@pleri/olam-cli 0.1.161 → 0.1.162

package/dist/index.js

@@ -492,8 +492,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path93, errorMaps, issueData } = params;
-      const fullPath = [...path93, ...issueData.path || []];
+      const { data, path: path94, errorMaps, issueData } = params;
+      const fullPath = [...path94, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -801,11 +801,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path93, key) {
+      constructor(parent, value, path94, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path93;
+        this._path = path94;
         this._key = key;
       }
       get path() {
@@ -4286,7 +4286,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path93, ctx, rejectSource) {
+function refineForbiddenKeys(value, path94, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4294,12 +4294,12 @@ function refineForbiddenKeys(value, path93, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path93, key],
+        path: [...path94, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path93.length === 0 && key === "source") {
+    if (rejectSource && path94.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4307,21 +4307,21 @@ function refineForbiddenKeys(value, path93, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path93, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path94, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path93, rejectSource) {
+function rejectForbiddenKeys(value, path94, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path93}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path94}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path93}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path94}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path93}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path94}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5500,8 +5500,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path93, body, attempt = 0) {
-        const url2 = `${this.baseUrl}${path93}`;
+      async request(method, path94, body, attempt = 0) {
+        const url2 = `${this.baseUrl}${path94}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5519,7 +5519,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path93, body, attempt + 1);
+            return this.request(method, path94, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -7322,8 +7322,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path93, method, body) {
-        const url2 = `${this.config.workerUrl}${path93}`;
+      async request(path94, method, body) {
+        const url2 = `${this.config.workerUrl}${path94}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -9092,17 +9092,17 @@ function kgRoot() {
 function worldsRoot() {
   return join17(olamHome(), "worlds");
 }
-function assertWithinPrefix(path93, prefix, label) {
-  if (!path93.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path93} not under ${prefix}/`);
+function assertWithinPrefix(path94, prefix, label) {
+  if (!path94.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path94} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path93 = resolve6(join17(root, workspace));
-  assertWithinPrefix(path93, root, "kgPristinePath");
-  return path93;
+  const path94 = resolve6(join17(root, workspace));
+  assertWithinPrefix(path94, root, "kgPristinePath");
+  return path94;
 }
 var KG_PATHS_INTERNALS;
 var init_storage_paths = __esm({
@@ -11042,7 +11042,7 @@ var init_auto_dispatch_task = __esm({
 });
 
 // ../core/dist/skill-sources/schema.js
-var SKILL_SOURCE_ID_LENGTH, NAME_PATTERN, URL_PATTERN, SkillSourceSchema;
+var SKILL_SOURCE_ID_LENGTH, NAME_PATTERN, URL_PATTERN, PREFIX_PATTERN, SkillSourceSchema;
 var init_schema3 = __esm({
   "../core/dist/skill-sources/schema.js"() {
     "use strict";
@@ -11050,13 +11050,24 @@ var init_schema3 = __esm({
     SKILL_SOURCE_ID_LENGTH = 12;
     NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
     URL_PATTERN = /^(?:https?:\/\/|git@|ssh:\/\/|file:\/\/|\/).+/;
+    PREFIX_PATTERN = /^[a-z0-9][a-z0-9_-]{0,38}$/;
     SkillSourceSchema = external_exports.object({
       id: external_exports.string().length(SKILL_SOURCE_ID_LENGTH, `skill-source id must be exactly ${SKILL_SOURCE_ID_LENGTH} chars (sha256-of-url prefix)`).regex(/^[a-f0-9]+$/, "skill-source id must be lowercase hex"),
       name: external_exports.string().regex(NAME_PATTERN, "skill-source name must be ASCII lowercase + digits + dash (1-64 chars, no leading/trailing dash)"),
       gitUrl: external_exports.string().min(1, "gitUrl must not be empty").regex(URL_PATTERN, "gitUrl must look like a git URL (https://, git@, ssh://, file://, or absolute path)"),
       branch: external_exports.string().min(1, "branch must not be empty").default("main"),
       addedAt: external_exports.number().int().nonnegative(),
-      lastPulledSha: external_exports.string().regex(/^[a-f0-9]{40}$/, "lastPulledSha must be a 40-char lowercase hex git SHA").optional()
+      lastPulledSha: external_exports.string().regex(/^[a-f0-9]{40}$/, "lastPulledSha must be a 40-char lowercase hex git SHA").optional(),
+      /**
+       * Optional rename prefix. When set, skills+agents from this source are
+       * deployed under `<prefix>:<canonical-name>` (both filename + frontmatter
+       * `name:` rewritten). Source clone + atlas-toolbox member overlays remain
+       * canonical-named on disk; the rename is purely a deploy-time view.
+       * Operator overlay files (`~/.claude/{skills,agents}.overrides/`) MUST
+       * use canonical names; `olam flywheel migrate-overlays --push` enforces
+       * this via the reverse validator.
+       */
+      prefix: external_exports.string().regex(PREFIX_PATTERN, "skill-source prefix must be ASCII lowercase + digits + dash/underscore (1-39 chars, no leading/trailing dash)").optional()
     });
   }
 });
@@ -15613,10 +15624,10 @@ async function readHostCpToken2() {
   if (!fs26.existsSync(tp)) return null;
   return fs26.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path93, body) {
+async function callHostCpProxy(method, worldId, path94, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path93}`;
+  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path94}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -16282,7 +16293,8 @@ var init_trust_audit_log = __esm({
       "removed",
       "meta-hook-stripped",
       "setup-skill-source-picked",
-      "setup-project-sweep-completed"
+      "setup-project-sweep-completed",
+      "prefix-collision"
     ]);
     TrustMethodSchema = external_exports.enum(["flag", "interactive", "auto-reject-tty", "none"]);
     TrustAuditEntrySchema = external_exports.object({
@@ -16395,24 +16407,49 @@ function updateSkillSource(id, patch) {
       throw new Error(`skill-source name "${patch.name}" already in use by id "${collision.id}".`);
     }
   }
+  if (patch.prefix !== void 0 && patch.prefix !== null) {
+    if (!PREFIX_PATTERN2.test(patch.prefix)) {
+      throw new Error(`prefix must match /^[a-z0-9][a-z0-9_-]{0,38}$/ \u2014 got "${patch.prefix}"`);
+    }
+  }
   const existing = config.skillSources[idx];
+  let prefixUpdate = {};
+  if (patch.prefix === null) {
+    const { prefix: _dropped, ...rest } = existing;
+    void _dropped;
+    const updated2 = {
+      ...rest,
+      ...patch.name !== void 0 ? { name: patch.name } : {},
+      ...patch.branch !== void 0 ? { branch: patch.branch } : {},
+      ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {}
+    };
+    const next2 = [...config.skillSources];
+    next2[idx] = updated2;
+    writeGlobalConfig({ ...config, skillSources: next2 });
+    return updated2;
+  } else if (patch.prefix !== void 0) {
+    prefixUpdate = { prefix: patch.prefix };
+  }
   const updated = {
     ...existing,
     ...patch.name !== void 0 ? { name: patch.name } : {},
     ...patch.branch !== void 0 ? { branch: patch.branch } : {},
-    ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {}
+    ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {},
+    ...prefixUpdate
   };
   const next = [...config.skillSources];
   next[idx] = updated;
   writeGlobalConfig({ ...config, skillSources: next });
   return updated;
 }
+var PREFIX_PATTERN2;
 var init_store3 = __esm({
   "../core/dist/skill-sources/store.js"() {
     "use strict";
     init_store2();
     init_schema3();
     init_trust_audit_log();
+    PREFIX_PATTERN2 = /^[a-z0-9][a-z0-9_-]{0,38}$/;
   }
 });
 
@@ -18739,17 +18776,195 @@ var init_managed_merge = __esm({
   }
 });
 
-// ../core/dist/skill-sync/engine.js
+// ../core/dist/skill-sync/prefix-rules.js
+function applyPrefix(name, prefix, otherKnownPrefixes = []) {
+  if (prefix.length === 0) {
+    throw new Error("applyPrefix: prefix must be non-empty");
+  }
+  if (prefix.includes(":")) {
+    throw new Error(`applyPrefix: prefix must not contain ':' (got "${prefix}")`);
+  }
+  if (name.startsWith(`${prefix}:`))
+    return name;
+  for (const other of otherKnownPrefixes) {
+    if (other.length > 0 && name.startsWith(`${other}:`))
+      return name;
+  }
+  return `${prefix}:${name}`;
+}
+function rewriteFrontmatterName(content, rewriter) {
+  const text = content.toString("utf-8");
+  const parsed = parseFrontmatter3(text);
+  if (Object.keys(parsed.fm).length === 0)
+    return content;
+  const currentName = parsed.fm["name"];
+  if (currentName === void 0)
+    return content;
+  const newName = rewriter(currentName);
+  if (newName === currentName)
+    return content;
+  const nextFm = { ...parsed.fm, name: newName };
+  const rebuilt = serializeFrontmatter(nextFm) + parsed.body;
+  return Buffer.from(rebuilt, "utf-8");
+}
+function validateCanonical(filenameBasename, content, registeredPrefixes) {
+  if (registeredPrefixes.length === 0)
+    return { ok: true };
+  const bareName = filenameBasename.replace(/\.md$/, "");
+  for (const prefix of registeredPrefixes) {
+    if (prefix.length === 0)
+      continue;
+    if (bareName.startsWith(`${prefix}:`)) {
+      return {
+        ok: false,
+        violation: { kind: "filename", prefix, value: filenameBasename }
+      };
+    }
+  }
+  const text = content.toString("utf-8");
+  const parsed = parseFrontmatter3(text);
+  const fmName = parsed.fm["name"];
+  if (fmName === void 0)
+    return { ok: true };
+  for (const prefix of registeredPrefixes) {
+    if (prefix.length === 0)
+      continue;
+    if (fmName.startsWith(`${prefix}:`)) {
+      return {
+        ok: false,
+        violation: { kind: "frontmatter", prefix, value: fmName }
+      };
+    }
+  }
+  return { ok: true };
+}
+function formatCanonicalViolation(filePath, violation) {
+  const surface = violation.kind === "filename" ? "filename" : "frontmatter `name:` field";
+  const stripped = violation.value.replace(new RegExp(`^${violation.prefix}:`), "");
+  return [
+    `overlay ${filePath} carries registered prefix "${violation.prefix}:" in its ${surface} ("${violation.value}").`,
+    `Overlays MUST use canonical names \u2014 renaming is a deploy-time view, not a content rewrite.`,
+    `Fix: rename to "${stripped}" (also strip from frontmatter name: if present).`,
+    `See docs/plans/skill-prefix-rules/README.md \xA7 Bidirectional invariant.`
+  ].join("\n  ");
+}
+var init_prefix_rules = __esm({
+  "../core/dist/skill-sync/prefix-rules.js"() {
+    "use strict";
+    init_markdown_merger();
+  }
+});
+
+// ../core/dist/skill-sync/prefix-deploy.js
 import * as fs68 from "node:fs";
-import * as os36 from "node:os";
 import * as path67 from "node:path";
+function buildSourcePrefixMap(sources) {
+  const byId = /* @__PURE__ */ new Map();
+  const prefixes = /* @__PURE__ */ new Set();
+  for (const s of sources) {
+    if (s.prefix !== void 0 && s.prefix.length > 0) {
+      byId.set(s.id, s.prefix);
+      prefixes.add(s.prefix);
+    }
+  }
+  return {
+    get: (sourceId) => byId.get(sourceId),
+    registeredPrefixes: Array.from(prefixes)
+  };
+}
+function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir2, dryRun) {
+  const result = { rewrittenCount: 0, entries: [] };
+  for (const artifact of baseArtifacts) {
+    if (artifact.kind !== "skill" && artifact.kind !== "agent")
+      continue;
+    const prefix = sourceMap.get(artifact.sourceId);
+    if (prefix === void 0)
+      continue;
+    const canonical = artifact.deployBasename;
+    const otherPrefixes = sourceMap.registeredPrefixes.filter((p) => p !== prefix);
+    const renamed = applyPrefix(canonical, prefix, otherPrefixes);
+    if (renamed === canonical)
+      continue;
+    const renamedFrontmatterName = renamed.replace(/\.md$/, "");
+    if (dryRun) {
+      artifact.deployBasename = renamed;
+      result.rewrittenCount += 1;
+      result.entries.push({
+        sourceId: artifact.sourceId,
+        kind: artifact.kind,
+        canonicalBasename: canonical,
+        renamedBasename: renamed,
+        prefix
+      });
+      continue;
+    }
+    if (artifact.kind === "skill") {
+      const skillMdPath = path67.join(artifact.sourcePath, "SKILL.md");
+      const content = fs68.readFileSync(skillMdPath);
+      const rewritten = rewriteFrontmatterName(content, () => renamedFrontmatterName);
+      const managedDir = materializeMergedSkill({
+        sourceId: artifact.sourceId,
+        sourcePath: artifact.sourcePath,
+        deployBasename: renamed,
+        mergedContent: rewritten,
+        claudeDir: claudeDir2
+      });
+      artifact.sourcePath = managedDir;
+      artifact.deployBasename = renamed;
+    } else {
+      const content = artifact.resolvedContent !== void 0 ? artifact.resolvedContent : fs68.readFileSync(artifact.sourcePath);
+      const rewritten = rewriteFrontmatterName(content, () => renamedFrontmatterName);
+      artifact.resolvedContent = rewritten;
+      artifact.deployBasename = renamed;
+    }
+    result.rewrittenCount += 1;
+    result.entries.push({
+      sourceId: artifact.sourceId,
+      kind: artifact.kind,
+      canonicalBasename: canonical,
+      renamedBasename: renamed,
+      prefix
+    });
+  }
+  return result;
+}
+function detectPrefixCollisions(sources) {
+  const byPrefix = /* @__PURE__ */ new Map();
+  for (const s of sources) {
+    if (s.prefix === void 0 || s.prefix.length === 0)
+      continue;
+    const ids = byPrefix.get(s.prefix) ?? [];
+    ids.push(s.id);
+    byPrefix.set(s.prefix, ids);
+  }
+  const collisions = [];
+  for (const [prefix, ids] of byPrefix.entries()) {
+    if (ids.length < 2)
+      continue;
+    const [winner, ...losers] = ids;
+    collisions.push({ prefix, winnerSourceId: winner, loserSourceIds: losers });
+  }
+  return collisions;
+}
+var init_prefix_deploy = __esm({
+  "../core/dist/skill-sync/prefix-deploy.js"() {
+    "use strict";
+    init_prefix_rules();
+    init_managed_merge();
+  }
+});
+
+// ../core/dist/skill-sync/engine.js
+import * as fs69 from "node:fs";
+import * as os36 from "node:os";
+import * as path68 from "node:path";
 function resolveAtlasUser(override) {
   if (override)
     return override;
-  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path67.join(os36.homedir(), ".claude");
-  const f = path67.join(claudeDir2, ".atlas-user");
-  if (fs68.existsSync(f)) {
-    return fs68.readFileSync(f, "utf-8").trim() || void 0;
+  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path68.join(os36.homedir(), ".claude");
+  const f = path68.join(claudeDir2, ".atlas-user");
+  if (fs69.existsSync(f)) {
+    return fs69.readFileSync(f, "utf-8").trim() || void 0;
   }
   return void 0;
 }
@@ -18761,7 +18976,7 @@ async function syncSkills(opts = {}) {
   const perSource = [];
   for (const source of sources) {
     const clonePath = skillSourceClonePath(source.id);
-    if (!fs68.existsSync(clonePath))
+    if (!fs69.existsSync(clonePath))
       continue;
     const { artifacts, subscription } = await withFileLock(clonePath, () => {
       const pinRef = projectOverride?.override.pin?.[source.id];
@@ -18799,9 +19014,15 @@ async function syncSkills(opts = {}) {
   const memberOverlaysEnabled = process.env["OLAM_MEMBER_OVERLAYS"] === "1";
   const baseArtifacts = projectFilteredArtifacts.filter((a) => a.kind !== "overlay");
   const overlayArtifacts = memberOverlaysEnabled ? projectFilteredArtifacts.filter((a) => a.kind === "overlay") : [];
-  if (memberOverlaysEnabled && overlayArtifacts.length > 0 && !opts.dryRun) {
+  const sourcePrefixMap = buildSourcePrefixMap(sources);
+  const hasPrefixRewrites = sources.some((s) => s.prefix !== void 0 && s.prefix.length > 0);
+  const willMutateManagedDir = !opts.dryRun && (memberOverlaysEnabled && overlayArtifacts.length > 0 || hasPrefixRewrites);
+  if (willMutateManagedDir) {
     const claude = claudeDir();
     cleanMergedDir(claude);
+  }
+  if (memberOverlaysEnabled && overlayArtifacts.length > 0 && !opts.dryRun) {
+    const claude = claudeDir();
     for (const overlay of overlayArtifacts) {
       if (!overlay.targetKind)
         continue;
@@ -18811,13 +19032,13 @@ async function syncSkills(opts = {}) {
       let baseContent;
       let basePath;
       if (overlay.targetKind === "skill") {
-        basePath = path67.join(base.sourcePath, "SKILL.md");
-        baseContent = fs68.readFileSync(basePath, "utf-8");
+        basePath = path68.join(base.sourcePath, "SKILL.md");
+        baseContent = fs69.readFileSync(basePath, "utf-8");
       } else {
         basePath = base.sourcePath;
-        baseContent = fs68.readFileSync(basePath, "utf-8");
+        baseContent = fs69.readFileSync(basePath, "utf-8");
       }
-      const overlayContent = fs68.readFileSync(overlay.sourcePath, "utf-8");
+      const overlayContent = fs69.readFileSync(overlay.sourcePath, "utf-8");
       const label = `${overlay.sourceId}/${overlay.deployBasename}`;
       const mergeResult = mergeMarkdown(baseContent, overlayContent, label, basePath, overlay.sourcePath);
       if ("error" in mergeResult) {
@@ -18841,6 +19062,23 @@ async function syncSkills(opts = {}) {
   }
   const hookFiles = projectFilteredArtifacts.filter((a) => a.kind === "hook").map((a) => a.sourcePath);
   const permissionFiles = projectFilteredArtifacts.filter((a) => a.kind === "permission").map((a) => a.sourcePath);
+  const claudeDirForRewrites = claudeDir();
+  const prefixRewriteResult = applyPrefixRewrites(baseArtifacts, sourcePrefixMap, claudeDirForRewrites, opts.dryRun === true);
+  const prefixCollisions = detectPrefixCollisions(sources);
+  if (!opts.dryRun) {
+    for (const collision of prefixCollisions) {
+      try {
+        appendTrustAudit({
+          gitUrl: "internal:prefix-collision",
+          action: "prefix-collision",
+          trustMethod: "none",
+          sourceId: collision.winnerSourceId,
+          note: `prefix="${collision.prefix}"; winner=${collision.winnerSourceId}; losers=${collision.loserSourceIds.join(",")}`
+        });
+      } catch {
+      }
+    }
+  }
   const summary2 = {
     sourceCount: sources.length,
     artifactCount: projectFilteredArtifacts.length,
@@ -18851,13 +19089,15 @@ async function syncSkills(opts = {}) {
     deploy: void 0,
     merge: void 0,
     metaHooks: void 0,
-    perSource
+    perSource,
+    prefixRewrites: prefixRewriteResult.entries,
+    prefixCollisions
   };
   if (opts.dryRun) {
     summary2.collisions = detectCollisions(baseArtifacts).collisions;
     return summary2;
   }
-  const claudeDirPath = process.env["OLAM_CLAUDE_DIR"] || path67.join(os36.homedir(), ".claude");
+  const claudeDirPath = process.env["OLAM_CLAUDE_DIR"] || path68.join(os36.homedir(), ".claude");
   const overlayReferences = scanOverlayReferences(claudeDirPath, SHIM_TARGETS.map((t) => t.basename));
   summary2.deploy = deployArtifacts(baseArtifacts, {
     installedOlamVersion,
@@ -18883,19 +19123,19 @@ async function injectMetaHooksIntoSettings(opts) {
   const result = await withSettingsJsonLock(() => {
     let currentSettings = {};
     let settingsExisted = false;
-    if (fs68.existsSync(settingsFile)) {
+    if (fs69.existsSync(settingsFile)) {
       settingsExisted = true;
       try {
-        const raw = fs68.readFileSync(settingsFile, "utf-8");
+        const raw = fs69.readFileSync(settingsFile, "utf-8");
         currentSettings = raw.trim() ? JSON.parse(raw) : {};
       } catch {
         try {
-          const raw = fs68.readFileSync(settingsFile);
-          const bakDir = path67.join(path67.dirname(settingsFile), ".malformed-backups");
-          fs68.mkdirSync(bakDir, { recursive: true });
+          const raw = fs69.readFileSync(settingsFile);
+          const bakDir = path68.join(path68.dirname(settingsFile), ".malformed-backups");
+          fs69.mkdirSync(bakDir, { recursive: true });
           const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-          const bakFile = path67.join(bakDir, `settings.json.malformed.${stamp}.bak`);
-          fs68.writeFileSync(bakFile, raw, { mode: 384 });
+          const bakFile = path68.join(bakDir, `settings.json.malformed.${stamp}.bak`);
+          fs69.writeFileSync(bakFile, raw, { mode: 384 });
           snapshotError = `settings.json was malformed; original bytes preserved at ${bakFile}`;
         } catch (bakErr) {
           snapshotError = `settings.json malformed AND .bak write failed: ${bakErr instanceof Error ? bakErr.message : String(bakErr)}`;
@@ -18945,10 +19185,10 @@ async function injectMetaHooksIntoSettings(opts) {
       } catch {
       }
     }
-    fs68.mkdirSync(path67.dirname(settingsFile), { recursive: true });
+    fs69.mkdirSync(path68.dirname(settingsFile), { recursive: true });
     const tmpPath = `${settingsFile}.tmp-${process.pid}-${Date.now()}`;
-    fs68.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
-    fs68.renameSync(tmpPath, settingsFile);
+    fs69.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
+    fs69.renameSync(tmpPath, settingsFile);
     return inject;
   }, { reason: `syncSkills meta-hook injection (mode=${mode})` });
   return {
@@ -18982,23 +19222,24 @@ var init_engine = __esm({
     init_meta_hook_injector();
     init_markdown_merger();
     init_managed_merge();
+    init_prefix_deploy();
   }
 });
 
