@plinth-music/cli 0.11.0 → 0.12.0

package/dist/cli.js

@@ -7584,7 +7584,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 // package.json
 var package_default = {
   name: "@plinth-music/cli",
-  version: "0.11.0",
+  version: "0.12.0",
   description: "Plinth capstone sync daemon and CLI",
   type: "module",
   private: false,
@@ -23651,17 +23651,6 @@ function writeMirrorFile(workspaceSlug, entityType, entitySlug, content) {
     throw err;
   }
 }
-function deleteMirrorFile(workspaceSlug, entityType, entitySlug) {
-  const target = entityFilePath(workspaceSlug, entityType, entitySlug);
-  try {
-    unlinkSync(target);
-    return true;
-  } catch (err) {
-    if (err?.code === "ENOENT")
-      return false;
-    throw err;
-  }
-}
 var ARTIST_MEMORY_ANCHOR = "memory.md";
 function artistMemoryFilePath(workspaceSlug, entitySlug) {
   assertSlug("entity slug", entitySlug);
@@ -23746,6 +23735,49 @@ function ensureFilesSubtree(workspaceSlug) {
   const target = filesSubtreeRoot(workspaceSlug);
   return mkdirSync(target, { recursive: true, mode: 448 }) !== undefined;
 }
+function ensureEntityFolders(workspaceSlug) {
+  const created = [];
+  for (const type of allEntityTypes()) {
+    try {
+      const target = entityFolderRoot(workspaceSlug, type);
+      if (mkdirSync(target, { recursive: true, mode: 448 }) !== undefined) {
+        created.push(type);
+      }
+    } catch {}
+  }
+  return created;
+}
+function observeMirrorFolders(workspaceSlug, names) {
+  const seen = [];
+  for (const name of names) {
+    let target;
+    try {
+      target = entityFolderRoot(workspaceSlug, name);
+    } catch {
+      continue;
+    }
+    try {
+      const raw = readdirSync(target);
+      const entries = name === FILES_SUBTREE_DIR ? raw : raw.filter((e) => !e.startsWith("."));
+      seen.push({ name, empty: entries.length === 0 });
+    } catch (err) {
+      if (err?.code === "ENOENT")
+        continue;
+      seen.push({ name, empty: false });
+    }
+  }
+  return seen;
+}
+function entityFolderRoot(workspaceSlug, name) {
+  const ws = workspaceMirrorPath(workspaceSlug);
+  const target = resolve(ws, name);
+  const prefix = ws.endsWith(sep) ? ws : ws + sep;
+  if (!target.startsWith(prefix)) {
+    throw new MirrorPathError(`Resolved folder path escapes the workspace mirror`);
+  }
+  assertNoSymlinkedComponent(ws, target);
+  return target;
+}
 function filesSubtreeRoot(workspaceSlug) {
   const ws = workspaceMirrorPath(workspaceSlug);
   const target = join2(ws, FILES_SUBTREE_DIR);
@@ -24863,11 +24895,20 @@ var WhoamiSchema = exports_external.object({
   workspace_id: exports_external.string().uuid(),
   workspace_slug: exports_external.string().min(1),
   workspace_name: exports_external.string().min(1),
+  role: exports_external.string().min(1).nullable().optional(),
   profile: exports_external.object({
     email: exports_external.string().email(),
-    display_name: exports_external.string().nullable().optional()
+    display_name: exports_external.string().nullable().optional(),
+    onboarding_completed_at: exports_external.string().nullable().optional()
   })
 });
+var MemberPrincipalSchema = exports_external.object({
+  email: exports_external.string().email().max(254),
+  display_name: exports_external.string().min(1).max(200).nullable().optional(),
+  role: exports_external.string().min(1).max(64).nullable().optional(),
+  onboarding_completed_at: exports_external.string().nullable().optional(),
+  fetched_at: exports_external.string().datetime({ offset: true }).optional()
+});
 var SyncCursorsSchema = exports_external.record(exports_external.string(), exports_external.string().nullable());
 var WorkspaceEntrySchema = exports_external.object({
   workspace_id: exports_external.string().uuid(),
@@ -24875,6 +24916,7 @@ var WorkspaceEntrySchema = exports_external.object({
   api_base_url: exports_external.string().url(),
   last_synced_at: exports_external.string().datetime({ offset: true }).nullable(),
   workspace_name: exports_external.string().min(1).optional(),
+  member: MemberPrincipalSchema.optional(),
   sync_cursors: SyncCursorsSchema.optional()
 });
 var ConfigFileSchema = exports_external.object({
@@ -24978,6 +25020,32 @@ function updateSyncCursor(slug, entityType, cursor) {
   writeAtomic(next);
   return next;
 }
+function setMemberPrincipal(slug, member) {
+  const existing = loadConfig();
+  if (!existing)
+    return false;
+  const entry = existing.workspaces[slug];
+  if (!entry)
+    return false;
+  const nextEntry = { ...entry, member };
+  writeAtomic({
+    ...existing,
+    workspaces: { ...existing.workspaces, [slug]: nextEntry }
+  });
+  return true;
+}
+var MEMBER_REFRESH_AFTER_MS = 24 * 60 * 60 * 1000;
+function memberNeedsRefresh(entry, now = () => new Date) {
+  const member = entry.member;
+  if (member === undefined)
+    return true;
+  if (member.fetched_at === undefined)
+    return true;
+  const age = now().getTime() - new Date(member.fetched_at).getTime();
+  if (Number.isNaN(age))
+    return true;
+  return age >= MEMBER_REFRESH_AFTER_MS;
+}
 function updateLastSyncedAt(slug, iso) {
   const existing = loadConfig();
   if (!existing) {
@@ -25684,12 +25752,12 @@ function runDeclare(args, deps = {}) {
   const now = deps.now ?? (() => new Date);
   const declaredPath = args.path?.trim();
   if (!declaredPath) {
-    out.error("Nothing to declare. Usage: plinth declare <path> --scratchpad <dir> [--label=<text>]");
+    out.error(`Nothing to declare. Usage: plinth declare "<path>" --scratchpad="<dir>" [--label='<text>']`);
     return { exitCode: 1 };
   }
   const rootArg = args.scratchpad?.trim() || env2[SCRATCHPAD_ENV]?.trim();
   if (!rootArg) {
-    out.error(`No scratchpad directory given, so there is nothing to declare into. ` + `Pass --scratchpad <dir> (the scratchpad directory your harness told ` + `you to use), or set ${SCRATCHPAD_ENV}. This is never guessed: a ` + `wrongly guessed root would widen the containment check silently.`);
+    out.error(`No scratchpad directory given, so there is nothing to declare into. ` + `Pass --scratchpad="<dir>" (the scratchpad directory your harness told ` + `you to use), or set ${SCRATCHPAD_ENV}. This is never guessed: a ` + `wrongly guessed root would widen the containment check silently.`);
     return { exitCode: 1 };
   }
   let rootStat;
@@ -25887,6 +25955,86 @@ function renderFreshnessStamp(today, updatedAt) {
   return `This index was last updated on ${bankedDay}, ${age}.`;
 }
 var GROUNDING_BUDGET_BYTES = 20000;
+var GROUNDING_CATEGORY_ORDER = [
+  "grounding",
+  "identity",
+  "budgetNote",
+  "voice",
+  "rules",
+  "workspaceFacts",
+  "personalFacts"
+];
+var GROUNDING_CATEGORY_LABELS = {
+  grounding: "Plinth's own grounding",
+  identity: "who you are",
+  budgetNote: "the trim notes",
+  voice: "voice pointer",
+  rules: "this workspace's rules",
+  workspaceFacts: "workspace facts",
+  personalFacts: "your own facts"
+};
+var MEMBER_EDITABLE_CATEGORIES = [
