdir as readdir14, readFile as readFile39, writeFile as writeFile15 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
-import path75 from "path";
+import path76 from "path";
 
 // src/gdgraph/types.ts
 var UNKNOWN_IMPORT_KIND = "unknown-static";
@@ -27571,8 +27831,8 @@ async function buildGraph(projectRoot) {
   const assetNodes = new Map;
   const fileRecords = [];
   for (const file of files) {
-    const absolutePath = path75.join(projectRoot, file);
-    const content = await readFile38(absolutePath, "utf8");
+    const absolutePath = path76.join(projectRoot, file);
+    const content = await readFile39(absolutePath, "utf8");
     fileRecords.push({ path: file, content });
     const language = getLanguage(file);
     const resolver = pickResolver(resolvers, language);
@@ -27624,24 +27884,24 @@ async function collectSourceFiles(projectRoot) {
   const result = [];
   const skippedDirectories = [];
   async function walk(relativeDir) {
-    const absoluteDir = path75.join(projectRoot, relativeDir);
-    const entries = await readdir13(absoluteDir, { withFileTypes: true });
+    const absoluteDir = path76.join(projectRoot, relativeDir);
+    const entries = await readdir14(absoluteDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (IGNORE_DIRS.has(entry.name)) {
-          skippedDirectories.push(normalizePath2(path75.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
+          skippedDirectories.push(normalizePath2(path76.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
           continue;
         }
-        await walk(normalizePath2(path75.posix.join(relativeDir, entry.name)));
+        await walk(normalizePath2(path76.posix.join(relativeDir, entry.name)));
         continue;
       }
       if (!entry.isFile()) {
         continue;
       }
-      if (!SOURCE_EXTENSIONS.includes(path75.extname(entry.name))) {
+      if (!SOURCE_EXTENSIONS.includes(path76.extname(entry.name))) {
         continue;
       }
-      result.push(normalizePath2(path75.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
+      result.push(normalizePath2(path76.posix.join(relativeDir, entry.name)).replace(/^\.\//, ""));
     }
   }
   await walk(".");
@@ -27723,8 +27983,8 @@ function resolveImport(projectRoot, fromFile, specifier, fileSet, resolver) {
 }
 function resolveAssetImport(projectRoot, fromFile, specifier, resolver) {
   for (const candidate of importCandidateBases(projectRoot, fromFile, specifier, resolver)) {
-    const extension = path75.posix.extname(candidate);
-    if (ASSET_EXTENSIONS.includes(extension) && existsSync7(path75.join(projectRoot, candidate))) {
+    const extension = path76.posix.extname(candidate);
+    if (ASSET_EXTENSIONS.includes(extension) && existsSync7(path76.join(projectRoot, candidate))) {
       return candidate;
     }
   }
@@ -27733,17 +27993,17 @@ function resolveAssetImport(projectRoot, fromFile, specifier, resolver) {
 function importCandidateBases(projectRoot, fromFile, specifier, resolver) {
   const normalizedSpecifier = stripImportSuffix(specifier);
   if (normalizedSpecifier.startsWith(".") && getLanguage(fromFile) !== "python") {
-    const fromDir = path75.posix.dirname(fromFile);
-    return [normalizePath2(path75.posix.normalize(path75.posix.join(fromDir, normalizedSpecifier)))];
+    const fromDir = path76.posix.dirname(fromFile);
+    return [normalizePath2(path76.posix.normalize(path76.posix.join(fromDir, normalizedSpecifier)))];
   }
-  return resolver.candidateBases(normalizedSpecifier, fromFile).map((candidate) => normalizePath2(path75.relative(projectRoot, path75.join(projectRoot, candidate))));
+  return resolver.candidateBases(normalizedSpecifier, fromFile).map((candidate) => normalizePath2(path76.relative(projectRoot, path76.join(projectRoot, candidate))));
 }
 function resolveSourceCandidate(base, fileSet) {
   const candidates = [
     base,
     ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => `${base}${extension}`),
-    ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => path75.posix.join(base, `index${extension}`)),
-    path75.posix.join(base, "__init__.py")
+    ...SOURCE_RESOLUTION_EXTENSIONS.map((extension) => path76.posix.join(base, `index${extension}`)),
+    path76.posix.join(base, "__init__.py")
   ];
   return candidates.find((candidate) => fileSet.has(candidate)) ?? null;
 }
@@ -27773,20 +28033,20 @@ async function loadJavaResolver(projectRoot) {
   return createJavaResolver(roots);
 }
 async function discoverJavaSourceRoots(projectRoot) {
-  const pomPath = path75.join(projectRoot, "pom.xml");
+  const pomPath = path76.join(projectRoot, "pom.xml");
   if (existsSync7(pomPath)) {
     try {
-      const roots = parseMavenSourceRoots(await readFile38(pomPath, "utf8"));
+      const roots = parseMavenSourceRoots(await readFile39(pomPath, "utf8"));
       if (roots.length > 0) {
         return roots;
       }
     } catch {}
   }
   for (const gradleName of ["build.gradle", "build.gradle.kts"]) {
-    const gradlePath = path75.join(projectRoot, gradleName);
+    const gradlePath = path76.join(projectRoot, gradleName);
     if (existsSync7(gradlePath)) {
       try {
-        const roots = parseGradleSourceRoots(await readFile38(gradlePath, "utf8"));
+        const roots = parseGradleSourceRoots(await readFile39(gradlePath, "utf8"));
         if (roots.length > 0) {
           return roots;
         }
@@ -27805,12 +28065,12 @@ function createJavaResolver(sourceRoots) {
         return [];
       }
       const relative = specifier.split(".").join("/");
-      return sourceRoots.map((root) => normalizePath2(path75.posix.join(root, relative)));
+      return sourceRoots.map((root) => normalizePath2(path76.posix.join(root, relative)));
     }
   };
 }
 function loadPythonResolver(projectRoot) {
-  const hasSrc = existsSync7(path75.join(projectRoot, "src"));
+  const hasSrc = existsSync7(path76.join(projectRoot, "src"));
   return createPythonResolver(hasSrc);
 }
 function createPythonResolver(hasSrc) {
@@ -27823,16 +28083,16 @@ function createPythonResolver(hasSrc) {
       if (specifier.startsWith(".")) {
         const dots = /^\.+/.exec(specifier)?.[0].length ?? 0;
         const rest = specifier.slice(dots);
-        let baseDir = path75.posix.dirname(fromFile);
+        let baseDir = path76.posix.dirname(fromFile);
         for (let level = 1;level < dots; level += 1) {
-          baseDir = path75.posix.dirname(baseDir);
+          baseDir = path76.posix.dirname(baseDir);
         }
         const suffix = rest ? rest.split(".").join("/") : "";
-        const base = suffix ? path75.posix.join(baseDir, suffix) : baseDir;
+        const base = suffix ? path76.posix.join(baseDir, suffix) : baseDir;
         return [normalizePath2(base)];
       }
       const relative = specifier.split(".").join("/");
-      return roots.map((root) => normalizePath2(root ? path75.posix.join(root, relative) : relative));
+      return roots.map((root) => normalizePath2(root ? path76.posix.join(root, relative) : relative));
     }
   };
 }
@@ -27841,8 +28101,8 @@ function parseMavenSourceRoots(pomXml) {
   for (const match of pomXml.matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
     const moduleDir = match[1]?.trim();
     if (moduleDir && !moduleDir.includes("${")) {
-      roots.add(normalizePath2(path75.posix.join(moduleDir, "src/main/java")));
-      roots.add(normalizePath2(path75.posix.join(moduleDir, "src/test/java")));
+      roots.add(normalizePath2(path76.posix.join(moduleDir, "src/main/java")));
+      roots.add(normalizePath2(path76.posix.join(moduleDir, "src/test/java")));
     }
   }
   for (const tag of ["sourceDirectory", "testSourceDirectory"]) {
@@ -27875,7 +28135,7 @@ function parseGradleSourceRoots(buildGradle) {
 var TSCONFIG_EXTENDS_MAX_DEPTH = 10;
 async function loadTsconfigResolver(projectRoot) {
   const empty = createTsconfigResolver(null, []);
-  const tsconfigPath = path75.join(projectRoot, "tsconfig.json");
+  const tsconfigPath = path76.join(projectRoot, "tsconfig.json");
   if (!existsSync7(tsconfigPath)) {
     return empty;
   }
@@ -27888,12 +28148,12 @@ async function loadTsconfigResolver(projectRoot) {
   return createTsconfigResolver(resolved.baseUrl, paths);
 }
 function toProjectRelativeDir(projectRoot, absoluteDir) {
-  const relative = normalizePath2(path75.relative(projectRoot, absoluteDir)).replace(/^\.\//, "");
+  const relative = normalizePath2(path76.relative(projectRoot, absoluteDir)).replace(/^\.\//, "");
   return relative === "." ? "" : relative;
 }
 async function readTsconfigJson(configPath) {
   try {
-    const raw = await readFile38(configPath, "utf8");
+    const raw = await readFile39(configPath, "utf8");
     return JSON.parse(stripJsonComments(raw));
   } catch {
     return null;
@@ -27903,11 +28163,11 @@ function resolveTsconfigExtendsPath(configDir, extendsSpecifier) {
   if (!extendsSpecifier.startsWith(".") && !extendsSpecifier.startsWith("/")) {
     return null;
   }
-  const resolved = path75.resolve(configDir, extendsSpecifier);
+  const resolved = path76.resolve(configDir, extendsSpecifier);
   return resolved.endsWith(".json") ? resolved : `${resolved}.json`;
 }
 async function resolveTsconfigOptions(configPath, visited, depth, projectRoot) {
-  const resolvedPath = path75.resolve(configPath);
+  const resolvedPath = path76.resolve(configPath);
   if (depth > TSCONFIG_EXTENDS_MAX_DEPTH || visited.has(resolvedPath)) {
     return null;
   }
@@ -27918,15 +28178,15 @@ async function resolveTsconfigOptions(configPath, visited, depth, projectRoot) {
   }
   let inherited = null;
   if (typeof parsed.extends === "string") {
-    const basePath = resolveTsconfigExtendsPath(path75.dirname(resolvedPath), parsed.extends);
+    const basePath = resolveTsconfigExtendsPath(path76.dirname(resolvedPath), parsed.extends);
     if (basePath) {
       inherited = await resolveTsconfigOptions(basePath, visited, depth + 1, projectRoot);
     }
   }
-  const configDir = path75.dirname(resolvedPath);
+  const configDir = path76.dirname(resolvedPath);
   const declaringDir = toProjectRelativeDir(projectRoot, configDir);
   const options = parsed.compilerOptions ?? {};
-  const ownBaseUrl = typeof options.baseUrl === "string" ? toProjectRelativeDir(projectRoot, path75.resolve(configDir, options.baseUrl)) : null;
+  const ownBaseUrl = typeof options.baseUrl === "string" ? toProjectRelativeDir(projectRoot, path76.resolve(configDir, options.baseUrl)) : null;
   const baseUrl = ownBaseUrl ?? inherited?.baseUrl ?? null;
   const ownPaths = isRecord4(options.paths) ? Object.entries(options.paths).filter((entry) => Array.isArray(entry[1])).map(([pattern, targets]) => ({
     pattern,
@@ -27955,7 +28215,7 @@ function createTsconfigResolver(baseUrl, mappings) {
         }
       }
       if (baseUrl !== null) {
-        candidates.push(normalizePath2(path75.posix.join(baseUrl, normalizedSpecifier)));
+        candidates.push(normalizePath2(path76.posix.join(baseUrl, normalizedSpecifier)));
       }
       return [...new Set(candidates.map((candidate) => candidate.replace(/^\.\//, "")))];
     }
@@ -27975,7 +28235,7 @@ function matchPathPattern(pattern, specifier) {
 }
 function applyPathTarget(base, target, wildcard) {
   const replaced = target.includes("*") ? target.replace("*", wildcard) : target;
-  return normalizePath2(path75.posix.normalize(path75.posix.join(base, replaced)));
+  return normalizePath2(path76.posix.normalize(path76.posix.join(base, replaced)));
 }
 function stripJsonComments(source) {
   let out = "";
@@ -28028,21 +28288,21 @@ function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function writeGraph(projectRoot, graph) {
-  const storageDir = path75.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
-  const artifactsDir = path75.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
+  const storageDir = path76.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  const artifactsDir = path76.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
   await mkdir21(storageDir, { recursive: true });
   await mkdir21(artifactsDir, { recursive: true });
-  await writeFile15(path75.join(storageDir, "nodes.jsonl"), graph.nodes.map((node) => JSON.stringify(node)).join(`
+  await writeFile15(path76.join(storageDir, "nodes.jsonl"), graph.nodes.map((node) => JSON.stringify(node)).join(`
 `) + `
 `, "utf8");
-  await writeFile15(path75.join(storageDir, "edges.jsonl"), graph.edges.map((edge) => JSON.stringify(edge)).join(`
+  await writeFile15(path76.join(storageDir, "edges.jsonl"), graph.edges.map((edge) => JSON.stringify(edge)).join(`
 `) + `
 `, "utf8");
-  await writeFile15(path75.join(artifactsDir, "module-map.json"), JSON.stringify(buildModuleMap(graph), null, 2) + `
+  await writeFile15(path76.join(artifactsDir, "module-map.json"), JSON.stringify(buildModuleMap(graph), null, 2) + `
 `, "utf8");
 }
 async function writeSummary(projectRoot, graph, collection) {
-  const artifactsDir = path75.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
+  const artifactsDir = path76.join(projectRoot, ".metaproject", "data", "gdgraph", "artifacts");
   await mkdir21(artifactsDir, { recursive: true });
   const unresolved = graph.edges.filter((edge) => edge.kind === "unresolved");
   const imports = graph.edges.filter((edge) => edge.kind === "imports");
@@ -28057,7 +28317,7 @@ async function writeSummary(projectRoot, graph, collection) {
 `);
   const skippedList = collection.skippedDirectories.length > 0 ? collection.skippedDirectories.slice(0, 30).map((dir) => `- \`${dir}\``).join(`
 `) : "- none";
-  const summaryPath = path75.join(artifactsDir, "summary.md");
+  const summaryPath = path76.join(artifactsDir, "summary.md");
   const content = `# gdgraph Summary
 
 ## Stats
@@ -28138,7 +28398,7 @@ function groupBy(items, getKey) {
 }
 function unresolvedType(specifier) {
   const stripped = stripImportSuffix(specifier);
-  const extension = path75.posix.extname(stripped);
+  const extension = path76.posix.extname(stripped);
   if (extension) {
     return extension;
   }
@@ -28148,13 +28408,13 @@ function unresolvedType(specifier) {
   return "package";
 }
 function normalizePath2(value) {
-  return value.split(path75.sep).join("/");
+  return value.split(path76.sep).join("/");
 }
 
 // src/gdgraph/target.ts
-import path76 from "path";
+import path77 from "path";
 function normalizeTarget(target) {
-  return target.replace(/^\.\//, "").split(path76.sep).join("/");
+  return target.replace(/^\.\//, "").split(path77.sep).join("/");
 }
 function resolveGraphTarget(graph, target) {
   const normalized = normalizeTarget(target);
@@ -28246,16 +28506,16 @@ function normalizeDepth(depth) {
 init_config3();
 
 // src/gdgraph/query.ts
-import { readFile as readFile39 } from "fs/promises";
-import path77 from "path";
+import { readFile as readFile40 } from "fs/promises";
+import path78 from "path";
 async function loadGraph(projectRoot) {
-  const storageDir = path77.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
-  const nodes = await readJsonl(path77.join(storageDir, "nodes.jsonl"));
-  const edges = await readJsonl(path77.join(storageDir, "edges.jsonl"));
-  const symbols = await readJsonl(path77.join(storageDir, "symbols.jsonl"));
-  const calls = await readJsonl(path77.join(storageDir, "calls.jsonl"));
-  const wikiPages = await readJsonl(path77.join(storageDir, "wiki-pages.jsonl"));
-  const describes = await readJsonl(path77.join(storageDir, "describes.jsonl"));
+  const storageDir = path78.join(projectRoot, ".metaproject", "data", "gdgraph", "storage");
+  const nodes = await readJsonl(path78.join(storageDir, "nodes.jsonl"));
+  const edges = await readJsonl(path78.join(storageDir, "edges.jsonl"));
+  const symbols = await readJsonl(path78.join(storageDir, "symbols.jsonl"));
+  const calls = await readJsonl(path78.join(storageDir, "calls.jsonl"));
+  const wikiPages = await readJsonl(path78.join(storageDir, "wiki-pages.jsonl"));
+  const describes = await readJsonl(path78.join(storageDir, "describes.jsonl"));
   const graph = { nodes, edges };
   if (symbols.length > 0) {
     graph.symbols = symbols;
@@ -28315,7 +28575,7 @@ async function bunfigPreloadRoots(projectRoot) {
   const roots = new Set;
   let text;
   try {
-    text = await readFile39(path77.join(projectRoot, "bunfig.toml"), "utf8");
+    text = await readFile40(path78.join(projectRoot, "bunfig.toml"), "utf8");
   } catch {
     return roots;
   }
@@ -28329,8 +28589,8 @@ async function bunfigPreloadRoots(projectRoot) {
       if (raw.length === 0) {
         continue;
       }
-      const absolute = path77.resolve(projectRoot, raw);
-      const relative = path77.relative(projectRoot, absolute).split(path77.sep).join("/");
+      const absolute = path78.resolve(projectRoot, raw);
+      const relative = path78.relative(projectRoot, absolute).split(path78.sep).join("/");
       roots.add(relative);
     }
   }
@@ -28379,7 +28639,7 @@ function getCycles(graph) {
 async function readJsonl(filePath) {
   let content;
   try {
-    content = await readFile39(filePath, "utf8");
+    content = await readFile40(filePath, "utf8");
   } catch {
     return [];
   }
@@ -28403,7 +28663,7 @@ function canonicalCycle(cycle) {
 