 // ../core/dist/skill-sync/shadow-backup-manager.js
-import * as fs69 from "node:fs";
-import * as path68 from "node:path";
+import * as fs70 from "node:fs";
+import * as path69 from "node:path";
 function listShadowBackups(opts = {}) {
   const claude = opts.claudeDirOverride ?? claudeDir();
   const now = opts.now ?? Date.now();
   const out = [];
   for (const bucket of SHADOW_BACKUP_BUCKETS) {
-    const bucketDir = path68.join(claude, bucket);
-    if (!fs69.existsSync(bucketDir))
+    const bucketDir = path69.join(claude, bucket);
+    if (!fs70.existsSync(bucketDir))
       continue;
     let entries;
     try {
-      entries = fs69.readdirSync(bucketDir);
+      entries = fs70.readdirSync(bucketDir);
     } catch {
       continue;
     }
@@ -19009,10 +19250,10 @@ function listShadowBackups(opts = {}) {
       const epochSeconds = Number.parseInt(match2[1], 10);
       if (!Number.isFinite(epochSeconds) || epochSeconds < 0)
         continue;
-      const full = path68.join(bucketDir, name);
+      const full = path69.join(bucketDir, name);
       let sizeBytes = 0;
       try {
-        const st = fs69.statSync(full);
+        const st = fs70.statSync(full);
         if (st.isDirectory())
           continue;
         sizeBytes = st.size;
@@ -19025,7 +19266,7 @@ function listShadowBackups(opts = {}) {
         bucket,
         basename: name,
         originalBasename,
-        originalPath: path68.join(bucketDir, originalBasename),
+        originalPath: path69.join(bucketDir, originalBasename),
         epochSeconds,
         ageMs: now - epochSeconds * 1e3,
         sizeBytes
@@ -19068,7 +19309,7 @@ function pruneShadowBackups(opts) {
     }
     if (!opts.dryRun) {
       try {
-        fs69.unlinkSync(b.path);
+        fs70.unlinkSync(b.path);
       } catch {
         skipped.push(b);
         continue;
@@ -19079,24 +19320,24 @@ function pruneShadowBackups(opts) {
   return { deleted, skipped };
 }
 function restoreShadowBackup(opts) {
-  const abs = path68.resolve(opts.backupPath);
-  if (!fs69.existsSync(abs)) {
+  const abs = path69.resolve(opts.backupPath);
+  if (!fs70.existsSync(abs)) {
     throw new Error(`backup file not found: ${abs}`);
   }
-  const basename16 = path68.basename(abs);
+  const basename16 = path69.basename(abs);
   const match2 = SHADOW_BACKUP_SUFFIX_RE.exec(basename16);
   if (!match2) {
     throw new Error(`not a shadow-backup file (basename "${basename16}" does not match \`.shadow-backup-<epoch>\`): ${abs}`);
   }
   const originalBasename = basename16.slice(0, basename16.length - match2[0].length);
-  const originalPath = path68.join(path68.dirname(abs), originalBasename);
-  if (fs69.existsSync(originalPath) && !opts.force) {
+  const originalPath = path69.join(path69.dirname(abs), originalBasename);
+  if (fs70.existsSync(originalPath) && !opts.force) {
     throw new Error(`original path already occupied: ${originalPath}. Move/rename it first OR re-run with --force.`);
   }
-  if (opts.force && fs69.existsSync(originalPath)) {
-    fs69.unlinkSync(originalPath);
+  if (opts.force && fs70.existsSync(originalPath)) {
+    fs70.unlinkSync(originalPath);
   }
-  fs69.renameSync(abs, originalPath);
+  fs70.renameSync(abs, originalPath);
   return { restoredTo: originalPath };
 }
 var SHADOW_BACKUP_BUCKETS, SHADOW_BACKUP_SUFFIX_RE;
@@ -19110,12 +19351,12 @@ var init_shadow_backup_manager = __esm({
 });
 
 // ../core/dist/global-config/repos.js
-import * as fs70 from "node:fs";
+import * as fs71 from "node:fs";
 import * as os37 from "node:os";
-import * as path69 from "node:path";
+import * as path70 from "node:path";
 function expandPath(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path69.join(os37.homedir(), p.slice(1));
+    return path70.join(os37.homedir(), p.slice(1));
   }
   return p;
 }
@@ -19128,7 +19369,7 @@ function addRepo(entry) {
     throw new Error(`repo "${entry.name}" already registered. Use "olam repos update" to change its path.`);
   }
   const resolvedPath = expandPath(entry.path);
-  if (!fs70.existsSync(resolvedPath)) {
+  if (!fs71.existsSync(resolvedPath)) {
     throw new Error(`path "${entry.path}" does not exist. Verify the path is correct.`);
   }
   const now = Date.now();
@@ -19157,7 +19398,7 @@ function updateRepo(name, updates) {
     throw new Error(`repo "${name}" is not registered. Run "olam repos list" to see registered repos.`);
   }
   const resolvedUpdatePath = updates.path !== void 0 ? expandPath(updates.path) : void 0;
-  if (resolvedUpdatePath !== void 0 && !fs70.existsSync(resolvedUpdatePath)) {
+  if (resolvedUpdatePath !== void 0 && !fs71.existsSync(resolvedUpdatePath)) {
     throw new Error(`path "${updates.path}" does not exist. Verify the path is correct.`);
   }
   const existing = config.repos[idx];
@@ -19226,14 +19467,14 @@ var init_global_config = __esm({
 });
 
 // ../core/dist/skill-sources/doctor-checks.js
-import * as fs71 from "node:fs";
-import * as path70 from "node:path";
+import * as fs72 from "node:fs";
+import * as path71 from "node:path";
 import * as os38 from "node:os";
 function claudeDirInternal3() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path70.join(os38.homedir(), ".claude");
+  return path71.join(os38.homedir(), ".claude");
 }
 function checkStateFileParse() {
   const filePath = globalConfigPath();
@@ -19242,11 +19483,11 @@ function checkStateFileParse() {
     healthy: true,
     description: `~/.olam state file (${filePath})`
   };
-  if (!fs71.existsSync(filePath)) {
+  if (!fs72.existsSync(filePath)) {
     result.details = ["(file does not yet exist \u2014 will be created on first write)"];
     return result;
   }
-  const raw = fs71.readFileSync(filePath, "utf-8");
+  const raw = fs72.readFileSync(filePath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -19256,8 +19497,8 @@ function checkStateFileParse() {
     result.details = [err instanceof Error ? err.message : String(err)];
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs71.renameSync(filePath, aside);
-      fs71.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
+      fs72.renameSync(filePath, aside);
+      fs72.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
     };
     return result;
   }
@@ -19268,7 +19509,7 @@ function checkStateFileParse() {
     result.details = validation.error.issues.map((e) => `${e.path.join(".")}: ${e.message}`);
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs71.copyFileSync(filePath, aside);
+      fs72.copyFileSync(filePath, aside);
       const base = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
       const next = {
         ...base,
@@ -19277,7 +19518,7 @@ function checkStateFileParse() {
         runbooks: [],
         skillSources: []
       };
-      fs71.writeFileSync(filePath, JSON.stringify(next, null, 2));
+      fs72.writeFileSync(filePath, JSON.stringify(next, null, 2));
     };
     return result;
   }
@@ -19288,16 +19529,16 @@ function checkDanglingSymlinks() {
   const buckets = ["commands", "agents", "skills", "scripts", "rules"];
   const dangling = [];
   for (const bucket of buckets) {
-    const dir = path70.join(claude, bucket);
-    if (!fs71.existsSync(dir))
+    const dir = path71.join(claude, bucket);
+    if (!fs72.existsSync(dir))
       continue;
-    for (const name of fs71.readdirSync(dir)) {
-      const linkPath = path70.join(dir, name);
+    for (const name of fs72.readdirSync(dir)) {
+      const linkPath = path71.join(dir, name);
       try {
-        const lst = fs71.lstatSync(linkPath);
+        const lst = fs72.lstatSync(linkPath);
         if (!lst.isSymbolicLink())
           continue;
-        if (!fs71.existsSync(linkPath)) {
+        if (!fs72.existsSync(linkPath)) {
           dangling.push(linkPath);
         }
       } catch {
@@ -19315,7 +19556,7 @@ function checkDanglingSymlinks() {
     result.repair = () => {
       for (const p of dangling) {
         try {
-          fs71.unlinkSync(p);
+          fs72.unlinkSync(p);
         } catch {
         }
       }
@@ -19330,19 +19571,19 @@ function checkOrphanedSnapshots() {
     healthy: true,
     description: `orphaned migration snapshots under ${dir}`
   };
-  if (!fs71.existsSync(dir)) {
+  if (!fs72.existsSync(dir)) {
     return result;
   }
   const orphans = [];
-  for (const name of fs71.readdirSync(dir)) {
+  for (const name of fs72.readdirSync(dir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path70.join(dir, name);
+    const full = path71.join(dir, name);
     try {
-      const stat = fs71.statSync(full);
+      const stat = fs72.statSync(full);
       if (!stat.isFile())
         continue;
-      const raw = fs71.readFileSync(full, "utf-8");
+      const raw = fs72.readFileSync(full, "utf-8");
       let parsed;
       try {
         parsed = JSON.parse(raw);
@@ -19367,7 +19608,7 @@ function checkOrphanedSnapshots() {
     result.repair = () => {
       for (const o of orphans) {
         try {
-          fs71.unlinkSync(o.path);
+          fs72.unlinkSync(o.path);
         } catch {
         }
       }
@@ -19382,12 +19623,12 @@ function checkSentinelDrift() {
     healthy: true,
     description: `olam-skills sentinel block in ${filePath}`
   };
-  if (!fs71.existsSync(filePath)) {
+  if (!fs72.existsSync(filePath)) {
     return result;
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs71.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs72.readFileSync(filePath, "utf-8"));
   } catch {
     return result;
   }
@@ -19428,7 +19669,7 @@ function checkSentinelDrift() {
         backupSettings();
       } catch {
       }
-      const next = JSON.parse(fs71.readFileSync(filePath, "utf-8"));
+      const next = JSON.parse(fs72.readFileSync(filePath, "utf-8"));
       if (!next.hooks)
         return;
       for (const stage of Object.keys(next.hooks)) {
@@ -19451,7 +19692,7 @@ function checkSentinelDrift() {
           return bad === void 0;
         });
       }
-      fs71.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs72.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
     };
   }
   return result;
@@ -19475,8 +19716,8 @@ function checkMemberNameMissing() {
     return result;
   }
   const claudeDir2 = claudeDirInternal3();
-  const atlasUserPath = path70.join(claudeDir2, ".atlas-user");
-  const value = fs71.existsSync(atlasUserPath) ? fs71.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  const atlasUserPath = path71.join(claudeDir2, ".atlas-user");
+  const value = fs72.existsSync(atlasUserPath) ? fs72.readFileSync(atlasUserPath, "utf-8").trim() : "";
   if (value.length > 0) {
     result.details = [`atlas-user: ${value}`];
     return result;
@@ -19484,10 +19725,10 @@ function checkMemberNameMissing() {
   result.healthy = false;
   result.issue = "atlas-toolbox source registered but ~/.claude/.atlas-user not set";
   const clonePath = skillSourceClonePath(atlasSource.id);
-  const membersDir = path70.join(clonePath, "members");
-  const existing = fs71.existsSync(membersDir) ? fs71.readdirSync(membersDir).filter((e) => {
+  const membersDir = path71.join(clonePath, "members");
+  const existing = fs72.existsSync(membersDir) ? fs72.readdirSync(membersDir).filter((e) => {
     try {
-      return fs71.statSync(path70.join(membersDir, e)).isDirectory();
+      return fs72.statSync(path71.join(membersDir, e)).isDirectory();
     } catch {
       return false;
     }
@@ -19501,8 +19742,8 @@ function checkMemberNameMissing() {
 }
 function checkMemberOverlayDrift() {
   const claudeDir2 = claudeDirInternal3();
-  const atlasUserPath = path70.join(claudeDir2, ".atlas-user");
-  const atlasUser = fs71.existsSync(atlasUserPath) ? fs71.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  const atlasUserPath = path71.join(claudeDir2, ".atlas-user");
+  const atlasUser = fs72.existsSync(atlasUserPath) ? fs72.readFileSync(atlasUserPath, "utf-8").trim() : "";
   if (atlasUser.length === 0) {
     return [];
   }
@@ -19518,26 +19759,26 @@ function checkMemberOverlayDrift() {
   const clonePath = skillSourceClonePath(atlasSource.id);
   const results = [];
   for (const kind of ["skills", "agents"]) {
-    const localRoot = path70.join(claudeDir2, `${kind}.overrides`);
-    if (!fs71.existsSync(localRoot))
+    const localRoot = path71.join(claudeDir2, `${kind}.overrides`);
+    if (!fs72.existsSync(localRoot))
       continue;
     let entries;
     try {
-      entries = fs71.readdirSync(localRoot);
+      entries = fs72.readdirSync(localRoot);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const localFile = path70.join(localRoot, entry);
+      const localFile = path71.join(localRoot, entry);
       let stat;
       try {
-        stat = fs71.statSync(localFile);
+        stat = fs72.statSync(localFile);
       } catch {
         continue;
       }
       if (!stat.isFile())
         continue;
-      const cloneFile = path70.join(clonePath, "members", atlasUser, `${kind}.overrides`, entry);
+      const cloneFile = path71.join(clonePath, "members", atlasUser, `${kind}.overrides`, entry);
       const localSha = sha256OfPath(localFile);
       const cloneSha = sha256OfPath(cloneFile);
       if (localSha === cloneSha) {
@@ -19698,7 +19939,7 @@ var project_sweep_exports = {};
 __export(project_sweep_exports, {
   walkProjectRoot: () => walkProjectRoot
 });
-import * as path71 from "node:path";
+import * as path72 from "node:path";
 import { readdirSync as readdirSync24, lstatSync as lstatSync6, statSync as statSync25, existsSync as existsSync81 } from "node:fs";
 function isSkipped(basename16, extra) {
   if (DEFAULT_SKIP.has(basename16))
@@ -19710,7 +19951,7 @@ function isSkipped(basename16, extra) {
   return false;
 }
 function resolveMtime(dirPath, manifestFile, fsAdapter) {
-  const gitHead = path71.join(dirPath, ".git", "HEAD");
+  const gitHead = path72.join(dirPath, ".git", "HEAD");
   if (fsAdapter.existsSync(gitHead)) {
     try {
       return fsAdapter.statSync(gitHead).mtimeMs;
@@ -19724,8 +19965,8 @@ function resolveMtime(dirPath, manifestFile, fsAdapter) {
   }
 }
 function walk2(currentPath, depth, maxDepth, extraExclude, fsAdapter, results) {
-  const adbManifest = path71.join(currentPath, ".adb.yaml");
-  const olamManifest = path71.join(currentPath, ".olam.yaml");
+  const adbManifest = path72.join(currentPath, ".adb.yaml");
+  const olamManifest = path72.join(currentPath, ".olam.yaml");
   if (fsAdapter.existsSync(adbManifest)) {
     const mtime = resolveMtime(currentPath, adbManifest, fsAdapter);
     results.push({ path: currentPath, manifestType: "adb", mtime });
@@ -19747,7 +19988,7 @@ function walk2(currentPath, depth, maxDepth, extraExclude, fsAdapter, results) {
   for (const entry of entries) {
     if (isSkipped(entry, extraExclude))
       continue;
-    const childPath = path71.join(currentPath, entry);
+    const childPath = path72.join(currentPath, entry);
     let stat;
     try {
       stat = fsAdapter.lstatSync(childPath);
@@ -19804,17 +20045,17 @@ __export(kg_eager_exports, {
   runEagerKgBuild: () => runEagerKgBuild,
   writeQueue: () => writeQueue
 });
-import * as fs72 from "node:fs";
-import * as path72 from "node:path";
+import * as fs73 from "node:fs";
+import * as path73 from "node:path";
 import * as os39 from "node:os";
 function defaultQueuePath() {
-  const stateDir = process.env["OLAM_STATE_DIR"] ?? path72.join(os39.homedir(), ".olam", "state");
-  return path72.join(stateDir, "kg-pending.jsonl");
+  const stateDir = process.env["OLAM_STATE_DIR"] ?? path73.join(os39.homedir(), ".olam", "state");
+  return path73.join(stateDir, "kg-pending.jsonl");
 }
 function readQueue(queuePath) {
-  if (!fs72.existsSync(queuePath))
+  if (!fs73.existsSync(queuePath))
     return [];
-  const raw = fs72.readFileSync(queuePath, "utf-8");
+  const raw = fs73.readFileSync(queuePath, "utf-8");
   const entries = [];
   for (const line of raw.split("\n")) {
     const trimmed = line.trim();
@@ -19828,16 +20069,16 @@ function readQueue(queuePath) {
   return entries;
 }
 function writeQueue(queuePath, entries) {
-  fs72.mkdirSync(path72.dirname(queuePath), { recursive: true });
+  fs73.mkdirSync(path73.dirname(queuePath), { recursive: true });
   const content = entries.map((e) => JSON.stringify(e)).join("\n") + (entries.length > 0 ? "\n" : "");
-  fs72.writeFileSync(queuePath, content, "utf-8");
+  fs73.writeFileSync(queuePath, content, "utf-8");
 }
 function appendQueue(queuePath, repos, nowMs) {
   if (repos.length === 0)
     return;
-  fs72.mkdirSync(path72.dirname(queuePath), { recursive: true });
+  fs73.mkdirSync(path73.dirname(queuePath), { recursive: true });
   const lines = repos.map((r) => JSON.stringify({ path: r.path, addedAt: nowMs })).join("\n") + "\n";
-  fs72.appendFileSync(queuePath, lines, "utf-8");
+  fs73.appendFileSync(queuePath, lines, "utf-8");
 }
 async function defaultBuildOne(_repo) {
   return { ok: true, ms: 0 };
@@ -19890,16 +20131,16 @@ __export(machine_schema_exports, {
   readMachineConfig: () => readMachineConfig,
   writeMachineConfig: () => writeMachineConfig
 });
-import * as fs75 from "node:fs";
-import * as path76 from "node:path";
+import * as fs76 from "node:fs";
+import * as path77 from "node:path";
 import * as os40 from "node:os";
 import { parse as parseYaml6, stringify as stringifyYaml5 } from "yaml";
 function readMachineConfig(configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  if (!fs75.existsSync(p))
+  if (!fs76.existsSync(p))
     return null;
   try {
-    const raw = fs75.readFileSync(p, "utf-8");
+    const raw = fs76.readFileSync(p, "utf-8");
     const parsed = parseYaml6(raw);
     return MachineConfigSchema.parse(parsed);
   } catch {
@@ -19908,8 +20149,8 @@ function readMachineConfig(configPath) {
 }
 function writeMachineConfig(config, configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  fs75.mkdirSync(path76.dirname(p), { recursive: true });
-  fs75.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
+  fs76.mkdirSync(path77.dirname(p), { recursive: true });
+  fs76.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
 }
 function initMachineConfig(opts = {}) {
   const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
@@ -19932,9 +20173,9 @@ var init_machine_schema = __esm({
       channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
       auto_update: external_exports.boolean().default(true),
       telemetry: external_exports.boolean().default(true),
-      worlds_dir: external_exports.string().default(() => path76.join(os40.homedir(), ".olam", "worlds"))
+      worlds_dir: external_exports.string().default(() => path77.join(os40.homedir(), ".olam", "worlds"))
     });
-    DEFAULT_CONFIG_PATH = path76.join(os40.homedir(), ".olam", "config.yaml");
+    DEFAULT_CONFIG_PATH = path77.join(os40.homedir(), ".olam", "config.yaml");
   }
 });
 