+  "rules",
+  "workspaceFacts",
+  "personalFacts"
+];
+function segmentBytes(lines, cats) {
+  const out = {
+    grounding: 0,
+    identity: 0,
+    rules: 0,
+    workspaceFacts: 0,
+    personalFacts: 0,
+    voice: 0,
+    budgetNote: 0
+  };
+  lines.forEach((text, i) => {
+    const cat = cats[i];
+    out[cat] += Buffer.byteLength(text) + (i < lines.length - 1 ? 1 : 0);
+  });
+  return out;
+}
+var IDENTITY_LINE_MAX_BYTES = 300;
+function renderMemberIdentity(member, workspaceSlug) {
+  if (member === null)
+    return null;
+  const tail = `. Tasks you create are assigned to this member unless told otherwise.`;
+  const budget = IDENTITY_LINE_MAX_BYTES - Buffer.byteLength(tail);
+  const email3 = oneLine(member.email);
+  const build = (withName, withRole, withZone) => {
+    const who = withName && member.displayName ? `${oneLine(member.displayName)} (${email3})` : email3;
+    const clauses = [`You are working for ${who}`];
+    if (withRole && member.role)
+      clauses.push(`role ${oneLine(member.role)}`);
+    if (workspaceSlug !== null)
+      clauses.push(`in workspace ${workspaceSlug}`);
+    if (withZone && member.timezone)
+      clauses.push(`timezone ${oneLine(member.timezone)}`);
+    return clauses.join(", ");
+  };
+  const candidates = [
+    build(true, true, true),
+    build(true, true, false),
+    build(true, false, false),
+    build(false, false, false)
+  ];
+  if (member.displayName) {
+    const slugClause = workspaceSlug === null ? `` : `, in workspace ${workspaceSlug}`;
+    candidates.push(`You are working for ${oneLine(member.displayName)}${slugClause}`);
+  }
+  const head = candidates.find((c) => Buffer.byteLength(c) <= budget);
+  if (head === undefined)
+    return null;
+  return head + tail;
+}
+function oneLine(value) {
+  return value.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
+}
+function shouldOfferOnboarding(rosterIsEmpty, member) {
+  if (member?.onboardingCompletedAt)
+    return false;
+  return rosterIsEmpty;
+}
 function bankedDate(line) {
   const matches = line.match(/\d{4}-\d{2}-\d{2}/g);
   if (matches === null || matches.length === 0)
@@ -25897,6 +26045,28 @@ function bankedDate(line) {
       latest = m;
   return latest;
 }
+var POINTER_RE = /\[\[[^\]]+\]\]/g;
+var TITLE_TRUNCATION_MARK = " …";
+function factTitle(fact) {
+  const firstLine = fact.split(`
+`)[0];
+  const match = /[.?!](\s|$)/.exec(firstLine);
+  const sentence = match === null ? firstLine : firstLine.slice(0, match.index + 1);
+  const missing = [...fact.matchAll(POINTER_RE)].map((m) => m[0]).filter((p) => !sentence.includes(p));
+  const unique = [...new Set(missing)];
+  const named = unique.length === 0 ? sentence : `${sentence} ${unique.join(" ")}`;
+  const truncated = named !== fact;
+  return { text: truncated ? `${named}${TITLE_TRUNCATION_MARK}` : named, truncated };
+}
+function rankFacts(facts) {
+  return facts.map((line, index) => ({ line, index, date: bankedDate(line) })).sort((a, b) => {
+    const ad = a.date ?? "";
+    const bd = b.date ?? "";
+    if (ad !== bd)
+      return ad < bd ? 1 : -1;
+    return b.index - a.index;
+  }).map(({ index, line }) => ({ index, line }));
+}
 function groupFacts(body) {
   const facts = [];
   for (const line of body.split(`
@@ -25912,32 +26082,64 @@ ${line}`;
   }
   return facts;
 }
-function selectRecentLines(body, capBytes) {
+function selectIndexContent(body, capBytes) {
   const lines = groupFacts(body);
   if (Buffer.byteLength(body) <= capBytes) {
-    return { text: body, kept: lines.length, total: lines.length };
-  }
-  const ranked = lines.map((line, index) => ({ line, index, date: bankedDate(line) })).sort((a, b) => {
-    const ad = a.date ?? "";
-    const bd = b.date ?? "";
-    if (ad !== bd)
-      return ad < bd ? 1 : -1;
-    return b.index - a.index;
-  });
-  const chosen = [];
-  let used = 0;
-  for (const entry of ranked) {
-    const add = Buffer.byteLength(entry.line) + (chosen.length > 0 ? 1 : 0);
-    if (used + add > capBytes)
+    return { text: body, titles: "", kept: lines.length, named: 0, total: lines.length };
+  }
+  const ranked = rankFacts(lines);
+  const titleOf = new Map;
+  const info2 = new Map;
+  for (const { index, line } of ranked) {
+    const t = factTitle(line);
+    info2.set(index, t);
+    titleOf.set(index, t.text);
+  }
+  const carried = new Map;
+  const used = () => {
+    let bytes = 0;
+    let bodies = 0;
+    let titles = 0;
+    for (const [index, kind] of carried) {
+      const line = lines[index];
+      if (kind === "body") {
+        bytes += Buffer.byteLength(line);
+        bodies++;
+      } else {
+        bytes += Buffer.byteLength(titleOf.get(index));
+        titles++;
+      }
+    }
+    return bytes + Math.max(0, bodies - 1) + Math.max(0, titles - 1);
+  };
+  for (const { index } of ranked) {
+    if (info2.get(index)?.truncated !== true)
+      continue;
+    carried.set(index, "title");
+    if (used() > capBytes)
+      carried.delete(index);
+  }
+  for (const { index } of ranked) {
+    const was = carried.get(index);
+    carried.set(index, "body");
+    if (used() > capBytes) {
+      if (was === undefined)
+        carried.delete(index);
+      else
+        carried.set(index, was);
       break;
-    chosen.push(entry.index);
-    used += add;
+    }
   }
-  chosen.sort((a, b) => a - b);
+  const inFileOrder = (kind) => [...carried.entries()].filter(([, k]) => k === kind).map(([i]) => i).sort((a, b) => a - b);
+  const bodyIdx = inFileOrder("body");
+  const titleIdx = inFileOrder("title");
   return {
-    text: chosen.map((i) => lines[i]).join(`
+    text: bodyIdx.map((i) => lines[i]).join(`
 `),
-    kept: chosen.length,
+    titles: titleIdx.map((i) => titleOf.get(i)).join(`
+`),
+    kept: bodyIdx.length,
+    named: titleIdx.length,
     total: lines.length
   };
 }
@@ -25947,83 +26149,103 @@ function trimmedIndexNote(kept, total, filename) {
   }
   return `Those are the ${kept} most recently banked of ${total} facts, not all of ` + `them: this injection carries a fixed budget and the rest of the index did ` + `not fit. The other ${total - kept} are in \`${filename}\` at the mirror ` + `root. READ THAT FILE IN FULL before you rely on what this workspace has ` + `taught you, and before you answer that no fact covers something. An index ` + `that is silent because it was trimmed reads exactly like one that has ` + `settled a subject.`;
 }
-function composeGroundingBlock(today, workspaceRules, workspaceMemory, userMemory, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, workspaceMemoryNote, userMemoryNote) {
+function titlesLeadIn(kept, named, unnamed, total, filename) {
+  const parts = [`${kept} above in full`];
+  parts.push(`${named} below as ${named === 1 ? "its opening" : "their openings"} only`);
+  if (unnamed > 0)
+    parts.push(`${unnamed} not shown at all`);