 // src/gdgraph/repomap.ts
 import { mkdir as mkdir22, writeFile as writeFile16 } from "fs/promises";
-import path78 from "path";
+import path79 from "path";
 
 // src/gdgraph/pagerank.ts
 function personalizedPageRank(nodes, edges, options) {
@@ -28514,7 +28774,7 @@ function overflowContent(required, missing, budget) {
 `);
 }
 function repomapArtifactPath(cwd) {
-  return path78.join(cwd, ".metaproject", "data", "gdgraph", "artifacts", "repomap.md");
+  return path79.join(cwd, ".metaproject", "data", "gdgraph", "artifacts", "repomap.md");
 }
 function buildRankEdges(graph, config) {
   const edges = [];
@@ -28659,7 +28919,7 @@ function computeRepomap(graph, config, options = {}) {
 async function writeRepomap(cwd, graph, config, options = {}) {
   const result = computeRepomap(graph, config, options);
   const artifactPath = repomapArtifactPath(cwd);
-  await mkdir22(path78.dirname(artifactPath), { recursive: true });
+  await mkdir22(path79.dirname(artifactPath), { recursive: true });
   await writeFile16(artifactPath, result.content, "utf8");
   return { ...result, path: artifactPath };
 }
@@ -28741,18 +29001,18 @@ init_section_tombstone();
 
 // src/forgetting/journal.ts
 init_fs();
-import { appendFile as appendFile4, mkdir as mkdir23, readFile as readFile40, stat as stat11 } from "fs/promises";
-import path79 from "path";
+import { appendFile as appendFile4, mkdir as mkdir23, readFile as readFile41, stat as stat12 } from "fs/promises";
+import path80 from "path";
 function forgettingDataDir(cwd) {
-  return path79.join(cwd, ".metaproject", "data", "forgetting");
+  return path80.join(cwd, ".metaproject", "data", "forgetting");
 }
 function deletionJournalPath(cwd) {
-  return path79.join(forgettingDataDir(cwd), "journal.jsonl");
+  return path80.join(forgettingDataDir(cwd), "journal.jsonl");
 }
 async function readDeletionJournal(cwd) {
   const file = deletionJournalPath(cwd);
   try {
-    await stat11(file);
+    await stat12(file);
   } catch (error) {
     if (isNotFound(error)) {
       return { state: "absent", path: file };
@@ -28766,7 +29026,7 @@ async function readDeletionJournal(cwd) {
   }
   let content;
   try {
-    content = await readFile40(file, "utf8");
+    content = await readFile41(file, "utf8");
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     return {
@@ -29166,12 +29426,12 @@ __export(exports_service7, {
   gateExitCode: () => gateExitCode,
   readWikiFreshnessMetric: () => readWikiFreshnessMetric
 });
-import path99 from "path";
+import path100 from "path";
 
 // src/health/config.ts
 init_fs();
 init_json();
-import path80 from "path";
+import path81 from "path";
 var DEFAULT_HEALTH_CONFIG = {
   schemaVersion: 2,
   ignore: {
@@ -29227,7 +29487,7 @@ var DEFAULT_HEALTH_CONFIG = {
   }
 };
 function configPath2(cwd) {
-  return path80.join(cwd, ".metaproject", "health.config.json");
+  return path81.join(cwd, ".metaproject", "health.config.json");
 }
 var STRICTEST_GATE = {
   failOnPriorities: ["P0", "P1", "P2", "P3"],
@@ -29278,7 +29538,7 @@ async function loadHealthConfig(cwd) {
 // src/health/run.ts
 init_fs();
 import { mkdir as mkdir27, writeFile as writeFile20 } from "fs/promises";
-import path98 from "path";
+import path99 from "path";
 
 // src/metrics/provenance.ts
 async function collectGitProvenance(cwd) {
@@ -29378,12 +29638,12 @@ function computeGate2(input) {
 }
 
 // src/health/scopes.ts
-import path83 from "path";
+import path84 from "path";
 
 // src/health/util.ts
 init_fs();
-import { mkdir as mkdir24, readFile as readFile41, readdir as readdir14, writeFile as writeFile17 } from "fs/promises";
-import path81 from "path";
+import { mkdir as mkdir24, readFile as readFile42, readdir as readdir15, writeFile as writeFile17 } from "fs/promises";
+import path82 from "path";
 var IGNORED_DIRS = new Set([
   "node_modules",
   ".git",
@@ -29427,14 +29687,14 @@ async function toolVersion(command, cwd) {
   }
 }
 function dataRoot3(cwd) {
-  return path81.join(cwd, ".metaproject", "data", "health");
+  return path82.join(cwd, ".metaproject", "data", "health");
 }
 async function writeRaw(cwd, source, content, stamp) {
-  const dir = path81.join(dataRoot3(cwd), "raw", source);
+  const dir = path82.join(dataRoot3(cwd), "raw", source);
   await mkdir24(dir, { recursive: true });
-  const file = path81.join(dir, `${stamp}.log`);
+  const file = path82.join(dir, `${stamp}.log`);
   await writeFile17(file, content, "utf8");
-  return path81.relative(cwd, file);
+  return path82.relative(cwd, file);
 }
 async function listSourceFiles(cwd, ignorePaths = []) {
   const { files } = await listSourceFilesWithReasons(cwd, ignorePaths);
@@ -29452,9 +29712,9 @@ async function listSourceFilesWithReasons(cwd, ignorePaths = []) {
 async function walk2(root, dir, out, incompleteReasons) {
   let entries;
   try {
-    entries = await readdir14(dir, { withFileTypes: true });
+    entries = await readdir15(dir, { withFileTypes: true });
   } catch (error) {
-    incompleteReasons.push(`${path81.relative(root, dir) || "."}: ${error instanceof Error ? error.message : String(error)}`);
+    incompleteReasons.push(`${path82.relative(root, dir) || "."}: ${error instanceof Error ? error.message : String(error)}`);
     return;
   }
   for (const entry of entries) {
@@ -29462,14 +29722,14 @@ async function walk2(root, dir, out, incompleteReasons) {
       if (entry.isDirectory() && !IGNORED_DIRS.has(entry.name)) {}
       continue;
     }
-    const abs = path81.join(dir, entry.name);
+    const abs = path82.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) {
         continue;
       }
       await walk2(root, abs, out, incompleteReasons);
-    } else if (entry.isFile() && SOURCE_EXT.has(path81.extname(entry.name))) {
-      out.push(path81.relative(root, abs));
+    } else if (entry.isFile() && SOURCE_EXT.has(path82.extname(entry.name))) {
+      out.push(path82.relative(root, abs));
     }
   }
 }
@@ -29484,7 +29744,7 @@ function moduleOfFile(file) {
   return null;
 }
 function isSourceFile(file) {
-  return SOURCE_EXT.has(path81.extname(file));
+  return SOURCE_EXT.has(path82.extname(file));
 }
 function matchesAnyPattern(file, patterns) {
   const normalized = file.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -29583,8 +29843,8 @@ function rankHotspots(files, churn, sourceAnalysis) {
 
 // src/health/source-analysis.ts
 init_fs();
-import { readFile as readFile42 } from "fs/promises";
-import path82 from "path";
+import { readFile as readFile43 } from "fs/promises";
+import path83 from "path";
 
 // src/health/metrics/complexity.ts
 var CONTROL_KEYWORDS = new Set([
@@ -29818,11 +30078,11 @@ async function analyzeSourceFiles(cwd, sourceFiles) {
   return new Map(entries.filter((entry) => entry !== null));
 }
 async function analyzeSourceFile(cwd, file) {
-  const abs = path82.join(cwd, file);
+  const abs = path83.join(cwd, file);
   if (!await pathExists(abs)) {
     return null;
   }
-  const content = await readFile42(abs, "utf8");
+  const content = await readFile43(abs, "utf8");
   return [
     file,
     {
@@ -29891,14 +30151,14 @@ async function computeMetrics(input) {
   }
   const components = new Map;
   for (const file of sourceFiles) {
-    const dir = path83.posix.dirname(file);
+    const dir = path84.posix.dirname(file);
     if (dir === "." || dir === moduleOfFile(file)) {
       continue;
     }
     components.set(dir, [...components.get(dir) ?? [], file]);
   }
   for (const [name, files] of [...components.entries()].sort()) {
-    const compFindings = findings.filter((f) => f.file && path83.posix.dirname(f.file) === name);
+    const compFindings = findings.filter((f) => f.file && path84.posix.dirname(f.file) === name);
     scopes.push(build("component", `component:${name}`, name, files, compFindings, averageCoverage(files, coverage)));
   }
   const findingFiles = findings.map((f) => f.file).filter((f) => Boolean(f));
@@ -29942,10 +30202,10 @@ function tally2(values) {
 
 // src/health/baseline.ts
 init_fs();
-import { mkdir as mkdir25, readFile as readFile43, writeFile as writeFile18 } from "fs/promises";
-import path84 from "path";
+import { mkdir as mkdir25, readFile as readFile44, writeFile as writeFile18 } from "fs/promises";
+import path85 from "path";
 function baselinePath(cwd) {
-  return path84.join(cwd, ".metaproject", "health", "baselines", "scores.json");
+  return path85.join(cwd, ".metaproject", "health", "baselines", "scores.json");
 }
 async function loadBaseline(cwd) {
   const file = baselinePath(cwd);
@@ -29953,7 +30213,7 @@ async function loadBaseline(cwd) {
     return new Map;
   }
   try {
-    const data = JSON.parse(await readFile43(file, "utf8"));
+    const data = JSON.parse(await readFile44(file, "utf8"));
     return new Map(Object.entries(data.scopes ?? {}));
   } catch {
     return new Map;
@@ -29977,7 +30237,7 @@ async function writeBaseline(cwd, metrics, generatedAt, selector) {
     scopes[key] = value;
   }
   const file = baselinePath(cwd);
-  await mkdir25(path84.dirname(file), { recursive: true });
+  await mkdir25(path85.dirname(file), { recursive: true });
   await writeFile18(file, `${JSON.stringify({ generatedAt, scopes }, null, 2)}
 `, "utf8");
   return updated;
@@ -30030,11 +30290,11 @@ async function getChurn(cwd, windowDays) {
 }
 
 // src/health/metrics/wiki-freshness.ts
-import { readFile as readFile44, stat as stat12 } from "fs/promises";
-import path85 from "path";
+import { readFile as readFile45, stat as stat13 } from "fs/promises";
+import path86 from "path";
 var DEFAULT_STALE_EVIDENCE_DAYS = 7;
 function freshnessReportPath(cwd) {
-  return path85.join(cwd, ".metaproject", "data", "wiki", "freshness", "latest.json");
+  return path86.join(cwd, ".metaproject", "data", "wiki", "freshness", "latest.json");
 }
 async function readWikiFreshnessMetric(cwd, options = {}) {
   const file = freshnessReportPath(cwd);
@@ -30042,7 +30302,7 @@ async function readWikiFreshnessMetric(cwd, options = {}) {
   const now = (options.now ?? (() => new Date))();
   let raw;
   try {
-    raw = await readFile44(file, "utf8");
+    raw = await readFile45(file, "utf8");
   } catch {
     return {
       status: "no-report",
@@ -30055,7 +30315,7 @@ async function readWikiFreshnessMetric(cwd, options = {}) {
   } catch {
     return {
       status: "unreadable-report",
-      reason: `${path85.relative(cwd, file)} is not valid JSON; re-run \`keryx wiki freshness\`.`
+      reason: `${path86.relative(cwd, file)} is not valid JSON; re-run \`keryx wiki freshness\`.`
     };
   }
   const report = parsed;
@@ -30065,7 +30325,7 @@ async function readWikiFreshnessMetric(cwd, options = {}) {
   if (pagesTotal === null || pagesFresh === null) {
     return {
       status: "unreadable-report",
-      reason: `${path85.relative(cwd, file)} is missing its totals; re-run \`keryx wiki freshness\`.`
+      reason: `${path86.relative(cwd, file)} is missing its totals; re-run \`keryx wiki freshness\`.`
     };
   }
   const pagesUndecidable = numberOr2(totals.pagesUndecidable) ?? 0;
@@ -30102,7 +30362,7 @@ async function reportAgeDays(file, generatedAt, now) {
     return Math.floor((now.getTime() - stamped) / 86400000);
   }
   try {
-    const info = await stat12(file);
+    const info = await stat13(file);
     return Math.floor((now.getTime() - info.mtimeMs) / 86400000);
   } catch {
     return null;
@@ -30119,12 +30379,12 @@ function renderWikiFreshnessLine(metric) {
 }
 
 // src/health/sources/helpers.ts
-import path86 from "path";
+import path87 from "path";
 import { existsSync as existsSync8 } from "fs";
 class NoImportError extends Error {
 }
 function resolveBin(cwd, name) {
-  const local = path86.join(cwd, "node_modules", ".bin", name);
+  const local = path87.join(cwd, "node_modules", ".bin", name);
   if (existsSync8(local)) {
     return local;
   }
@@ -30205,13 +30465,13 @@ async function getComplexityFindings(cwd, sourceFiles, config, sourceAnalysis) {
 
 // src/health/metrics/coverage.ts
 import { existsSync as existsSync9 } from "fs";
-import path87 from "path";
+import path88 from "path";
 var SUMMARY_PATHS = [
   "coverage/coverage-summary.json",
   "coverage/coverage-final.json"
 ];
 async function getCoverage(cwd) {
-  const summary = SUMMARY_PATHS.map((rel) => path87.join(cwd, rel)).find((abs) => existsSync9(abs));
+  const summary = SUMMARY_PATHS.map((rel) => path88.join(cwd, rel)).find((abs) => existsSync9(abs));
   if (!summary) {
     return { status: "missing", total: null, byFile: new Map };
   }
@@ -30232,7 +30492,7 @@ async function getCoverage(cwd) {
       total = pct;
       continue;
     }
-    const relative = path87.isAbsolute(key) ? path87.relative(cwd, key) : key;
+    const relative = path88.isAbsolute(key) ? path88.relative(cwd, key) : key;
     byFile.set(relative.replace(/\\/g, "/"), pct);
   }
   return { status: "available", total, byFile };
@@ -30364,17 +30624,17 @@ function renderWikiFreshness(metric) {
 
 // src/health/skills.ts
 init_fs();
-import { readFile as readFile45 } from "fs/promises";
-import path88 from "path";
+import { readFile as readFile46 } from "fs/promises";
+import path89 from "path";
 var EMPTY = { skills: [], skillForFile: () => null };
 async function loadSkillOwnership(cwd) {
-  const manifestPath = path88.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path89.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return EMPTY;
   }
   let registry;
   try {
-    const manifest = JSON.parse(await readFile45(manifestPath, "utf8"));
+    const manifest = JSON.parse(await readFile46(manifestPath, "utf8"));
     registry = manifest.modules?.gdskills?.projectSkillRegistry ?? [];
   } catch {
     return EMPTY;
@@ -30406,7 +30666,7 @@ function normalize(value) {
 
 // src/health/sources/eslint.ts
 import { existsSync as existsSync10 } from "fs";
-import path89 from "path";
+import path90 from "path";
 var CONFIG_FILES = [
   ".eslintrc",
   ".eslintrc.js",
@@ -30420,7 +30680,7 @@ var CONFIG_FILES = [
   "eslint.config.ts"
 ];
 function hasConfig(cwd) {
-  return CONFIG_FILES.some((file) => existsSync10(path89.join(cwd, file)));
+  return CONFIG_FILES.some((file) => existsSync10(path90.join(cwd, file)));
 }
 var eslintAdapter = {
   id: "eslint",
@@ -30445,7 +30705,7 @@ var eslintAdapter = {
     };
   },
   async import(ctx) {
-    const report = path89.join(ctx.cwd, "eslint-report.json");
+    const report = path90.join(ctx.cwd, "eslint-report.json");
     if (!existsSync10(report)) {
       throw new NoImportError("no eslint-report.json");
     }
@@ -30472,7 +30732,7 @@ var eslintAdapter = {
     }
     const findings = [];
     for (const file of data) {
-      const relative = path89.isAbsolute(file.filePath) ? path89.relative(ctx.cwd, file.filePath) : file.filePath;
+      const relative = path90.isAbsolute(file.filePath) ? path90.relative(ctx.cwd, file.filePath) : file.filePath;
       for (const message of file.messages ?? []) {
         const isError = message.severity === 2;
         findings.push(makeFinding({
@@ -30504,9 +30764,9 @@ var eslintAdapter = {
 