@@ -20128,16 +20369,16 @@ function isValidConfig(value) {
   if (typeof v.install_id !== "string" || v.install_id.length === 0) return false;
   return true;
 }
-function atomicWriteJSON(path93, value, stderr = process.stderr) {
+function atomicWriteJSON(path94, value, stderr = process.stderr) {
   ensureStateDir();
-  const dir = dirname3(path93);
+  const dir = dirname3(path94);
   if (!existsSync6(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
-  const tmp = `${path93}.tmp.${process.pid}`;
+  const tmp = `${path94}.tmp.${process.pid}`;
   try {
     writeFileSync2(tmp, JSON.stringify(value, null, 2) + "\n", { encoding: "utf8" });
-    renameSync2(tmp, path93);
+    renameSync2(tmp, path94);
   } catch (err) {
     if (existsSync6(tmp)) {
       try {
@@ -20473,9 +20714,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path93) {
-    super(`Archetype inheritance cycle detected: ${path93.join(" \u2192 ")} \u2192 ${path93[0] ?? "?"}`);
-    this.path = path93;
+  constructor(path94) {
+    super(`Archetype inheritance cycle detected: ${path94.join(" \u2192 ")} \u2192 ${path94[0] ?? "?"}`);
+    this.path = path94;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -21197,7 +21438,7 @@ function step(label) {
   process.stdout.write("\n" + pc6.bold(pc6.cyan(`==> ${label}`)) + "\n");
 }
 function preflight(opts) {
-  step("0/5 \u2014 preflight (tool detection)");
+  step("0/6 \u2014 preflight (tool detection)");
   const missing = detectMissingTools();
   if (missing.length === 0) {
     printSuccess("all required tools present");
@@ -21239,23 +21480,23 @@ function preflight(opts) {
   printSuccess("docker daemon reachable");
 }
 function ensureSecrets() {
-  step("1/5 \u2014 operator secrets");
+  step("1/6 \u2014 operator secrets");
   mkdirSync19(OLAM_HOME3, { recursive: true });
   for (const name of SECRET_FILES) {
-    const path93 = join34(OLAM_HOME3, name);
-    if (existsSync29(path93)) {
+    const path94 = join34(OLAM_HOME3, name);
+    if (existsSync29(path94)) {
       printInfo("skip", `~/.olam/${name} already exists`);
       continue;
     }
     const hex = randomBytes7(32).toString("hex");
-    writeFileSync15(path93, hex + "\n", { encoding: "utf8", mode: 384 });
-    chmodSync4(path93, 384);
+    writeFileSync15(path94, hex + "\n", { encoding: "utf8", mode: 384 });
+    chmodSync4(path94, 384);
     printSuccess(`generated ~/.olam/${name}`);
   }
 }
 function ensureColima() {
   if (platform() !== "darwin") return;
-  step("2/5 \u2014 colima (macOS)");
+  step("2/6 \u2014 colima (macOS)");
   if (!runCapture("colima", ["status"]).ok) {
     printWarning("colima not running \u2014 starting");
     runOrFail(
@@ -21274,10 +21515,10 @@ function ensureColima() {
 }
 function ensureCluster(opts) {
   if (opts.skipClusterCreate) {
-    step("3/5 \u2014 cluster (skipped via --skip-cluster-create)");
+    step("3/6 \u2014 cluster (skipped via --skip-cluster-create)");
     return;
   }
-  step(`3/5 \u2014 k3d cluster create (${opts.cluster})`);
+  step(`3/6 \u2014 k3d cluster create (${opts.cluster})`);
   if (runCapture("k3d", ["cluster", "list", opts.cluster]).ok) {
     printInfo("cluster", `'${opts.cluster}' already exists`);
     return;
@@ -21304,26 +21545,51 @@ function resolveObservabilityScriptsDir() {
   }
   return null;
 }
+function resolvePeripheralServicesDir() {
+  const installed = join34(installRoot(), "host-cp", "peripheral-services");
+  if (existsSync29(installed)) return installed;
+  const k8sRoot = resolveK8sAssetsRoot();
+  if (k8sRoot) {
+    const dev = join34(k8sRoot, "..", "..", "peripheral-services");
+    if (existsSync29(dev)) return dev;
+  }
+  return null;
+}
+function resolveBundleRoot() {
+  const installed = join34(installRoot(), "host-cp");
+  if (existsSync29(join34(installed, "peripheral-services"))) return installed;
+  const k8sRoot = resolveK8sAssetsRoot();
+  if (k8sRoot) {
+    const dev = join34(k8sRoot, "..", "..");
+    if (existsSync29(join34(dev, "peripheral-services"))) return dev;
+  }
+  return null;
+}
 function installObservability(opts) {
   if (opts.skipObservability) {
-    step("4/5 \u2014 observability (skipped via --skip-observability)");
+    step("4/6 \u2014 observability (skipped via --skip-observability)");
     return;
   }
-  step("4/5 \u2014 observability stack (Loki + Promtail + Grafana + Prometheus + Kyverno)");
+  step("4/6 \u2014 observability stack (Loki + Promtail + Grafana + Prometheus + Kyverno)");
   const observabilityDir = resolveObservabilityScriptsDir();
   if (!observabilityDir) {
     printWarning("bundled observability scripts not found \u2014 skipping");
     printWarning("  (expected in published CLI installs; missing only in dev tarballs without bundling)");
     return;
   }
+  const bundleRoot = resolveBundleRoot();
+  const scriptEnv = { ...process.env };
+  if (bundleRoot) {
+    scriptEnv.OLAM_BUNDLE_ROOT = bundleRoot;
+  }
   for (const script of OBSERVABILITY_SCRIPTS) {
-    const path93 = join34(observabilityDir, script);
-    if (!existsSync29(path93)) {
+    const path94 = join34(observabilityDir, script);
+    if (!existsSync29(path94)) {
       printWarning(`observability script missing: ${script} \u2014 skipping`);
       continue;
     }
     printInfo("run", script);
-    const result = spawnSync10("bash", [path93], { stdio: "inherit" });
+    const result = spawnSync10("bash", [path94], { stdio: "inherit", env: scriptEnv });
     if (result.status !== 0) {
       if (script === "loki-ingest.sh") {
         printWarning("loki-ingest non-zero \u2014 likely Promtail scrub-wait flake; continuing");
@@ -21336,8 +21602,28 @@ function installObservability(opts) {
     }
   }
 }
+function applyPeripheralServicesManifests() {
+  step("5/6 \u2014 peripheral-services manifests (IngressRoutes + ServiceMonitors + recording rules + dashboards + Kyverno)");
+  const dir = resolvePeripheralServicesDir();
+  if (!dir) {
+    printWarning("bundled peripheral-services manifests not found \u2014 skipping");
+    return;
+  }
+  const manifestsDir = join34(dir, "manifests");
+  if (!existsSync29(manifestsDir)) {
+    printWarning(`peripheral-services/manifests not found at ${manifestsDir} \u2014 skipping`);
+    return;
+  }
+  printInfo("apply", manifestsDir);
+  const result = spawnSync10("kubectl", ["apply", "-f", manifestsDir], { stdio: "inherit" });
+  if (result.status !== 0) {
+    printError("kubectl apply failed \u2014 peripheral-services manifests not applied");
+    process.exit(result.status ?? 1);
+  }
+  printSuccess("peripheral-services manifests applied");
+}
 function delegateToUpgrade() {
-  step("5/5 \u2014 apply manifests + rollout (olam upgrade)");
+  step("6/6 \u2014 apply host-cp + peripherals + rollout (olam upgrade)");
   const olamBin = process.argv[1] ?? "olam";
   const result = spawnSync10(process.execPath, [olamBin, "upgrade", "-y"], { stdio: "inherit" });
   if (result.status !== 0) {
@@ -21363,23 +21649,25 @@ function summary(opts) {
 `);
 }
 async function runBootstrapKubernetes(rawOpts) {
+  const defaultAutoInstall = platform() === "darwin";
   const opts = {
     cluster: rawOpts.cluster ?? DEFAULT_K3S_CLUSTER,
-    autoInstall: rawOpts.autoInstall ?? false,
+    autoInstall: rawOpts.autoInstall ?? defaultAutoInstall,
     skipObservability: rawOpts.skipObservability ?? false,
     skipClusterCreate: rawOpts.skipClusterCreate ?? false
   };
-  printHeader("olam bootstrap \u2014 k3s mode");
+  printHeader("olam setup \u2014 k3s mode");
   printInfo("mode", "one-command bring-up of olam peripherals + observability on a local k3d cluster");
   preflight(opts);
   ensureSecrets();
   ensureColima();
   ensureCluster(opts);
   installObservability(opts);
+  applyPeripheralServicesManifests();
   delegateToUpgrade();
   summary(opts);
-  printSuccess("bootstrap complete");
-  return { exitCode: 0, summary: `bootstrap complete on cluster ${opts.cluster}` };
+  printSuccess("setup complete");
+  return { exitCode: 0, summary: `setup complete on cluster ${opts.cluster}` };
 }
 
 // src/commands/bootstrap.ts
@@ -21673,13 +21961,13 @@ async function runBootstrap2(opts, deps = {}) {
   printInfo("next", '`olam create --task "your task"` to spawn a world');
   return { exitCode: 0, summary: "stack ready" };
 }
-function registerBootstrap(program2) {
-  program2.command("bootstrap").description(
-    "Bootstrap the olam stack. Substrate-aware: on kubernetes (default), detects tools, generates secrets, creates a k3d cluster, installs observability (Loki + Promtail + Grafana + Prometheus + Kyverno), and applies all peripheral manifests. On compose, pulls 3 images by digest + starts host-cp + auth + runs auth login."
-  ).option("--with-smoke", "After bootstrap, create a smoke-test world to verify end-to-end").option("--skip-auth-login", "Skip the interactive PKCE step (CI / scripted use only)").option("--skip-postgres-singleton", "Skip the olam-postgres singleton bring-up (operators with host postgres opt-out, or CI)").option("--skip-memory", "Skip the agent-memory Docker container bring-up (CI / scripted use, or hosts without Docker)").option("--skip-kg-service", "Skip the olam-kg-service container pull + start (classifier-augmented retrieval; v2 feature)").option(
+function buildSetupCommand(program2, name) {
+  return program2.command(name).description(
+    "Bring up the olam substrate. Substrate-aware: on kubernetes (default), detects tools, auto-installs missing brew formulae on macOS, generates secrets, creates a k3d cluster, installs observability (Loki + Promtail + Grafana + Prometheus + Kyverno), applies peripheral-services manifests (IngressRoutes + ServiceMonitors + dashboards), and runs the `olam upgrade` flow for host-cp + peripherals + rollout. On compose, pulls 3 images by digest + starts host-cp + auth. The full operator-onboarding wizard is `olam setup` \u2014 this command is the substrate primitive it calls."
+  ).option("--with-smoke", "After setup, create a smoke-test world to verify end-to-end").option("--skip-auth-login", "Skip the interactive PKCE step (CI / scripted use only)").option("--skip-postgres-singleton", "Skip the olam-postgres singleton bring-up (operators with host postgres opt-out, or CI)").option("--skip-memory", "Skip the agent-memory Docker container bring-up (CI / scripted use, or hosts without Docker)").option("--skip-kg-service", "Skip the olam-kg-service container pull + start (classifier-augmented retrieval; v2 feature)").option(
     "--registry <ref>",
     "Override the registry prefix (default: read from image-digests.json or fall back to ghcr.io/pleri)"
-  ).option("--k3s-cluster <name>", `[k3s] k3d cluster name (default: ${DEFAULT_K3S_CLUSTER})`, DEFAULT_K3S_CLUSTER).option("--auto-install", "[k3s] auto-install missing tools via brew on macOS", false).option("--skip-observability", "[k3s] skip Loki/Promtail/Grafana/Prom install (already in place)", false).option("--skip-cluster-create", "[k3s] cluster already exists; install substrate only", false).action(async (opts) => {
+  ).option("--k3s-cluster <name>", `[k3s] k3d cluster name (default: ${DEFAULT_K3S_CLUSTER})`, DEFAULT_K3S_CLUSTER).option("--auto-install", "[k3s] auto-install missing tools via brew on macOS (default: ON for macOS)", void 0).option("--no-auto-install", "[k3s] disable auto-install (operator runs brew themselves)").option("--skip-observability", "[k3s] skip Loki/Promtail/Grafana/Prom install (already in place)", false).option("--skip-cluster-create", "[k3s] cluster already exists; install substrate only", false).action(async (opts) => {
     try {
       const result = await runBootstrap2({
         withSmoke: opts.withSmoke === true,
@@ -21689,7 +21977,10 @@ function registerBootstrap(program2) {
         skipKgService: opts.skipKgService === true,
         registry: opts.registry,
         k3sCluster: opts.k3sCluster,
-        autoInstall: opts.autoInstall === true,
+        // Tri-state: undefined = let runBootstrapKubernetes apply the
+        // platform-default (ON for macOS, OFF otherwise). `--no-auto-install`
+        // sets autoInstall=false explicitly.
+        autoInstall: opts.autoInstall,
         skipObservability: opts.skipObservability === true,
         skipClusterCreate: opts.skipClusterCreate === true
       });
@@ -21700,6 +21991,9 @@ function registerBootstrap(program2) {
     }
   });
 }
+function registerBootstrap(program2) {
+  buildSetupCommand(program2, "bootstrap");
+}
 
 // src/commands/auth-upgrade.ts
 init_exit_codes();
@@ -22270,56 +22564,56 @@ var SECRET_LEN_BYTES = 32;
 function generateSecret() {
   return randomBytes8(SECRET_LEN_BYTES).toString("hex");
 }
-function writeSecretAtPath(path93, value) {
-  mkdirSync21(dirname22(path93), { recursive: true });
-  const tmp = `${path93}.tmp.${process.pid}`;
+function writeSecretAtPath(path94, value) {
+  mkdirSync21(dirname22(path94), { recursive: true });
+  const tmp = `${path94}.tmp.${process.pid}`;
   writeFileSync16(tmp, value, { mode: 384 });
   chmodSync5(tmp, 384);
-  renameSync6(tmp, path93);
+  renameSync6(tmp, path94);
 }
-function readSecretAtPathOrNull(path93) {
-  if (!existsSync32(path93)) return null;
-  const mode = statSync8(path93).mode & 511;
+function readSecretAtPathOrNull(path94) {
+  if (!existsSync32(path94)) return null;
+  const mode = statSync8(path94).mode & 511;
   if (mode !== 384) {
     process.stderr.write(
-      `warn: ${path93} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
+      `warn: ${path94} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
 `
     );
   }
-  return readFileSync25(path93, "utf8").trim();
+  return readFileSync25(path94, "utf8").trim();
 }
-function readSecretAtPath(path93) {
-  const v = readSecretAtPathOrNull(path93);
+function readSecretAtPath(path94) {
+  const v = readSecretAtPathOrNull(path94);
   if (v === null) {
     throw new Error(
-      `Secret not found at ${path93}. Run 'olam memory start' to generate it.`
+      `Secret not found at ${path94}. Run 'olam memory start' to generate it.`
     );
   }
   return v;
 }
-function ensureMemorySecret(path93 = MEMORY_SECRET_PATH) {
-  const existing = readSecretAtPathOrNull(path93);
+function ensureMemorySecret(path94 = MEMORY_SECRET_PATH) {
+  const existing = readSecretAtPathOrNull(path94);
   if (existing) return existing;
   const fresh = generateSecret();
-  writeSecretAtPath(path93, fresh);
+  writeSecretAtPath(path94, fresh);
   return fresh;
 }
-function readMemorySecretOrNull(path93 = MEMORY_SECRET_PATH) {
-  return readSecretAtPathOrNull(path93);
+function readMemorySecretOrNull(path94 = MEMORY_SECRET_PATH) {
+  return readSecretAtPathOrNull(path94);
 }
-function readMemorySecret(path93 = MEMORY_SECRET_PATH) {
-  return readSecretAtPath(path93);
+function readMemorySecret(path94 = MEMORY_SECRET_PATH) {
+  return readSecretAtPath(path94);
 }
-function rotateMemorySecret(path93 = MEMORY_SECRET_PATH) {
+function rotateMemorySecret(path94 = MEMORY_SECRET_PATH) {
   const fresh = generateSecret();
-  writeSecretAtPath(path93, fresh);
+  writeSecretAtPath(path94, fresh);
   return fresh;
 }
-function hasMemorySecret(path93 = MEMORY_SECRET_PATH) {
-  return existsSync32(path93);
+function hasMemorySecret(path94 = MEMORY_SECRET_PATH) {
+  return existsSync32(path94);
 }
-function writeCloudMemorySecret(value, path93 = CLOUD_MEMORY_SECRET_PATH) {
-  writeSecretAtPath(path93, value);
+function writeCloudMemorySecret(value, path94 = CLOUD_MEMORY_SECRET_PATH) {
+  writeSecretAtPath(path94, value);
 }
 
 // src/commands/memory-service-container.ts
@@ -23361,7 +23655,7 @@ function appendAuditEntry(entry, auditLogPath, writeFileSyncImpl) {
 async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, peripheral) {
   const auditLogPath = deps.auditLogPath ?? MANIFEST_REFRESH_AUDIT_LOG;
   const readdirSync32 = deps.readdirSync ?? fs31.readdirSync;
-  const readFileSync91 = deps.readFileSync ?? fs31.readFileSync;
+  const readFileSync92 = deps.readFileSync ?? fs31.readFileSync;
   const writeFileSyncImpl = deps.writeFileSync ?? fs31.writeFileSync;
   const existsSync112 = deps.existsSync ?? fs31.existsSync;
   const now = deps.now ? deps.now() : /* @__PURE__ */ new Date();
@@ -23387,7 +23681,7 @@ async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, per
     const filePath = path32.join(targetDir, file);
     let content;
     try {
-      content = readFileSync91(filePath, "utf8");
+      content = readFileSync92(filePath, "utf8");
     } catch {
       continue;
     }
@@ -23639,11 +23933,11 @@ async function checkSecretPreCondition(context, deps) {
 }
 async function applyConfigMapSubstitution(context, manifestsDir, deps) {
   const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
-  const readFileSync91 = deps.readFileSyncImpl ?? fs32.readFileSync;
+  const readFileSync92 = deps.readFileSyncImpl ?? fs32.readFileSync;
   const configMapPath = path33.join(manifestsDir, "30-configmap.yaml");
   let rawYaml;
   try {
-    rawYaml = readFileSync91(configMapPath, "utf8");
+    rawYaml = readFileSync92(configMapPath, "utf8");
   } catch (err) {
     return `Failed to read ConfigMap at ${configMapPath}: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -24464,9 +24758,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path93, mtimeMs } of result.newerSources) {
+  for (const { path: path94, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path93}  (modified ${when})`);
+    lines.push(`  \u2022 ${path94}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -24845,15 +25139,15 @@ var AGENTMEMORY_LOCAL_URL = "http://host.docker.internal:3111";
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs94 } = await import("node:fs");
+    const { default: fs95 } = await import("node:fs");
     const { default: os49 } = await import("node:os");
-    const { default: path93 } = await import("node:path");
-    const tp = path93.join(
-      process.env.OLAM_HOME ?? path93.join(os49.homedir(), ".olam"),
+    const { default: path94 } = await import("node:path");
+    const tp = path94.join(
+      process.env.OLAM_HOME ?? path94.join(os49.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs94.existsSync(tp)) return null;
-    return fs94.readFileSync(tp, "utf-8").trim();
+    if (!fs95.existsSync(tp)) return null;
+    return fs95.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -25290,12 +25584,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs94 } = await import("node:fs");
+    const { default: fs95 } = await import("node:fs");
     const { default: os49 } = await import("node:os");
-    const { default: path93 } = await import("node:path");
-    const tp = path93.join(os49.homedir(), ".olam", "host-cp.token");
-    if (!fs94.existsSync(tp)) return null;
-    const raw = fs94.readFileSync(tp, "utf-8").trim();
+    const { default: path94 } = await import("node:path");
+    const tp = path94.join(os49.homedir(), ".olam", "host-cp.token");
+    if (!fs95.existsSync(tp)) return null;
+    const raw = fs95.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -29102,11 +29396,11 @@ function zodIssueToError(issue, doc, lineCounter) {
     suggestion: deriveSuggestion(issue)
   };
 }
-function formatJsonPath(path93) {
-  if (path93.length === 0)
+function formatJsonPath(path94) {
+  if (path94.length === 0)
     return "<root>";
   let out = "";
-  for (const seg of path93) {
+  for (const seg of path94) {
     if (typeof seg === "number") {
       out += `[${seg}]`;
     } else {
@@ -29115,11 +29409,11 @@ function formatJsonPath(path93) {
   }
   return out;
 }
-function resolveYamlLocation(path93, doc, lineCounter) {
+function resolveYamlLocation(path94, doc, lineCounter) {
   let bestLine = 0;
   let bestColumn = 0;
-  for (let depth = path93.length; depth >= 0; depth -= 1) {
-    const segment = path93.slice(0, depth);
+  for (let depth = path94.length; depth >= 0; depth -= 1) {
+    const segment = path94.slice(0, depth);
     try {
       const node = doc.getIn(segment, true);
       if (node && typeof node === "object" && "range" in node) {
@@ -29337,11 +29631,11 @@ function topoSort(nodes) {
 }
 function traceCycle(start, byId) {
   const seen = /* @__PURE__ */ new Set();
-  const path93 = [];
+  const path94 = [];
   let current = start;
   while (current && !seen.has(current)) {
     seen.add(current);
-    path93.push(current);
+    path94.push(current);
     const node = byId.get(current);
     const next = node?.dependsOn[0];
     if (next === void 0)
@@ -29349,10 +29643,10 @@ function traceCycle(start, byId) {
     current = next;
   }
   if (current && seen.has(current)) {
-    const idx = path93.indexOf(current);
-    return [...path93.slice(idx), current];
+    const idx = path94.indexOf(current);
+    return [...path94.slice(idx), current];
   }
-  return path93;
+  return path94;
 }
 