+  return `Not all of this index fits. It holds ${total} facts: ${parts.join(", ")}. ` + `Every line below ends \`…\` because it is an opening and not the whole ` + `fact. They are all in \`${filename}\` at the mirror root: READ THAT FILE ` + `IN FULL before you answer that no fact covers something.`;
+}
+function composeGroundingBlock(today, workspaceRules, workspaceMemory, userMemory, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, workspaceMemoryNote, userMemoryNote, member, workspaceTitles = null, userTitles = null) {
   const gateFlag = workspaceSlug === null ? `--workspace="<this workspace>"` : `--workspace ${workspaceSlug}`;
-  const block = [
-    `Plinth session grounding:`,
-    ``,
-    `Today's date: ${today}. You have no inherent sense of the current date and ` + `your training has a knowledge cutoff, so treat this injected date as ` + `authoritative for anything time-relative: deadlines, what counts as ` + `"recent" or "upcoming", and the age of any data or of your own knowledge.`,
-    ``,
-    `Resolve Plinth entities before answering about them. For any answer grounded ` + `in a specific artist, project, task, or other workspace entity, first look ` + `the name up in THIS workspace with the Plinth MCP tools ` + `(\`mcp__plinth__search_entities\`, \`mcp__plinth__list_artists\`, or ` + `\`mcp__plinth__list_projects\`) and ground your answer in what they return. ` + `Do not answer from name recognition alone: a globally famous name may not ` + `exist in this workspace, and an entity here may differ from the public ` + `figure of the same name. If the lookup returns nothing, say so instead of ` + `inventing details.`,
-    ``,
-    `Plan before you write. The first time you call any mutating Plinth MCP tool ` + `in a session (create_*, update_*, delete_*, mark_*: anything that changes ` + `workspace data), do not commit silently: state exactly what you would write, ` + `naming the tool, the entity, and the fields and values, and proceed only after ` + `the user confirms or amends. (Native dry_run support in the Plinth MCP tools ` + `ships separately; until then this is a behavioural rule.)`,
-    ``,
-    `Write through the canonical surface. In this cockpit the file tree is your edit ` + `surface, so reach for it before the most direct tool. Change prose (document ` + `bodies, free-form notes, anything textual) by editing the mirror markdown ` + `file; the daemon syncs it up. An artist's master context is the clearest case: ` + `it lives in the body of that artist's \`artists/<slug>/_artist.md\` mirror file, ` + `the file the web context pane renders, and one of only two files under ` + `\`artists/<slug>/\` the daemon syncs both ways (\`memory.md\` is the other), ` + `so change it by editing that body, never by creating ` + `a separate document or context entity (e.g. \`create_document\`) the pane won't ` + `render. One carve-out inside that file: a block labelled as rendered from ` + `Plinth is regenerated on every sync and your edits to it are discarded, so ` + `write those through the tool the block names. Change structured fields (task ` + `status, priority, assignees, due dates, a project's category) through the ` + `Plinth MCP (\`mcp__plinth__*\`) or the task file's frontmatter, which is ` + `row-canonical but still written through the validated API. Make a bulk or ` + `destructive change (a mass delete, a gutting overwrite) by editing the file ` + `path, so the daemon's confirm-gate can quarantine it for \`plinth confirm\`. ` + `Never write the database directly, which rules out raw SQL and ` + `\`execute_sql\`, \`apply_migration\` and \`psql\`: those bypass the daemon, the ` + `mirror, the confirm-gate, canonicality, and API validation.`,
-    ``,
-    `Dates belong on the calendar, not in \`key_dates\`. The date surface for an artist ` + `is their mapped Google Calendar; the \`key_dates\` table is retired. Never create ` + `or update a key date: do not call \`create_key_date\` or \`update_key_date\` (they ` + `write to the retired table and are being removed from the tool surface). Reading ` + `dates is fine, and this mirror already holds them: the daemon projects every ` + `mapped calendar into \`views/calendar/upcoming.md\` and ` + `\`views/calendar/<slug>.md\`, so read those before reaching for a tool ` + `(\`list_artist_calendars\`, \`list_key_dates\`). They are derived and overwritten, ` + `so they are current only as of the \`generated_at\` in their header - quote that ` + `stamp, never edit them, and check the status line, because a calendar Plinth ` + `could not reach is unknown rather than empty.`,
-    ``,
-    `Read the calendar, and hand a date over rather than writing it yourself. An ` + `artist's dates live on their mapped Google Calendar and reading them is yours: ` + `resolve the calendar through \`mcp__plinth__list_artist_calendars\` and use its ` + `\`calendar_id\` field, not the mapping row's \`id\`, because the default ` + `\`primary\` is almost never theirs. Writing it is not yours. When a date needs ` + `adding or correcting (a show, a hold, a release, a deadline), say plainly what ` + `the change is, say that it goes in through Plinth's calendar view, and say that ` + `a person makes that change rather than you. Say the reason too, because a date ` + `left looking handled is worse than one openly outstanding: a calendar write ` + `goes out to everyone invited the moment it lands, and it cannot be recalled. ` + `This is not a puzzle to route around. Do not reach for a shell command line to ` + `do it, the Google Workspace one included, and do not go looking for another ` + `tool that writes a calendar. Those tools are denied to you wherever Plinth has ` + `configured this workspace, and where a deny has not reached, the rule is the ` + `same and you are the only thing holding it.`,
-    ``,
-    `Draft email. Never send it. Writing the draft is yours: use the draft tools ` + `(\`create_draft\`, \`update_draft\`), then say where the draft is and what it ` + `says, so the person can read it and send it in their own name. Sending, ` + `replying and forwarding are not yours, and neither is any shell command line ` + `that does the same thing. Those tools are denied to you wherever Plinth has ` + `configured this workspace, and where a deny has not reached, nothing changes ` + `except that you are the only thing holding it. This is not a comment on your ` + `writing. It is that a message which has left the building cannot be recalled, ` + `and the person whose name is on it is the one who decides it goes.`,
-    ``,
-    `Check the voice yourself, because nothing else checks it now. Two files carry ` + `it: \`workspace-rules.md\` at the mirror root holds this workspace's house ` + `style, and \`${VOICE_FILENAME}\` beside it holds your own voice profile, the ` + `sign-off and the habits that belong to one member rather than the team. Read ` + `them before you write and follow them as written, rather than drafting in ` + `your own register and correcting after. Nothing inspects a draft between you ` + `and the person reading it, so the rules in those files are the whole of it.`,