 // src/health/sources/typescript.ts
 import { existsSync as existsSync11 } from "fs";
-import path90 from "path";
+import path91 from "path";
 function hasTsconfig(cwd) {
-  return existsSync11(path90.join(cwd, "tsconfig.json"));
+  return existsSync11(path91.join(cwd, "tsconfig.json"));
 }
 var typescriptAdapter = {
   id: "typescript",
@@ -30581,8 +30841,8 @@ __export(exports_service6, {
   testingDataRoot: () => testingDataRoot
 });
 import { existsSync as existsSync12 } from "fs";
-import { readFile as readFile48, readdir as readdir15 } from "fs/promises";
-import path95 from "path";
+import { readFile as readFile49, readdir as readdir16 } from "fs/promises";
+import path96 from "path";
 
 // src/lib/git-env.ts
 var GIT_DISCOVERY_OVERRIDE_VARS = [
@@ -30606,8 +30866,8 @@ function withoutGitDiscoveryOverrides(env) {
 // src/metrics/lifecycle.ts
 init_fs();
 init_guard();
-import { readFile as readFile46 } from "fs/promises";
-import path91 from "path";
+import { readFile as readFile47 } from "fs/promises";
+import path92 from "path";
 
 // src/metrics/record.ts
 var RELIABILITIES = new Set(["exact", "estimated", "unknown"]);
@@ -30622,16 +30882,16 @@ var RETRY_TYPES = new Set([
 
 // src/metrics/lifecycle.ts
 async function readArtifactPointer(root, expected) {
-  const pointerFile = path91.join(root, "latest.json");
+  const pointerFile = path92.join(root, "latest.json");
   if (!await pathExists(pointerFile))
     return { status: "missing", pointer: null };
   let pointer;
   try {
-    pointer = JSON.parse(await readFile46(pointerFile, "utf8"));
+    pointer = JSON.parse(await readFile47(pointerFile, "utf8"));
   } catch {
     return { status: "stale", pointer: null, reason: "latest pointer is invalid JSON" };
   }
-  const recordFile = pointer.record ? path91.join(root, pointer.record) : null;
+  const recordFile = pointer.record ? path92.join(root, pointer.record) : null;
   if (!recordFile || !isPathInside(root, recordFile) || !await pathExists(recordFile)) {
     return { status: "stale", pointer, reason: "pointer record is missing" };
   }
@@ -30647,9 +30907,9 @@ init_guard();
 // src/testing/capability.ts
 init_fs();
 init_json();
-import path92 from "path";
+import path93 from "path";
 async function isTestingCapabilityEnabled(cwd, capability) {
-  const manifestPath = path92.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path93.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return false;
   }
@@ -30674,11 +30934,11 @@ async function isTestingCapabilityEnabled(cwd, capability) {
 // src/testing/coverage-map.ts
 init_fs();
 init_guard();
-import { readFile as readFile47, mkdir as mkdir26, writeFile as writeFile19 } from "fs/promises";
-import path93 from "path";
+import { readFile as readFile48, mkdir as mkdir26, writeFile as writeFile19 } from "fs/promises";
+import path94 from "path";
 var COVERAGE_MAP_SCHEMA_VERSION = 1;
 function coverageMapPath(cwd, cfg) {
-  return path93.isAbsolute(cfg.coverageMap.artifact) ? cfg.coverageMap.artifact : path93.join(cwd, cfg.coverageMap.artifact);
+  return path94.isAbsolute(cfg.coverageMap.artifact) ? cfg.coverageMap.artifact : path94.join(cwd, cfg.coverageMap.artifact);
 }
 async function loadCoverageMap(cwd, cfg) {
   const file = coverageMapPath(cwd, cfg);
@@ -30686,7 +30946,7 @@ async function loadCoverageMap(cwd, cfg) {
     return null;
   }
   try {
-    const parsed = JSON.parse(await readFile47(file, "utf8"));
+    const parsed = JSON.parse(await readFile48(file, "utf8"));
     if (!parsed || typeof parsed !== "object" || typeof parsed.map !== "object") {
       return null;
     }
@@ -30752,20 +31012,20 @@ function normalizePath4(file) {
 }
 
 // src/testing/selection.ts
-import path94 from "path";
+import path95 from "path";
 var TEST_FILE_RE = /(^|\/)(__tests__\/.*|.*\.(test|spec)\.[cm]?[tj]sx?$|e2e\/.*\.[cm]?[tj]sx?$|tests\/.*\.[cm]?[tj]sx?$)/;
 function normalizePath5(file) {
   return file.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function relatedByNamingAndDirectory(target, testFiles) {
   const normalized = normalizePath5(target);
-  const ext = path94.extname(normalized);
+  const ext = path95.extname(normalized);
   const withoutExt = ext ? normalized.slice(0, -ext.length) : normalized;
-  const base = path94.basename(withoutExt);
-  const dir = path94.dirname(normalized);
+  const base = path95.basename(withoutExt);
+  const dir = path95.dirname(normalized);
   return testFiles.filter((file) => {
-    const fileDir = path94.dirname(file);
-    const fileBase = path94.basename(file);
+    const fileDir = path95.dirname(file);
+    const fileBase = path95.basename(file);
     return file.startsWith(`${withoutExt}.`) || file.includes(`${withoutExt}.`) || fileDir === dir && fileBase.startsWith(`${base}.`) || fileDir.startsWith(dir) && fileBase.includes(base);
   }).sort();
 }
@@ -30895,7 +31155,7 @@ var DEFAULT_TESTING_CONFIG = {
   }
 };
 function testingDataRoot(cwd) {
-  return path95.join(cwd, ".metaproject", "data", "testing");
+  return path96.join(cwd, ".metaproject", "data", "testing");
 }
 async function computeTestingContext(cwd) {
   const { files, incompleteReasons } = await listProjectFiles(cwd);
@@ -31070,33 +31330,33 @@ async function runTesting(input) {
   return runResult;
 }
 async function loadTestingContext(cwd) {
-  const file = path95.join(testingDataRoot(cwd), "context.json");
+  const file = path96.join(testingDataRoot(cwd), "context.json");
   if (!await pathExists(file)) {
     return null;
   }
   try {
-    return JSON.parse(await readFile48(file, "utf8"));
+    return JSON.parse(await readFile49(file, "utf8"));
   } catch {
     return null;
   }
 }
 async function loadTestingReport(cwd) {
-  const file = path95.join(testingDataRoot(cwd), "artifacts", "latest.json");
+  const file = path96.join(testingDataRoot(cwd), "artifacts", "latest.json");
   if (!await pathExists(file)) {
     return null;
   }
   try {
-    const latest = JSON.parse(await readFile48(file, "utf8"));
+    const latest = JSON.parse(await readFile49(file, "utf8"));
     if (typeof latest.record === "string") {
-      const pointer = await readArtifactPointer(path95.join(testingDataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
+      const pointer = await readArtifactPointer(path96.join(testingDataRoot(cwd), "artifacts"), await collectGitProvenance(cwd));
       if (pointer.status !== "fresh")
         return null;
-      const recordFile = path95.join(testingDataRoot(cwd), "artifacts", latest.record);
-      if (!isPathInside(path95.join(testingDataRoot(cwd), "artifacts"), recordFile))
+      const recordFile = path96.join(testingDataRoot(cwd), "artifacts", latest.record);
+      if (!isPathInside(path96.join(testingDataRoot(cwd), "artifacts"), recordFile))
         return null;
       if (!await pathExists(recordFile))
         return null;
-      return JSON.parse(await readFile48(recordFile, "utf8"));
+      return JSON.parse(await readFile49(recordFile, "utf8"));
     }
     return latest;
   } catch {
@@ -31139,28 +31399,28 @@ async function ensureContext(cwd) {
 }
 async function writeContext(cwd, context) {
   const root = testingDataRoot(cwd);
-  const rel = (p) => path95.relative(cwd, p);
+  const rel = (p) => path96.relative(cwd, p);
   await mkdirContained(cwd, rel(root));
-  await writeContained(cwd, rel(path95.join(root, "context.json")), `${JSON.stringify(context, null, 2)}
+  await writeContained(cwd, rel(path96.join(root, "context.json")), `${JSON.stringify(context, null, 2)}
 `);
-  await writeContained(cwd, rel(path95.join(root, "context.md")), renderContextMarkdown(context));
-  await writeContained(cwd, rel(path95.join(root, "recommendations.md")), renderRecommendationsMarkdown(context));
+  await writeContained(cwd, rel(path96.join(root, "context.md")), renderContextMarkdown(context));
+  await writeContained(cwd, rel(path96.join(root, "recommendations.md")), renderRecommendationsMarkdown(context));
 }
 async function writeReport(cwd, report) {
   const root = testingDataRoot(cwd);
-  const artifacts = path95.join(root, "artifacts");
-  const history = path95.join(root, "history");
-  const rel = (p) => path95.relative(cwd, p);
+  const artifacts = path96.join(root, "artifacts");
+  const history = path96.join(root, "history");
+  const rel = (p) => path96.relative(cwd, p);
   await mkdirContained(cwd, rel(artifacts));
   await mkdirContained(cwd, rel(history));
   const stamp = report.generatedAt.replace(/[:.]/g, "-");
-  const json = path95.join(artifacts, "latest.json");
-  const markdown = path95.join(artifacts, "latest.md");
+  const json = path96.join(artifacts, "latest.json");
+  const markdown = path96.join(artifacts, "latest.md");
   const serialized = `${JSON.stringify(report, null, 2)}
 `;
   if (report.runId) {
-    const runJson = path95.join(artifacts, "runs", `${report.runId}.json`);
-    const runMarkdown = path95.join(artifacts, "runs", `${report.runId}.md`);
+    const runJson = path96.join(artifacts, "runs", `${report.runId}.json`);
+    const runMarkdown = path96.join(artifacts, "runs", `${report.runId}.md`);
     if (await pathExists(runJson))
       throw new Error(`immutable testing run already exists: ${report.runId}`);
     await writeContained(cwd, rel(runJson), serialized);
@@ -31171,26 +31431,26 @@ async function writeReport(cwd, report) {
       branch: report.provenance?.branch ?? null,
       worktree: report.provenance?.worktree ?? null,
       generated_at: report.generatedAt,
-      record: path95.posix.join("runs", `${report.runId}.json`)
+      record: path96.posix.join("runs", `${report.runId}.json`)
     }, null, 2)}
 `);
   } else {
     await writeContained(cwd, rel(json), serialized);
   }
   await writeContained(cwd, rel(markdown), renderReportMarkdown3(report));
-  await writeContained(cwd, rel(path95.join(history, `${stamp}.json`)), serialized);
+  await writeContained(cwd, rel(path96.join(history, `${stamp}.json`)), serialized);
   return {
-    markdownPath: path95.relative(cwd, markdown),
-    jsonPath: path95.relative(cwd, json)
+    markdownPath: path96.relative(cwd, markdown),
+    jsonPath: path96.relative(cwd, json)
   };
 }
 async function writeRawLog(cwd, raw) {
-  const logs = path95.join(testingDataRoot(cwd), "logs");
-  const rel = (p) => path95.relative(cwd, p);
+  const logs = path96.join(testingDataRoot(cwd), "logs");
+  const rel = (p) => path96.relative(cwd, p);
   await mkdirContained(cwd, rel(logs));
-  const latest = path95.join(logs, "latest.raw.log");
+  const latest = path96.join(logs, "latest.raw.log");
   await writeContained(cwd, rel(latest), raw);
-  return path95.relative(cwd, latest);
+  return path96.relative(cwd, latest);
 }
 async function listProjectFiles(cwd) {
   const out = [];
@@ -31201,13 +31461,13 @@ async function listProjectFiles(cwd) {
 async function walk3(root, dir, out, incompleteReasons) {
   let entries;
   try {
-    entries = await readdir15(dir, { withFileTypes: true });
+    entries = await readdir16(dir, { withFileTypes: true });
   } catch (error) {
-    incompleteReasons.push(`${normalizePath6(path95.relative(root, dir)) || "."}: ${error instanceof Error ? error.message : String(error)}`);
+    incompleteReasons.push(`${normalizePath6(path96.relative(root, dir)) || "."}: ${error instanceof Error ? error.message : String(error)}`);
     return;
   }
   for (const entry of entries) {
-    const abs = path95.join(dir, entry.name);
+    const abs = path96.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (IGNORED_DIRS2.has(entry.name) || entry.name.startsWith(".tmp-")) {
         continue;
@@ -31216,28 +31476,28 @@ async function walk3(root, dir, out, incompleteReasons) {
       continue;
     }
     if (entry.isFile()) {
-      out.push(normalizePath6(path95.relative(root, abs)));
+      out.push(normalizePath6(path96.relative(root, abs)));
     }
   }
 }
 async function readPackageJson(cwd) {
-  const file = path95.join(cwd, "package.json");
+  const file = path96.join(cwd, "package.json");
   if (!await pathExists(file)) {
     return null;
   }
   try {
-    return JSON.parse(await readFile48(file, "utf8"));
+    return JSON.parse(await readFile49(file, "utf8"));
   } catch {
     return null;
   }
 }
 async function loadTestingConfig(cwd) {
-  const file = path95.join(cwd, ".metaproject", "testing.config.json");
+  const file = path96.join(cwd, ".metaproject", "testing.config.json");
   if (!await pathExists(file)) {
     return DEFAULT_TESTING_CONFIG;
   }
   try {
-    const parsed = JSON.parse(await readFile48(file, "utf8"));
+    const parsed = JSON.parse(await readFile49(file, "utf8"));
     return {
       schemaVersion: parsed.schemaVersion ?? DEFAULT_TESTING_CONFIG.schemaVersion,
       enabled: parsed.enabled ?? DEFAULT_TESTING_CONFIG.enabled,
@@ -31297,11 +31557,11 @@ function detectFrameworks(input) {
 async function extractConventions(cwd, files) {
   const conventions = new Set;
   for (const file of files.slice(0, 40)) {
-    const abs = path95.join(cwd, file);
+    const abs = path96.join(cwd, file);
     if (!await pathExists(abs)) {
       continue;
     }
-    const text = await readFile48(abs, "utf8");
+    const text = await readFile49(abs, "utf8");
     for (const line of text.split(`
 `)) {
       if (/test|testing|spec|coverage|playwright|vitest|jest|bun:test/i.test(line)) {
@@ -31427,11 +31687,11 @@ async function findTestsByImportedTargets(cwd, targets, testFiles) {
   const targetKeys = new Set(targets.map((target) => modulePathKey(normalizePath6(target))));
   const selected = new Set;
   for (const testFile of testFiles) {
-    const absoluteTest = path95.join(cwd, testFile);
+    const absoluteTest = path96.join(cwd, testFile);
     if (!await pathExists(absoluteTest)) {
       continue;
     }
-    const content = await readFile48(absoluteTest, "utf8");
+    const content = await readFile49(absoluteTest, "utf8");
     const imports = extractImportPaths(content);
     if (imports.length === 0) {
       continue;
@@ -31461,10 +31721,10 @@ function resolveImportPath(cwd, testFile, importPath) {
   if (!importPath.startsWith(".")) {
     return null;
   }
-  const importerDir = path95.dirname(testFile);
-  const absoluteResolved = path95.resolve(path95.join(cwd, importerDir), importPath);
-  const relative = path95.relative(cwd, absoluteResolved);
-  if (relative.startsWith(`..${path95.sep}`) || relative === "..") {
+  const importerDir = path96.dirname(testFile);
+  const absoluteResolved = path96.resolve(path96.join(cwd, importerDir), importPath);
+  const relative = path96.relative(cwd, absoluteResolved);
+  if (relative.startsWith(`..${path96.sep}`) || relative === "..") {
     return null;
   }
   const relativeNormalized = normalizePath6(relative);
@@ -31516,13 +31776,13 @@ function resolveTestCommand(cwd, context, input) {
 }
 var BUN_LOCKFILES = ["bun.lock", "bun.lockb"];
 function detectPackageManager(cwd) {
-  if (resolveBunBin() && BUN_LOCKFILES.some((name) => pathExistsSync(path95.join(cwd, name)))) {
+  if (resolveBunBin() && BUN_LOCKFILES.some((name) => pathExistsSync(path96.join(cwd, name)))) {
     return "bun";
   }
-  if (Bun.which("pnpm") && pathExistsSync(path95.join(cwd, "pnpm-lock.yaml"))) {
+  if (Bun.which("pnpm") && pathExistsSync(path96.join(cwd, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (Bun.which("yarn") && pathExistsSync(path95.join(cwd, "yarn.lock"))) {
+  if (Bun.which("yarn") && pathExistsSync(path96.join(cwd, "yarn.lock"))) {
     return "yarn";
   }
   return "npm";
@@ -31862,7 +32122,7 @@ async function compatibleReportForHealth(ctx) {
 
 // src/health/sources/dependency-audit.ts
 import { existsSync as existsSync13 } from "fs";
-import path96 from "path";
+import path97 from "path";
 function auditSeverityToPriority(severity) {
   if (severity === "critical" || severity === "high")
     return "P0";
@@ -31981,7 +32241,7 @@ var LOCKFILE_COMMANDS = [
 ];
 function auditCommand(cwd) {
   for (const entry of LOCKFILE_COMMANDS) {
-    if (!entry.lockfiles.some((name) => existsSync13(path96.join(cwd, name))))
+    if (!entry.lockfiles.some((name) => existsSync13(path97.join(cwd, name))))
       continue;
     const bin = resolveBin(cwd, entry.bin);
     if (bin)
@@ -32040,13 +32300,13 @@ var dependencyAuditAdapter = {
 