 // ../core/dist/executor/types.js
@@ -34059,8 +34353,8 @@ function checkWorld(container, hostShas, dockerExec) {
     const m = shaLine.match(/^([a-f0-9]{64})\s+(.+)$/);
     if (!m) continue;
     const sha = m[1];
-    const path93 = m[2];
-    const filename = path93?.split("/").pop();
+    const path94 = m[2];
+    const filename = path94?.split("/").pop();
     if (!filename) continue;
     const mtimeSecs = parseInt(mtimeLine.trim(), 10);
     if (Number.isNaN(mtimeSecs) || !sha) continue;
@@ -34927,9 +35221,9 @@ var TasksClient = class {
     this.olamNodeId = opts.olamNodeId;
     this.sessionId = opts.sessionId;
   }
-  async call(method, path93, scopes, body, query) {
+  async call(method, path94, scopes, body, query) {
     const qs = query ? "?" + new URLSearchParams(Object.entries(query).filter(([, v]) => v !== void 0)).toString() : "";
-    const url2 = `${this.baseUrl}${path93}${qs}`;
+    const url2 = `${this.baseUrl}${path94}${qs}`;
     const res = await fetch(url2, {
       method,
       headers: {
@@ -34980,8 +35274,8 @@ function parseFrontmatter2(raw) {
   }
   return { frontmatter: fm, body };
 }
-function parseTracker(path93) {
-  const raw = readFileSync46(path93, "utf8");
+function parseTracker(path94) {
+  const raw = readFileSync46(path94, "utf8");
   const { frontmatter, body } = parseFrontmatter2(raw);
   const lines = body.split("\n");
   const tasks = [];
@@ -35218,8 +35512,8 @@ function registerTasks(program2) {
 `);
     }
   });
-  tasks.command("sync-tracker <path>").description("Parse /10x:commit-plan tracker.md + upsert each task via POST /api/tasks (B2.4; dual-emit pattern, olam-side per cross-ownership decoupling)").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--dry-run", "Parse + print task records; do not POST").option("--json", "Output raw JSON envelope").action(async (path93, opts) => {
-    const parsed = parseTracker(path93);
+  tasks.command("sync-tracker <path>").description("Parse /10x:commit-plan tracker.md + upsert each task via POST /api/tasks (B2.4; dual-emit pattern, olam-side per cross-ownership decoupling)").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--dry-run", "Parse + print task records; do not POST").option("--json", "Output raw JSON envelope").action(async (path94, opts) => {
+    const parsed = parseTracker(path94);
     if (opts.dryRun) {
       process.stdout.write(JSON.stringify(parsed, null, 2) + "\n");
       return;
@@ -35376,7 +35670,7 @@ init_health_probes();
 import { spawn as spawn7 } from "node:child_process";
 import { existsSync as existsSync84 } from "node:fs";
 import { homedir as homedir43 } from "node:os";
-import path74 from "node:path";
+import path75 from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // src/lib/shell-rc.ts
@@ -35566,8 +35860,8 @@ async function pickSkillSourcePhase(opts, deps) {
 
 // src/commands/setup-phase-5b-project-sweep.ts
 import { homedir as homedir42 } from "node:os";
-import * as path73 from "node:path";
-import * as fs73 from "node:fs";
+import * as path74 from "node:path";
+import * as fs74 from "node:fs";
 async function loadWalkFn() {
   const m = await Promise.resolve().then(() => (init_project_sweep(), project_sweep_exports));
   return m.walkProjectRoot;
@@ -35585,9 +35879,9 @@ async function loadAppendTrustAuditFn() {
   return m.appendTrustAudit;
 }
 function deriveRepoName(repoPath, existingNames) {
-  const base = path73.basename(repoPath).toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const base = path74.basename(repoPath).toLowerCase().replace(/[^a-z0-9-]/g, "-");
   if (!existingNames.has(base)) return base;
-  const parent = path73.basename(path73.dirname(repoPath)).toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const parent = path74.basename(path74.dirname(repoPath)).toLowerCase().replace(/[^a-z0-9-]/g, "-");
   const composite = `${parent}-${base}`;
   if (!existingNames.has(composite)) return composite;
   let suffix = 2;
@@ -35599,8 +35893,8 @@ async function runProjectSweepPhase(opts, deps, sweepDeps = {}) {
     return { ok: true, skipped: true, message: "skipped via --skip-project-sweep" };
   }
   const home = deps.home ?? homedir42();
-  const projectsRoot = opts.projects ?? path73.join(home, "Projects");
-  const existsSyncFn = sweepDeps.existsSync ?? fs73.existsSync;
+  const projectsRoot = opts.projects ?? path74.join(home, "Projects");
+  const existsSyncFn = sweepDeps.existsSync ?? fs74.existsSync;
   if (!existsSyncFn(projectsRoot)) {
     return {
       ok: true,
@@ -35807,7 +36101,7 @@ async function phase4ShellInit(opts, deps) {
       message: `unsupported $SHELL (${shellEnv ?? "unset"}); add \`eval "$(olam completion <shell>)"\` to your shell rc manually`
     };
   }
-  const shellBasename = path74.basename(shellEnv);
+  const shellBasename = path75.basename(shellEnv);
   const evalLine = `eval "$(olam completion ${shellBasename})"`;
   const result = appendIdempotent({
     rcPath,
@@ -35833,7 +36127,7 @@ async function phase4ShellInit(opts, deps) {
 async function phase5InitProject(opts, deps) {
   const cwd = deps.cwd ?? process.cwd();
   const projectRoot = findProjectRoot(cwd);
-  const configPath = path74.join(projectRoot, ".olam", "config.yaml");
+  const configPath = path75.join(projectRoot, ".olam", "config.yaml");
   if (existsSync84(configPath)) {
     return { ok: true, message: `${configPath} present (no change)` };
   }
@@ -36146,24 +36440,24 @@ function registerSetupLinuxGate(program2) {
 }
 
 // src/commands/update.ts
-import * as fs76 from "node:fs";
+import * as fs77 from "node:fs";
 import * as os41 from "node:os";
-import * as path77 from "node:path";
+import * as path78 from "node:path";
 import { execSync as execSync14 } from "node:child_process";
 import pc28 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
-import * as fs74 from "node:fs";
-import * as path75 from "node:path";
+import * as fs75 from "node:fs";
+import * as path76 from "node:path";
 var realFs = {
-  readdirSync: (p) => fs74.readdirSync(p),
-  existsSync: (p) => fs74.existsSync(p),
-  lstatSync: (p) => fs74.lstatSync(p),
-  readlinkSync: (p) => fs74.readlinkSync(p),
-  symlinkSync: (t, l) => fs74.symlinkSync(t, l),
-  unlinkSync: (p) => fs74.unlinkSync(p),
+  readdirSync: (p) => fs75.readdirSync(p),
+  existsSync: (p) => fs75.existsSync(p),
+  lstatSync: (p) => fs75.lstatSync(p),
+  readlinkSync: (p) => fs75.readlinkSync(p),
+  symlinkSync: (t, l) => fs75.symlinkSync(t, l),
+  unlinkSync: (p) => fs75.unlinkSync(p),
   mkdirSync: (p, o) => {
-    fs74.mkdirSync(p, o);
+    fs75.mkdirSync(p, o);
   }
 };
 function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir2, _fs = realFs) {
@@ -36173,8 +36467,8 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir2, _fs = realFs) {
   _fs.mkdirSync(claudeSkillsDir2, { recursive: true });
   const sourceSkills = _fs.existsSync(npmSkillsDir) ? _fs.readdirSync(npmSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const skill of sourceSkills) {
-    const linkPath = path75.join(claudeSkillsDir2, skill);
-    const target = path75.join(npmSkillsDir, skill);
+    const linkPath = path76.join(claudeSkillsDir2, skill);
+    const target = path76.join(npmSkillsDir, skill);
     if (!_fs.existsSync(linkPath)) {
       try {
         _fs.symlinkSync(target, linkPath);
@@ -36187,7 +36481,7 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir2, _fs = realFs) {
   }
   const deployedEntries = _fs.existsSync(claudeSkillsDir2) ? _fs.readdirSync(claudeSkillsDir2).filter((d) => d.startsWith("olam-")) : [];
   for (const entry of deployedEntries) {
-    const linkPath = path75.join(claudeSkillsDir2, entry);
+    const linkPath = path76.join(claudeSkillsDir2, entry);
     let isSymlink = false;
     try {
       isSymlink = _fs.lstatSync(linkPath).isSymbolicLink();
@@ -36212,9 +36506,9 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir2, _fs = realFs) {
 
 // src/commands/update.ts
 var PACKAGE_NAME = "@pleri/olam-cli";
-var CACHE_DIR2 = path77.join(os41.homedir(), ".olam", "cache");
-var LOG_DIR2 = path77.join(os41.homedir(), ".olam", "log");
-var LAST_STABLE_FILE = path77.join(CACHE_DIR2, "last-stable.txt");
+var CACHE_DIR2 = path78.join(os41.homedir(), ".olam", "cache");
+var LOG_DIR2 = path78.join(os41.homedir(), ".olam", "log");
+var LAST_STABLE_FILE = path78.join(CACHE_DIR2, "last-stable.txt");
 function defaultExec(cmd) {
   try {
     const stdout = execSync14(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
@@ -36236,22 +36530,22 @@ function getCurrentVersion(_exec = defaultExec) {
 }
 function readLastStable(file = LAST_STABLE_FILE) {
   try {
-    const v = fs76.readFileSync(file, "utf-8").trim();
+    const v = fs77.readFileSync(file, "utf-8").trim();
     return v || null;
   } catch {
     return null;
   }
 }
 function writeLastStable(version, file = LAST_STABLE_FILE) {
-  fs76.mkdirSync(path77.dirname(file), { recursive: true });
-  fs76.writeFileSync(file, version, { mode: 420 });
+  fs77.mkdirSync(path78.dirname(file), { recursive: true });
+  fs77.writeFileSync(file, version, { mode: 420 });
 }
 function logUpdateFailure(stderr) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const logFile = path77.join(LOG_DIR2, `update-${ts}.log`);
+  const logFile = path78.join(LOG_DIR2, `update-${ts}.log`);
   try {
-    fs76.mkdirSync(LOG_DIR2, { recursive: true });
-    fs76.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
+    fs77.mkdirSync(LOG_DIR2, { recursive: true });
+    fs77.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
 ${stderr}
 `, "utf-8");
   } catch {
@@ -36338,8 +36632,8 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
   let symlinkResult = { added: [], removed: [] };
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
-    const npmSkillsDir = path77.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
-    const claudeSkillsDir2 = path77.join(os41.homedir(), ".claude", "skills");
+    const npmSkillsDir = path78.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
+    const claudeSkillsDir2 = path78.join(os41.homedir(), ".claude", "skills");
     const rec = _reconcile(npmSkillsDir, claudeSkillsDir2);
     symlinkResult = { added: rec.added, removed: rec.removed };
     if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
@@ -36385,8 +36679,8 @@ async function doRollback(_exec = defaultExec, _reconcile = reconcileSkillSymlin
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
     _reconcile(
-      path77.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
-      path77.join(os41.homedir(), ".claude", "skills")
+      path78.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
+      path78.join(os41.homedir(), ".claude", "skills")
     );
   }
   return { action: "rolled-back", restoredVersion: prev, exitCode: 0 };
@@ -36469,7 +36763,7 @@ function registerBegin(program2) {
 // src/commands/config.ts
 init_global_config();
 init_store2();
-import * as fs77 from "node:fs";
+import * as fs78 from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 var _require4 = createRequire4(import.meta.url);
 var { parse: parseWithMap } = _require4("json-source-map");
@@ -36477,14 +36771,14 @@ function registerConfig(program2) {
   const config = program2.command("config").description("Manage global olam configuration");
   config.command("validate [path]").description("Validate ~/.olam/config.json (or a custom path) against the schema").action((filePath) => {
     const resolvedPath = filePath ?? globalConfigPath();
-    if (!fs77.existsSync(resolvedPath)) {
+    if (!fs78.existsSync(resolvedPath)) {
       process.stderr.write(`config file not found: ${resolvedPath}
 `);
       process.exit(1);
     }
     let raw;
     try {
-      raw = fs77.readFileSync(resolvedPath, "utf-8");
+      raw = fs78.readFileSync(resolvedPath, "utf-8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`cannot read ${resolvedPath}: ${msg}
@@ -36742,9 +37036,9 @@ import * as readline2 from "node:readline";
 import pc32 from "picocolors";
 
 // src/commands/flywheel/install-shims.ts
-import { copyFileSync as copyFileSync9, existsSync as existsSync88, mkdirSync as mkdirSync53, readFileSync as readFileSync70, writeFileSync as writeFileSync44 } from "node:fs";
+import { copyFileSync as copyFileSync9, existsSync as existsSync88, mkdirSync as mkdirSync53, readFileSync as readFileSync71, writeFileSync as writeFileSync44 } from "node:fs";
 import { homedir as homedir46 } from "node:os";
-import { dirname as dirname48, join as join84 } from "node:path";
+import { dirname as dirname48, join as join85 } from "node:path";
 
 // src/lib/shim-generator.ts
 var SHIM_SPECS = Object.freeze([
@@ -36807,7 +37101,7 @@ ${argsBlock}
 // src/commands/flywheel/install-shims.ts
 var SHIM_HEADER_MARKER = "# AUTO-GENERATED by `olam flywheel install-shims`";
 function refreshShims(opts = {}) {
-  const targetDir = opts.targetDir ?? join84(homedir46(), ".claude", "scripts");
+  const targetDir = opts.targetDir ?? join85(homedir46(), ".claude", "scripts");
   const results = [];
   let written = 0;
   let overwritten = 0;
@@ -36837,7 +37131,7 @@ function isOlamGeneratedShim(text) {
   return text.includes(SHIM_HEADER_MARKER);
 }
 function installOne(spec, targetDir, opts) {
-  const targetPath = join84(targetDir, spec.basename);
+  const targetPath = join85(targetDir, spec.basename);
   const newContent = generateShim(spec);
   if (!existsSync88(targetPath)) {
     if (opts.dryRun !== true) {
@@ -36846,7 +37140,7 @@ function installOne(spec, targetDir, opts) {
     }
     return { basename: spec.basename, action: "written", targetPath };
   }
-  const existing = readFileSync70(targetPath, "utf8");
+  const existing = readFileSync71(targetPath, "utf8");
   if (existing === newContent) {
     return { basename: spec.basename, action: "unchanged", targetPath };
   }
@@ -36868,7 +37162,7 @@ function installOne(spec, targetDir, opts) {
 }
 function registerFlywheelInstallShims(parent) {
   parent.command("install-shims").description("Install backwards-compat bash shims under ~/.claude/scripts/ that delegate to olam flywheel <subcmd>").option("--force", "overwrite existing non-shim files (backs them up to .shim-backup-<ts>)").option("--dry-run", "preview which shims would be written without modifying disk").option("--target-dir <path>", "override target directory (default: ~/.claude/scripts/); for tests").action((opts) => {
-    const targetDir = opts.targetDir ?? join84(homedir46(), ".claude", "scripts");
+    const targetDir = opts.targetDir ?? join85(homedir46(), ".claude", "scripts");
     const summary2 = refreshShims(opts);
     const lines = [];
     const dryRunSuffix = opts.dryRun === true ? " (dry-run)" : "";
@@ -36975,16 +37269,28 @@ function registerSkillsSource(program2) {
       const when = new Date(s.addedAt).toISOString().slice(0, 10);
       const sha = s.lastPulledSha ? s.lastPulledSha.slice(0, 8) : pc32.dim("(unpulled)");
       const ord = pc32.dim(`[${i + 1}]`);
+      const prefixCol = s.prefix ? pc32.cyan(s.prefix.padEnd(12)) : pc32.dim("\u2014".padEnd(12));
       console.log(
-        `  ${ord} ${pc32.bold(s.id.padEnd(14))} ${s.name.padEnd(24)} ${s.branch.padEnd(12)} ${sha.padEnd(12)} ${pc32.dim(when)} ${pc32.dim(s.gitUrl)}`
+        `  ${ord} ${pc32.bold(s.id.padEnd(14))} ${s.name.padEnd(24)} ${s.branch.padEnd(12)} ${sha.padEnd(12)} ${prefixCol} ${pc32.dim(when)} ${pc32.dim(s.gitUrl)}`
       );
     }
   });
-  source.command("add").description("Register and clone a skill source (T6 capability-class: requires --trust OR interactive ack)").requiredOption("--name <name>", "Display name (lowercase, digits, dash)").requiredOption("--git-url <url>", "git URL (https://, git@, ssh://, file://, or absolute path)").option("--branch <branch>", "Branch to track", "main").option("--trust", "Acknowledge that registering grants symlink-into-~/.claude permission (skips interactive picker)").option("--sync-now", "Run `olam skills sync` immediately after add (skips interactive prompt)").option("--no-sync-now", "Skip the post-add sync (skips interactive prompt)").option("--install-hook", "Install the SessionStart hook after add (skips interactive prompt)").option("--no-install-hook", "Skip installing the SessionStart hook (skips interactive prompt)").option(
+  source.command("add").description("Register and clone a skill source (T6 capability-class: requires --trust OR interactive ack)").requiredOption("--name <name>", "Display name (lowercase, digits, dash)").requiredOption("--git-url <url>", "git URL (https://, git@, ssh://, file://, or absolute path)").option("--branch <branch>", "Branch to track", "main").option(
+    "--prefix <prefix>",
+    'Deploy prefix: skills+agents from this source deploy as <prefix>:<canonical-name> (e.g. "atl", "pln"). Must match /^[a-z0-9][a-z0-9_-]{0,38}$/'
+  ).option("--trust", "Acknowledge that registering grants symlink-into-~/.claude permission (skips interactive picker)").option("--sync-now", "Run `olam skills sync` immediately after add (skips interactive prompt)").option("--no-sync-now", "Skip the post-add sync (skips interactive prompt)").option("--install-hook", "Install the SessionStart hook after add (skips interactive prompt)").option("--no-install-hook", "Skip installing the SessionStart hook (skips interactive prompt)").option(
     "--hook-scope <scope>",
     "When installing the hook (post-add): project (<cwd>/.claude) or user (~/.claude)",
     "project"
   ).action(async (opts) => {
+    const PREFIX_PATTERN3 = /^[a-z0-9][a-z0-9_-]{0,38}$/;
+    if (opts.prefix !== void 0 && !PREFIX_PATTERN3.test(opts.prefix)) {
+      printError(
+        `prefix must match /^[a-z0-9][a-z0-9_-]{0,38}$/ \u2014 got "${opts.prefix}"`
+      );
+      process.exitCode = 1;
+      return;
+    }
     const isTTY = Boolean(process.stdout.isTTY);
     const testPromptFn = globalThis.__olamTestTrustPrompt;
     let decision;
@@ -37022,6 +37328,9 @@ function registerSkillsSource(program2) {
         branch: opts.branch,
         trustMethod: decision.method
       });
+      if (opts.prefix !== void 0) {
+        updateSkillSource(entry.id, { prefix: opts.prefix });
+      }
     } catch (err) {
       try {
         appendTrustAudit({
@@ -37231,14 +37540,50 @@ function registerSkillsSource(program2) {
     console.log(`${pc32.bold("lastPulledSha:")} ${entry.lastPulledSha ?? pc32.dim("(unpulled)")}`);
     console.log(`${pc32.bold("clonePath:")}     ${skillSourceClonePath(entry.id)}`);
   });
+  source.command("set-prefix").description(
+    "Set the deploy prefix for a registered skill source (skills+agents deploy as <prefix>:<canonical-name>)"
+  ).argument("<name>", 'Display name of the skill source (from "olam skills source list")').argument("<prefix>", "Prefix value (must match /^[a-z0-9][a-z0-9_-]{0,38}$/)").action((name, prefix) => {
+    const entry = getSkillSourceByName(name);
+    if (entry === null) {
+      printError(
+        `skill source "${name}" is not registered. Run "olam skills source list" to see registered sources.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      updateSkillSource(entry.id, { prefix });
+      printSuccess(`set prefix "${prefix}" on source "${name}" (${entry.id})`);
+    } catch (err) {
+      printError(asMessage3(err));
+      process.exitCode = 1;
+    }
+  });
+  source.command("unset-prefix").description("Remove the deploy prefix from a registered skill source (reverts to canonical deploy names)").argument("<name>", 'Display name of the skill source (from "olam skills source list")').action((name) => {
+    const entry = getSkillSourceByName(name);
+    if (entry === null) {
+      printError(
+        `skill source "${name}" is not registered. Run "olam skills source list" to see registered sources.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      updateSkillSource(entry.id, { prefix: null });
+      printSuccess(`unset prefix on source "${name}" (${entry.id})`);
+    } catch (err) {
+      printError(asMessage3(err));
+      process.exitCode = 1;
+    }
+  });
 }
 
 // src/commands/skills.ts
 init_skill_sources();
 init_output();
-import * as fs78 from "node:fs";
+import * as fs79 from "node:fs";
 import * as os42 from "node:os";
-import * as path78 from "node:path";
+import * as path79 from "node:path";
 import * as readline3 from "node:readline";
 import pc33 from "picocolors";
 
@@ -37251,14 +37596,14 @@ import {
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync54,
   readdirSync as readdirSync26,
-  readFileSync as readFileSync71,
+  readFileSync as readFileSync72,
   readlinkSync as readlinkSync4,
   rmSync as rmSync9,
   statSync as statSync27,
   writeFileSync as writeFileSync45
 } from "node:fs";
 import { homedir as homedir47 } from "node:os";
-import { basename as basename8, dirname as dirname49, isAbsolute as isAbsolute4, join as join85, relative as relative5, resolve as resolve21 } from "node:path";
+import { basename as basename8, dirname as dirname49, isAbsolute as isAbsolute4, join as join86, relative as relative5, resolve as resolve21 } from "node:path";
 
 // src/commands/flywheel/sanitize-persona-output.ts
 var FORBIDDEN_HEADERS = [
@@ -37320,7 +37665,7 @@ function registerFlywheelSanitizePersonaOutput(parent) {
 