-    ``,
-    `Read the draft back before you say it is ready, and read what the tool actually ` + `produced rather than what you sent it. Do this every time you write one, not ` + `once a session: a later edit can undo what an earlier check confirmed. A ` + `draft surface takes your text and renders it, and it may escape what you ` + `wrote, wrap it, quote an earlier message underneath it, thread it somewhere ` + `you did not intend, or leave the first one in place and add a second. What ` + `the person opens is the rendered result, not your input, and those are not ` + `always the same thing. So fetch the staged draft, look at its body, its ` + `recipients, the thread it landed on and that there is one of it, and only ` + `then say it is ready. Separately, and once per session is enough for this ` + `part: if a tool's own description tells you how it handles your text, treat ` + `that as a claim like any other and check it against what came out. A tool ` + `that is documented wrong will put markup, an empty body, or a stranger's ` + `address in front of a person whose name is on the message, and you are the ` + `only thing standing between those two.`
-  ];
+  const identity = renderMemberIdentity(member, workspaceSlug);
+  const block = [];
+  const cats = [];
+  const add = (cat, ...lines) => {
+    for (const line of lines) {
+      block.push(line);
+      cats.push(cat);
+    }
+  };
+  add("grounding", `Plinth session grounding:`, ``, `Today's date: ${today}. You have no inherent sense of the current date and ` + `your training has a knowledge cutoff, so treat this injected date as ` + `authoritative for anything time-relative: deadlines, what counts as ` + `"recent" or "upcoming", and the age of any data or of your own knowledge.`);
+  if (identity !== null)
+    add("identity", ``, identity);
+  add("grounding", ``, `Resolve Plinth entities before answering about them. For any answer grounded ` + `in a specific artist, project, task, or other workspace entity, first look ` + `the name up in THIS workspace with the Plinth MCP tools ` + `(\`mcp__plinth__search_entities\`, \`mcp__plinth__list_artists\`, or ` + `\`mcp__plinth__list_projects\`) and ground your answer in what they return. ` + `Do not answer from name recognition alone: a globally famous name may not ` + `exist in this workspace, and an entity here may differ from the public ` + `figure of the same name. If the lookup returns nothing, say so instead of ` + `inventing details.`, ``, `Plan before you write. The first time you call any mutating Plinth MCP tool ` + `in a session (create_*, update_*, delete_*, mark_*: anything that changes ` + `workspace data), do not commit silently: state exactly what you would write, ` + `naming the tool, the entity, and the fields and values, and proceed only after ` + `the user confirms or amends.`, ``, `Write through the canonical surface. In this cockpit the file tree is your edit ` + `surface, so reach for it before the most direct tool. Change prose (document ` + `bodies, free-form notes, anything textual) by editing the mirror markdown ` + `file; the daemon syncs it up. An artist's master context is the clearest case: ` + `it lives in the body of that artist's \`artists/<slug>/_artist.md\` mirror file, ` + `the file the web context pane renders, and one of only two files under ` + `\`artists/<slug>/\` the daemon syncs both ways (\`memory.md\` is the other), ` + `so change it by editing that body, never by creating ` + `a separate document or context entity (e.g. \`create_document\`) the pane won't ` + `render. One carve-out inside that file: a block labelled as rendered from ` + `Plinth is regenerated on every sync and your edits to it are discarded, so ` + `write those through the tool the block names. Change structured fields (task ` + `status, priority, assignees, due dates, a project's category) through the ` + `Plinth MCP (\`mcp__plinth__*\`) or the task file's frontmatter, which is ` + `row-canonical but still written through the validated API. Make a bulk or ` + `destructive change (a mass delete, a gutting overwrite) by editing the file ` + `path, so the daemon's confirm-gate can quarantine it for \`plinth confirm\`. ` + `Never write the database directly, which rules out raw SQL and ` + `\`execute_sql\`, \`apply_migration\` and \`psql\`: those bypass the daemon, the ` + `mirror, the confirm-gate, canonicality, and API validation.`, ``, `Dates belong on the calendar, not in \`key_dates\`. The date surface for an artist ` + `is their mapped Google Calendar; the \`key_dates\` table is retired. Reading ` + `dates is yours, and this mirror already holds them: the daemon projects every ` + `mapped calendar into \`views/calendar/upcoming.md\` and ` + `\`views/calendar/<slug>.md\`, so read those before reaching for a tool ` + `(\`list_artist_calendars\`). They are derived and overwritten, ` + `so they are current only as of the \`generated_at\` in their header - quote that ` + `stamp, never edit them, and check the status line, because a calendar Plinth ` + `could not reach is unknown rather than empty. When a tool is the only way, ` + `resolve the calendar through \`mcp__plinth__list_artist_calendars\` and use its ` + `\`calendar_id\` field, not the mapping row's \`id\`, because the default ` + `\`primary\` is almost never theirs.`, ``, `Writing a date is not yours, by any route: not a calendar tool, and not a ` + `shell command line either, the Google Workspace one included. The calendar ` + `tools are refused for you where Plinth has configured this workspace. ` + `Nothing refuses a shell, anywhere, and where Plinth has not configured ` + `this workspace nothing is refused at all: you are the only thing holding ` + `those. The way ` + `through is a person, not a workaround, so when a date needs adding or ` + `correcting say plainly what the change is, say that it goes in through ` + `Plinth's calendar view, and say that a person makes it. Say why, too: a date ` + `left looking handled is worse than one openly outstanding, and a calendar ` + `write goes out to everyone invited the moment it lands and cannot be recalled.`, ``, `Draft email. Never send it. Writing the draft is yours: use the draft tools ` + `(\`create_draft\`, \`update_draft\`), then say where the draft is and what it ` + `says, so the person can read it and send it in their own name. Sending, ` + `replying and forwarding are not yours, by any route: not a mail tool, and ` + `not a shell command line either. The mail tools are refused for you where ` + `Plinth has configured this workspace. Nothing refuses a shell, anywhere, ` + `and where Plinth has not configured this workspace nothing is refused at ` + `all: you are the only thing holding those. This is not a comment on your ` + `writing. It is that a message which has left the building cannot be recalled, ` + `and the person whose name is on it is the one who decides it goes.`);