 // src/health/sources/sonarqube.ts
 import { existsSync as existsSync14 } from "fs";
-import path97 from "path";
+import path98 from "path";
 var REPORT_FILES = ["sonar-issues.json", ".metaproject/data/health/sonar-issues.json"];
 function reportPath(cwd) {
   const fromEnv = process.env.SONAR_ISSUES_FILE;
   const candidates = fromEnv ? [fromEnv, ...REPORT_FILES] : REPORT_FILES;
   for (const rel of candidates) {
-    const abs = path97.isAbsolute(rel) ? rel : path97.join(cwd, rel);
+    const abs = path98.isAbsolute(rel) ? rel : path98.join(cwd, rel);
     if (existsSync14(abs)) {
       return abs;
     }
@@ -32130,7 +32390,7 @@ var sonarqubeAdapter = {
 function relativizeComponent(component, cwd) {
   const colon = component.indexOf(":");
   const value = colon >= 0 ? component.slice(colon + 1) : component;
-  return path97.isAbsolute(value) ? path97.relative(cwd, value) : value;
+  return path98.isAbsolute(value) ? path98.relative(cwd, value) : value;
 }
 
 // src/health/sources/index.ts
@@ -32467,19 +32727,19 @@ function filteredInfo(source, cfg) {
   };
 }
 async function writeOutputs(cwd, report, config, stamp) {
-  const artifacts = path98.join(dataRoot3(cwd), "artifacts");
-  const history = path98.join(dataRoot3(cwd), "history");
+  const artifacts = path99.join(dataRoot3(cwd), "artifacts");
+  const history = path99.join(dataRoot3(cwd), "history");
   await mkdir27(artifacts, { recursive: true });
   await mkdir27(history, { recursive: true });
-  const markdown = path98.join(artifacts, "latest.md");
-  const json = path98.join(artifacts, "latest.json");
-  const historyJson = path98.join(history, `${stamp}.json`);
+  const markdown = path99.join(artifacts, "latest.md");
+  const json = path99.join(artifacts, "latest.json");
+  const historyJson = path99.join(history, `${stamp}.json`);
   const serialized = `${JSON.stringify(report, null, 2)}
 `;
   await writeFile20(markdown, renderReportMarkdown2(report, config), "utf8");
   if (report.runId) {
-    const runJson = path98.join(artifacts, "runs", `${report.runId}.json`);
-    const runMarkdown = path98.join(artifacts, "runs", `${report.runId}.md`);
+    const runJson = path99.join(artifacts, "runs", `${report.runId}.json`);
+    const runMarkdown = path99.join(artifacts, "runs", `${report.runId}.md`);
     if (await pathExists(runJson))
       throw new Error(`immutable health run already exists: ${report.runId}`);
     await writeFileAtomic(runJson, serialized);
@@ -32490,7 +32750,7 @@ async function writeOutputs(cwd, report, config, stamp) {
       branch: report.provenance?.branch ?? null,
       worktree: report.provenance?.worktree ?? null,
       generated_at: report.generatedAt,
-      record: path98.posix.join("runs", `${report.runId}.json`)
+      record: path99.posix.join("runs", `${report.runId}.json`)
     }, null, 2)}
 `);
   } else {
@@ -32498,8 +32758,8 @@ async function writeOutputs(cwd, report, config, stamp) {
   }
   await writeFile20(historyJson, serialized, "utf8");
   return {
-    markdownPath: path98.relative(cwd, markdown),
-    jsonPath: path98.relative(cwd, json)
+    markdownPath: path99.relative(cwd, markdown),
+    jsonPath: path99.relative(cwd, json)
   };
 }
 async function resolveChanged(cwd, selector) {
@@ -32552,7 +32812,7 @@ function hasGateShape(value) {
   return Array.isArray(report.metrics) && Array.isArray(report.sources) && Array.isArray(report.findings);
 }
 async function readLatest(cwd) {
-  const file = path99.join(dataRoot3(cwd), "artifacts", "latest.json");
+  const file = path100.join(dataRoot3(cwd), "artifacts", "latest.json");
   if (!await pathExists(file)) {
     return null;
   }
@@ -32563,11 +32823,11 @@ async function readLatest(cwd) {
     const latest = read.value;
     const record = latest.record;
     if (typeof record === "string") {
-      const pointer = await readArtifactPointer(path99.join(dataRoot3(cwd), "artifacts"), await collectGitProvenance(cwd));
+      const pointer = await readArtifactPointer(path100.join(dataRoot3(cwd), "artifacts"), await collectGitProvenance(cwd));
       if (pointer.status !== "fresh")
         return null;
-      const recordFile = path99.join(dataRoot3(cwd), "artifacts", record);
-      if (!isPathInside(path99.join(dataRoot3(cwd), "artifacts"), recordFile))
+      const recordFile = path100.join(dataRoot3(cwd), "artifacts", record);
+      if (!isPathInside(path100.join(dataRoot3(cwd), "artifacts"), recordFile))
         return null;
       if (!await pathExists(recordFile))
         return null;
@@ -32640,7 +32900,7 @@ function createCodeHealthService() {
   return {
     run: (input) => runHealth(input),
     async status(input) {
-      const enabled = await pathExists(path99.join(input.cwd, ".metaproject", "health.config.json"));
+      const enabled = await pathExists(path100.join(input.cwd, ".metaproject", "health.config.json"));
       const latest = await readLatest(input.cwd);
       const project = latest?.metrics.find((m) => m.key === "project") ?? null;
       const decliningScopes = latest ? latest.metrics.filter((m) => m.regression_score > 0).length : 0;
@@ -32798,10 +33058,10 @@ function renderEvidenceBlock(evidences, siblings) {
 init_fs();
 init_contained_write();
 init_json();
-import path100 from "path";
+import path101 from "path";
 import { createHash as createHash16 } from "crypto";
 function impactEvidenceDataRoot(root) {
-  return path100.join(root, ".metaproject", "data", "security", "impact-evidence");
+  return path101.join(root, ".metaproject", "data", "security", "impact-evidence");
 }
 function sanitizeSessionId(sessionId) {
   const cleaned = sessionId.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -32813,7 +33073,7 @@ function sessionStateFilename(sessionId) {
   return `${sanitized}-${suffix}.json`;
 }
 function sessionStatePath(root, sessionId) {
-  return path100.join(impactEvidenceDataRoot(root), "sessions", sessionStateFilename(sessionId));
+  return path101.join(impactEvidenceDataRoot(root), "sessions", sessionStateFilename(sessionId));
 }
 async function loadSessionState(root, sessionId) {
   const file = sessionStatePath(root, sessionId);
@@ -32832,11 +33092,11 @@ async function loadSessionState(root, sessionId) {
 }
 async function saveSessionState(root, sessionId, state) {
   const file = sessionStatePath(root, sessionId);
-  await writeContained(root, path100.relative(root, file), `${JSON.stringify(state, null, 2)}
+  await writeContained(root, path101.relative(root, file), `${JSON.stringify(state, null, 2)}
 `);
 }
 function logPath(root) {
-  return path100.join(impactEvidenceDataRoot(root), "log.jsonl");
+  return path101.join(impactEvidenceDataRoot(root), "log.jsonl");
 }
 async function appendLogRecord(root, record) {
   const full = {
@@ -32847,7 +33107,7 @@ async function appendLogRecord(root, record) {
     ...record.detail !== undefined ? { detail: record.detail } : {}
   };
   const file = logPath(root);
-  await appendContained(root, path100.relative(root, file), `${JSON.stringify(full)}
+  await appendContained(root, path101.relative(root, file), `${JSON.stringify(full)}
 `);
   return full;
 }
@@ -32874,7 +33134,7 @@ init_command_risk();
 init_shell_syntax();
 init_fs();
 init_service2();
-import path101 from "path";
+import path102 from "path";
 import { createHash as createHash17 } from "crypto";
 import { realpathSync as realpathSync2 } from "fs";
 function impactEvidenceHookClass(strict) {
@@ -32890,29 +33150,29 @@ function realpathNearestExisting(p) {
   for (;; ) {
     try {
       const real = realpathSync2(current);
-      return tail.length > 0 ? path101.join(real, ...tail) : real;
+      return tail.length > 0 ? path102.join(real, ...tail) : real;
     } catch {
-      const parent = path101.dirname(current);
+      const parent = path102.dirname(current);
       if (parent === current) {
-        return tail.length > 0 ? path101.join(current, ...tail) : current;
+        return tail.length > 0 ? path102.join(current, ...tail) : current;
       }
-      tail.unshift(path101.basename(current));
+      tail.unshift(path102.basename(current));
       current = parent;
     }
   }
 }
 function normalizeRequestFiles(root, files) {
-  const rootReal = realpathNearestExisting(path101.resolve(root));
+  const rootReal = realpathNearestExisting(path102.resolve(root));
   const normalized = [];
   const rejected = [];
   for (const file of files) {
-    const lexicalAbsolute = path101.isAbsolute(file) ? path101.resolve(file) : path101.resolve(rootReal, toPosix(file).replace(/^\.\//, ""));
+    const lexicalAbsolute = path102.isAbsolute(file) ? path102.resolve(file) : path102.resolve(rootReal, toPosix(file).replace(/^\.\//, ""));
     const effective = realpathNearestExisting(lexicalAbsolute);
     if (!isPathInside(rootReal, effective)) {
       rejected.push(file);
       continue;
     }
-    normalized.push(toPosix(path101.relative(rootReal, effective)));
+    normalized.push(toPosix(path102.relative(rootReal, effective)));
   }
   return { files: [...new Set(normalized)], rejected };
 }
@@ -33198,7 +33458,7 @@ __export(exports_service8, {
   createJobService: () => createJobService
 });
 import { copyFile, mkdir as mkdir29 } from "fs/promises";
-import path104 from "path";
+import path105 from "path";
 
 // src/job/types.ts
 var JOB_INTENTS = ["implement", "analyze", "review", "custom"];
@@ -33338,16 +33598,16 @@ function defaultPlan(intent) {
 init_validator();
 init_contracts();
 init_fs();
-import { appendFile as appendFile5, mkdir as mkdir28, readFile as readFile50, readdir as readdir16 } from "fs/promises";
-import path103 from "path";
+import { appendFile as appendFile5, mkdir as mkdir28, readFile as readFile51, readdir as readdir17 } from "fs/promises";
+import path104 from "path";
 function jobsRoot(cwd) {
-  return path103.join(cwd, ".metaproject", "jobs");
+  return path104.join(cwd, ".metaproject", "jobs");
 }
 function jobDir(cwd, name) {
-  return path103.join(jobsRoot(cwd), name);
+  return path104.join(jobsRoot(cwd), name);
 }
 function jobStatePath(cwd, name) {
-  return path103.join(jobDir(cwd, name), "state.json");
+  return path104.join(jobDir(cwd, name), "state.json");
 }
 var JOB_NAME_PATTERN = /^[a-z0-9-]+$/;
 function assertJobName(name) {
@@ -33364,7 +33624,7 @@ async function listJobNames(cwd) {
   if (!await pathExists(root)) {
     return [];
   }
-  const entries = await readdir16(root, { withFileTypes: true });
+  const entries = await readdir17(root, { withFileTypes: true });
   return entries.filter((entry) => entry.isDirectory() && JOB_NAME_PATTERN.test(entry.name)).map((entry) => entry.name).sort();
 }
 async function readJob(cwd, name) {
@@ -33373,7 +33633,7 @@ async function readJob(cwd, name) {
     const known = await listJobNames(cwd);
     throw new Error(`Job not found: ${name}.` + (known.length > 0 ? ` Known: ${known.join(", ")}` : " Run: keryx job list"));
   }
-  return JSON.parse(await readFile50(file, "utf8"));
+  return JSON.parse(await readFile51(file, "utf8"));
 }
 async function writeJob(cwd, name, state) {
   const schema = await loadSchema("job-orchestrator-state");
@@ -33384,12 +33644,12 @@ async function writeJob(cwd, name, state) {
 `));
   }
   const file = jobStatePath(cwd, name);
-  await mkdir28(path103.dirname(file), { recursive: true });
+  await mkdir28(path104.dirname(file), { recursive: true });
   await writeFileAtomic(file, `${JSON.stringify(state, null, 2)}
 `);
 }
 async function appendJournal2(cwd, name, at, line) {
-  await appendFile5(path103.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
+  await appendFile5(path104.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
 `, "utf8");
 }
 function renderJournal2(name, at) {
@@ -33410,7 +33670,7 @@ function assertDocumentType(raw) {
   return raw;
 }
 function documentFileName(type, sourcePath) {
-  const extension = path103.extname(sourcePath) || ".md";
+  const extension = path104.extname(sourcePath) || ".md";
   return `${type}${extension}`;
 }
 
@@ -33418,7 +33678,7 @@ function documentFileName(type, sourcePath) {
 function createJobService(deps) {
   const now = () => deps.now().toISOString();
   function lockPath(cwd, name) {
-    return path104.join(jobsRoot(cwd), `.job-lock-${name}`);
+    return path105.join(jobsRoot(cwd), `.job-lock-${name}`);
   }
   async function mutate(cwd, name, run) {
     assertJobName(name);
@@ -33467,20 +33727,20 @@ function createJobService(deps) {
         },
         plan: { steps: defaultPlan(intent) },
         documentation: {
-          job_path: path104.join(".metaproject", "jobs", name),
+          job_path: path105.join(".metaproject", "jobs", name),
           documents_created: []
         },
         metrics: { steps: [] },
-        jobs_root: path104.join(".metaproject", "jobs"),
+        jobs_root: path105.join(".metaproject", "jobs"),
         updated_at: createdAt
       };
       const first = firstOpenStep(state.plan.steps);
       if (first) {
         state.plan.current_step = first.id;
       }
-      await writeFileAtomic(path104.join(absolute, "journal.md"), renderJournal2(name, createdAt));
+      await writeFileAtomic(path105.join(absolute, "journal.md"), renderJournal2(name, createdAt));
       await writeJob(input.cwd, name, state);
-      return { state, dir: path104.relative(input.cwd, absolute) };
+      return { state, dir: path105.relative(input.cwd, absolute) };
     },
     async status({ cwd, name }) {
       assertJobName(name);
@@ -33492,7 +33752,7 @@ function createJobService(deps) {
       }
       return {
         state,
-        dir: path104.join(".metaproject", "jobs", name),
+        dir: path105.join(".metaproject", "jobs", name),
         stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
         stepsTotal: state.plan.steps.length,
         nextStep: firstOpenStep(state.plan.steps),
@@ -33549,23 +33809,23 @@ function createJobService(deps) {
       if (!input.file) {
         throw new Error("Missing --file. Usage: keryx job document <name> --type <type> --file <path>");
       }
-      const source = path104.isAbsolute(input.file) ? input.file : path104.join(input.cwd, input.file);
+      const source = path105.isAbsolute(input.file) ? input.file : path105.join(input.cwd, input.file);
       if (!await pathExists(source)) {
         throw new Error(`--file not found: ${input.file}. Write the document first, then record it.`);
       }
       let recorded;
       await mutate(input.cwd, input.name, async (state) => {
         const fileName = documentFileName(type, source);
-        const target = path104.join(jobDir(input.cwd, state.job_name), fileName);
+        const target = path105.join(jobDir(input.cwd, state.job_name), fileName);
         await copyFile(source, target);
         state.documentation ??= {};
-        state.documentation.job_path ??= path104.join(".metaproject", "jobs", state.job_name);
+        state.documentation.job_path ??= path105.join(".metaproject", "jobs", state.job_name);
         const created = state.documentation.documents_created ?? [];
         state.documentation.documents_created = created.includes(fileName) ? created : [...created, fileName];
         recorded = {
           state,
           document: fileName,
-          path: path104.join(".metaproject", "jobs", state.job_name, fileName)
+          path: path105.join(".metaproject", "jobs", state.job_name, fileName)
         };
         return { state, event: "document", detail: `${type} -> ${fileName}` };
       });
@@ -33600,7 +33860,7 @@ function createJobService(deps) {
             name: state.job_name,
             phase: state.phase,
             intent: state.intent,
-            dir: path104.join(".metaproject", "jobs", name),
+            dir: path105.join(".metaproject", "jobs", name),
             stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
             stepsTotal: state.plan.steps.length,
             nextStep: firstOpenStep(state.plan.steps)?.id ?? null
@@ -33704,13 +33964,13 @@ function normalizeWorkspaceReference(raw) {
 
 // src/sac/fwk-service.ts
 init_assembly();
-import { appendFile as appendFile6, mkdir as mkdir31, open as open3, readFile as readFile53, rename as rename7, rm as rm6, stat as stat13, writeFile as writeFile21 } from "fs/promises";
-import path108 from "path";
+import { appendFile as appendFile6, mkdir as mkdir31, open as open3, readFile as readFile54, rename as rename7, rm as rm6, stat as stat14, writeFile as writeFile21 } from "fs/promises";
+import path109 from "path";
 