 // src/lib/skills-apply-overlays.ts
 function claudeRoot(opts) {
-  return opts.claudeDir ?? opts.fixtureRoot ?? join85(homedir47(), ".claude");
+  return opts.claudeDir ?? opts.fixtureRoot ?? join86(homedir47(), ".claude");
 }
 function ensureRealDir(p) {
   if (!existsSync89(p)) {
@@ -37335,8 +37680,8 @@ function ensureRealDir(p) {
     mkdirSync54(p, { recursive: true });
     if (existsSync89(target) && statSync27(target).isDirectory()) {
       for (const entry of readdirSync26(target)) {
-        const src = join85(target, entry);
-        const dest = join85(p, entry);
+        const src = join86(target, entry);
+        const dest = join86(p, entry);
         const srcStat = lstatSync8(src);
         if (srcStat.isDirectory()) {
           try {
@@ -37358,8 +37703,8 @@ function postMergeSanitize(mergedText, label) {
   return { ok: false, reason: `[post-merge-sanitize] ${label} merged output failed sanitizer: ${result.reason}` };
 }
 function mergeOne(upstreamPath, overlayPath, destPath2, label, dryRun, messages) {
-  const upstreamText = readFileSync71(upstreamPath, "utf8");
-  const overlayText = readFileSync71(overlayPath, "utf8");
+  const upstreamText = readFileSync72(upstreamPath, "utf8");
+  const overlayText = readFileSync72(overlayPath, "utf8");
   const result = mergeMarkdown(upstreamText, overlayText, label, upstreamPath, overlayPath);
   if ("error" in result) {
     messages.push(`ERROR ${result.error.reason}`);
@@ -37379,7 +37724,7 @@ function mergeOne(upstreamPath, overlayPath, destPath2, label, dryRun, messages)
 }
 function isNewAgentOverlay(overlayPath) {
   try {
-    const text = readFileSync71(overlayPath, "utf8");
+    const text = readFileSync72(overlayPath, "utf8");
     const { fm } = parseFrontmatter3(text);
     return fm["overlay-intent"] === "new-agent";
   } catch {
@@ -37396,9 +37741,9 @@ function copyNewAgent(overlayPath, destPath2, label, dryRun, messages) {
 function walkSkillsOverlays(skillsOverridesDir, skillsDir, opts, result) {
   if (!existsSync89(skillsOverridesDir)) return;
   for (const skillName of readdirSync26(skillsOverridesDir)) {
-    const overlaySkillDir = join85(skillsOverridesDir, skillName);
+    const overlaySkillDir = join86(skillsOverridesDir, skillName);
     if (!statSync27(overlaySkillDir).isDirectory()) continue;
-    const upstreamSkillDir = join85(skillsDir, skillName);
+    const upstreamSkillDir = join86(skillsDir, skillName);
     if (!existsSync89(upstreamSkillDir)) {
       result.messages.push(`SKIP ${skillName}: no upstream skill at ${upstreamSkillDir} (skill overlays require an upstream skill dir)`);
       continue;
@@ -37412,7 +37757,7 @@ function walkOverlayTree(overlayRoot, upstreamRoot, labelPrefix, opts, result, i
   while (stack.length > 0) {
     const current = stack.pop();
     for (const entry of readdirSync26(current)) {
-      const overlayPath = join85(current, entry);
+      const overlayPath = join86(current, entry);
       const stat = lstatSync8(overlayPath);
       if (stat.isDirectory()) {
         stack.push(overlayPath);
@@ -37420,7 +37765,7 @@ function walkOverlayTree(overlayRoot, upstreamRoot, labelPrefix, opts, result, i
       }
       if (!stat.isFile() && !stat.isSymbolicLink()) continue;
       const rel = relative5(overlayRoot, overlayPath);
-      const upstreamPath = join85(upstreamRoot, rel);
+      const upstreamPath = join86(upstreamRoot, rel);
       const label = `${labelPrefix} ${rel}`;
       if (!entry.endsWith(".md")) {
         if (!opts.dryRun) {
@@ -37465,10 +37810,10 @@ function walkAgentsOverlays(agentsOverridesDir, agentsDir, opts, result) {
 }
 async function applyOverlays(opts = {}) {
   const root = claudeRoot(opts);
-  const skillsDir = join85(root, "skills");
-  const agentsDir = join85(root, "agents");
-  const skillsOverridesDir = join85(root, "skills.overrides");
-  const agentsOverridesDir = join85(root, "agents.overrides");
+  const skillsDir = join86(root, "skills");
+  const agentsDir = join86(root, "agents");
+  const skillsOverridesDir = join86(root, "skills.overrides");
+  const agentsOverridesDir = join86(root, "agents.overrides");
   const result = {
     rc: 0,
     skillsMerged: 0,
@@ -37517,12 +37862,12 @@ function asMessage4(err) {
 }
 var ATLAS_USER_PICKER_RE = /^[a-z0-9][a-z0-9_-]{0,38}$/;
 function listMemberNames(clonePath) {
-  const membersDir = path78.join(clonePath, "members");
-  if (!fs78.existsSync(membersDir)) return [];
+  const membersDir = path79.join(clonePath, "members");
+  if (!fs79.existsSync(membersDir)) return [];
   try {
-    return fs78.readdirSync(membersDir).filter((e) => {
+    return fs79.readdirSync(membersDir).filter((e) => {
       try {
-        return fs78.statSync(path78.join(membersDir, e)).isDirectory();
+        return fs79.statSync(path79.join(membersDir, e)).isDirectory();
       } catch {
         return false;
       }
@@ -37543,10 +37888,10 @@ function defaultAtlasUserPrompt(question) {
 async function resolveAtlasUserWithPicker(cliOverride, opts) {
   if (cliOverride !== void 0) return cliOverride;
   const ATLAS_USER_RE2 = /^[a-z0-9][a-z0-9_-]{0,38}$/;
-  const claudeDirPathForRead = opts?._testClaudeDir ?? (process.env["OLAM_CLAUDE_DIR"] ?? path78.join(os42.homedir(), ".claude"));
-  const atlasUserFile = path78.join(claudeDirPathForRead, ".atlas-user");
-  if (fs78.existsSync(atlasUserFile)) {
-    const existing = fs78.readFileSync(atlasUserFile, "utf-8").trim();
+  const claudeDirPathForRead = opts?._testClaudeDir ?? (process.env["OLAM_CLAUDE_DIR"] ?? path79.join(os42.homedir(), ".claude"));
+  const atlasUserFile = path79.join(claudeDirPathForRead, ".atlas-user");
+  if (fs79.existsSync(atlasUserFile)) {
+    const existing = fs79.readFileSync(atlasUserFile, "utf-8").trim();
     if (existing.length > 0) {
       if (ATLAS_USER_RE2.test(existing)) {
         return existing;
@@ -37605,10 +37950,10 @@ async function resolveAtlasUserWithPicker(cliOverride, opts) {
     );
     return void 0;
   }
-  const claudeDirPath = opts?._testClaudeDir ?? (process.env["OLAM_CLAUDE_DIR"] ?? path78.join(os42.homedir(), ".claude"));
-  fs78.mkdirSync(claudeDirPath, { recursive: true });
-  fs78.writeFileSync(path78.join(claudeDirPath, ".atlas-user"), picked + "\n", "utf8");
-  process.stdout.write(pc33.green(`\u2713 atlas-user set to "${picked}" (written to ${path78.join(claudeDirPath, ".atlas-user")})
+  const claudeDirPath = opts?._testClaudeDir ?? (process.env["OLAM_CLAUDE_DIR"] ?? path79.join(os42.homedir(), ".claude"));
+  fs79.mkdirSync(claudeDirPath, { recursive: true });
+  fs79.writeFileSync(path79.join(claudeDirPath, ".atlas-user"), picked + "\n", "utf8");
+  process.stdout.write(pc33.green(`\u2713 atlas-user set to "${picked}" (written to ${path79.join(claudeDirPath, ".atlas-user")})
 `));
   return picked;
 }
@@ -37620,14 +37965,14 @@ function listDeployed() {
   );
   const entries = [];
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const bucketDir = path78.join(dir, bucket);
-    if (!fs78.existsSync(bucketDir)) continue;
-    for (const name of fs78.readdirSync(bucketDir)) {
-      const full = path78.join(bucketDir, name);
+    const bucketDir = path79.join(dir, bucket);
+    if (!fs79.existsSync(bucketDir)) continue;
+    for (const name of fs79.readdirSync(bucketDir)) {
+      const full = path79.join(bucketDir, name);
       try {
-        const stat = fs78.lstatSync(full);
+        const stat = fs79.lstatSync(full);
         if (!stat.isSymbolicLink()) continue;
-        const target = fs78.readlinkSync(full);
+        const target = fs79.readlinkSync(full);
         let sourceId;
         for (const [clonePath, id] of sourcePaths.entries()) {
           if (target.startsWith(clonePath)) {
@@ -37702,6 +38047,19 @@ function printSyncSummary(summary2, dryRun) {
       console.log(`  ${pc33.red("  (migrate-hooks-back will not be able to undo this sync)")}`);
     }
   }
+  if (summary2.prefixRewrites.length > 0) {
+    console.log(`  prefix rewrites: ${summary2.prefixRewrites.length}`);
+  }
+  if (summary2.prefixCollisions.length > 0) {
+    const allSources = summary2.perSource;
+    for (const col of summary2.prefixCollisions) {
+      const winnerName = allSources.find((s) => s.sourceId === col.winnerSourceId)?.name ?? col.winnerSourceId.slice(0, 8);
+      const loserNames = col.loserSourceIds.map((id) => allSources.find((s) => s.sourceId === id)?.name ?? id.slice(0, 8)).join(", ");
+      console.log(
+        `  ${pc33.yellow(`\u26A0 prefix collision: '${col.prefix}' used by ${winnerName} (winner) + ${loserNames}; first-registered wins`)}`
+      );
+    }
+  }
   console.log();
   for (const s of summary2.perSource) {
     const sub = s.fromSubscriptionsFile ? "(subscribed)" : "(all categories)";
@@ -37813,12 +38171,12 @@ function registerSkills(program2) {
 // src/commands/skills-hook.ts
 init_skill_sources();
 init_output();
-import * as fs79 from "node:fs";
+import * as fs80 from "node:fs";
 function backup(filePath) {
-  if (!fs79.existsSync(filePath)) return null;
+  if (!fs80.existsSync(filePath)) return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs79.copyFileSync(filePath, backupPath);
+  fs80.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 function registerSkillsHook(program2) {
@@ -37866,7 +38224,7 @@ function registerSkillsHook(program2) {
           printInfo("olam-skills hook", `not found in ${filePath} \u2014 already uninstalled`);
           if (backupPath) {
             try {
-              fs79.unlinkSync(backupPath);
+              fs80.unlinkSync(backupPath);
             } catch {
             }
           }
@@ -38048,24 +38406,24 @@ init_skill_sources();
 init_merge_settings();
 init_skill_sources();
 init_output();
-import * as fs80 from "node:fs";
-import * as path79 from "node:path";
+import * as fs81 from "node:fs";
+import * as path80 from "node:path";
 var MIGRATE_FROM_TOOLBOX_COMMAND = "migrate-from-toolbox";
 function asMessage6(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function isOlamSkillsHookPresent(filePath) {
-  if (!fs80.existsSync(filePath)) return false;
+  if (!fs81.existsSync(filePath)) return false;
   try {
-    const raw = fs80.readFileSync(filePath, "utf-8");
+    const raw = fs81.readFileSync(filePath, "utf-8");
     return raw.includes(OLAM_SKILLS_HOOK_SENTINEL);
   } catch {
     return false;
   }
 }
 function uninstallLegacyToolboxSessionStartHook(filePath, toolboxPath) {
-  if (!fs80.existsSync(filePath)) return { removed: 0 };
-  const raw = fs80.readFileSync(filePath, "utf-8");
+  if (!fs81.existsSync(filePath)) return { removed: 0 };
+  const raw = fs81.readFileSync(filePath, "utf-8");
   const settings = raw.trim() ? JSON.parse(raw) : {};
   const ss = settings?.hooks?.SessionStart;
   if (!Array.isArray(ss)) return { removed: 0 };
@@ -38094,7 +38452,7 @@ function uninstallLegacyToolboxSessionStartHook(filePath, toolboxPath) {
     if (otherStages.length === 0) delete next.hooks;
     else delete next.hooks.SessionStart;
   }
-  fs80.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+  fs81.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
   return { removed };
 }
 function registerSkillsMigrate(program2) {
@@ -38117,7 +38475,7 @@ function registerSkillsMigrate(program2) {
       return;
     }
     const toolboxPath = opts.path;
-    const namespace = opts.namespace ?? path79.basename(toolboxPath);
+    const namespace = opts.namespace ?? path80.basename(toolboxPath);
     const sourceName = opts.sourceName ?? namespace;
     const snapshot = detectToolboxState({ toolboxPath, namespace });
     if (!snapshot) {
@@ -38171,9 +38529,9 @@ function registerSkillsMigrate(program2) {
       printWarning(`legacy hook removal failed: ${asMessage6(err)}; proceeding`);
     }
     const scope = opts.scope === "user" ? "user" : "project";
-    const olamHookPath = scope === "user" ? settingsFile : path79.join(process.cwd(), ".claude", "settings.json");
+    const olamHookPath = scope === "user" ? settingsFile : path80.join(process.cwd(), ".claude", "settings.json");
     try {
-      fs80.mkdirSync(path79.dirname(olamHookPath), { recursive: true });
+      fs81.mkdirSync(path80.dirname(olamHookPath), { recursive: true });
       const result = mergeHomeSettingsJson(olamHookPath, {
         ensureHook: {
           stage: OLAM_SKILLS_HOOK_STAGE,
@@ -38206,8 +38564,8 @@ function registerSkillsMigrate(program2) {
 // src/commands/skills-migrate-back.ts
 init_skill_sources();
 init_output();
-import * as fs81 from "node:fs";
-import * as path80 from "node:path";
+import * as fs82 from "node:fs";
+import * as path81 from "node:path";
 var MIGRATE_BACK_TO_TOOLBOX_COMMAND = "migrate-back-to-toolbox";
 function asMessage7(err) {
   return err instanceof Error ? err.message : String(err);
@@ -38215,16 +38573,16 @@ function asMessage7(err) {
 function claudeDirInternal4() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0) return override;
-  return path80.join(process.env["HOME"] ?? "", ".claude");
+  return path81.join(process.env["HOME"] ?? "", ".claude");
 }
 function restoreSessionStartFromSnapshot(filePath, originalSessionStartHook) {
   if (!originalSessionStartHook || originalSessionStartHook.length === 0) {
     return { restored: false };
   }
   let settings;
-  if (fs81.existsSync(filePath)) {
+  if (fs82.existsSync(filePath)) {
     try {
-      const raw = fs81.readFileSync(filePath, "utf-8");
+      const raw = fs82.readFileSync(filePath, "utf-8");
       settings = raw.trim() ? JSON.parse(raw) : {};
     } catch {
       settings = {};
@@ -38240,8 +38598,8 @@ function restoreSessionStartFromSnapshot(filePath, originalSessionStartHook) {
       SessionStart: originalSessionStartHook
     }
   };
-  fs81.mkdirSync(path80.dirname(filePath), { recursive: true });
-  fs81.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+  fs82.mkdirSync(path81.dirname(filePath), { recursive: true });
+  fs82.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
   return { restored: true };
 }
 function removeOlamManagedSymlinks() {
@@ -38250,16 +38608,16 @@ function removeOlamManagedSymlinks() {
   const olamClonePaths = sources.map((s) => skillSourceClonePath(s.id));
   let removed = 0;
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const dir = path80.join(claude, bucket);
-    if (!fs81.existsSync(dir)) continue;
-    for (const name of fs81.readdirSync(dir)) {
-      const linkPath = path80.join(dir, name);
+    const dir = path81.join(claude, bucket);
+    if (!fs82.existsSync(dir)) continue;
+    for (const name of fs82.readdirSync(dir)) {
+      const linkPath = path81.join(dir, name);
       try {
-        const stat = fs81.lstatSync(linkPath);
+        const stat = fs82.lstatSync(linkPath);
         if (!stat.isSymbolicLink()) continue;
-        const target = fs81.readlinkSync(linkPath);
+        const target = fs82.readlinkSync(linkPath);
         if (olamClonePaths.some((cp) => target.startsWith(cp))) {
-          fs81.unlinkSync(linkPath);
+          fs82.unlinkSync(linkPath);
           removed += 1;
         }
       } catch {
@@ -38272,18 +38630,18 @@ function restoreToolboxSymlinks(symlinks) {
   let restored = 0;
   for (const { link, target } of symlinks) {
     try {
-      fs81.mkdirSync(path80.dirname(link), { recursive: true });
-      if (fs81.existsSync(link) || (() => {
+      fs82.mkdirSync(path81.dirname(link), { recursive: true });
+      if (fs82.existsSync(link) || (() => {
         try {
-          fs81.lstatSync(link);
+          fs82.lstatSync(link);
           return true;
         } catch {
           return false;
         }
       })()) {
-        fs81.unlinkSync(link);
+        fs82.unlinkSync(link);
       }
-      fs81.symlinkSync(target, link);
+      fs82.symlinkSync(target, link);
       restored += 1;
     } catch {
     }
@@ -38292,9 +38650,9 @@ function restoreToolboxSymlinks(symlinks) {
 }
 function restoreAtlasUserMarker(atlasUser) {
   if (!atlasUser) return false;
-  const file = path80.join(claudeDirInternal4(), ".atlas-user");
-  fs81.mkdirSync(path80.dirname(file), { recursive: true });
-  fs81.writeFileSync(file, atlasUser);
+  const file = path81.join(claudeDirInternal4(), ".atlas-user");
+  fs82.mkdirSync(path81.dirname(file), { recursive: true });
+  fs82.writeFileSync(file, atlasUser);
   return true;
 }
 function registerSkillsMigrateBack(program2) {
@@ -38307,15 +38665,15 @@ function registerSkillsMigrateBack(program2) {
     let snapshot;
     try {
       if (opts.snapshot) {
-        snapshotPath = path80.resolve(opts.snapshot);
-        if (!fs81.existsSync(snapshotPath)) {
+        snapshotPath = path81.resolve(opts.snapshot);
+        if (!fs82.existsSync(snapshotPath)) {
           printError(`snapshot not found at ${snapshotPath}`);
           process.exitCode = 1;
           return;
         }
         snapshot = readMigrationSnapshotFromPath(snapshotPath);
       } else {
-        const filterNamespace = opts.namespace ?? (opts.path ? path80.basename(opts.path) : void 0);
+        const filterNamespace = opts.namespace ?? (opts.path ? path81.basename(opts.path) : void 0);
         const latest = readLatestMigrationSnapshot({ namespace: filterNamespace });
         if (!latest) {
           const where = filterNamespace ? ` for namespace "${filterNamespace}"` : "";
@@ -38392,8 +38750,8 @@ init_meta_hooks_migration_snapshot();
 init_trust_audit_log();
 init_atlas_hook_strip();
 init_output();
-import * as fs82 from "node:fs";
-import * as path81 from "node:path";
+import * as fs83 from "node:fs";
+import * as path82 from "node:path";
 import pc35 from "picocolors";
 var MIGRATE_HOOKS_COMMAND = "migrate-hooks";
 function settingsHasOlamMetaSentinel(settings) {
@@ -38414,16 +38772,16 @@ function settingsHasOlamMetaSentinel(settings) {
   return false;
 }
 function readSettings2(filePath) {
-  if (!fs82.existsSync(filePath)) return null;
-  const raw = fs82.readFileSync(filePath, "utf-8");
+  if (!fs83.existsSync(filePath)) return null;
+  const raw = fs83.readFileSync(filePath, "utf-8");
   if (raw.trim().length === 0) return {};
   return JSON.parse(raw);
 }
 function writeSettings(filePath, settings) {
-  fs82.mkdirSync(path81.dirname(filePath), { recursive: true });
+  fs83.mkdirSync(path82.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.tmp-migrate-hooks-${process.pid}-${Date.now()}`;
-  fs82.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
-  fs82.renameSync(tmp, filePath);
+  fs83.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
+  fs83.renameSync(tmp, filePath);
 }
 function printSummary(candidates2, opts) {
   if (candidates2.length === 0) {
@@ -38503,7 +38861,7 @@ function registerSkillsMigrateHooks(program2) {
 init_meta_hooks_migration_snapshot();
 init_skill_sources();
 init_output();
-import * as path82 from "node:path";
+import * as path83 from "node:path";
 function asMessage9(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -38520,16 +38878,16 @@ function registerSkillsMigrateHooksBack(program2) {
         return;
       }
       if (opts.snapshot) {
-        const resolved = path82.resolve(opts.snapshot);
-        const allowedDir = path82.resolve(migrationSnapshotsDir2());
-        if (!resolved.startsWith(allowedDir + path82.sep)) {
+        const resolved = path83.resolve(opts.snapshot);
+        const allowedDir = path83.resolve(migrationSnapshotsDir2());
+        if (!resolved.startsWith(allowedDir + path83.sep)) {
           printError(
             `--snapshot path must be inside ${allowedDir} (got "${resolved}"). Refusing to restore from an arbitrary path \u2014 settings.json would land operator-chosen content.`
           );
           process.exitCode = 1;
           return;
         }
-        const basename16 = path82.basename(resolved);
+        const basename16 = path83.basename(resolved);
         if (!basename16.startsWith(META_HOOKS_SNAPSHOT_PREFIX)) {
           printError(
             `--snapshot filename must start with "${META_HOOKS_SNAPSHOT_PREFIX}" (got "${basename16}"). Cross-namespace snapshots (atlas-toolbox-*) are not valid restore targets for olam-meta hooks.`
@@ -38558,7 +38916,7 @@ function registerSkillsMigrateHooksBack(program2) {
 // src/commands/skills-shadow-backups.ts
 init_skill_sources();
 init_output();
-import * as fs83 from "node:fs";
+import * as fs84 from "node:fs";
 import pc36 from "picocolors";
 function asMessage10(err) {
   return err instanceof Error ? err.message : String(err);
@@ -38641,7 +38999,7 @@ function registerSkillsShadowBackups(program2) {
   });
   sb.command("restore").description("Move a shadow-backup file back to its original path").argument("<path>", "Absolute path to the .shadow-backup-<epoch> file").option("--force", "Overwrite the original path if it already exists").action((p, opts) => {
     try {
-      if (!fs83.existsSync(p)) {
+      if (!fs84.existsSync(p)) {
         printError(`backup file not found: ${p}`);
         process.exitCode = 1;
         return;
@@ -38764,8 +39122,8 @@ init_skill_sources();
 init_cli_version();
 init_output();
 import { execFileSync as execFileSync15 } from "node:child_process";
-import * as fs84 from "node:fs";
-import * as path83 from "node:path";
+import * as fs85 from "node:fs";
+import * as path84 from "node:path";
 var CHAIN_SKILL_NAMES = [
   "10x:brainstorm",
   "10x:plan-hard",
@@ -38788,13 +39146,13 @@ function hasBeadsCli() {
   }
 }
 function hasBeadsProjectInit(cwd) {
-  return fs84.existsSync(path83.join(cwd, ".beads"));
+  return fs85.existsSync(path84.join(cwd, ".beads"));
 }
 function hasBeadsClaudeSetup() {
-  const settingsPath = path83.join(claudeDir(), "settings.json");
-  if (!fs84.existsSync(settingsPath)) return false;
+  const settingsPath = path84.join(claudeDir(), "settings.json");
+  if (!fs85.existsSync(settingsPath)) return false;
   try {
-    const content = fs84.readFileSync(settingsPath, "utf8");
+    const content = fs85.readFileSync(settingsPath, "utf8");
     return /"command"\s*:\s*"bd\b/.test(content) || /"bd setup\b/.test(content);
   } catch {
     return false;
@@ -38859,12 +39217,12 @@ function shortSha(sha) {
   return sha.slice(0, 8);
 }
 function listInstalledClaudeSkills() {
-  const skillsDir = path83.join(claudeDir(), "skills");
-  if (!fs84.existsSync(skillsDir)) return [];
+  const skillsDir = path84.join(claudeDir(), "skills");
+  if (!fs85.existsSync(skillsDir)) return [];
   try {
-    return fs84.readdirSync(skillsDir).filter((name) => {
+    return fs85.readdirSync(skillsDir).filter((name) => {
       try {
-        const stat = fs84.lstatSync(path83.join(skillsDir, name));
+        const stat = fs85.lstatSync(path84.join(skillsDir, name));
         return stat.isSymbolicLink() || stat.isDirectory();
       } catch {
         return false;
@@ -38939,20 +39297,20 @@ function registerSkills10x(program2) {
   tenx.command("uninstall").description(
     "Remove /10x: chain skill symlinks from ~/.claude/skills (preserves user-authored skills + non-chain skill sources)"
   ).action(() => {
-    const skillsDir = path83.join(claudeDir(), "skills");
-    if (!fs84.existsSync(skillsDir)) {
+    const skillsDir = path84.join(claudeDir(), "skills");
+    if (!fs85.existsSync(skillsDir)) {
       printWarning("No ~/.claude/skills/ directory found; nothing to uninstall");
       return;
     }
     let removed = 0;
-    for (const name of fs84.readdirSync(skillsDir)) {
-      const full = path83.join(skillsDir, name);
+    for (const name of fs85.readdirSync(skillsDir)) {
+      const full = path84.join(skillsDir, name);
       try {
-        const stat = fs84.lstatSync(full);
+        const stat = fs85.lstatSync(full);
         if (!stat.isSymbolicLink()) continue;
-        const target = fs84.readlinkSync(full);
+        const target = fs85.readlinkSync(full);
         if (isChainSkill(name) || /\/10x[-:]/.test(target)) {
-          fs84.unlinkSync(full);
+          fs85.unlinkSync(full);
           removed += 1;
         }
       } catch {
@@ -39020,22 +39378,22 @@ function registerSkills10x(program2) {
 