+  if (workspaceRules === null && voiceProfile === null) {
+    add("voice", ``, `Check the voice yourself, because nothing else checks it now. Two files carry ` + `it: \`workspace-rules.md\` at the mirror root holds this workspace's house ` + `style, and \`${VOICE_FILENAME}\` beside it holds your own voice profile, the ` + `sign-off and the habits that belong to one member rather than the team. Read ` + `them before you write and follow them as written, rather than drafting in ` + `your own register and correcting after. Nothing inspects a draft between you ` + `and the person reading it, so the rules in those files are the whole of it.`);
+  }
+  add("grounding", ``, `Read the draft back before you say it is ready, and read what the tool actually ` + `produced rather than what you sent it. Do this every time you write one, not ` + `once a session: a later edit can undo what an earlier check confirmed. A ` + `draft surface takes your text and renders it, and it may escape what you ` + `wrote, wrap it, quote an earlier message underneath it, thread it somewhere ` + `you did not intend, or leave the first one in place and add a second. What ` + `the person opens is the rendered result, not your input, and those are not ` + `always the same thing. So fetch the staged draft, look at its body, its ` + `recipients, the thread it landed on and that there is one of it, and only ` + `then say it is ready. Separately, and once per session is enough for this ` + `part: if a tool's own description tells you how it handles your text, treat ` + `that as a claim like any other and check it against what came out. A tool ` + `that is documented wrong will put markup, an empty body, or a stranger's ` + `address in front of a person whose name is on the message, and you are the ` + `only thing standing between those two.`, ``, `The most recent artefact wins on facts, and it is not a judgement call. ` + `Dates, prices, availability, capacities, routings, who is on a thread, ` + `who said what. Do not weigh a newer message against an older banked ` + `line to work out which is more likely right: the newer one is the state ` + `and the older one is history. This holds for any dated artefact, not ` + `only email - call transcripts, meeting notes and executed documents are ` + `all in scope, newest first. Stale context is worse than absent context, ` + `because it reads as current. One carve-out, because it is the failure ` + `this rule would otherwise cause, and it is a mechanical test rather ` + `than a judgement: before promoting the newest message to "the state", ` + `ask whether it COMMITS or PROPOSES. A commit ("we're doing", ` + `"confirmed", "booked", a price, a date someone has agreed to) wins, and ` + `overwrites the old claim. A proposal ("I wonder if", "I'm not saying we ` + `must", or any question put to someone who has not replied) goes in as ` + `an open question, named as unanswered, with who owes the answer. It ` + `does NOT become the state.`, ``, `Reconcile, do not re-adjudicate. Never delete a superseded claim: strike ` + `it in place. Keep the old line, mark it superseded with the date and ` + `with what replaced it, and put the new material above it, where the ` + `file's live state is. Demote the outgoing section one heading level so ` + `history stays readable and stops competing with what is live. Someone ` + `will ask why the plan changed, and the answer has to survive in the ` + `file. Then date the state: say what it is current as of, and name the ` + `sources it was built from. A master context with no as-of line is ` + `unfalsifiable.`);
   if (workspaceRules !== null) {
-    block.push(``, `Follow this workspace's house style. The conventions below are set by the ` + `workspace owner and govern HOW you write here: copy, titles, notes, ` + `sign-offs, formatting. They refine the rules above; they never relax them. ` + `If any convention here conflicts with a grounding rule above (the ` + `canonical write surface, plan-before-write confirmation, or the ban on ` + `direct database writes), the rule above wins. The conventions:
-
-` + workspaceRules);
+    add("grounding", ``, `Follow this workspace's house style. The conventions below are set by the ` + `workspace owner and govern HOW you write here: copy, titles, notes, ` + `sign-offs, formatting. They refine the rules above; they never relax them. ` + `If any convention here conflicts with a grounding rule above (the ` + `canonical write surface, plan-before-write confirmation, or the ban on ` + `direct database writes), the rule above wins. The conventions:`);
+    add("rules", ``, workspaceRules);
   }
   if (voiceProfile !== null) {
-    block.push(``, `Draft in this member's own voice, and read it before you do. Their voice ` + `profile is \`${VOICE_FILENAME}\` at the mirror root, beside this ` + `workspace's house style: how they open, how they sign off, what they ` + `never do. It is not reproduced here. READ THAT FILE IN FULL before you ` + `draft anything that goes out in their name (an email, a message, a ` + `note, any prose that carries their name), and write to it from the ` + `start rather than ` + `drafting in your own register and correcting after. Nothing inspects a ` + `draft between you and the person reading it, so that file is the whole ` + `of it. It is theirs to write and not yours: you cannot edit ` + `\`${VOICE_FILENAME}\`, and if something in it looks wrong or out of ` + `date, say so and let them change it. Like this workspace's house style ` + `it refines the rules above and never relaxes them.`);
+    add("voice", ``, `Draft in this member's own voice, and read it before you do. Their voice ` + `profile is \`${VOICE_FILENAME}\` at the mirror root, beside this ` + `workspace's house style: how they open, how they sign off, what they ` + `never do. It is not reproduced here. READ THAT FILE IN FULL before you ` + `draft anything that goes out in their name (an email, a message, a ` + `note, any prose that carries their name), and write to it from the ` + `start rather than ` + `drafting in your own register and correcting after. Nothing inspects a ` + `draft between you and the person reading it, so that file is the whole ` + `of it. It is theirs to write and not yours: you cannot edit ` + `\`${VOICE_FILENAME}\`, and if something in it looks wrong or out of ` + `date, say so and let them change it. Like this workspace's house style ` + `it refines the rules above and never relaxes them.`);
     if (voiceMalformed) {
-      block.push(``, `That voice profile does not currently parse. Plinth read it and found ` + `its structure broken, most often a code fence that was opened and ` + `never closed, so any machine-read setting inside it is being ignored ` + `rather than applied. The prose in it is still the member's own ` + `writing and is still worth following. Treat anything that looks like ` + `a configured setting in it as NOT in force, say so if it comes up, ` + `and tell them their profile needs fixing rather than fixing it ` + `yourself.`);