 // src/sac/index.ts
-import { access as access3, readFile as readFile51, realpath as realpath11 } from "fs/promises";
+import { access as access3, readFile as readFile52, realpath as realpath12 } from "fs/promises";
 import { createHash as createHash18 } from "crypto";
-import path105 from "path";
+import path106 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var idPattern = /^[a-z][a-z0-9-]{2,63}$/;
 var subjectPattern = /^(?:user|team|service|agent):[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -33728,21 +33988,21 @@ var normativeSchemaFiles = {
   "review-decision": "review-decision.schema.json"
 };
 var normativeSchemas = new Map;
-var NORMATIVE_SCHEMA_DIR = path105.join("docs", "requirements", "shared-agent-context", "schemas");
+var NORMATIVE_SCHEMA_DIR = path106.join("docs", "requirements", "shared-agent-context", "schemas");
 async function resolveSacNormativeSchemaPath(fileName, searchFrom = [fileURLToPath3(new URL(".", import.meta.url)), process.cwd()]) {
   const seen = new Set;
   for (const start of searchFrom) {
-    let dir = path105.resolve(start);
+    let dir = path106.resolve(start);
     for (let i = 0;i < 10; i++) {
       if (seen.has(dir))
         break;
       seen.add(dir);
-      const candidate = path105.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
+      const candidate = path106.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
       try {
         await access3(candidate);
         return candidate;
       } catch {}
-      const parent = path105.dirname(dir);
+      const parent = path106.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -33788,7 +34048,7 @@ function isRecord5(value) {
 async function loadNormativeSchema(schema) {
   let pending = normativeSchemas.get(schema);
   if (!pending) {
-    pending = resolveSacNormativeSchemaPath(normativeSchemaFiles[schema]).then((file) => readFile51(file, "utf8")).then((source) => JSON.parse(source));
+    pending = resolveSacNormativeSchemaPath(normativeSchemaFiles[schema]).then((file) => readFile52(file, "utf8")).then((source) => JSON.parse(source));
     normativeSchemas.set(schema, pending);
   }
   return pending;
@@ -34411,20 +34671,20 @@ class SacReferenceError extends Error {
   code = "unsafe_workspace_reference";
 }
 async function resolveWorkspaceReference(input) {
-  if (!workspacePathPattern.test(input.uri) || path105.isAbsolute(input.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input.uri) || input.uri.includes("\\"))
+  if (!workspacePathPattern.test(input.uri) || path106.isAbsolute(input.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input.uri) || input.uri.includes("\\"))
     throw new SacReferenceError("unsafe workspace reference");
-  const lexicalRoot = path105.resolve(input.workspaceRoot);
-  const root = await realpath11(lexicalRoot);
-  const candidate = path105.resolve(lexicalRoot, input.uri.slice(2));
-  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path105.sep}`))
+  const lexicalRoot = path106.resolve(input.workspaceRoot);
+  const root = await realpath12(lexicalRoot);
+  const candidate = path106.resolve(lexicalRoot, input.uri.slice(2));
+  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path106.sep}`))
     throw new SacReferenceError("workspace reference escapes root");
   let resolved;
   try {
-    resolved = await realpath11(candidate);
+    resolved = await realpath12(candidate);
   } catch {
     throw new SacReferenceError("workspace reference is not resolvable");
   }
-  if (resolved !== root && !resolved.startsWith(`${root}${path105.sep}`))
+  if (resolved !== root && !resolved.startsWith(`${root}${path106.sep}`))
     throw new SacReferenceError("workspace reference escapes root after realpath");
   return candidate;
 }
@@ -34478,18 +34738,18 @@ async function evaluateStrictSacGuard(input) {
 
 // src/sac/workspace-service.ts
 init_fs();
-import { mkdir as mkdir30, readdir as readdir17, readFile as readFile52 } from "fs/promises";
+import { mkdir as mkdir30, readdir as readdir18, readFile as readFile53 } from "fs/promises";
 import { createHash as createHash19, randomUUID as randomUUID3 } from "crypto";
-import path107 from "path";
+import path108 from "path";
 
 // src/sac/secure-resource-read.ts
 init_contained_read();
 init_descriptor_read();
-import path106 from "path";
+import path107 from "path";
 function readWorkspaceFileNoFollow(workspaceRoot, absolutePath) {
-  const relativePath = path106.relative(workspaceRoot, absolutePath);
-  const components = relativePath.split(path106.sep);
-  if (!relativePath || path106.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
+  const relativePath = path107.relative(workspaceRoot, absolutePath);
+  const components = relativePath.split(path107.sep);
+  if (!relativePath || path107.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
     throw new Error("safe source path is not workspace-relative");
   }
   return readDescriptorChain(workspaceRoot, absolutePath, {
@@ -34516,8 +34776,8 @@ class WorkspaceService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path107.resolve(options.workspaceRoot);
-    this.storageRoot = path107.resolve(options.storageRoot ?? path107.join(this.root, ".metaproject", "workspaces"));
+    this.root = path108.resolve(options.workspaceRoot);
+    this.storageRoot = path108.resolve(options.storageRoot ?? path108.join(this.root, ".metaproject", "workspaces"));
     this.now = options.now ?? (() => new Date);
   }
   async create(input) {
@@ -34540,7 +34800,7 @@ class WorkspaceService {
     await mkdir30(this.storageRoot, { recursive: true, mode: 448 });
     await withFileLock(this.lockPath(manifest.id), async () => {
       try {
-        await readFile52(this.manifestPath(manifest.id), "utf8");
+        await readFile53(this.manifestPath(manifest.id), "utf8");
         throw new WorkspaceServiceError("conflict", "workspace already exists");
       } catch (error) {
         if (error instanceof WorkspaceServiceError || !isNotFound(error))
@@ -34569,7 +34829,7 @@ class WorkspaceService {
     } catch {
       return [];
     }
-    const entries = await readdir17(this.storageRoot, { withFileTypes: true });
+    const entries = await readdir18(this.storageRoot, { withFileTypes: true });
     const visible = [];
     for (const entry of entries) {
       if (!entry.isDirectory())
@@ -34830,7 +35090,7 @@ class WorkspaceService {
       throw new WorkspaceServiceError("not_found", "workspace not found");
     let parsed;
     try {
-      parsed = JSON.parse(await readFile52(this.manifestPath(id), "utf8"));
+      parsed = JSON.parse(await readFile53(this.manifestPath(id), "utf8"));
     } catch (error) {
       if (isNotFound(error))
         throw new WorkspaceServiceError("not_found", "workspace not found");
@@ -34842,13 +35102,13 @@ class WorkspaceService {
     return parsed;
   }
   workspaceDir(id) {
-    return path107.join(this.storageRoot, id);
+    return path108.join(this.storageRoot, id);
   }
   manifestPath(id) {
-    return path107.join(this.workspaceDir(id), "workspace.json");
+    return path108.join(this.workspaceDir(id), "workspace.json");
   }
   lockPath(id) {
-    return path107.join(this.storageRoot, `.${id}.lock`);
+    return path108.join(this.storageRoot, `.${id}.lock`);
   }
   timestamp() {
     return this.now().toISOString();
@@ -35457,7 +35717,7 @@ var ledgerDigestChunkBytes = 64 * 1024;
 var isMissing = (error) => error instanceof Error && error.code === "ENOENT";
 var checkpointHash = (body) => createHash22("sha256").update(JSON.stringify(body), "utf8").digest("hex");
 async function ledgerByteLength(ledger) {
-  const value = await stat13(ledger, { bigint: true });
+  const value = await stat14(ledger, { bigint: true });
   if (value.size > BigInt(Number.MAX_SAFE_INTEGER))
     throw new Error("invalid access receipt ledger: ledger-too-large");
   return Number(value.size);
@@ -35503,7 +35763,7 @@ function parseCheckpoint(value) {
 }
 async function readCheckpoint(checkpointPath) {
   try {
-    const raw = await readFile53(checkpointPath, "utf8");
+    const raw = await readFile54(checkpointPath, "utf8");
     try {
       const checkpoint = parseCheckpoint(JSON.parse(raw));
       return checkpoint ? { present: true, checkpoint } : { present: true };
@@ -35571,7 +35831,7 @@ async function fastCheckpointState(ledger, checkpoint, ledgerBytes) {
   }
 }
 async function auditLedger(ledger, checkpointPath, verifier) {
-  const bytes = await readFile53(ledger);
+  const bytes = await readFile54(ledger);
   const raw = bytes.toString("utf8");
   if (raw.length > 0 && !raw.endsWith(`
 `))
@@ -35621,7 +35881,7 @@ var isEvaluationReport = (report) => report.schemaVersion === "1.0" && asString2
 var isConfigRecord = (value) => typeof value.enabled === "boolean" && typeof value.killSwitch === "boolean";
 async function readPinnedJson(input) {
   const ref = await resolveWorkspaceReference({ workspaceRoot: input.workspaceRoot, kind: "artifact", uri: input.uri });
-  const raw = await readFile53(ref, "utf8");
+  const raw = await readFile54(ref, "utf8");
   const digest = createHash22("sha256").update(raw).digest("hex");
   if (digest !== input.digest)
     throw new Error("policy experiment pinned artifact digest mismatch");
@@ -35629,7 +35889,7 @@ async function readPinnedJson(input) {
 }
 async function readWorkspaceJson(input) {
   const ref = await resolveWorkspaceReference({ workspaceRoot: input.workspaceRoot, kind: "artifact", uri: input.uri });
-  const raw = await readFile53(ref, "utf8");
+  const raw = await readFile54(ref, "utf8");
   return { artifact: JSON.parse(raw), raw };
 }
 function hasReportIntegrity(report) {
@@ -35637,10 +35897,10 @@ function hasReportIntegrity(report) {
   return reportHashPattern.test(reportDigest) && sha2564(body) === reportDigest;
 }
 async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
-  const configPath = path108.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path109.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
-    const raw = await readFile53(configPath, "utf8").catch((error) => {
+    const raw = await readFile54(configPath, "utf8").catch((error) => {
       if (isMissing(error))
         return;
       throw error;
@@ -35835,9 +36095,9 @@ class FwkReadService {
     const recordedAt = nowIso(now);
     const id = `receipt-${randomUUID4().replace(/-/g, "").slice(0, 16)}`;
     const base = { schemaVersion: "1.0", id, workspaceId, actor, action, decision, recordedAt, cost: { tokens: 0, toolCalls: 1, elapsedMs: 0 }, contextAssembly: { traceRef: assembly.traceRef, configurationRevision: assembly.configurationRevision, selected: assembly.selected.map((id) => `./ids/${id}`), omittedOptional: assembly.omittedOptional.map((id) => `./ids/${id}`) }, policy: { ref: assembly.policyRef, revision: assembly.policyRevision }, ...action === "resource" ? { resourceRef: `./ids/${resourceId ?? "unknown"}` } : {} };
-    const ledger = path108.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
-    const checkpointPath = path108.join(path108.dirname(ledger), "access-receipts.checkpoint.json");
-    await mkdir31(path108.dirname(ledger), { recursive: true, mode: 448 });
+    const ledger = path109.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
+    const checkpointPath = path109.join(path109.dirname(ledger), "access-receipts.checkpoint.json");
+    await mkdir31(path109.dirname(ledger), { recursive: true, mode: 448 });
     return withFileLock(`${ledger}.lock`, async () => {
       const state = await resolveLedgerState(ledger, checkpointPath, this.options.verifyReceiptLedger ?? verifyAccessReceiptLedger);
       const receipt = sealAccessReceipt(base, state.headHash);
@@ -35940,8 +36200,8 @@ function normalizeFwkResult(result) {
 // src/sac/proposal-lifecycle.ts
 init_fs();
 import { createHash as createHash29, randomUUID as randomUUID7 } from "crypto";
-import { appendFile as appendFile7, mkdir as mkdir34, readdir as readdir19, readFile as readFile62 } from "fs/promises";
-import path118 from "path";
+import { appendFile as appendFile7, mkdir as mkdir34, readdir as readdir20, readFile as readFile63 } from "fs/promises";
+import path119 from "path";
 
 // src/sac/trusted-wrap-up.ts
 import { createHash as createHash23, randomUUID as randomUUID5 } from "crypto";
@@ -36013,7 +36273,7 @@ function bindingHash(owner, intent) {
 // src/sac/session-wrap-up.ts
 import { createHash as createHash25 } from "crypto";
 import { mkdir as mkdir33, writeFile as writeFile22 } from "fs/promises";
-import path112 from "path";
+import path113 from "path";
 
 // src/session/store.ts
 init_config_dir();
@@ -36025,12 +36285,12 @@ import {
   renameSync as renameSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import path111 from "path";
+import path112 from "path";
 
 // src/session/paths.ts
 import { existsSync as existsSync16 } from "fs";
 import { homedir } from "os";
-import path109 from "path";
+import path110 from "path";
 function keryxDataDir(override) {
   if (override !== undefined && override.length > 0) {
     return override;
@@ -36042,22 +36302,22 @@ function keryxDataDir(override) {
   const home = homedir();
   if (process.platform === "win32") {
     const appData = process.env.APPDATA;
-    const base = appData !== undefined && appData.length > 0 ? appData : path109.join(home, "AppData", "Roaming");
-    return path109.join(base, "keryx");
+    const base = appData !== undefined && appData.length > 0 ? appData : path110.join(home, "AppData", "Roaming");
+    return path110.join(base, "keryx");
   }
   const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg !== undefined && xdg.length > 0 ? xdg : path109.join(home, ".local", "share");
-  return path109.join(base, "keryx");
+  const base = xdg !== undefined && xdg.length > 0 ? xdg : path110.join(home, ".local", "share");
+  return path110.join(base, "keryx");
 }
 function resolveProjectRoot2(cwd) {
-  const abs = path109.resolve(cwd);
+  const abs = path110.resolve(cwd);
   let dir = abs;
   for (;; ) {
-    const gitPath = path109.join(dir, ".git");
+    const gitPath = path110.join(dir, ".git");
     if (existsSync16(gitPath)) {
       return dir;
     }
-    const parent = path109.dirname(dir);
+    const parent = path110.dirname(dir);
     if (parent === dir) {
       break;
     }
@@ -36066,12 +36326,12 @@ function resolveProjectRoot2(cwd) {
   return abs;
 }
 function projectKeyFromPath(projectPath) {
-  const abs = path109.resolve(projectPath);
+  const abs = path110.resolve(projectPath);
   const encoded = encodeURIComponent(abs);
   if (encoded.length <= 200) {
     return encoded;
   }
-  const base = path109.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40);
+  const base = path110.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40);
   let h = 0;
   for (let i = 0;i < abs.length; i++) {
     h = Math.imul(31, h) + abs.charCodeAt(i) | 0;
@@ -36081,17 +36341,17 @@ function projectKeyFromPath(projectPath) {
 }
 function projectSessionsDir(projectPath, dataDir) {
   const key = projectKeyFromPath(resolveProjectRoot2(projectPath));
-  return path109.join(keryxDataDir(dataDir), "sessions", key);
+  return path110.join(keryxDataDir(dataDir), "sessions", key);
 }
 function sessionDir(projectPath, sessionId, dataDir) {
-  return path109.join(projectSessionsDir(projectPath, dataDir), sessionId);
+  return path110.join(projectSessionsDir(projectPath, dataDir), sessionId);
 }
 