 // src/commands/hermes.ts
 init_output();
-import * as fs85 from "node:fs";
+import * as fs86 from "node:fs";
 import * as os43 from "node:os";
-import * as path84 from "node:path";
+import * as path85 from "node:path";
 import * as child_process from "node:child_process";
 import { parse as yamlParse2, stringify as yamlStringify3 } from "yaml";
 function hermesConfigPath() {
-  return path84.join(os43.homedir(), ".hermes", "config.yaml");
+  return path85.join(os43.homedir(), ".hermes", "config.yaml");
 }
 function hermesSkillsDir() {
-  return path84.join(os43.homedir(), ".hermes", "skills");
+  return path85.join(os43.homedir(), ".hermes", "skills");
 }
 function claudeSkillsDir() {
-  return path84.join(os43.homedir(), ".claude", "skills");
+  return path85.join(os43.homedir(), ".claude", "skills");
 }
 function readHermesConfig(configPath) {
-  const raw = fs85.readFileSync(configPath, "utf-8");
+  const raw = fs86.readFileSync(configPath, "utf-8");
   const parsed = yamlParse2(raw);
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`${configPath} is not a YAML mapping`);
@@ -39043,13 +39401,13 @@ function readHermesConfig(configPath) {
   return parsed;
 }
 function writeHermesConfig(configPath, config) {
-  fs85.writeFileSync(configPath, yamlStringify3(config), "utf-8");
+  fs86.writeFileSync(configPath, yamlStringify3(config), "utf-8");
 }
 function resolveOlamBinary() {
   try {
     const result = child_process.spawnSync("which", ["olam"], { encoding: "utf-8" });
     const found = result.stdout.trim();
-    if (found && fs85.existsSync(found)) return found;
+    if (found && fs86.existsSync(found)) return found;
   } catch {
   }
   return process.argv[1] ?? "olam";
@@ -39062,7 +39420,7 @@ function resolveWorkspaceDir() {
       { encoding: "utf-8" }
     );
     const out = result.stdout.trim();
-    if (out && fs85.existsSync(out)) return out;
+    if (out && fs86.existsSync(out)) return out;
   } catch {
   }
   return process.cwd();
@@ -39132,22 +39490,22 @@ function ensureTerminalBackendLocal(config, dryRun, summary2) {
 }
 function mirrorSkillSymlinks(dryRun, summary2) {
   const srcDir = claudeSkillsDir();
-  if (!fs85.existsSync(srcDir)) {
+  if (!fs86.existsSync(srcDir)) {
     summary2.skipped.push("skills mirror (no ~/.claude/skills/ found)");
     return;
   }
   const destDir = hermesSkillsDir();
   if (!dryRun) {
-    fs85.mkdirSync(destDir, { recursive: true });
+    fs86.mkdirSync(destDir, { recursive: true });
   }
-  const entries = fs85.readdirSync(srcDir);
+  const entries = fs86.readdirSync(srcDir);
   let mirrored = 0;
   let collisions = 0;
   for (const entry of entries) {
-    const srcPath = path84.join(srcDir, entry);
-    const destPath2 = path84.join(destDir, entry);
-    if (fs85.existsSync(destPath2) || fs85.lstatSync(srcPath).isFile()) {
-      if (fs85.existsSync(destPath2)) collisions++;
+    const srcPath = path85.join(srcDir, entry);
+    const destPath2 = path85.join(destDir, entry);
+    if (fs86.existsSync(destPath2) || fs86.lstatSync(srcPath).isFile()) {
+      if (fs86.existsSync(destPath2)) collisions++;
       continue;
     }
     if (dryRun) {
@@ -39155,7 +39513,7 @@ function mirrorSkillSymlinks(dryRun, summary2) {
       continue;
     }
     try {
-      fs85.symlinkSync(srcPath, destPath2);
+      fs86.symlinkSync(srcPath, destPath2);
       mirrored++;
     } catch (err) {
       printWarning(`skills mirror: skipping ${entry} \u2014 ${err instanceof Error ? err.message : String(err)}`);
@@ -39174,7 +39532,7 @@ async function runHermesBootstrap(opts, deps = {}) {
   const writeConfig2 = deps.writeConfig ?? writeHermesConfig;
   const mirrorSkillsFn = deps.mirrorSkills ?? mirrorSkillSymlinks;
   const installHookFn = deps.installHook ?? installKgFirstHookForHermes;
-  if (!fs85.existsSync(configPath)) {
+  if (!fs86.existsSync(configPath)) {
     printError(`~/.hermes/config.yaml not found at ${configPath}`);
     printInfo(
       "remedy",
@@ -39200,7 +39558,7 @@ async function runHermesBootstrap(opts, deps = {}) {
   } else {
     summary2.skipped.push("mcp_servers.agentmemory-atlas (AGENTMEMORY_BRIDGE_URL/SECRET not set; use --bridge-url/--bridge-secret to add)");
   }
-  const hooksDir = path84.join(path84.dirname(configPath), "hooks");
+  const hooksDir = path85.join(path85.dirname(configPath), "hooks");
   const hookResult = installHookFn(hooksDir, dryRun);
   switch (hookResult.status) {
     case "installed":
@@ -39247,7 +39605,7 @@ async function runHermesBootstrap(opts, deps = {}) {
 }
 var HOOK_MATCHERS = ["terminal", "bash", "shell", "search_files", "grep", "ripgrep"];
 function ensureHermesHookEntry(config, hooksDir, dryRun, summary2) {
-  const hookScriptPath = path84.join(hooksDir, "kg-first.sh");
+  const hookScriptPath = path85.join(hooksDir, "kg-first.sh");
   const hooks = config["hooks"] ?? {};
   const preToolCall = Array.isArray(hooks["pre_tool_call"]) ? hooks["pre_tool_call"] : [];
   const alreadyPresent = preToolCall.some(
@@ -39520,8 +39878,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path93, init = {}) {
-  const res = await fetch(`${BASE_URL}${path93}`, {
+async function apiFetch(path94, init = {}) {
+  const res = await fetch(`${BASE_URL}${path94}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -39781,12 +40139,12 @@ import * as readline6 from "node:readline";
 import pc40 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs86 from "node:fs";
+import * as fs87 from "node:fs";
 import * as os44 from "node:os";
-import * as path85 from "node:path";
+import * as path86 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs86.readFileSync(filePath, "utf-8");
+    const raw = fs87.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -39815,24 +40173,24 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path85.join(os44.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path86.join(os44.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path85.join(os44.homedir(), "AppData", "Roaming");
-    return path85.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path86.join(os44.homedir(), "AppData", "Roaming");
+    return path86.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path85.join(os44.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path86.join(os44.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path85.join(os44.homedir(), ".olam", "config.yaml"),
-    path85.join(process.cwd(), ".olam", "config.yaml")
+    path86.join(os44.homedir(), ".olam", "config.yaml"),
+    path86.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs86.existsSync(configPath)) continue;
+    if (!fs87.existsSync(configPath)) continue;
     try {
-      const raw = fs86.readFileSync(configPath, "utf-8");
+      const raw = fs87.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -39848,7 +40206,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path85.join(os44.homedir(), ".claude.json"),
+      path: path86.join(os44.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -39856,19 +40214,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path85.join(os44.homedir(), ".cursor", "mcp.json"),
+      path: path86.join(os44.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path85.join(os44.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path86.join(os44.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path85.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path85.basename(repoPath)})`
+      path: path86.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path86.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -40104,27 +40462,27 @@ function registerMcp(program2) {
 init_output();
 
 // src/lib/memory-host-process-migration.ts
-import { existsSync as existsSync100, readFileSync as readFileSync79, unlinkSync as unlinkSync23 } from "node:fs";
+import { existsSync as existsSync100, readFileSync as readFileSync80, unlinkSync as unlinkSync23 } from "node:fs";
 import { spawnSync as spawnSync28 } from "node:child_process";
 
 // src/commands/memory/_paths.ts
 import { homedir as homedir51 } from "node:os";
-import { join as join92, dirname as dirname55 } from "node:path";
+import { join as join93, dirname as dirname55 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
-var OLAM_HOME4 = join92(homedir51(), ".olam");
-var MEMORY_PID_PATH = join92(OLAM_HOME4, "memory.pid");
-var MEMORY_LOG_PATH = join92(OLAM_HOME4, "memory-service.log");
-var MEMORY_DATA_DIR = join92(OLAM_HOME4, "memory-data");
+var OLAM_HOME4 = join93(homedir51(), ".olam");
+var MEMORY_PID_PATH = join93(OLAM_HOME4, "memory.pid");
+var MEMORY_LOG_PATH = join93(OLAM_HOME4, "memory-service.log");
+var MEMORY_DATA_DIR = join93(OLAM_HOME4, "memory-data");
 var MEMORY_REST_PORT = 3111;
 var MEMORY_LIVEZ_URL = `http://localhost:${MEMORY_REST_PORT}/agentmemory/livez`;
 var here2 = dirname55(fileURLToPath8(import.meta.url));
 var candidates = [
   // 1. Workspace dev (built): packages/cli/dist/commands/memory/_paths.js → packages/cli → packages/memory-service
-  join92(here2, "..", "..", "..", "..", "memory-service"),
+  join93(here2, "..", "..", "..", "..", "memory-service"),
   // 2. Workspace bundled: packages/cli/dist/index.js → packages/cli → packages/memory-service
-  join92(here2, "..", "..", "memory-service"),
+  join93(here2, "..", "..", "memory-service"),
   // 3. CWD fallback
-  join92(process.cwd(), "packages", "memory-service")
+  join93(process.cwd(), "packages", "memory-service")
 ];
 var MEMORY_SERVICE_CANDIDATES = candidates;
 
@@ -40173,7 +40531,7 @@ function migrateFromHostProcess(opts = {}) {
 }
 function readPidFromFile(pidPath2) {
   try {
-    const raw = readFileSync79(pidPath2, "utf8").trim();
+    const raw = readFileSync80(pidPath2, "utf8").trim();
     const pid = parseInt(raw, 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
@@ -40606,13 +40964,13 @@ function registerMemoryUninstall(cmd) {
 // src/commands/memory/mode.ts
 init_schema2();
 init_output();
-import { existsSync as existsSync103, readFileSync as readFileSync80, writeFileSync as writeFileSync51 } from "node:fs";
-import { join as join93 } from "node:path";
+import { existsSync as existsSync103, readFileSync as readFileSync81, writeFileSync as writeFileSync51 } from "node:fs";
+import { join as join94 } from "node:path";
 import * as readline7 from "node:readline/promises";
 import { parse as parseYaml7, stringify as stringifyYaml6 } from "yaml";
 var CONFIG_REL = ".olam/config.yaml";
 function locateConfig(cwd) {
-  const absPath = join93(cwd, CONFIG_REL);
+  const absPath = join94(cwd, CONFIG_REL);
   if (!existsSync103(absPath)) {
     throw new Error(
       `No ${CONFIG_REL} at ${cwd}. Run \`olam init\` in your workspace root first.`
@@ -40621,7 +40979,7 @@ function locateConfig(cwd) {
   return { absPath };
 }
 function readConfigYaml(absPath) {
-  const raw = readFileSync80(absPath, "utf-8");
+  const raw = readFileSync81(absPath, "utf-8");
   const parsed = parseYaml7(raw) ?? {};
   if (typeof parsed !== "object" || parsed === null) {
     throw new Error(`${absPath} is not a YAML object`);
@@ -40750,7 +41108,7 @@ function registerMemoryMode(cmd) {
 init_output();
 import { spawn as spawn11 } from "node:child_process";
 import { existsSync as existsSync104 } from "node:fs";
-import { join as join94 } from "node:path";
+import { join as join95 } from "node:path";
 var DEFAULT_PORT2 = 8788;
 function resolveMemoryServiceDir() {
   for (const c of MEMORY_SERVICE_CANDIDATES) {
@@ -40761,13 +41119,13 @@ function resolveMemoryServiceDir() {
   );
 }
 function resolveLocalBridgeScript(serviceDir) {
-  const path93 = join94(serviceDir, "scripts", "local-bridge-server.mjs");
-  if (!existsSync104(path93)) {
+  const path94 = join95(serviceDir, "scripts", "local-bridge-server.mjs");
+  if (!existsSync104(path94)) {
     throw new Error(
-      `Could not find local-bridge-server.mjs at ${path93}. Verify packages/memory-service ships the scripts/ directory.`
+      `Could not find local-bridge-server.mjs at ${path94}. Verify packages/memory-service ships the scripts/ directory.`
     );
   }
-  return path93;
+  return path94;
 }
 function validateBridgeOpts(opts) {
   const local = opts.local ?? false;
@@ -41108,9 +41466,9 @@ function registerMemoryStats(cmd) {
 }
 
 // src/commands/memory/install-hooks.ts
-import { copyFileSync as copyFileSync12, existsSync as existsSync105, mkdirSync as mkdirSync60, readFileSync as readFileSync81, writeFileSync as writeFileSync52 } from "node:fs";
+import { copyFileSync as copyFileSync12, existsSync as existsSync105, mkdirSync as mkdirSync60, readFileSync as readFileSync82, writeFileSync as writeFileSync52 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
-import { dirname as dirname56, join as join95, resolve as resolve25 } from "node:path";
+import { dirname as dirname56, join as join96, resolve as resolve25 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 var HOOK_BASENAMES = [
   "agentmemory-session-recall.js",
@@ -41126,12 +41484,12 @@ function defaultSourceDir() {
   return candidate;
 }
 function installOne2(basename16, sourceDir, targetDir, opts) {
-  const sourcePath = join95(sourceDir, basename16);
-  const targetPath = join95(targetDir, basename16);
+  const sourcePath = join96(sourceDir, basename16);
+  const targetPath = join96(targetDir, basename16);
   if (!existsSync105(sourcePath)) {
     throw new Error(`canonical hook source missing at ${sourcePath} \u2014 olam install corrupt or sourceDir is wrong`);
   }
-  const newContent = readFileSync81(sourcePath, "utf8");
+  const newContent = readFileSync82(sourcePath, "utf8");
   if (!existsSync105(targetPath)) {
     if (opts.dryRun !== true) {
       mkdirSync60(dirname56(targetPath), { recursive: true });
@@ -41139,7 +41497,7 @@ function installOne2(basename16, sourceDir, targetDir, opts) {
     }
     return { basename: basename16, action: "written", targetPath };
   }
-  const existing = readFileSync81(targetPath, "utf8");
+  const existing = readFileSync82(targetPath, "utf8");
   if (existing === newContent) {
     return { basename: basename16, action: "unchanged", targetPath };
   }
@@ -41162,13 +41520,13 @@ Add these hook entries to ~/.claude/settings.json:
 {
   "hooks": {
     "SessionStart": [
-      { "command": "node ${join95(targetDir, "agentmemory-session-recall.js")}" }
+      { "command": "node ${join96(targetDir, "agentmemory-session-recall.js")}" }
     ],
     "PreToolUse": [
-      { "command": "node ${join95(targetDir, "agentmemory-recall-trigger.mjs")}" }
+      { "command": "node ${join96(targetDir, "agentmemory-recall-trigger.mjs")}" }
     ],
     "PostToolUse": [
-      { "command": "node ${join95(targetDir, "agentmemory-classify-queue.mjs")}" }
+      { "command": "node ${join96(targetDir, "agentmemory-classify-queue.mjs")}" }
     ]
   }
 }
@@ -41178,7 +41536,7 @@ If existing entries already point at the same paths, no edit needed.
 }
 function registerMemoryInstallHooks(parent) {
   parent.command("install-hooks").description("Install agentmemory hooks (PreToolUse + PostToolUse + SessionStart) to ~/.claude/scripts/hooks/").option("--force", "overwrite existing non-canonical files (backs them up to .agentmemory-hook-backup-<ts>)").option("--dry-run", "preview which hooks would be written without modifying disk").option("--target-dir <path>", "override target directory (default: ~/.claude/scripts/hooks/); for tests").option("--source-dir <path>", "override source directory (default: packages/memory-service/hooks/); for tests").action((opts) => {
-    const targetDir = opts.targetDir ?? join95(homedir52(), ".claude", "scripts", "hooks");
+    const targetDir = opts.targetDir ?? join96(homedir52(), ".claude", "scripts", "hooks");
     const sourceDir = opts.sourceDir ?? defaultSourceDir();
     let written = 0;
     let unchanged = 0;
@@ -41256,9 +41614,9 @@ function registerMemory(program2) {
 // src/commands/kg-build.ts
 init_storage_paths();
 init_workspace_name();
-import * as fs91 from "node:fs";
+import * as fs92 from "node:fs";
 import * as os47 from "node:os";
-import * as path90 from "node:path";
+import * as path91 from "node:path";
 