+      add("voice", ``, `That voice profile does not currently parse. Plinth read it and found ` + `its structure broken, most often a code fence that was opened and ` + `never closed, so any machine-read setting inside it is being ignored ` + `rather than applied. The prose in it is still the member's own ` + `writing and is still worth following. Treat anything that looks like ` + `a configured setting in it as NOT in force, say so if it comes up, ` + `and tell them their profile needs fixing rather than fixing it ` + `yourself.`);
     }
   }
-  block.push(``, `Keep your memory on the Plinth surface. Your memory here IS the Plinth ` + `surface (\`workspace-memory.md\`, your own \`user-memory.md\`, and the ` + `per-artist warm stores the daemon syncs), and it is the ONLY memory you ` + `keep. Do not use any other memory store: no private notes-to-self, no ` + `separate scratch file, no tool-native memory of your own. What you learn ` + `here is recorded on the Plinth surface, or nowhere. When you learn a ` + `durable fact worth keeping, bank it by adding a line to the right index, ` + `which the daemon syncs up, following the write-back conventions in that ` + `file's header: one line, at least one \`[[pointer]]\` to where the full ` + `fact lives, an absolute date, and where you learned it. Only ever record ` + `what you have actually been taught, never public knowledge and never your ` + `own priors. The scope rule decides WHICH index, and there are ` + `THREE. A fact true of ONE ARTIST (their rate card, how their kit ` + `works, what a contact of theirs reliably does) goes in that artist's ` + `own warm store, \`artists/<slug>/memory.md\`, and not in the shared ` + `index: putting it there taxes every teammate who never touches that ` + `artist and hides it from the one who does. A fact that holds for the ` + `whole workspace (a project, a working convention, a standing ` + `fact true for everyone here) goes in \`workspace-memory.md\`, which ` + `grounds EVERY teammate - and that file is the one you NEVER write on ` + `your own judgement. It changes only when a member ASKS you to remember ` + `something for everyone, in their own words rather than your summary of ` + `them, and you log that decision with ` + `\`plinth memory-gate log ${gateFlag} --proposed="<their words>" --decision accept\` ` + `BEFORE you write the line. That command fails LOUD on exit 1: surface ` + `it, and do not report the line as banked. Never infer a line for that ` + `file from what merely happened in a session, and never propose one ` + `unasked - a wrong line there reaches every member on every machine and ` + `is injected into every future session. A fact about one person (an individual ` + `preference, your own working style or tools) is NOT a workspace fact: it ` + `goes in \`user-memory.md\`, your member-private index that only YOU can ` + `read. HOW THIS MEMBER WRITES IS THE ONE EXCEPTION: their register and ` + `sign-off are a rubric, not a fact, and live in \`${VOICE_FILENAME}\`, ` + `which is theirs and you cannot edit, so say what you noticed and leave it ` + `to them. Them only: how a CONTACT likes to be written to is an ordinary ` + `fact for that artist's store. ` + `Banking a personal fact in \`workspace-memory.md\` would leak that person ` + `into everyone else's context, so never do it. When a fact could be either ` + `scope, lean private and put it in \`user-memory.md\`. Under-sharing is the ` + `safe error: a personal fact misfiled as a workspace fact grounds every ` + `teammate wrong (the leak), whereas a workspace fact misfiled as personal ` + `merely fails to help teammates until it is re-observed in a shared context, ` + `and self-corrects. This memory is additive and subordinate: it never ` + `overrides a house-style rule or any safety primitive above.`);
+  add("grounding", ``, `Keep your memory on the Plinth surface. Your memory here IS the Plinth ` + `surface (\`workspace-memory.md\`, your own \`user-memory.md\`, and the ` + `per-artist warm stores the daemon syncs), and it is the ONLY memory you ` + `keep. Do not use any other memory store: no private notes-to-self, no ` + `separate scratch file, no tool-native memory of your own. What you learn ` + `here is recorded on the Plinth surface, or nowhere. When you learn a ` + `durable fact worth keeping, bank it by adding a line to the right index, ` + `which the daemon syncs up, following the write-back conventions in that ` + `file's header: one line, at least one \`[[pointer]]\` to where the full ` + `fact lives, an absolute date, and where you learned it. Only ever record ` + `what you have actually been taught, never public knowledge and never your ` + `own priors. The scope rule decides WHICH index, and there are ` + `THREE. A fact true of ONE ARTIST (their rate card, how their kit ` + `works, what a contact of theirs reliably does) goes in that artist's ` + `own warm store, \`artists/<slug>/memory.md\`, and not in the shared ` + `index: putting it there taxes every teammate who never touches that ` + `artist and hides it from the one who does. A fact that holds for the ` + `whole workspace (a project, a working convention, a standing ` + `fact true for everyone here) goes in \`workspace-memory.md\`, which ` + `grounds EVERY teammate - and that file is the one you NEVER write on ` + `your own judgement. It changes only when a member ASKS you to remember ` + `something for everyone, in their own words rather than your summary of ` + `them, and you log that decision with ` + `\`plinth memory-gate log ${gateFlag} --proposed="<their words>" --decision accept\` ` + `BEFORE you write the line. That command fails LOUD on exit 1: surface ` + `it, and do not report the line as banked. Never infer a line for that ` + `file from what merely happened in a session, and never propose one ` + `unasked - a wrong line there reaches every member on every machine and ` + `is injected into every future session. A fact about one person (an individual ` + `preference, your own working style or tools) is NOT a workspace fact: it ` + `goes in \`user-memory.md\`, your member-private index that only YOU can ` + `read. HOW THIS MEMBER WRITES IS THE ONE EXCEPTION: their register and ` + `sign-off are a rubric, not a fact, and live in \`${VOICE_FILENAME}\`, ` + `which is theirs and you cannot edit, so say what you noticed and leave it ` + `to them. Them only: how a CONTACT likes to be written to is an ordinary ` + `fact for that artist's store. ` + `Banking a personal fact in \`workspace-memory.md\` would leak that person ` + `into everyone else's context, so never do it. When a fact could be either ` + `scope, lean private and put it in \`user-memory.md\`. ` + `Live state does not belong in any memory file. This week's open ` + `threads, one show's logistics, where a release has got to: a memory ` + `file is for what stays true after the session that taught it, and live ` + `state goes in the body of the record it belongs to. A deadline rides ` + `its task as a due date, and every other date is a calendar matter. ` + `This memory is additive and subordinate: it never ` + `overrides a house-style rule or any safety primitive above.`);