 // src/session/slate.ts
 init_fs();
 init_assembly();
-import { mkdir as mkdir32, readFile as readFile54, rm as rm7 } from "fs/promises";
-import path110 from "path";
+import { mkdir as mkdir32, readFile as readFile55, rm as rm7 } from "fs/promises";
+import path111 from "path";
 init_redact();
 var SLATE_SEED_KINDS = [
   "decision",
@@ -36106,14 +36366,14 @@ function isSlateSeedKind(value) {
 }
 var SEED_TEXT_MAX_LENGTH = 4000;
 function slatePath(dir) {
-  return path110.join(dir, "slate.json");
+  return path111.join(dir, "slate.json");
 }
 function slateLockPath(dir) {
   return `${slatePath(dir)}.lock`;
 }
 async function readSlate(dir) {
   try {
-    const raw = await readFile54(slatePath(dir), "utf8");
+    const raw = await readFile55(slatePath(dir), "utf8");
     return JSON.parse(raw);
   } catch (error) {
     if (isNotFound(error))
@@ -36329,11 +36589,11 @@ function listSessions(cwd, dataDir) {
     if (name.startsWith(".")) {
       continue;
     }
-    const summary = readSummaryFile(path111.join(root, name, "summary.json"));
+    const summary = readSummaryFile(path112.join(root, name, "summary.json"));
     if (summary === undefined) {
       continue;
     }
-    if (path111.resolve(summary.projectPath) !== path111.resolve(projectPath)) {
+    if (path112.resolve(summary.projectPath) !== path112.resolve(projectPath)) {
       continue;
     }
     out.push(summary);
@@ -36366,15 +36626,15 @@ async function readSessionSlate(cwd, sessionId, dataDir) {
 }
 function loadContext(cwd, sessionId, dataDir) {
   const dir = sessionDir(resolveProjectRoot2(cwd), sessionId, dataDir);
-  const contextPath = path111.join(dir, "context.jsonl");
+  const contextPath = path112.join(dir, "context.jsonl");
   if (existsSync17(contextPath)) {
     return readJsonl2(contextPath);
   }
-  return readJsonl2(path111.join(dir, "transcript.jsonl"));
+  return readJsonl2(path112.join(dir, "transcript.jsonl"));
 }
 function loadArchive(cwd, sessionId, dataDir, onDegraded) {
   const dir = sessionDir(resolveProjectRoot2(cwd), sessionId, dataDir);
-  const archivePath = path111.join(dir, "archive.jsonl");
+  const archivePath = path112.join(dir, "archive.jsonl");
   if (existsSync17(archivePath)) {
     try {
       const archive = readJsonl2(archivePath);
@@ -36558,7 +36818,7 @@ function sessionEvidenceRef(workspaceId, sessionId) {
 }
 async function resolveSessionWrapUp(input) {
   const now = input.now ?? (() => new Date);
-  const sessionId = path112.posix.basename(input.sourceRef, ".md");
+  const sessionId = path113.posix.basename(input.sourceRef, ".md");
   const summary = findSession(input.cwd, sessionId);
   if (summary === undefined || input.sourceRef !== sessionEvidenceRef(input.workspaceId, summary.id)) {
     throw new SessionWrapUpError("session_not_found", `no session matching "${input.sourceRef}" in this project \u2014 use \`keryx sessions list\``);
@@ -36575,7 +36835,7 @@ async function resolveSessionWrapUp(input) {
     throw new SessionWrapUpError("session_unreadable", `session "${summary.id}" could not be read: ${cause.message}`);
   }
   const relPath = sessionEvidenceRef(input.workspaceId, summary.id).slice(2);
-  const evidenceDir = path112.dirname(relPath);
+  const evidenceDir = path113.dirname(relPath);
   const slate = await readSessionSlate(input.cwd, summary.id);
   const diff = await gitDiff(input.cwd);
   const diffBody = diff.kind === "measured" ? diff.text : unmeasurableDiffBody(diff.detail);
@@ -36597,23 +36857,23 @@ async function resolveSessionWrapUp(input) {
     ""
   ].join(`
 `);
-  const wrapUpRelPath = path112.join(evidenceDir, `${summary.id}.wrap-up.md`);
-  const diffRelPath = path112.join(evidenceDir, `${summary.id}.diff.txt`);
-  const noticeRelPath = path112.join(evidenceDir, `${summary.id}.redaction.md`);
+  const wrapUpRelPath = path113.join(evidenceDir, `${summary.id}.wrap-up.md`);
+  const diffRelPath = path113.join(evidenceDir, `${summary.id}.diff.txt`);
+  const noticeRelPath = path113.join(evidenceDir, `${summary.id}.redaction.md`);
   const floor = await applyEvidenceRedactionFloor(input.cwd, [
-    { name: path112.basename(relPath), content: markdown, path: relPath, source: "generated" },
-    { name: path112.basename(wrapUpRelPath), content: wrapUpMarkdown, path: wrapUpRelPath, source: "generated" },
-    { name: path112.basename(diffRelPath), content: diffBody, path: diffRelPath, source: "tool-output" }
+    { name: path113.basename(relPath), content: markdown, path: relPath, source: "generated" },
+    { name: path113.basename(wrapUpRelPath), content: wrapUpMarkdown, path: wrapUpRelPath, source: "generated" },
+    { name: path113.basename(diffRelPath), content: diffBody, path: diffRelPath, source: "tool-output" }
   ]);
   if (!floor.ok)
     throw new SessionWrapUpError("security_denied", floor.reason);
   const [safeSession, safeWrapUp, safeDiff] = floor.bodies;
-  await mkdir33(path112.join(input.cwd, evidenceDir), { recursive: true });
-  await writeFile22(path112.join(input.cwd, relPath), safeSession.content, "utf8");
-  await writeFile22(path112.join(input.cwd, wrapUpRelPath), safeWrapUp.content, "utf8");
-  await writeFile22(path112.join(input.cwd, diffRelPath), safeDiff.content, "utf8");
+  await mkdir33(path113.join(input.cwd, evidenceDir), { recursive: true });
+  await writeFile22(path113.join(input.cwd, relPath), safeSession.content, "utf8");
+  await writeFile22(path113.join(input.cwd, wrapUpRelPath), safeWrapUp.content, "utf8");
+  await writeFile22(path113.join(input.cwd, diffRelPath), safeDiff.content, "utf8");
   if (floor.notice !== undefined)
-    await writeFile22(path112.join(input.cwd, noticeRelPath), floor.notice, "utf8");
+    await writeFile22(path113.join(input.cwd, noticeRelPath), floor.notice, "utf8");
   const observedAt = now().toISOString();
   const evidence = [
     { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash25("sha256").update(safeWrapUp.content).digest("hex"), observedAt },
@@ -36635,14 +36895,14 @@ async function resolveSessionWrapUp(input) {
 // src/sac/review-confirm-token.ts
 init_fs();
 import { createHash as createHash26, randomBytes as randomBytes5 } from "crypto";
-import { readFile as readFile55 } from "fs/promises";
-import path113 from "path";
+import { readFile as readFile56 } from "fs/promises";
+import path114 from "path";
 var CONFIRM_TOKEN_TTL_MS = 2 * 60000;
 function confirmTokenPath2(cwd, workspaceId, proposalId) {
-  return path113.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
+  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
 }
 function confirmReceiptPath(cwd, workspaceId, proposalId, idempotencyKey) {
-  return path113.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2565(idempotencyKey)}.confirm-receipt.json`);
+  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2565(idempotencyKey)}.confirm-receipt.json`);
 }
 function sha2565(text) {
   return createHash26("sha256").update(text).digest("hex");
@@ -36658,7 +36918,7 @@ async function consumeConfirmToken(cwd, workspaceId, proposalId, idempotencyKey,
       return { ok: false, reason: "token_required" };
     let stored;
     try {
-      stored = JSON.parse(await readFile55(file, "utf8"));
+      stored = JSON.parse(await readFile56(file, "utf8"));
     } catch (error) {
       return { ok: false, reason: isNotFound(error) ? "token_required" : "token_invalid" };
     }
@@ -36681,28 +36941,28 @@ async function consumeConfirmToken(cwd, workspaceId, proposalId, idempotencyKey,
 init_dedup();
 init_store();
 init_config();
-import { readFile as readFile57, readdir as readdir18 } from "fs/promises";
+import { readFile as readFile58, readdir as readdir19 } from "fs/promises";
 import { randomUUID as randomUUID6 } from "crypto";
-import path115 from "path";
+import path116 from "path";
 
 // src/sac/proposal-evidence.ts
 init_fs();
 import { createHash as createHash27 } from "crypto";
-import { readFile as readFile56, rm as rm8 } from "fs/promises";
-import path114 from "path";
+import { readFile as readFile57, rm as rm8 } from "fs/promises";
+import path115 from "path";
 function proposalPath(cwd, workspaceId, proposalId) {
-  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+  return path115.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
 }
 function ownerReceiptPath(cwd, owner, workspaceId, idempotencyKey) {
-  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
+  return path115.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
 }
 function proposalNotePath(cwd, workspaceId, proposalId) {
-  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
+  return path115.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
 }
 async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
   let proposal;
   try {
-    proposal = JSON.parse(await readFile56(proposalPath(cwd, workspaceId, proposalId), "utf8"));
+    proposal = JSON.parse(await readFile57(proposalPath(cwd, workspaceId, proposalId), "utf8"));
   } catch {
     return { ok: false, code: "proposal_record_unreadable" };
   }
@@ -36711,7 +36971,7 @@ async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
     return { ok: false, code: "no_evidence_to_write" };
   let content;
   try {
-    content = await readFile56(path114.join(cwd, evidence.uri), "utf8");
+    content = await readFile57(path115.join(cwd, evidence.uri), "utf8");
   } catch {
     return { ok: false, code: "evidence_file_unreadable" };
   }
@@ -36721,7 +36981,7 @@ async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
   return { proposal, evidence, content };
 }
 async function readSidecarNote(cwd, workspaceId, proposalId) {
-  return readFile56(proposalNotePath(cwd, workspaceId, proposalId), "utf8").catch(() => {
+  return readFile57(proposalNotePath(cwd, workspaceId, proposalId), "utf8").catch(() => {
     return;
   });
 }
@@ -36730,7 +36990,7 @@ function digestOf2(content) {
 }
 async function readTargetVersion(absolutePath) {
   try {
-    return digestOf2(await readFile56(absolutePath, "utf8"));
+    return digestOf2(await readFile57(absolutePath, "utf8"));
   } catch (error) {
     if (isNotFound(error))
       return null;
@@ -36741,26 +37001,26 @@ function targetRelPath(targetRef) {
   return targetRef.replace(/^\.\//, "");
 }
 function targetAbsolutePath(cwd, targetRef) {
-  return path114.join(cwd, ".metaproject", targetRelPath(targetRef));
+  return path115.join(cwd, ".metaproject", targetRelPath(targetRef));
 }
 function targetKey(targetRef) {
   return digestOf2(targetRelPath(targetRef)).slice(0, 32);
 }
 function ownerTargetVersionPath(cwd, owner, workspaceId, targetRef) {
-  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-target-versions`, `${targetKey(targetRef)}.json`);
+  return path115.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-target-versions`, `${targetKey(targetRef)}.json`);
 }
 function ownerTargetLockPath(cwd, owner, targetRef) {
-  return path114.join(cwd, ".metaproject", "data", "sac", "target-locks", owner, `${targetKey(targetRef)}.lock`);
+  return path115.join(cwd, ".metaproject", "data", "sac", "target-locks", owner, `${targetKey(targetRef)}.lock`);
 }
 function ownerStagingDir(cwd, owner, workspaceId, idempotencyKey) {
-  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-staging`, digestOf2(idempotencyKey).slice(0, 32));
+  return path115.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-staging`, digestOf2(idempotencyKey).slice(0, 32));
 }
 function ownerConflictDir(cwd, owner, workspaceId, idempotencyKey) {
-  return path114.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-conflicts`, digestOf2(idempotencyKey).slice(0, 32));
+  return path115.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-conflicts`, digestOf2(idempotencyKey).slice(0, 32));
 }
 async function readJson2(file) {
   try {
-    return JSON.parse(await readFile56(file, "utf8"));
+    return JSON.parse(await readFile57(file, "utf8"));
   } catch {
     return;
   }
@@ -36827,7 +37087,7 @@ async function applyGuardedTargetWrite(input) {
       staged: input.staged,
       stagedAt: receipt.completedAt
     };
-    await writeFileAtomic(path114.join(ownerStagingDir(cwd, owner, intent.workspaceId, intent.idempotencyKey), "plan.json"), `${JSON.stringify(staged, null, 2)}
+    await writeFileAtomic(path115.join(ownerStagingDir(cwd, owner, intent.workspaceId, intent.idempotencyKey), "plan.json"), `${JSON.stringify(staged, null, 2)}
 `);
     const applied = await input.apply(input.staged);
     if (!applied.ok) {
@@ -36853,15 +37113,15 @@ async function recoverStagedOwnerWrite(input) {
   });
 }
 async function readStagedOwnerWrite(cwd, owner, workspaceId, idempotencyKey) {
-  return readJson2(path114.join(ownerStagingDir(cwd, owner, workspaceId, idempotencyKey), "plan.json"));
+  return readJson2(path115.join(ownerStagingDir(cwd, owner, workspaceId, idempotencyKey), "plan.json"));
 }
 async function recordConflict(input) {
   const base = { targetRef: input.targetRef, expectedVersion: input.expectedVersion, currentVersion: input.currentVersion };
   if (input.proposedContent === undefined)
     return base;
   const dir = ownerConflictDir(input.cwd, input.owner, input.intent.workspaceId, input.intent.idempotencyKey);
-  await writeFileAtomic(path114.join(dir, "proposed"), input.proposedContent);
-  const diffRef = `./workspaces/${input.intent.workspaceId}/${input.owner}-write-conflicts/${path114.basename(dir)}/proposed`;
+  await writeFileAtomic(path115.join(dir, "proposed"), input.proposedContent);
+  const diffRef = `./workspaces/${input.intent.workspaceId}/${input.owner}-write-conflicts/${path115.basename(dir)}/proposed`;
   return { ...base, diffRef };
 }
 
@@ -36911,21 +37171,21 @@ async function resolveWorkspaceModule(cwd, workspaceId) {
   }
 }
 async function collectWikiDecisionEntries(cwd) {
-  const dir = path115.join(cwd, ".metaproject", "wiki", "decisions");
+  const dir = path116.join(cwd, ".metaproject", "wiki", "decisions");
   let files;
   try {
-    files = (await readdir18(dir)).filter((name) => name.endsWith(".md"));
+    files = (await readdir19(dir)).filter((name) => name.endsWith(".md"));
   } catch {
     return [];
   }
   const entries = [];
   for (const file of files) {
-    const absolutePath = path115.join(dir, file);
+    const absolutePath = path116.join(dir, file);
     try {
-      const content = await readFile57(absolutePath, "utf8");
+      const content = await readFile58(absolutePath, "utf8");
       entries.push({
         absolutePath,
-        relativePath: path115.posix.join("decisions", file),
+        relativePath: path116.posix.join("decisions", file),
         type: extractHeaderField(content, "Type") ?? "decision",
         title: extractTitle(content),
         version: extractHeaderField(content, "Version") ?? null,
@@ -37039,7 +37299,7 @@ ${candidates}`;
 
 // src/sac/memory-owner-writer.ts
 init_write();
-import { readFile as readFile58 } from "fs/promises";
+import { readFile as readFile59 } from "fs/promises";
 function renderWrapUpMemoryEntry(input) {
   const note = input.note?.trim();
   return `# ${input.title}
@@ -37098,7 +37358,7 @@ function createRealMemoryOwnerWriter(cwd, opts) {
     },
     async recover(intent) {
       try {
-        const raw = await readFile58(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey), "utf8");
+        const raw = await readFile59(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey), "utf8");
         return JSON.parse(raw);
       } catch {
         return;
@@ -37146,8 +37406,8 @@ function createRealMemoryOwnerWriter(cwd, opts) {
 // src/sac/wiki-owner-writer.ts
 init_fs();
 init_guard();
-import { readFile as readFile59 } from "fs/promises";
-import path116 from "path";
+import { readFile as readFile60 } from "fs/promises";
+import path117 from "path";
 function renderWrapUpDecisionPage(input) {
   const note = input.note?.trim();
   return `# ${input.title}
@@ -37188,14 +37448,14 @@ export is the source of truth for what actually happened.
 `;
 }
 function wikiPageRelativePath(proposalId) {
-  return path116.posix.join("decisions", `sac-${proposalId}.md`);
+  return path117.posix.join("decisions", `sac-${proposalId}.md`);
 }
 function createRealWikiOwnerWriter(cwd, opts) {
   const now = opts?.now ?? (() => new Date);
   const applyStaged = async (staged) => {
     const relativePath = staged.relativePath;
     const content = staged.content;
-    await writeFileAtomic(path116.join(cwd, ".metaproject", "wiki", relativePath), content);
+    await writeFileAtomic(path117.join(cwd, ".metaproject", "wiki", relativePath), content);
     return { ok: true };
   };
   return {
@@ -37204,7 +37464,7 @@ function createRealWikiOwnerWriter(cwd, opts) {
     },
     async recover(intent) {
       try {
-        const raw = await readFile59(ownerReceiptPath(cwd, "wiki", intent.workspaceId, intent.idempotencyKey), "utf8");
+        const raw = await readFile60(ownerReceiptPath(cwd, "wiki", intent.workspaceId, intent.idempotencyKey), "utf8");
         return JSON.parse(raw);
       } catch {
         return;
@@ -37255,7 +37515,7 @@ function createRealWikiOwnerWriter(cwd, opts) {
 }
 
 // src/sac/skill-owner-writer.ts
-import { readFile as readFile61 } from "fs/promises";
+import { readFile as readFile62 } from "fs/promises";
 