 // ../core/dist/kg/kg-service-client.js
 var KG_SERVICE_PORT_DEFAULT = 9997;
@@ -41269,8 +41627,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path93) {
-  return `http://127.0.0.1:${port()}${path93}`;
+function url(path94) {
+  return `http://127.0.0.1:${port()}${path94}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -41350,39 +41708,39 @@ init_storage_paths();
 init_workspace_name();
 init_kg_caps();
 init_output();
-import fs87 from "node:fs";
+import fs88 from "node:fs";
 import { homedir as homedir53 } from "node:os";
-import path86 from "node:path";
+import path87 from "node:path";
 function olamHome4() {
-  return process.env.OLAM_HOME ?? path86.join(homedir53(), ".olam");
+  return process.env.OLAM_HOME ?? path87.join(homedir53(), ".olam");
 }
 function kgRoot2() {
-  return path86.join(olamHome4(), "kg");
+  return path87.join(olamHome4(), "kg");
 }
 function worldsRoot2() {
-  return path86.join(olamHome4(), "worlds");
+  return path87.join(olamHome4(), "worlds");
 }
 function dirSizeBytes2(dir) {
-  if (!fs87.existsSync(dir)) return 0;
+  if (!fs88.existsSync(dir)) return 0;
   let total = 0;
   const stack = [dir];
   while (stack.length > 0) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs87.readdirSync(cur, { withFileTypes: true });
+      entries = fs88.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const full = path86.join(cur, entry.name);
+      const full = path87.join(cur, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
       }
       try {
-        total += fs87.statSync(full).size;
+        total += fs88.statSync(full).size;
       } catch {
       }
     }
@@ -41396,10 +41754,10 @@ function formatBytes5(n) {
   return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 function readFreshness(workspace) {
-  const file = path86.join(kgPristinePath(workspace), "freshness.json");
-  if (!fs87.existsSync(file)) return null;
+  const file = path87.join(kgPristinePath(workspace), "freshness.json");
+  if (!fs88.existsSync(file)) return null;
   try {
-    const raw = JSON.parse(fs87.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs88.readFileSync(file, "utf-8"));
     if (raw && typeof raw === "object") return raw;
     return null;
   } catch {
@@ -41407,10 +41765,10 @@ function readFreshness(workspace) {
   }
 }
 function readOverlayNodeCount(graphifyOutDir) {
-  const graphPath = path86.join(graphifyOutDir, "graph.json");
-  if (!fs87.existsSync(graphPath)) return null;
+  const graphPath = path87.join(graphifyOutDir, "graph.json");
+  if (!fs88.existsSync(graphPath)) return null;
   try {
-    const raw = JSON.parse(fs87.readFileSync(graphPath, "utf-8"));
+    const raw = JSON.parse(fs88.readFileSync(graphPath, "utf-8"));
     if (raw && typeof raw === "object") {
       const nodes = raw.nodes;
       if (Array.isArray(nodes)) return nodes.length;
@@ -41422,28 +41780,28 @@ function readOverlayNodeCount(graphifyOutDir) {
 }
 function listOverlays() {
   const root = worldsRoot2();
-  if (!fs87.existsSync(root)) return [];
+  if (!fs88.existsSync(root)) return [];
   const records = [];
   let worldDirs;
   try {
-    worldDirs = fs87.readdirSync(root, { withFileTypes: true });
+    worldDirs = fs88.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
   for (const worldEntry of worldDirs) {
     if (!worldEntry.isDirectory()) continue;
     const worldId = worldEntry.name;
-    const worldDir = path86.join(root, worldId);
+    const worldDir = path87.join(root, worldId);
     let cloneDirs;
     try {
-      cloneDirs = fs87.readdirSync(worldDir, { withFileTypes: true });
+      cloneDirs = fs88.readdirSync(worldDir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const cloneEntry of cloneDirs) {
       if (!cloneEntry.isDirectory()) continue;
-      const graphifyOut = path86.join(worldDir, cloneEntry.name, "graphify-out");
-      if (!fs87.existsSync(graphifyOut)) continue;
+      const graphifyOut = path87.join(worldDir, cloneEntry.name, "graphify-out");
+      if (!fs88.existsSync(graphifyOut)) continue;
       records.push({
         world_id: worldId,
         clone_dir: cloneEntry.name,
@@ -41457,11 +41815,11 @@ function listOverlays() {
 }
 function listPristines(overlays) {
   const root = kgRoot2();
-  if (!fs87.existsSync(root)) return [];
+  if (!fs88.existsSync(root)) return [];
   const records = [];
   let entries;
   try {
-    entries = fs87.readdirSync(root, { withFileTypes: true });
+    entries = fs88.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -41474,7 +41832,7 @@ function listPristines(overlays) {
       continue;
     }
     const fresh = readFreshness(workspace);
-    const graphifyOut = path86.join(kgPristinePath(workspace), "graphify-out");
+    const graphifyOut = path87.join(kgPristinePath(workspace), "graphify-out");
     const size = dirSizeBytes2(graphifyOut);
     const worldCount = overlays.filter((o) => o.clone_dir === workspace).length;
     records.push({
@@ -41610,10 +41968,10 @@ init_storage_paths();
 init_workspace_name();
 init_output();
 import { spawn as spawn12 } from "node:child_process";
-import fs88 from "node:fs";
-import path87 from "node:path";
+import fs89 from "node:fs";
+import path88 from "node:path";
 function pidFilePath2(workspace) {
-  return path87.join(kgPristinePath(workspace), ".watch.pid");
+  return path88.join(kgPristinePath(workspace), ".watch.pid");
 }
 function isPidAlive3(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -41628,39 +41986,39 @@ function isPidAlive3(pid) {
 }
 function readAndClassifyPid(workspace) {
   const file = pidFilePath2(workspace);
-  if (!fs88.existsSync(file)) return { status: "no-pidfile", pid: null };
+  if (!fs89.existsSync(file)) return { status: "no-pidfile", pid: null };
   let pid;
   try {
-    const raw = fs88.readFileSync(file, "utf-8").trim();
+    const raw = fs89.readFileSync(file, "utf-8").trim();
     pid = Number.parseInt(raw, 10);
   } catch {
-    fs88.rmSync(file, { force: true });
+    fs89.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (!Number.isInteger(pid) || pid <= 0) {
-    fs88.rmSync(file, { force: true });
+    fs89.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (isPidAlive3(pid)) return { status: "active", pid };
-  fs88.rmSync(file, { force: true });
+  fs89.rmSync(file, { force: true });
   return { status: "stale-reclaimed", pid: null };
 }
 function writePidFile2(workspace, pid) {
   const file = pidFilePath2(workspace);
-  const dir = path87.dirname(file);
-  fs88.mkdirSync(dir, { recursive: true });
-  fs88.writeFileSync(file, String(pid), { encoding: "utf-8" });
+  const dir = path88.dirname(file);
+  fs89.mkdirSync(dir, { recursive: true });
+  fs89.writeFileSync(file, String(pid), { encoding: "utf-8" });
 }
 function removePidFile(workspace) {
   const file = pidFilePath2(workspace);
   try {
-    fs88.rmSync(file, { force: true });
+    fs89.rmSync(file, { force: true });
   } catch {
   }
 }
 async function runKgWatch(workspaceArg, opts, deps = {}) {
   const cwd = deps.cwd ?? opts.cwd ?? process.cwd();
-  const name = workspaceArg ?? path87.basename(cwd).toLowerCase();
+  const name = workspaceArg ?? path88.basename(cwd).toLowerCase();
   try {
     validateWorkspaceName(name);
   } catch (err) {
@@ -41668,7 +42026,7 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
     return { exitCode: 1, pidWritten: false };
   }
   const pristinePath = kgPristinePath(name);
-  const graphPath = path87.join(pristinePath, "graphify-out", "graph.json");
+  const graphPath = path88.join(pristinePath, "graphify-out", "graph.json");
   const pidState = readAndClassifyPid(name);
   if (pidState.status === "active") {
     printError(
@@ -41906,8 +42264,8 @@ function registerKgDoctorCommand(kg) {
 
 // src/commands/kg-install-hook.ts
 init_merge_settings();
-import * as fs89 from "node:fs";
-import * as path88 from "node:path";
+import * as fs90 from "node:fs";
+import * as path89 from "node:path";
 import * as os45 from "node:os";
 import { parse as yamlParse3, stringify as yamlStringify4 } from "yaml";
 
@@ -41960,27 +42318,27 @@ function buildHookMatcherEntry(opts) {
 init_output();
 function settingsPathFor2(scope) {
   if (scope === "user") {
-    return path88.join(os45.homedir(), ".claude", "settings.json");
+    return path89.join(os45.homedir(), ".claude", "settings.json");
   }
-  return path88.join(process.cwd(), ".claude", "settings.json");
+  return path89.join(process.cwd(), ".claude", "settings.json");
 }
 function backup2(filePath) {
-  if (!fs89.existsSync(filePath)) return null;
+  if (!fs90.existsSync(filePath)) return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs89.copyFileSync(filePath, backupPath);
+  fs90.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 var HERMES_HOOK_MATCHERS = ["terminal", "bash", "shell", "search_files", "grep", "ripgrep"];
 function hermesConfigPath2() {
-  return path88.join(os45.homedir(), ".hermes", "config.yaml");
+  return path89.join(os45.homedir(), ".hermes", "config.yaml");
 }
 function hermesHooksDir() {
-  return path88.join(os45.homedir(), ".hermes", "hooks");
+  return path89.join(os45.homedir(), ".hermes", "hooks");
 }
 function patchHermesConfigForHook(action) {
   const configPath = hermesConfigPath2();
-  const raw = fs89.readFileSync(configPath, "utf-8");
+  const raw = fs90.readFileSync(configPath, "utf-8");
   const config = yamlParse3(raw);
   const hooks = config["hooks"] ?? {};
   const preToolCall = Array.isArray(hooks["pre_tool_call"]) ? hooks["pre_tool_call"] : [];
@@ -41989,7 +42347,7 @@ function patchHermesConfigForHook(action) {
       (e) => typeof e["command"] === "string" && e["command"].includes(HERMES_KG_HOOK_SENTINEL)
     );
     if (alreadyPresent) return "already-present";
-    const hookScriptPath = path88.join(hermesHooksDir(), "kg-first.sh");
+    const hookScriptPath = path89.join(hermesHooksDir(), "kg-first.sh");
     const entry = {
       matcher: HERMES_HOOK_MATCHERS.join("|"),
       command: `${hookScriptPath} # ${HERMES_KG_HOOK_SENTINEL}`
@@ -41999,7 +42357,7 @@ function patchHermesConfigForHook(action) {
       hooks: { ...hooks, pre_tool_call: [...preToolCall, entry] },
       hooks_auto_accept: true
     };
-    fs89.writeFileSync(configPath, yamlStringify4(updated2), "utf-8");
+    fs90.writeFileSync(configPath, yamlStringify4(updated2), "utf-8");
     return "patched";
   }
   const filtered = preToolCall.filter(
@@ -42010,12 +42368,12 @@ function patchHermesConfigForHook(action) {
     ...config,
     hooks: { ...hooks, pre_tool_call: filtered }
   };
-  fs89.writeFileSync(configPath, yamlStringify4(updated), "utf-8");
+  fs90.writeFileSync(configPath, yamlStringify4(updated), "utf-8");
   return "patched";
 }
 function doInstallForHermes() {
   const configPath = hermesConfigPath2();
-  if (!fs89.existsSync(configPath)) {
+  if (!fs90.existsSync(configPath)) {
     printError(`~/.hermes/config.yaml not found at ${configPath}`);
     printInfo("remedy", "Install Hermes first, then re-run `olam kg install-hook --for hermes`");
     process.exitCode = 1;
@@ -42043,17 +42401,17 @@ function doInstallForHermes() {
 function doUninstallForHermes() {
   const configPath = hermesConfigPath2();
   const hooksDir = hermesHooksDir();
-  const hookScriptPath = path88.join(hooksDir, "kg-first.sh");
+  const hookScriptPath = path89.join(hooksDir, "kg-first.sh");
   let scriptRemoved = false;
-  if (fs89.existsSync(hookScriptPath)) {
-    const content = fs89.readFileSync(hookScriptPath, "utf-8");
+  if (fs90.existsSync(hookScriptPath)) {
+    const content = fs90.readFileSync(hookScriptPath, "utf-8");
     if (content.includes(HERMES_KG_HOOK_SENTINEL)) {
-      fs89.unlinkSync(hookScriptPath);
+      fs90.unlinkSync(hookScriptPath);
       scriptRemoved = true;
     }
   }
   let configPatched = false;
-  if (fs89.existsSync(configPath)) {
+  if (fs90.existsSync(configPath)) {
     const result = patchHermesConfigForHook("uninstall");
     configPatched = result === "patched";
   }
@@ -42078,9 +42436,9 @@ function registerKgInstallHookCommand(kg) {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor2(scope);
     try {
-      fs89.mkdirSync(path88.dirname(filePath), { recursive: true });
+      fs90.mkdirSync(path89.dirname(filePath), { recursive: true });
     } catch (err) {
-      printError(`could not create ${path88.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
+      printError(`could not create ${path89.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
       return;
     }
@@ -42104,7 +42462,7 @@ function registerKgInstallHookCommand(kg) {
           printInfo("kg-service hook", `already installed at ${filePath}`);
           if (backupPath) {
             try {
-              fs89.unlinkSync(backupPath);
+              fs90.unlinkSync(backupPath);
             } catch {
             }
           }
@@ -42122,15 +42480,15 @@ function registerKgInstallHookCommand(kg) {
 }
 
 // src/commands/kg-uninstall-hook.ts
-import * as fs90 from "node:fs";
-import * as path89 from "node:path";
+import * as fs91 from "node:fs";
+import * as path90 from "node:path";
 import * as os46 from "node:os";
 init_output();
 function settingsPathFor3(scope) {
   if (scope === "user") {
-    return path89.join(os46.homedir(), ".claude", "settings.json");
+    return path90.join(os46.homedir(), ".claude", "settings.json");
   }
-  return path89.join(process.cwd(), ".claude", "settings.json");
+  return path90.join(process.cwd(), ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -42160,13 +42518,13 @@ function registerKgUninstallHookCommand(kg) {
   kg.command("uninstall-hook").description("Remove kg-service PreToolUse hook from .claude/settings.json (sentinel-matched; surgical)").option("--scope <scope>", "project (default) or user", "project").action((opts) => {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor3(scope);
-    if (!fs90.existsSync(filePath)) {
+    if (!fs91.existsSync(filePath)) {
       printInfo("kg-service hook", `no settings.json at ${filePath} \u2014 nothing to remove`);
       return;
     }
     let settings;
     try {
-      const raw = fs90.readFileSync(filePath, "utf-8");
+      const raw = fs91.readFileSync(filePath, "utf-8");
       settings = raw.trim() ? JSON.parse(raw) : {};
     } catch (err) {
       printError(`could not parse ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
@@ -42186,7 +42544,7 @@ function registerKgUninstallHookCommand(kg) {
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const backupPath = `${filePath}.olam-bak.${ts}`;
     try {
-      fs90.copyFileSync(filePath, backupPath);
+      fs91.copyFileSync(filePath, backupPath);
     } catch {
     }
     const next = {
@@ -42205,7 +42563,7 @@ function registerKgUninstallHookCommand(kg) {
       }
     }
     try {
-      fs90.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs91.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
       printSuccess(`kg-service hook removed from ${filePath}`);
       printInfo("backup", backupPath);
     } catch (err) {
@@ -42278,8 +42636,8 @@ function registerKgSavingsCommand(kg) {
 
 // src/commands/kg-build.ts
 function readQueueFromDisk(queuePath) {
-  if (!fs91.existsSync(queuePath)) return [];
-  const raw = fs91.readFileSync(queuePath, "utf-8");
+  if (!fs92.existsSync(queuePath)) return [];
+  const raw = fs92.readFileSync(queuePath, "utf-8");
   const entries = [];
   for (const line of raw.split("\n")) {
     const t = line.trim();
@@ -42292,14 +42650,14 @@ function readQueueFromDisk(queuePath) {
   return entries;
 }
 function writeQueueToDisk(queuePath, entries) {
-  fs91.mkdirSync(path90.dirname(queuePath), { recursive: true });
+  fs92.mkdirSync(path91.dirname(queuePath), { recursive: true });
   const content = entries.map((e) => JSON.stringify(e)).join("\n") + (entries.length > 0 ? "\n" : "");
-  fs91.writeFileSync(queuePath, content, "utf-8");
+  fs92.writeFileSync(queuePath, content, "utf-8");
 }
 async function runKgBuildPending(opts = {}) {
   const queuePath = opts.queuePath ?? (() => {
-    const stateDir = process.env["OLAM_STATE_DIR"] ?? path90.join(os47.homedir(), ".olam", "state");
-    return path90.join(stateDir, "kg-pending.jsonl");
+    const stateDir = process.env["OLAM_STATE_DIR"] ?? path91.join(os47.homedir(), ".olam", "state");
+    return path91.join(stateDir, "kg-pending.jsonl");
   })();
   const readQueue2 = opts.readQueueFn ?? readQueueFromDisk;
   const writeQueue2 = opts.writeQueueFn ?? writeQueueToDisk;
@@ -42315,7 +42673,7 @@ async function runKgBuildPending(opts = {}) {
   const remaining = [];
   for (const entry of deduped) {
     const repoPath = entry.path;
-    const workspaceName = path90.basename(repoPath).toLowerCase();
+    const workspaceName = path91.basename(repoPath).toLowerCase();
     printInfo("kg build --pending", `building ${repoPath} (workspace=${workspaceName})`);
     let containerPath;
     try {
@@ -42353,20 +42711,20 @@ async function runKgBuildPending(opts = {}) {
 }
 function resolveWorkspace(arg) {
   const cwd = process.cwd();
-  const name = arg ?? path90.basename(cwd).toLowerCase();
+  const name = arg ?? path91.basename(cwd).toLowerCase();
   validateWorkspaceName(name);
   return { name, sourcePath: cwd };
 }
 function toContainerPath(hostPath) {
   const home = os47.homedir();
-  const resolved = path90.resolve(hostPath);
-  if (!resolved.startsWith(home + path90.sep) && resolved !== home) {
+  const resolved = path91.resolve(hostPath);
+  if (!resolved.startsWith(home + path91.sep) && resolved !== home) {
     throw new Error(
       `source path "${resolved}" is not under $HOME (${home}). kg-service can only build repos that live under your home dir (it bind-mounts $HOME:/host-home:ro at start). Move the repo or set OLAM_HOME if you need a different root.`
     );
   }
-  const rel = path90.relative(home, resolved);
-  return rel === "" ? "/host-home" : path90.posix.join("/host-home", rel.split(path90.sep).join("/"));
+  const rel = path91.relative(home, resolved);
+  return rel === "" ? "/host-home" : path91.posix.join("/host-home", rel.split(path91.sep).join("/"));
 }
 async function runKgBuild(workspaceArg, options = {}) {
   let workspace;
@@ -42384,7 +42742,7 @@ async function runKgBuild(workspaceArg, options = {}) {
     return { exitCode: 2 };
   }
   const outDir = kgPristinePath(workspace.name);
-  fs91.mkdirSync(outDir, { recursive: true });
+  fs92.mkdirSync(outDir, { recursive: true });
   const human = !options.json;
   if (human) {
     printInfo("kg build", `workspace=${workspace.name} source=${workspace.sourcePath}`);
@@ -42417,12 +42775,12 @@ async function runKgBuild(workspaceArg, options = {}) {
     workspace: workspace.name,
     graphify_path: "container"
   };
-  fs91.writeFileSync(
-    path90.join(outDir, "freshness.json"),
+  fs92.writeFileSync(
+    path91.join(outDir, "freshness.json"),
     JSON.stringify(freshness, null, 2) + "\n",
     "utf-8"
   );
-  const finalOut = path90.join(outDir, "graphify-out");
+  const finalOut = path91.join(outDir, "graphify-out");
   if (options.json) {
     process.stdout.write(JSON.stringify(freshness) + "\n");
   } else {
@@ -42465,11 +42823,11 @@ function registerKg(program2) {
 init_file_lock();
 import { mkdirSync as mkdirSync63, appendFileSync as appendFileSync6 } from "node:fs";
 import { homedir as homedir57 } from "node:os";
-import { dirname as dirname59, join as join99 } from "node:path";
+import { dirname as dirname59, join as join100 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "low", "info", "warn"]);
 var PROMPT_FEEDING_FIELDS = ["extracted_pattern", "severity", "affected_persona", "proposed_edit"];
-var BREADCRUMBS_BASE = join99(homedir57(), ".local", "share", "claude", "breadcrumbs");
+var BREADCRUMBS_BASE = join100(homedir57(), ".local", "share", "claude", "breadcrumbs");
 var LOCK_FILENAME = ".flywheel-emit.lock";
 function buildRecord(opts) {
   const rec = {
@@ -42516,7 +42874,7 @@ function validatePromptFeeding(rec) {
 }
 function destPath(projectSlug) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  return join99(BREADCRUMBS_BASE, projectSlug, `${today}.jsonl`);
+  return join100(BREADCRUMBS_BASE, projectSlug, `${today}.jsonl`);
 }
 async function emitBreadcrumb(opts) {
   if (!VALID_SEVERITIES.has(opts.severity)) {
@@ -42535,14 +42893,14 @@ async function emitBreadcrumb(opts) {
     );
     process.exit(2);
   }
-  const path93 = destPath(rec.project_slug);
-  const lockDir = dirname59(path93);
+  const path94 = destPath(rec.project_slug);
+  const lockDir = dirname59(path94);
   mkdirSync63(lockDir, { recursive: true });
   const line = JSON.stringify(rec) + "\n";
   await withFileLock(
     lockDir,
     () => {
-      appendFileSync6(path93, line, "utf8");
+      appendFileSync6(path94, line, "utf8");
     },
     {
       lockFilename: LOCK_FILENAME,
@@ -42552,7 +42910,7 @@ async function emitBreadcrumb(opts) {
       acquireTimeoutMs: 5e3
     }
   );
-  process.stdout.write(`[K7-emit] ${path93}: ${rec.extracted_pattern} (${rec.severity})
+  process.stdout.write(`[K7-emit] ${path94}: ${rec.extracted_pattern} (${rec.severity})
 `);
 }
 function registerFlywheelEmitBreadcrumb(parent) {
@@ -42617,7 +42975,7 @@ function registerFlywheelK5Score(parent) {
 }
 