   if (workspaceMemory !== null) {
-    block.push(``, `Draw on this workspace's memory. The lines below are this workspace's ` + `memory index: durable facts it has taught you, each a one-line hook that ` + `points (via a \`[[wikilink]]\`) to the warm store where the full detail ` + `lives. Treat them as recall, not gospel: use a line to load the right ` + `context and verify it against the live workspace before you rely on it, ` + `never as a settled fact to assert. ` + `${renderFreshnessStamp(today, freshness.workspaceMemoryUpdatedAt)} ` + `The index:
-
-` + workspaceMemory + (workspaceMemoryNote === null ? `` : `
-
-${workspaceMemoryNote}`));
+    add("grounding", ``, `Draw on this workspace's memory. The lines below are this workspace's ` + `memory index: durable facts it has taught you, each a one-line hook that ` + `points (via a \`[[wikilink]]\`) to the warm store where the full detail ` + `lives. Treat them as recall, not gospel: use a line to load the right ` + `context and verify it against the live workspace before you rely on it, ` + `never as a settled fact to assert. ` + `${renderFreshnessStamp(today, freshness.workspaceMemoryUpdatedAt)} ` + `The index:`);
+    add("workspaceFacts", ``, workspaceMemory);
+    if (workspaceTitles !== null) {
+      add("budgetNote", ``, workspaceTitles.leadIn);
+      add("workspaceFacts", ``, workspaceTitles.text);
+    }
+    if (workspaceMemoryNote !== null)
+      add("budgetNote", ``, workspaceMemoryNote);
   }
   if (userMemory !== null) {
-    block.push(``, `Draw on your personal memory. The lines below are YOUR personal memory ` + `index: member-private facts you have taught the harness about yourself ` + `(your preferences, working style, tools), each a one-line hook ` + `that points (via a \`[[wikilink]]\`) to the warm store where the full ` + `detail lives. Only you can read this. Treat it as recall, not gospel: use ` + `a line to load the right context and verify it before you rely on it, ` + `never as a settled fact to assert. ` + `${renderFreshnessStamp(today, freshness.userMemoryUpdatedAt)} ` + `The index:
-
-` + userMemory + (userMemoryNote === null ? `` : `
-
-${userMemoryNote}`));
+    add("grounding", ``, `Draw on your personal memory. The lines below are YOUR personal memory ` + `index: member-private facts you have taught the harness about yourself ` + `(your preferences, working style, tools), each a one-line hook ` + `that points (via a \`[[wikilink]]\`) to the warm store where the full ` + `detail lives. Only you can read this. Treat it as recall, not gospel: use ` + `a line to load the right context and verify it before you rely on it, ` + `never as a settled fact to assert. ` + `${renderFreshnessStamp(today, freshness.userMemoryUpdatedAt)} ` + `The index:`);
+    add("personalFacts", ``, userMemory);
+    if (userTitles !== null) {
+      add("budgetNote", ``, userTitles.leadIn);
+      add("personalFacts", ``, userTitles.text);
+    }
+    if (userMemoryNote !== null)
+      add("budgetNote", ``, userMemoryNote);
   }
   if (workspaceMemory !== null || userMemory !== null) {
-    block.push(``, `Dated recall. Every line in these indexes carries the date it was banked, ` + `and today's date is injected above, so the age of any line is ` + `computable. When you rely on a line in an answer, say how old it is - ` + `"banked 21 July, seventeen days ago" - rather than presenting it as ` + `current. Age is not a reason to distrust a line, it is what tells the ` + `reader whether to check: a working convention banked a year ago is ` + `probably still the convention, a fact about a live negotiation banked ` + `three weeks ago probably is not. And say what the indexes do NOT cover. ` + `If you are asked about something no line here addresses, say so plainly ` + `rather than answering only from what happens to be present - an index ` + `that is silent on a subject reads exactly like one that has settled it.`);
+    add("grounding", ``, `Dated recall. Every line in these indexes carries the date it was banked, ` + `and today's date is injected above, so the age of any line is ` + `computable. When you rely on a line in an answer, say how old it is - ` + `"banked 21 July, seventeen days ago" - rather than presenting it as ` + `current. Age is not a reason to distrust a line, it is what tells the ` + `reader whether to check: a working convention banked a year ago is ` + `probably still the convention, a fact about a live negotiation banked ` + `three weeks ago probably is not. And say what the indexes do NOT cover. ` + `If you are asked about something no line here addresses, say so plainly ` + `rather than answering only from what happens to be present - an index ` + `that is silent on a subject reads exactly like one that has settled it.`);
   }
-  block.push(``, `Declare a work product before you finish with it. Your scratchpad ` + `directory sits outside Plinth: temporary, scoped to this session, and ` + `invisible to the person who asked for the work. Prefer not to leave a ` + `deliverable there at all. If it belongs to this workspace, write it to ` + `a mirror file instead, where it syncs and is durable. When the ` + `scratchpad genuinely is a file's only home, meaning a document, ` + `profile, report or analysis that was the POINT of the work rather than ` + `a step toward it, declare it the moment you write it, with ` + `\`plinth declare <path> --scratchpad <the scratchpad directory your ` + `harness told you to use> --label='<short description>'\`. Declare only ` + `those. A file that already has another home is not a deliverable: not ` + `raw API dumps, thread JSON, helper scripts, or the body files you write ` + `for a tool that reads a path, where the durable deliverable is the ` + `draft the tool creates. Declaring everything you wrote buries the one ` + `that mattered, which is the failure this exists to prevent. ` + `Re-declaring a path replaces the earlier entry, so refine a label ` + `freely. This is about work products, not memory: durable facts still go ` + `to the index above. Like every rule here it is additive and ` + `subordinate, and never relaxes a safety primitive above.`);
-  if (rosterIsEmpty) {