 // src/gdskills/project-skills.ts
 init_contained_write();
@@ -37264,8 +37524,8 @@ init_json();
 init_guard();
 import { createHash as createHash28 } from "crypto";
 import { homedir as homedir2 } from "os";
-import { readFile as readFile60, stat as stat14 } from "fs/promises";
-import path117 from "path";
+import { readFile as readFile61, stat as stat15 } from "fs/promises";
+import path118 from "path";
 var VERSION = "0.1.0";
 var PROJECT_SKILLS_DIR = ".metaproject/project-skills";
 var PROJECT_SKILLS_MANIFEST_PATH = ".metaproject/metaproject.json";
@@ -37295,7 +37555,7 @@ async function assertProjectWritesContained(projectRoot, paths) {
   }
 }
 async function createProjectSkill(projectRoot, options) {
-  const metaprojectRoot = path117.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path118.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
@@ -37306,7 +37566,7 @@ async function createProjectSkill(projectRoot, options) {
   const skillName = projectSkillSlug(options.name ?? inferSkillName(options.target));
   const format = options.format ?? "auto";
   const relativeSkillPath = projectSkillPackagePath(moduleName, skillName);
-  const packageRoot = path117.join(projectRoot, relativeSkillPath);
+  const packageRoot = path118.join(projectRoot, relativeSkillPath);
   await assertProjectWritesContained(projectRoot, projectSkillWritePaths(moduleName, skillName, format));
   const origin = options.origin ? options.originContent !== undefined ? {
     ref: options.origin.trim(),
@@ -37317,7 +37577,7 @@ async function createProjectSkill(projectRoot, options) {
   const warnings = collectWarnings(evidence, format);
   const files = filesForPackage(packageRoot, format);
   if (!options.dryRun) {
-    await withFileLock(path117.join(projectRoot, PROJECT_SKILLS_LOCK_PATH), async () => {
+    await withFileLock(path118.join(projectRoot, PROJECT_SKILLS_LOCK_PATH), async () => {
       await writeProjectSkillPackage({
         projectRoot,
         packageRoot,
@@ -37346,7 +37606,7 @@ async function createProjectSkill(projectRoot, options) {
     name: skillName,
     target: options.target,
     skillPath: relativeSkillPath,
-    files: files.map((filePath) => toPosix(path117.relative(projectRoot, filePath))),
+    files: files.map((filePath) => toPosix(path118.relative(projectRoot, filePath))),
     warnings,
     dryRun: options.dryRun === true
   };
@@ -37355,9 +37615,9 @@ var MAX_SKILL_TARGET_LENGTH = 80;
 function resolveOriginPath(ref, projectRoot) {
   const trimmed = ref.trim();
   if (trimmed === "~" || trimmed.startsWith("~/")) {
-    return path117.join(homedir2(), trimmed.slice(1));
+    return path118.join(homedir2(), trimmed.slice(1));
   }
-  return path117.resolve(projectRoot, trimmed);
+  return path118.resolve(projectRoot, trimmed);
 }
 function hashOriginContent(content) {
   return `sha256:${createHash28("sha256").update(content).digest("hex")}`;
@@ -37366,7 +37626,7 @@ async function readSkillOrigin(projectRoot, ref, now = () => new Date) {
   const resolved = resolveOriginPath(ref, projectRoot);
   let content;
   try {
-    content = await readFile60(resolved, "utf8");
+    content = await readFile61(resolved, "utf8");
   } catch (cause) {
     throw new Error(`Cannot read the origin file ${ref} (resolved to ${resolved}): ${cause instanceof Error ? cause.message : String(cause)}`);
   }
@@ -37395,16 +37655,16 @@ async function writeProjectSkillPackage({
 }) {
   const packageFormat = format === "single" ? "single" : "package";
   const skillContent = renderProjectSkill({ moduleName, skillName, target, note, origin, evidence, packageFormat });
-  const relativeSkillMdPath = toPosix(path117.join(path117.relative(projectRoot, packageRoot), "SKILL.md"));
+  const relativeSkillMdPath = toPosix(path118.join(path118.relative(projectRoot, packageRoot), "SKILL.md"));
   const guard = await guardOutput({ cwd: projectRoot, content: skillContent, target: "skill", source: "generated", path: relativeSkillMdPath });
   const output = prepareOutputForPersistence(guard, skillContent);
   if (!output.allowed) {
     throw new Error(`Project skill blocked by the security gate: ${output.reason}`);
   }
-  const packageRel = toPosix(path117.relative(projectRoot, packageRoot));
+  const packageRel = toPosix(path118.relative(projectRoot, packageRoot));
   const write = (file, content) => writeContained(projectRoot, `${packageRel}/${file}`, content);
   await write("SKILL.md", output.content);
-  if (!await pathExists(path117.join(packageRoot, "skill-changelog.md"))) {
+  if (!await pathExists(path118.join(packageRoot, "skill-changelog.md"))) {
     await write("skill-changelog.md", renderSkillChangelog({ moduleName, skillName, target }));
   }
   if (packageFormat === "package") {
@@ -37414,10 +37674,10 @@ async function writeProjectSkillPackage({
   }
 }
 async function collectEvidence(projectRoot, target) {
-  const absoluteTarget = path117.resolve(projectRoot, target);
+  const absoluteTarget = path118.resolve(projectRoot, target);
   const targetExists = await pathExists(absoluteTarget);
   const targetKind = await classifyTarget(absoluteTarget, targetExists);
-  const maybeRelativeTarget = targetExists ? toPosix(path117.relative(projectRoot, absoluteTarget)) : undefined;
+  const maybeRelativeTarget = targetExists ? toPosix(path118.relative(projectRoot, absoluteTarget)) : undefined;
   const graphArtifacts = await existingRelativePaths(projectRoot, [
     ".metaproject/data/gdgraph/artifacts/summary.md",
     ".metaproject/data/gdgraph/artifacts/module-map.json"
@@ -37441,13 +37701,13 @@ async function classifyTarget(absoluteTarget, targetExists) {
   if (!targetExists) {
     return "symbol-or-concept";
   }
-  const stats = await stat14(absoluteTarget);
+  const stats = await stat15(absoluteTarget);
   return stats.isDirectory() ? "directory" : "file";
 }
 async function existingRelativePaths(projectRoot, candidates) {
   const existing = [];
   for (const candidate of candidates) {
-    if (await pathExists(path117.join(projectRoot, candidate))) {
+    if (await pathExists(path118.join(projectRoot, candidate))) {
       existing.push(candidate);
     }
   }
@@ -37474,17 +37734,17 @@ function collectWarnings(evidence, format) {
 }
 function filesForPackage(packageRoot, format) {
   const base = [
-    path117.join(packageRoot, "SKILL.md"),
-    path117.join(packageRoot, "skill-changelog.md")
+    path118.join(packageRoot, "SKILL.md"),
+    path118.join(packageRoot, "skill-changelog.md")
   ];
   if (format === "single") {
     return base;
   }
   return [
     ...base,
-    path117.join(packageRoot, "verification.md"),
-    path117.join(packageRoot, "references", "context.md"),
-    path117.join(packageRoot, "templates", "README.md")
+    path118.join(packageRoot, "verification.md"),
+    path118.join(packageRoot, "references", "context.md"),
+    path118.join(packageRoot, "templates", "README.md")
   ];
 }
 function renderProjectSkill({
@@ -37712,7 +37972,7 @@ keryx skills verify ${moduleName}/${skillName}
 `;
 }
 async function updateManifest(projectRoot, entry) {
-  const manifestPath = path117.join(projectRoot, PROJECT_SKILLS_MANIFEST_PATH);
+  const manifestPath = path118.join(projectRoot, PROJECT_SKILLS_MANIFEST_PATH);
   const manifest = await readJsonFileOr(manifestPath, {});
   manifest.modules ??= {};
   manifest.modules.gdskills ??= {};
@@ -37726,8 +37986,8 @@ async function updateManifest(projectRoot, entry) {
 `);
 }
 async function updateSkillsCatalog(projectRoot) {
-  const manifestPath = path117.join(projectRoot, PROJECT_SKILLS_MANIFEST_PATH);
-  const catalogPath = path117.join(projectRoot, PROJECT_SKILLS_CATALOG_PATH);
+  const manifestPath = path118.join(projectRoot, PROJECT_SKILLS_MANIFEST_PATH);
+  const catalogPath = path118.join(projectRoot, PROJECT_SKILLS_CATALOG_PATH);
   const manifest = await readJsonFileOr(manifestPath, {});
   const registry = manifest.modules?.gdskills?.projectSkillRegistry ?? [];
   const rows = registry.length > 0 ? registry.map(projectSkillCatalogRow).join(`
@@ -37739,7 +37999,7 @@ async function updateSkillsCatalog(projectRoot) {
 |---|---|---|---|
 ${rows}
 ${PROJECT_SKILLS_CATALOG_END}`;
-  const current = await pathExists(catalogPath) ? await readFile60(catalogPath, "utf8") : `# Metaproject Skills Catalog
+  const current = await pathExists(catalogPath) ? await readFile61(catalogPath, "utf8") : `# Metaproject Skills Catalog
 `;
   const start = PROJECT_SKILLS_CATALOG_START;
   const end = PROJECT_SKILLS_CATALOG_END;
@@ -37767,7 +38027,7 @@ function inferModule(target) {
 }
 function inferSkillName(target) {
   const normalized = target.trim().replace(/[#:]+/g, "/");
-  const base = path117.basename(normalized).replace(/\.[^.]+$/, "");
+  const base = path118.basename(normalized).replace(/\.[^.]+$/, "");
   return base || "entity";
 }
 function projectSkillSlug(value) {
@@ -37814,7 +38074,7 @@ function createRealSkillOwnerWriter(cwd, opts) {
     },
     async recover(intent) {
       try {
-        const raw = await readFile61(ownerReceiptPath(cwd, "skill", intent.workspaceId, intent.idempotencyKey), "utf8");
+        const raw = await readFile62(ownerReceiptPath(cwd, "skill", intent.workspaceId, intent.idempotencyKey), "utf8");
         return JSON.parse(raw);
       } catch {
         return;
@@ -37872,7 +38132,7 @@ class ProposalLifecycleService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path118.resolve(options.workspaceRoot);
+    this.root = path119.resolve(options.workspaceRoot);
     this.now = options.now ?? (() => new Date);
   }
   async create(input) {
@@ -37891,13 +38151,13 @@ class ProposalLifecycleService {
       if (manifest.status === "archived")
         throw new ProposalLifecycleError("guard_denied", "workspace is archived");
       const file = this.proposalPath(workspaceId, proposal.id);
-      await mkdir34(path118.dirname(file), { recursive: true, mode: 448 });
+      await mkdir34(path119.dirname(file), { recursive: true, mode: 448 });
       return withFileLock(`${file}.lock`, async () => {
         const consume = this.options.wrapUpAuthority.consume(input.wrapUp, { actor, workspaceId });
         if (consume !== "ok")
           throw new ProposalLifecycleError("trusted_wrap_up_required", `trusted wrap-up ${consume}`);
         try {
-          await readFile62(file, "utf8");
+          await readFile63(file, "utf8");
           throw new ProposalLifecycleError("conflict", "proposal already exists");
         } catch (error) {
           if (error instanceof ProposalLifecycleError)
@@ -37919,7 +38179,7 @@ class ProposalLifecycleService {
     return this.options.workspaces.withAuthorizedActor({ actorContext: actor, workspaceId: input.workspaceId, action: "review", execute: async (manifest) => {
       const proposal = await this.loadProposal(input.workspaceId, input.proposalId);
       const ledger = this.ledgerPath(input.workspaceId);
-      await mkdir34(path118.dirname(ledger), { recursive: true, mode: 448 });
+      await mkdir34(path119.dirname(ledger), { recursive: true, mode: 448 });
       return withFileLock(`${ledger}.lock`, async () => {
         const records = (await this.records(ledger)).filter((record) => record.proposalId === proposal.id);
         const events = records.filter((record) => record.recordType === "proposal-transition");
@@ -37961,10 +38221,10 @@ class ProposalLifecycleService {
     } });
   }
   async listProposedProposals(workspaceId) {
-    const proposalsDir = path118.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
+    const proposalsDir = path119.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
     let entries;
     try {
-      entries = (await readdir19(proposalsDir)).filter((name) => name.endsWith(".json"));
+      entries = (await readdir20(proposalsDir)).filter((name) => name.endsWith(".json"));
     } catch (error) {
       if (isNotFound(error))
         return [];
@@ -37973,7 +38233,7 @@ class ProposalLifecycleService {
     const proposals = [];
     for (const entry of entries) {
       try {
-        const parsed = JSON.parse(await readFile62(path118.join(proposalsDir, entry), "utf8"));
+        const parsed = JSON.parse(await readFile63(path119.join(proposalsDir, entry), "utf8"));
         if (parsed.recordType === "proposal-created")
           proposals.push(parsed);
       } catch {}
@@ -38058,7 +38318,7 @@ class ProposalLifecycleService {
   }
   async loadOwnerWriteAttempt(workspaceId, proposalId, key) {
     try {
-      return JSON.parse(await readFile62(this.attemptPath(workspaceId, proposalId, key), "utf8"));
+      return JSON.parse(await readFile63(this.attemptPath(workspaceId, proposalId, key), "utf8"));
     } catch (error) {
       if (isNotFound(error))
         return;
@@ -38073,7 +38333,7 @@ class ProposalLifecycleService {
   async ensureReviewDecision(proposal, actor, reviewerAuthority, input, outcome, targetWrite, policyRevision) {
     const file = this.decisionPath(proposal.workspaceId, proposal.id, input.idempotencyKey);
     try {
-      const existing = JSON.parse(await readFile62(file, "utf8"));
+      const existing = JSON.parse(await readFile63(file, "utf8"));
       const existingWrite = existing.targetWrite;
       if (existing.proposalId !== proposal.id || existing.proposalRevision !== proposal.proposalRevision || existing.workspaceId !== proposal.workspaceId || existing.correlationId !== input.requestCorrelationId || existing.idempotencyKey !== input.idempotencyKey || existing.decision !== outcome) {
         throw new ProposalLifecycleError("conflict", "review decision does not match the recovery request");
@@ -38106,7 +38366,7 @@ class ProposalLifecycleService {
     const approvalRef = this.approvalRef(proposal.id, input.idempotencyKey);
     const approvalPath = this.approvalPath(proposal.workspaceId, proposal.id, input.idempotencyKey);
     try {
-      const existing = JSON.parse(await readFile62(approvalPath, "utf8"));
+      const existing = JSON.parse(await readFile63(approvalPath, "utf8"));
       if (existing.proposalId !== proposal.id || existing.proposalRevision !== proposal.proposalRevision || existing.workspaceId !== proposal.workspaceId || existing.correlationId !== input.requestCorrelationId || existing.idempotencyKey !== input.idempotencyKey || existing.policyRevision !== policyRevision || JSON.stringify(existing.reviewer) !== JSON.stringify({ subject: actor.subject, authority: reviewerAuthority }))
         throw new ProposalLifecycleError("conflict", "approval does not match the recovery request");
       return { approvalRef };
@@ -38126,7 +38386,7 @@ class ProposalLifecycleService {
     if (existing)
       return { intentRef };
     try {
-      const recovered = JSON.parse(await readFile62(this.intentPath(proposal.workspaceId, proposal.id, input.idempotencyKey), "utf8"));
+      const recovered = JSON.parse(await readFile63(this.intentPath(proposal.workspaceId, proposal.id, input.idempotencyKey), "utf8"));
       await this.validateRecord(recovered);
       if (recovered.proposalId !== proposal.id || recovered.proposalRevision !== proposal.proposalRevision || recovered.correlationId !== input.requestCorrelationId || recovered.idempotencyKey !== input.idempotencyKey || recovered.workspaceId !== proposal.workspaceId)
         throw new ProposalLifecycleError("conflict", "write intent does not match the recovery request");
@@ -38219,7 +38479,7 @@ class ProposalLifecycleService {
   }
   async loadProposal(workspaceId, proposalId) {
     try {
-      const item = JSON.parse(await readFile62(this.proposalPath(workspaceId, proposalId), "utf8"));
+      const item = JSON.parse(await readFile63(this.proposalPath(workspaceId, proposalId), "utf8"));
       await this.validateProposal(item);
       return item;
     } catch (error) {
@@ -38230,7 +38490,7 @@ class ProposalLifecycleService {
   }
   async records(ledger) {
     try {
-      return (await readFile62(ledger, "utf8")).trim().split(`
+      return (await readFile63(ledger, "utf8")).trim().split(`
 `).filter(Boolean).map((line) => JSON.parse(line));
     } catch (error) {
       if (isNotFound(error))
@@ -38239,35 +38499,35 @@ class ProposalLifecycleService {
     }
   }
   proposalPath(workspaceId, proposalId) {
-    return path118.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+    return path119.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
   }
   decisionRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.decision.json`;
   }
   decisionPath(workspaceId, proposalId, key) {
-    return path118.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
+    return path119.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
   }
   approvalRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.approval.json`;
   }
   approvalPath(workspaceId, proposalId, key) {
-    return path118.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
+    return path119.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
   }
   writeResultPath(workspaceId, proposalId, key) {
-    return path118.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
+    return path119.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
   }
   intentRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.write-intent.json`;
   }
   intentPath(workspaceId, proposalId, key) {
-    return path118.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
+    return path119.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
   }
   attemptPath(workspaceId, proposalId, key) {
-    return path118.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.owner-write-attempt.json`);
+    return path119.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.owner-write-attempt.json`);
   }
   async loadWriteResult(workspaceId, proposalId, key) {
     try {
-      return JSON.parse(await readFile62(this.writeResultPath(workspaceId, proposalId, key), "utf8"));
+      return JSON.parse(await readFile63(this.writeResultPath(workspaceId, proposalId, key), "utf8"));
     } catch (error) {
       if (isNotFound(error))
         return;
@@ -38276,7 +38536,7 @@ class ProposalLifecycleService {
   }
   async writeImmutable(file, record) {
     try {
-      const existing = await readFile62(file, "utf8");
+      const existing = await readFile63(file, "utf8");
       if (existing !== `${JSON.stringify(record)}
 `)
         throw new ProposalLifecycleError("conflict", "immutable lifecycle record already exists");
@@ -38290,7 +38550,7 @@ class ProposalLifecycleService {
     }
   }
   ledgerPath(workspaceId) {
-    return path118.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
+    return path119.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
   }
   timestamp() {
     return this.now().toISOString();
@@ -38371,9 +38631,9 @@ function normalizeProposalLifecycleResult(value) {
   return JSON.parse(JSON.stringify(value));
 }
 // src/sac/collaboration-service.ts
-import { appendFile as appendFile8, mkdir as mkdir35, readFile as readFile63 } from "fs/promises";
+import { appendFile as appendFile8, mkdir as mkdir35, readFile as readFile64 } from "fs/promises";
 import { randomUUID as randomUUID8 } from "crypto";
-import path119 from "path";
+import path120 from "path";
 class CollaborationServiceError extends Error {
   code;
   constructor(code, message) {
@@ -38388,7 +38648,7 @@ class CollaborationService {
     this.input = input;
   }
   file(id) {
-    return path119.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
+    return path120.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
   }
   async overview(input) {
     const manifest = await this.input.workspaces.show(input);
@@ -38397,7 +38657,7 @@ class CollaborationService {
   async activity(input) {
     await this.input.workspaces.show(input);
     try {
-      return (await readFile63(this.file(input.workspaceId), "utf8")).trim().split(`
+      return (await readFile64(this.file(input.workspaceId), "utf8")).trim().split(`
 `).filter(Boolean).map((line) => this.validate(JSON.parse(line)));
     } catch (error) {
       if (typeof error === "object" && error && "code" in error && error.code === "ENOENT")
@@ -38425,7 +38685,7 @@ class CollaborationService {
         occurredAt: (this.input.now ?? (() => new Date))().toISOString(),
         ...suppliedHandoff ? { handoff: { ...suppliedHandoff, from: actor.subject } } : {}
       });
-      await mkdir35(path119.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
+      await mkdir35(path120.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
       await appendFile8(this.file(manifest.id), `${JSON.stringify(activity)}
 `, { mode: 384 });
       return normalizeCollaborationResult(activity);
@@ -38474,14 +38734,14 @@ function normalizeCollaborationResult(value) {
 }
 // src/session/external-slate.ts
 init_fs();
-import { mkdir as mkdir37, readdir as readdir20, readFile as readFile64 } from "fs/promises";
-import path121 from "path";
+import { mkdir as mkdir37, readdir as readdir21, readFile as readFile65 } from "fs/promises";
+import path122 from "path";
 