 // src/commands/flywheel/k5-validate.ts
-import { readFileSync as readFileSync85, statSync as statSync30 } from "node:fs";
+import { readFileSync as readFileSync86, statSync as statSync30 } from "node:fs";
 import { parse as parseYAML } from "yaml";
 var K5_DIMS = ["direction", "approach", "open_questions", "constraints", "reuse"];
 var MAX_PLAN_BYTES = 1048576;
@@ -42675,38 +43033,38 @@ function validateK5ScoredAt(scoredAt) {
   }
   return null;
 }
-function validatePlan(path93) {
+function validatePlan(path94) {
   let stat;
   try {
-    stat = statSync30(path93);
+    stat = statSync30(path94);
   } catch (err) {
-    return { ok: false, message: `FAIL cannot stat ${path93}: ${err instanceof Error ? err.message : "unknown"}` };
+    return { ok: false, message: `FAIL cannot stat ${path94}: ${err instanceof Error ? err.message : "unknown"}` };
   }
   if (stat.size > MAX_PLAN_BYTES) {
-    return { ok: false, message: `FAIL ${path93}: plan file exceeds 1MB (${stat.size} bytes); refusing to parse` };
+    return { ok: false, message: `FAIL ${path94}: plan file exceeds 1MB (${stat.size} bytes); refusing to parse` };
   }
   let text;
   try {
-    text = readFileSync85(path93, "utf8");
+    text = readFileSync86(path94, "utf8");
   } catch (err) {
-    return { ok: false, message: `FAIL cannot read ${path93}: ${err instanceof Error ? err.message : "unknown"}` };
+    return { ok: false, message: `FAIL cannot read ${path94}: ${err instanceof Error ? err.message : "unknown"}` };
   }
   if (!text.replace(/^/, "").startsWith("---")) {
-    return { ok: false, message: `FAIL ${path93}: no YAML frontmatter (missing opening --- marker)` };
+    return { ok: false, message: `FAIL ${path94}: no YAML frontmatter (missing opening --- marker)` };
   }
   if (!text.includes("\n---", 3)) {
-    return { ok: false, message: `FAIL ${path93}: frontmatter block never closed (missing closing --- marker)` };
+    return { ok: false, message: `FAIL ${path94}: frontmatter block never closed (missing closing --- marker)` };
   }
   const fm = extractFrontmatter(text);
   if (fm === null) {
-    return { ok: false, message: `FAIL ${path93}: frontmatter could not be parsed as YAML` };
+    return { ok: false, message: `FAIL ${path94}: frontmatter could not be parsed as YAML` };
   }
   const hasScores = "k5_scores" in fm;
   const hasBoost = "k5_boost" in fm;
   const hasComposite = "k5_composite" in fm;
   const hasScoredAt = "k5_scored_at" in fm;
   if (!hasScores && !hasBoost && !hasComposite && !hasScoredAt) {
-    return { ok: true, message: `PASS ${path93}: k5_scores absent (acceptable \u2014 legacy plan)` };
+    return { ok: true, message: `PASS ${path94}: k5_scores absent (acceptable \u2014 legacy plan)` };
   }
   const errors = [];
   if (hasScores) {
@@ -42726,9 +43084,9 @@ function validatePlan(path93) {
     if (err !== null) errors.push(err);
   }
   if (errors.length > 0) {
-    return { ok: false, message: `FAIL ${path93}: ${errors.join("; ")}` };
+    return { ok: false, message: `FAIL ${path94}: ${errors.join("; ")}` };
   }
-  const lines = [`PASS ${path93}: k5_scores valid`];
+  const lines = [`PASS ${path94}: k5_scores valid`];
   if (hasScores && typeof fm.k5_scores === "object" && fm.k5_scores !== null) {
     const scoresObj = fm.k5_scores;
     const vals = [];
@@ -42769,7 +43127,7 @@ function registerFlywheelK5Validate(parent) {
 }
 
 // src/commands/flywheel/k10-measure.ts
-import { readFileSync as readFileSync86 } from "node:fs";
+import { readFileSync as readFileSync87 } from "node:fs";
 
 // ../core/dist/lib/k10-budget.js
 var K10_TOKEN_CAP = 5500;
@@ -42826,7 +43184,7 @@ function registerFlywheelK10Measure(parent) {
   parent.command("k10-measure").description("Measure K10 token budget for upstream + optional overlay; emit PASS/REJECT verdict").requiredOption("--upstream <path>", "path to upstream file (e.g. persona prompt)").option("--overlay <path>", "path to overlay file (omit if none \u2014 PASS without enforcement)").option("--json", "emit verdict as JSON instead of human-readable").action((opts) => {
     let upstreamText;
     try {
-      upstreamText = readFileSync86(opts.upstream, "utf8");
+      upstreamText = readFileSync87(opts.upstream, "utf8");
     } catch (err) {
       process.stderr.write(
         `[k10-measure-error] cannot read upstream ${opts.upstream}: ${err instanceof Error ? err.message : "unknown"}
@@ -42838,7 +43196,7 @@ function registerFlywheelK10Measure(parent) {
     let overlayTokens = null;
     if (opts.overlay !== void 0) {
       try {
-        const overlayText = readFileSync86(opts.overlay, "utf8");
+        const overlayText = readFileSync87(opts.overlay, "utf8");
         overlayTokens = tokensFromText(overlayText);
       } catch (err) {
         process.stderr.write(
@@ -42872,13 +43230,13 @@ function registerFlywheelK10Measure(parent) {
 }
 
 // src/commands/flywheel/check-persona-skeleton.ts
-import { existsSync as existsSync109, readFileSync as readFileSync87, statSync as statSync31 } from "node:fs";
+import { existsSync as existsSync109, readFileSync as readFileSync88, statSync as statSync31 } from "node:fs";
 import { homedir as homedir58 } from "node:os";
-import { basename as basename14, join as join100 } from "node:path";
+import { basename as basename14, join as join101 } from "node:path";
 import { parse as parseYAML2 } from "yaml";
 var CHARS_PER_TOKEN3 = 4;
 var K10_TOKEN_CAP2 = 6e3;
-var AGENTS_DIR = join100(homedir58(), ".claude", "agents");
+var AGENTS_DIR = join101(homedir58(), ".claude", "agents");
 var REQUIRED_FRONTMATTER_KEYS = ["name", "description", "allowed-tools"];
 var REQUIRED_SECTIONS = [
   "## Role",
@@ -42921,7 +43279,7 @@ function checkFile(filepath) {
   if (!existsSync109(filepath) || !statSync31(filepath).isFile()) {
     return { passed: false, failures: [`file not found: ${filepath}`], tokens: 0, mergedSkipped: false };
   }
-  const text = readFileSync87(filepath, "utf8");
+  const text = readFileSync88(filepath, "utf8");
   const { fm, body } = parseFile(text);
   const failures = [];
   for (const key of REQUIRED_FRONTMATTER_KEYS) {
@@ -42934,7 +43292,7 @@ function checkFile(filepath) {
   const agentName = typeof fm.name === "string" ? fm.name : "";
   let mergedSkipped = false;
   if (!isNewAgent && agentName !== "") {
-    const upstreamPath = join100(AGENTS_DIR, `${agentName}.md`);
+    const upstreamPath = join101(AGENTS_DIR, `${agentName}.md`);
     if (existsSync109(upstreamPath)) {
       mergedSkipped = true;
     }
@@ -42987,7 +43345,7 @@ Results: ${passCount} passed, ${failCount} failed
 }
 
 // src/commands/flywheel/diversity-check.ts
-import { readFileSync as readFileSync88 } from "node:fs";
+import { readFileSync as readFileSync89 } from "node:fs";
 import { basename as basename15 } from "node:path";
 import { globSync as globSync2 } from "node:fs";
 
@@ -43096,7 +43454,7 @@ function registerFlywheelDiversityCheck(parent) {
     const personas = /* @__PURE__ */ new Map();
     for (const filepath of files) {
       try {
-        const body = readFileSync88(filepath, "utf8");
+        const body = readFileSync89(filepath, "utf8");
         if (body.trim().length > 0) {
           personas.set(basename15(filepath, ".md"), body);
         }
@@ -43129,7 +43487,7 @@ ${formatRedivergencePrompt(persona_a, persona_b, score, void 0, void 0, threshol
 // src/commands/flywheel/ping.ts
 import { mkdirSync as mkdirSync64, writeFileSync as writeFileSync56 } from "node:fs";
 import { homedir as homedir59 } from "node:os";
-import { dirname as dirname60, join as join101 } from "node:path";
+import { dirname as dirname60, join as join102 } from "node:path";
 var COLD_START_BUDGET_GOOD_MS = 200;
 var COLD_START_BUDGET_FAIR_MS = 500;
 function classifyColdStart(coldStartMs) {
@@ -43145,7 +43503,7 @@ function readOlamVersion() {
   }
 }
 function writeBaseline(record) {
-  const baselinePath = join101(homedir59(), ".local", "share", "olam", "flywheel-baseline.json");
+  const baselinePath = join102(homedir59(), ".local", "share", "olam", "flywheel-baseline.json");
   mkdirSync64(dirname60(baselinePath), { recursive: true });
   writeFileSync56(baselinePath, JSON.stringify(record, null, 2) + "\n", "utf8");
   return baselinePath;
@@ -43184,18 +43542,19 @@ function registerFlywheelPing(parent) {
 // src/commands/flywheel/migrate-overlays.ts
 init_shim_targets();
 init_skill_sources();
+init_prefix_rules();
 import {
   copyFileSync as copyFileSync15,
   existsSync as existsSync110,
   mkdirSync as mkdirSync65,
-  readFileSync as readFileSync89,
+  readFileSync as readFileSync90,
   readdirSync as readdirSync31,
   statSync as statSync32,
   writeFileSync as writeFileSync57
 } from "node:fs";
 import { spawnSync as spawnSync29 } from "node:child_process";
 import { homedir as homedir60 } from "node:os";
-import { dirname as dirname61, join as join102, relative as relative7 } from "node:path";
+import { dirname as dirname61, join as join103, relative as relative7 } from "node:path";
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -43232,7 +43591,7 @@ function walkOverlayFiles(dir) {
     return [];
   }
   for (const entry of entries) {
-    const fullPath = join102(dir, entry);
+    const fullPath = join103(dir, entry);
     let stat;
     try {
       stat = statSync32(fullPath);
@@ -43271,10 +43630,10 @@ function resolveAtlasUser2(opts) {
     assertValidAtlasUser(v);
     return v;
   }
-  const claudeDir2 = opts._testClaudeDir ?? process.env["OLAM_CLAUDE_DIR"] ?? join102(homedir60(), ".claude");
-  const f = join102(claudeDir2, ".atlas-user");
+  const claudeDir2 = opts._testClaudeDir ?? process.env["OLAM_CLAUDE_DIR"] ?? join103(homedir60(), ".claude");
+  const f = join103(claudeDir2, ".atlas-user");
   if (existsSync110(f)) {
-    const v = readFileSync89(f, "utf-8").trim();
+    const v = readFileSync90(f, "utf-8").trim();
     if (v.length === 0) return null;
     assertValidAtlasUser(v);
     return v;
@@ -43296,8 +43655,8 @@ function runGit2(args, cwd) {
 function walkPushSourceFiles(claudeDir2) {
   const result = [];
   const roots = [
-    { dir: join102(claudeDir2, "skills.overrides"), overlayKind: "skills" },
-    { dir: join102(claudeDir2, "agents.overrides"), overlayKind: "agents" }
+    { dir: join103(claudeDir2, "skills.overrides"), overlayKind: "skills" },
+    { dir: join103(claudeDir2, "agents.overrides"), overlayKind: "agents" }
   ];
   for (const { dir, overlayKind } of roots) {
     const files = walkOverlayFiles(dir);
@@ -43408,6 +43767,27 @@ function pushOverlays(opts) {
   Run \`olam skills atlas-user set <name>\` to configure your atlas user.`
     );
   }
+  const claudeDir2 = opts._testClaudeDir ?? opts.targetDir ?? process.env["OLAM_CLAUDE_DIR"] ?? join103(homedir60(), ".claude");
+  const sourceFiles = walkPushSourceFiles(claudeDir2);
+  const registeredPrefixes = (opts._testSkillSources ?? listSkillSources()).map((s) => s.prefix).filter((p) => typeof p === "string" && p.length > 0);
+  if (registeredPrefixes.length > 0) {
+    for (const { srcFile, relPath } of sourceFiles) {
+      const basename16 = relPath.split("/").pop() ?? relPath;
+      let content;
+      try {
+        content = readFileSync90(srcFile);
+      } catch {
+        continue;
+      }
+      const validation = validateCanonical(basename16, content, registeredPrefixes);
+      if (!validation.ok && validation.violation !== void 0) {
+        throw new PushError(
+          1,
+          formatCanonicalViolation(relPath, validation.violation)
+        );
+      }
+    }
+  }
   let clonePath;
   if (opts._testClonePath !== void 0) {
     clonePath = opts._testClonePath;
@@ -43426,8 +43806,6 @@ function pushOverlays(opts) {
     }
     clonePath = skillSourceClonePath(source.id);
   }
-  const claudeDir2 = opts._testClaudeDir ?? opts.targetDir ?? process.env["OLAM_CLAUDE_DIR"] ?? join102(homedir60(), ".claude");
-  const sourceFiles = walkPushSourceFiles(claudeDir2);
   if (opts.dryRun === true) {
     const { preflightWarnings } = runPreFlight(clonePath, opts.forceCurrentBranch === true, true);
     if (preflightWarnings.length > 0) {
@@ -43436,21 +43814,21 @@ function pushOverlays(opts) {
 ` + preflightWarnings.map((w) => `  - ${w.split("\n")[0]}`).join("\n") + "\n"
       );
     }
-    const membersBase2 = join102(clonePath, "members", atlasUser);
+    const membersBase2 = join103(clonePath, "members", atlasUser);
     let wouldCopy = 0;
     let wouldUnchange = 0;
     let wouldCreate = 0;
     for (const { srcFile, overlayKind, relPath } of sourceFiles) {
-      const targetDir = join102(membersBase2, `${overlayKind}.overrides`);
-      const targetFile = join102(targetDir, relPath);
+      const targetDir = join103(membersBase2, `${overlayKind}.overrides`);
+      const targetFile = join103(targetDir, relPath);
       let srcBuf;
       try {
-        srcBuf = readFileSync89(srcFile);
+        srcBuf = readFileSync90(srcFile);
       } catch {
         continue;
       }
       if (existsSync110(targetFile)) {
-        const dstBuf = readFileSync89(targetFile);
+        const dstBuf = readFileSync90(targetFile);
         if (srcBuf.equals(dstBuf)) {
           wouldUnchange += 1;
           process.stdout.write(`  [skip] ${overlayKind}.overrides/${relPath} (unchanged)
@@ -43491,23 +43869,23 @@ function pushOverlays(opts) {
       `failed to create branch "${branchName}": ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const membersBase = join102(clonePath, "members", atlasUser);
+  const membersBase = join103(clonePath, "members", atlasUser);
   let filesCopied = 0;
   let filesUnchanged = 0;
   let filesCreated = 0;
   try {
     for (const { srcFile, overlayKind, relPath } of sourceFiles) {
-      const targetDir = join102(membersBase, `${overlayKind}.overrides`, dirname61(relPath));
-      const targetFile = join102(membersBase, `${overlayKind}.overrides`, relPath);
+      const targetDir = join103(membersBase, `${overlayKind}.overrides`, dirname61(relPath));
+      const targetFile = join103(membersBase, `${overlayKind}.overrides`, relPath);
       let srcBuf;
       try {
-        srcBuf = readFileSync89(srcFile);
+        srcBuf = readFileSync90(srcFile);
       } catch {
         continue;
       }
       const targetExists = existsSync110(targetFile);
       if (targetExists) {
-        const dstBuf = readFileSync89(targetFile);
+        const dstBuf = readFileSync90(targetFile);
         if (srcBuf.equals(dstBuf)) {
           filesUnchanged += 1;
           continue;
@@ -43584,7 +43962,7 @@ function initMember(opts) {
     clonePath = skillSourceClonePath(source.id);
   }
   const atlasUser = resolveAtlasUser2(opts) ?? memberName;
-  const memberDir = join102(clonePath, "members", memberName);
+  const memberDir = join103(clonePath, "members", memberName);
   if (existsSync110(memberDir)) {
     throw new PushError(
       1,
@@ -43593,9 +43971,9 @@ function initMember(opts) {
     );
   }
   const wouldCreate = [
-    join102(memberDir, "skills.overrides", ".gitkeep"),
-    join102(memberDir, "agents.overrides", ".gitkeep"),
-    join102(memberDir, "README.md")
+    join103(memberDir, "skills.overrides", ".gitkeep"),
+    join103(memberDir, "agents.overrides", ".gitkeep"),
+    join103(memberDir, "README.md")
   ];
   if (opts.dryRun === true) {
     const { preflightWarnings } = runPreFlight(clonePath, opts.forceCurrentBranch === true, true);
@@ -43651,12 +44029,12 @@ function initMember(opts) {
     );
   }
   try {
-    mkdirSync65(join102(memberDir, "skills.overrides"), { recursive: true });
-    writeFileSync57(join102(memberDir, "skills.overrides", ".gitkeep"), "");
-    mkdirSync65(join102(memberDir, "agents.overrides"), { recursive: true });
-    writeFileSync57(join102(memberDir, "agents.overrides", ".gitkeep"), "");
+    mkdirSync65(join103(memberDir, "skills.overrides"), { recursive: true });
+    writeFileSync57(join103(memberDir, "skills.overrides", ".gitkeep"), "");
+    mkdirSync65(join103(memberDir, "agents.overrides"), { recursive: true });
+    writeFileSync57(join103(memberDir, "agents.overrides", ".gitkeep"), "");
     writeFileSync57(
-      join102(memberDir, "README.md"),
+      join103(memberDir, "README.md"),
       `# Member overlays for \`${memberName}\`
 
 See docs/plans/member-overlays-sync/ for layer architecture.
@@ -43697,10 +44075,10 @@ Next steps (run in ${clonePath}):`,
   };
 }
 function migrateOverlays(opts = {}) {
-  const root = opts.targetDir ?? join102(homedir60(), ".claude");
+  const root = opts.targetDir ?? join103(homedir60(), ".claude");
   const overrideRoots = [
-    join102(root, "skills.overrides"),
-    join102(root, "agents.overrides")
+    join103(root, "skills.overrides"),
+    join103(root, "agents.overrides")
   ];
   const allFiles = [];
   for (const overrideRoot of overrideRoots) {
@@ -43716,7 +44094,7 @@ function migrateOverlays(opts = {}) {
   for (const filePath of allFiles) {
     let original;
     try {
-      original = readFileSync89(filePath, "utf8");
+      original = readFileSync90(filePath, "utf8");
     } catch {
       continue;
     }
@@ -43819,7 +44197,7 @@ function registerFlywheelMigrateOverlays(parent) {
       }
       return;
     }
-    const root = opts.targetDir ?? join102(homedir60(), ".claude");
+    const root = opts.targetDir ?? join103(homedir60(), ".claude");
     const summary2 = migrateOverlays(opts);
     if (opts.json === true) {
       process.stdout.write(JSON.stringify(summary2, null, 2) + "\n");
@@ -44123,14 +44501,14 @@ init_manager();
 init_context();
 init_output();
 import { spawnSync as defaultSpawnSync } from "node:child_process";
-import * as fs92 from "node:fs";
+import * as fs93 from "node:fs";
 import * as os48 from "node:os";
-import * as path91 from "node:path";
+import * as path92 from "node:path";
 function devboxContainerName(worldId) {
   return `olam-${worldId}-devbox`;
 }
 function olamHomeDir() {
-  return process.env["OLAM_HOME"] ?? path91.join(os48.homedir(), ".olam");
+  return process.env["OLAM_HOME"] ?? path92.join(os48.homedir(), ".olam");
 }
 function defaultRestartContainer(name, spawn13 = defaultSpawnSync) {
   const r = spawn13("docker", ["restart", "--time", "30", name], {
@@ -44143,8 +44521,8 @@ function defaultRestartContainer(name, spawn13 = defaultSpawnSync) {
   };
 }
 function defaultAppendAuditLog(homeDir, line) {
-  fs92.mkdirSync(homeDir, { recursive: true });
-  fs92.appendFileSync(path91.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
+  fs93.mkdirSync(homeDir, { recursive: true });
+  fs93.appendFileSync(path92.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
     encoding: "utf-8"
   });
 }
@@ -44189,19 +44567,19 @@ async function doRekey(worldId, deps) {
   );
   const rotatedAt = deps.now().toISOString();
   const homeDir = deps.olamHomeDir();
-  const worldDir = path91.join(homeDir, "worlds", worldId);
-  fs92.mkdirSync(worldDir, { recursive: true });
-  const credentialsPath = path91.join(worldDir, "credentials.json");
+  const worldDir = path92.join(homeDir, "worlds", worldId);
+  fs93.mkdirSync(worldDir, { recursive: true });
+  const credentialsPath = path92.join(worldDir, "credentials.json");
   const payload = {
     worldRoleName,
     password,
     rotatedAt
   };
-  fs92.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
+  fs93.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
-  fs92.chmodSync(credentialsPath, 384);
+  fs93.chmodSync(credentialsPath, 384);
   const restart = deps.restartContainer(devboxContainerName(worldId));
   deps.appendAuditLog(`${rotatedAt} ${worldId} rekey`);
   if (!restart.ok) {
@@ -44265,18 +44643,18 @@ function registerRekey(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs93 from "node:fs";
-import * as path92 from "node:path";
+import * as fs94 from "node:fs";
+import * as path93 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path92.join(configDir, "config.yaml");
-  if (!fs93.existsSync(configPath)) {
+  const configPath = path93.join(configDir, "config.yaml");
+  if (!fs94.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs93.readFileSync(configPath, "utf8");
+    const contents = fs94.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;