 // src/sac/machine-wrap-up.ts
 init_fs();
 import { createHash as createHash30, randomUUID as randomUUID10 } from "crypto";
 import { mkdir as mkdir36 } from "fs/promises";
-import path120 from "path";
+import path121 from "path";
 
 // src/sac/workspace-resolve.ts
 init_redact();
@@ -38622,11 +38882,11 @@ async function resolveMachineWrapUp(input) {
 `;
   const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
 `;
-  const evidenceRelBase = path120.posix.join(".metaproject", "workspaces", input.workspaceId, "machine-evidence");
+  const evidenceRelBase = path121.posix.join(".metaproject", "workspaces", input.workspaceId, "machine-evidence");
   const floor = await applyEvidenceRedactionFloor(input.cwd, [
-    { name: `${input.kind}.diff.txt`, content: diffBody, path: path120.posix.join(evidenceRelBase, `${input.kind}.diff.txt`), source: "tool-output" },
-    { name: `${input.kind}.flow.json`, content: flowSnapshotJson, path: path120.posix.join(evidenceRelBase, `${input.kind}.flow.json`), source: "generated" },
-    { name: `${input.kind}.seeds.json`, content: seedsJson, path: path120.posix.join(evidenceRelBase, `${input.kind}.seeds.json`), source: "generated" }
+    { name: `${input.kind}.diff.txt`, content: diffBody, path: path121.posix.join(evidenceRelBase, `${input.kind}.diff.txt`), source: "tool-output" },
+    { name: `${input.kind}.flow.json`, content: flowSnapshotJson, path: path121.posix.join(evidenceRelBase, `${input.kind}.flow.json`), source: "generated" },
+    { name: `${input.kind}.seeds.json`, content: seedsJson, path: path121.posix.join(evidenceRelBase, `${input.kind}.seeds.json`), source: "generated" }
   ]);
   if (!floor.ok)
     return { ok: false, code: "security_denied", detail: floor.reason };
@@ -38680,14 +38940,14 @@ ${safeSeeds.content}`;
     }
     summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(summaryDiff, course);
   }
-  const evidenceDir = path120.join(input.cwd, ".metaproject", "workspaces", input.workspaceId, "machine-evidence");
+  const evidenceDir = path121.join(input.cwd, ".metaproject", "workspaces", input.workspaceId, "machine-evidence");
   await mkdir36(evidenceDir, { recursive: true });
   const diffFile = `${input.kind}.${shortHash}.diff.txt`;
   const flowFile = `${input.kind}.${shortHash}.flow.json`;
   const seedsFile = `${input.kind}.${shortHash}.seeds.json`;
-  await writeFileAtomic(path120.join(evidenceDir, diffFile), safeDiff.content);
-  await writeFileAtomic(path120.join(evidenceDir, flowFile), safeFlow.content);
-  await writeFileAtomic(path120.join(evidenceDir, seedsFile), safeSeeds.content);
+  await writeFileAtomic(path121.join(evidenceDir, diffFile), safeDiff.content);
+  await writeFileAtomic(path121.join(evidenceDir, flowFile), safeFlow.content);
+  await writeFileAtomic(path121.join(evidenceDir, seedsFile), safeSeeds.content);
   const observedAt = now().toISOString();
   const relBase = `./.metaproject/workspaces/${input.workspaceId}/machine-evidence`;
   const evidence = [
@@ -38697,7 +38957,7 @@ ${safeSeeds.content}`;
   ];
   if (floor.notice !== undefined) {
     const noticeFile = `${input.kind}.${shortHash}.redaction.md`;
-    await writeFileAtomic(path120.join(evidenceDir, noticeFile), floor.notice);
+    await writeFileAtomic(path121.join(evidenceDir, noticeFile), floor.notice);
     evidence.push({ kind: REDACTION_NOTICE_KIND, uri: `${relBase}/${noticeFile}`, revision: sha2566(floor.notice), observedAt });
   }
   return {
@@ -38716,18 +38976,18 @@ async function writeFlooredArchiveArtifact(params) {
     {
       name: params.filename,
       content: params.content,
-      path: path120.posix.join("slate-archive", params.filename),
+      path: path121.posix.join("slate-archive", params.filename),
       source: "generated"
     }
   ]);
   if (!floor.ok)
     return { ok: false, code: "security_denied", detail: floor.reason };
   const body = floor.bodies[0];
-  const archiveDir = path120.join(params.dir, "slate-archive");
+  const archiveDir = path121.join(params.dir, "slate-archive");
   await mkdir36(archiveDir, { recursive: true });
-  await writeFileAtomic(path120.join(archiveDir, params.filename), body.content);
+  await writeFileAtomic(path121.join(archiveDir, params.filename), body.content);
   if (floor.notice !== undefined) {
-    await writeFileAtomic(path120.join(archiveDir, `${params.filename}${ARCHIVE_REDACTION_NOTICE_SUFFIX}`), floor.notice);
+    await writeFileAtomic(path121.join(archiveDir, `${params.filename}${ARCHIVE_REDACTION_NOTICE_SUFFIX}`), floor.notice);
   }
   return { ok: true, altered: body.altered };
 }
@@ -38763,9 +39023,9 @@ async function writeWrapUpOutcomeArtifact(cwd, dir, trigger, now, groups) {
       return;
     const refusalIso = now().toISOString();
     const refusalFilename = `${refusalIso.replace(/[:.]/g, "-")}-wrap-up-outcome.json`;
-    const archiveDir = path120.join(dir, "slate-archive");
+    const archiveDir = path121.join(dir, "slate-archive");
     await mkdir36(archiveDir, { recursive: true });
-    await writeFileAtomic(path120.join(archiveDir, refusalFilename), `${JSON.stringify({
+    await writeFileAtomic(path121.join(archiveDir, refusalFilename), `${JSON.stringify({
       recordType: "wrap-up-outcome",
       trigger,
       generatedAt: refusalIso,
@@ -38901,7 +39161,7 @@ async function runWrapUp(input) {
 
 // src/session/external-slate.ts
 function externalSlatesDir(cwd) {
-  return path121.join(cwd, ".keryx", "external-slates");
+  return path122.join(cwd, ".keryx", "external-slates");
 }
 var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function assertValidExternalSessionId(externalSessionId) {
@@ -38911,18 +39171,18 @@ function assertValidExternalSessionId(externalSessionId) {
 }
 function externalSlatePath(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path121.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+  return path122.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
 }
 function externalSlateLockPath(cwd, externalSessionId) {
   return `${externalSlatePath(cwd, externalSessionId)}.lock`;
 }
 function externalSlateEvidenceDir(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path121.join(externalSlatesDir(cwd), externalSessionId);
+  return path122.join(externalSlatesDir(cwd), externalSessionId);
 }
 async function readExternalSlate(cwd, externalSessionId) {
   try {
-    const raw = await readFile64(externalSlatePath(cwd, externalSessionId), "utf8");
+    const raw = await readFile65(externalSlatePath(cwd, externalSessionId), "utf8");
     return JSON.parse(raw);
   } catch (error) {
     if (isNotFound(error))
@@ -38942,7 +39202,7 @@ async function writeExternalSlate(cwd, externalSessionId, update) {
 }
 async function listExternalSlateIds(cwd) {
   try {
-    const entries = await readdir20(externalSlatesDir(cwd));
+    const entries = await readdir21(externalSlatesDir(cwd));
     return entries.filter((name) => name.endsWith(".json")).map((name) => name.slice(0, -".json".length));
   } catch (error) {
     if (isNotFound(error))
@@ -39024,13 +39284,13 @@ __export(exports_service10, {
   runDoctor: () => runDoctor,
   runValidate: () => runValidate
 });
-import path124 from "path";
-import { readFile as readFile67 } from "fs/promises";
+import path125 from "path";
+import { readFile as readFile68 } from "fs/promises";
 
 // src/standard/validate.ts
 init_fs();
-import path123 from "path";
-import { readFile as readFile66 } from "fs/promises";
+import path124 from "path";
+import { readFile as readFile67 } from "fs/promises";
 
 // src/standard/schemas.ts
 var MODULE_SCHEMA = {
@@ -39159,8 +39419,8 @@ var SCHEMA_REGISTRY2 = {
 // src/standard/profiles.ts
 init_fs();
 init_entrypoint_targets();
-import path122 from "path";
-import { readFile as readFile65 } from "fs/promises";
+import path123 from "path";
+import { readFile as readFile66 } from "fs/promises";
 var AGENT_MODULES = ["gdgraph", "gdctx", "gdskills", "gdwiki", "memory"];
 var CI_MODULES = ["health", "testing"];
 var INDEX_LINK = ".metaproject/index.md";
@@ -39184,11 +39444,11 @@ function enabledModuleKeys(manifest) {
 }
 async function rootEntrypointLinksIndex(cwd, manifest) {
   for (const { path: name } of namedEntrypoints(manifest)) {
-    const filePath = path122.join(cwd, name);
+    const filePath = path123.join(cwd, name);
     if (!await pathExists(filePath)) {
       continue;
     }
-    const content = await readFile65(filePath, "utf8");
+    const content = await readFile66(filePath, "utf8");
     if (content.includes(INDEX_LINK)) {
       return true;
     }
@@ -39196,16 +39456,16 @@ async function rootEntrypointLinksIndex(cwd, manifest) {
   return false;
 }
 async function minimalSatisfied(cwd) {
-  const metaprojectRoot = path122.join(cwd, ".metaproject");
+  const metaprojectRoot = path123.join(cwd, ".metaproject");
   const requiredFiles = ["index.md", "README.md", "metaproject.json"];
   const requiredDirs = ["modules", "rules", "skills", "data"];
   for (const file of requiredFiles) {
-    if (!await pathExists(path122.join(metaprojectRoot, file))) {
+    if (!await pathExists(path123.join(metaprojectRoot, file))) {
       return false;
     }
   }
   for (const dir of requiredDirs) {
-    if (!await pathExists(path122.join(metaprojectRoot, dir))) {
+    if (!await pathExists(path123.join(metaprojectRoot, dir))) {
       return false;
     }
   }
@@ -39218,7 +39478,7 @@ async function ciSatisfied(cwd, manifest) {
     return false;
   }
   for (const key of ciModules) {
-    if (await pathExists(path122.join(cwd, ".metaproject", "data", key, "artifacts"))) {
+    if (await pathExists(path123.join(cwd, ".metaproject", "data", key, "artifacts"))) {
       return true;
     }
   }
@@ -39231,7 +39491,7 @@ async function evaluateProfiles(cwd, manifest) {
     satisfied.push("minimal");
   }
   const hasAgentModule = AGENT_MODULES.some((key) => new Set(enabledModuleKeys(manifest)).has(key));
-  const agent = minimal && hasAgentModule && await rootEntrypointLinksIndex(cwd, manifest) && await pathExists(path122.join(cwd, ".metaproject", "rules"));
+  const agent = minimal && hasAgentModule && await rootEntrypointLinksIndex(cwd, manifest) && await pathExists(path123.join(cwd, ".metaproject", "rules"));
   if (agent) {
     satisfied.push("agent");
   }
@@ -39400,26 +39660,26 @@ var MANIFEST_TOP_LEVEL_SCHEMA = {
 async function validateWorkspace2(cwd) {
   const errors = [];
   const warnings = [];
-  const metaprojectRoot = path123.join(cwd, ".metaproject");
+  const metaprojectRoot = path124.join(cwd, ".metaproject");
   const requiredFiles = ["index.md", "README.md", "metaproject.json"];
   for (const file of requiredFiles) {
-    if (!await pathExists(path123.join(metaprojectRoot, file))) {
+    if (!await pathExists(path124.join(metaprojectRoot, file))) {
       errors.push(issue("missing-required-file", `Required file .metaproject/${file} is missing`, `Run \`keryx init\` to scaffold .metaproject/${file}.`));
     }
   }
   const requiredDirs = ["modules", "rules", "skills", "data"];
   for (const dir of requiredDirs) {
-    if (!await pathExists(path123.join(metaprojectRoot, dir))) {
+    if (!await pathExists(path124.join(metaprojectRoot, dir))) {
       errors.push(issue("missing-required-dir", `Required directory .metaproject/${dir}/ is missing`, `Run \`keryx init\` to create .metaproject/${dir}/.`));
     }
   }
-  const manifestPath = path123.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path124.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return { ok: errors.length === 0, errors, warnings };
   }
   let manifest;
   try {
-    manifest = JSON.parse(await readFile66(manifestPath, "utf8"));
+    manifest = JSON.parse(await readFile67(manifestPath, "utf8"));
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     errors.push(issue("invalid-manifest-json", `.metaproject/metaproject.json is not valid JSON: ${detail}`, "Fix the JSON syntax or regenerate it with `keryx init`."));
@@ -39445,7 +39705,7 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path123.join(cwd, value))) {
+      if (!await pathExists(path124.join(cwd, value))) {
         errors.push(issue("missing-declared-path", `Declared path paths.${key} -> ${value} does not exist`, `Create ${value} or remove paths.${key} from metaproject.json.`));
       }
     }
@@ -39455,7 +39715,7 @@ async function validateWorkspace2(cwd) {
       continue;
     }
     if (typeof entry.manifest === "string") {
-      if (!await pathExists(path123.join(cwd, entry.manifest))) {
+      if (!await pathExists(path124.join(cwd, entry.manifest))) {
         errors.push(issue("missing-module-manifest", `Enabled module "${key}" manifest ${entry.manifest} is missing`, `Create ${entry.manifest} or run \`keryx update\` to regenerate module manifests.`));
       }
     }
@@ -39464,18 +39724,18 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path123.join(cwd, value))) {
+      if (!await pathExists(path124.join(cwd, value))) {
         const sink = field === "data" ? warnings : errors;
         sink.push(issue("missing-module-path", `Module "${key}" declares ${String(field)} ${value}, which does not exist`, field === "data" ? `Run the module (e.g. \`keryx ${key} ...\`) to generate ${value}, or update modules.${key}.data in metaproject.json.` : `Create ${value} or update modules.${key}.${String(field)} in metaproject.json.`));
       }
     }
   }
   for (const { path: name, scope } of namedEntrypoints(manifest)) {
-    const filePath = path123.join(cwd, name);
+    const filePath = path124.join(cwd, name);
     if (!await pathExists(filePath)) {
       continue;
     }
-    const content = await readFile66(filePath, "utf8");
+    const content = await readFile67(filePath, "utf8");
     if (!content.includes(INDEX_LINK2)) {
       errors.push(issue("entrypoint-missing-index-link", `Root entrypoint ${name} does not link ${INDEX_LINK2}`, scope === "local" ? `Run \`keryx update\` to put the managed block back into ${name}.` : `Add a reference to ${INDEX_LINK2} in ${name} (\`keryx rules sync\` does this).`));
     }
@@ -40381,12 +40641,12 @@ async function runDoctor(cwd) {
   return validateWorkspace2(cwd);
 }
 async function readManifest(cwd) {
-  const manifestPath = path124.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path125.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     throw new Error("Metaproject is not initialized (missing .metaproject/metaproject.json). Run `keryx init` first.");
   }
   try {
-    return JSON.parse(await readFile67(manifestPath, "utf8"));
+    return JSON.parse(await readFile68(manifestPath, "utf8"));
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     throw new Error(`Invalid .metaproject/metaproject.json: ${detail}`);