-    block.push(``, `This workspace has no artists in it yet. OFFER to set it up before you ` + `get into anything else, because an empty roster reported as a summary ` + `reads as a broken product rather than a new one. Say in one or two ` + `lines that ` + `${ONBOARD_COMMAND_INVOCATION} walks them through connecting their ` + `inbox, calendar and files, gets their roster in, and turns the work ` + `they already have running into projects and tasks, then ask whether ` + `to start now. Then STOP AND WAIT for their answer. Do not begin the ` + `interview, do not connect anything, and do not create an artist, a ` + `project or a task until they have said yes. If they say no, or they ` + `asked for something else in the same message, drop it and do the ` + `thing they asked for. Offer once, and never twice in one session. ` + `And a workspace can have no artists on purpose: if they have turned ` + `this down before, or this is not an artist workspace, leave it alone ` + `rather than raising it every time you open one.`);
+  add("grounding", ``, `Declare a work product before you finish with it. Your scratchpad ` + `directory sits outside Plinth: temporary, scoped to this session, and ` + `invisible to the person who asked for the work. Prefer not to leave a ` + `deliverable there at all. If it belongs to this workspace, write it to ` + `a mirror file instead, where it syncs and is durable. When the ` + `scratchpad genuinely is a file's only home, meaning a document, ` + `profile, report or analysis that was the POINT of the work rather than ` + `a step toward it, declare it the moment you write it, with ` + `\`plinth declare "<path>" --scratchpad="<the scratchpad directory ` + `your harness told you to use>" --label='<short description>'\`. ` + `Declare only ` + `those. A file that already has another home is not a deliverable: not ` + `raw API dumps, thread JSON, helper scripts, or the body files you write ` + `for a tool that reads a path, where the durable deliverable is the ` + `draft the tool creates. Declaring everything you wrote buries the one ` + `that mattered, which is the failure this exists to prevent. ` + `Re-declaring a path replaces the earlier entry, so refine a label ` + `freely. This is about work products, not memory: durable facts still go ` + `to the index above. Like every rule here it is additive and ` + `subordinate, and never relaxes a safety primitive above.`);
+  if (shouldOfferOnboarding(rosterIsEmpty, member)) {
+    add("grounding", ``, `This workspace has no artists in it yet. OFFER to set it up before you ` + `get into anything else, because an empty roster reported as a summary ` + `reads as a broken product rather than a new one. Say in one or two ` + `lines that ` + `${ONBOARD_COMMAND_INVOCATION} walks them through connecting their ` + `inbox, calendar and files, gets their roster in, and turns the work ` + `they already have running into projects and tasks, then ask whether ` + `to start now. Then STOP AND WAIT for their answer. Do not begin the ` + `interview, do not connect anything, and do not create an artist, a ` + `project or a task until they have said yes. If they say no, or they ` + `asked for something else in the same message, drop it and do the ` + `thing they asked for. Offer once, and never twice in one session. ` + `And a workspace can have no artists on purpose: if they have turned ` + `this down before, or this is not an artist workspace, leave it alone ` + `rather than raising it every time you open one.`);
   }
-  return block.join(`
-`);
+  return { text: block.join(`
+`), split: segmentBytes(block, cats) };
 }
-function buildGroundingReport(today, workspaceRules = null, workspaceMemory = null, userMemory = null, freshness = {}, rosterIsEmpty = false, voiceProfile = null, voiceMalformed = false, workspaceSlug = null) {
-  const compose = (wmBody, umBody, wmNote, umNote) => composeGroundingBlock(today, workspaceRules, wmBody, umBody, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, wmNote, umNote);
+function buildGroundingReport(today, workspaceRules = null, workspaceMemory = null, userMemory = null, freshness = {}, rosterIsEmpty = false, voiceProfile = null, voiceMalformed = false, workspaceSlug = null, member = null) {
+  const compose = (wmBody, umBody, wmNote, umNote, wmTitles = null, umTitles = null) => composeGroundingBlock(today, workspaceRules, wmBody, umBody, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, wmNote, umNote, member, wmTitles, umTitles);
   const whole = compose(workspaceMemory, userMemory, null, null);
-  const untrimmed = () => ({
-    block: whole,
-    picks: {
-      wmPick: workspaceMemory === null ? null : { text: workspaceMemory, kept: groupFacts(workspaceMemory).length, total: groupFacts(workspaceMemory).length },
-      umPick: userMemory === null ? null : { text: userMemory, kept: groupFacts(userMemory).length, total: groupFacts(userMemory).length }
-    }
-  });
-  if (Buffer.byteLength(whole) <= GROUNDING_BUDGET_BYTES)
+  const untrimmed = () => {
+    const all = (body) => {
+      const n = groupFacts(body).length;
+      return { text: body, titles: "", kept: n, named: 0, total: n };
+    };
+    return {
+      block: whole.text,
+      split: whole.split,
+      picks: {
+        wmPick: workspaceMemory === null ? null : all(workspaceMemory),
+        umPick: userMemory === null ? null : all(userMemory)
+      }
+    };
+  };
+  if (Buffer.byteLength(whole.text) <= GROUNDING_BUDGET_BYTES)
     return untrimmed();
   if (workspaceMemory === null && userMemory === null)
     return untrimmed();
   const factCount = (body) => body === null ? 0 : groupFacts(body).length;
   const wmFacts = factCount(workspaceMemory);
   const umFacts = factCount(userMemory);
-  const measureFixed = (wmNoted, umNoted) => Buffer.byteLength(compose(workspaceMemory === null ? null : "", userMemory === null ? null : "", wmNoted ? trimmedIndexNote(wmFacts, wmFacts, WORKSPACE_MEMORY_FILENAME) : null, umNoted ? trimmedIndexNote(umFacts, umFacts, USER_MEMORY_FILENAME) : null));
+  const titlesFor = (pick2, filename) => pick2 === null || pick2.named === 0 ? null : {
+    leadIn: titlesLeadIn(pick2.kept, pick2.named, pick2.total - pick2.kept - pick2.named, pick2.total, filename),
+    text: pick2.titles
+  };
+  const noteFor = (pick2, filename) => pick2 === null || pick2.kept === pick2.total ? null : trimmedIndexNote(pick2.kept, pick2.total, filename);
+  const measureFixed = (withNotes2, withTitles) => Buffer.byteLength(compose(workspaceMemory === null ? null : "", userMemory === null ? null : "", withNotes2 && workspaceMemory !== null ? trimmedIndexNote(wmFacts, wmFacts, WORKSPACE_MEMORY_FILENAME) : null, withNotes2 && userMemory !== null ? trimmedIndexNote(umFacts, umFacts, USER_MEMORY_FILENAME) : null, withTitles && workspaceMemory !== null ? { leadIn: titlesLeadIn(wmFacts, wmFacts, wmFacts, wmFacts, WORKSPACE_MEMORY_FILENAME), text: "" } : null, withTitles && userMemory !== null ? { leadIn: titlesLeadIn(umFacts, umFacts, umFacts, umFacts, USER_MEMORY_FILENAME), text: "" } : null).text);
   const wmSize = workspaceMemory === null ? 0 : Buffer.byteLength(workspaceMemory);
   const umSize = userMemory === null ? 0 : Buffer.byteLength(userMemory);
   const allocate = (remaining) => {
@@ -26040,23 +26262,45 @@ function buildGroundingReport(today, workspaceRules = null, workspaceMemory = nu
       umCap = half;
       wmCap = remaining - half;
     }
-    const umPick = userMemory === null ? null : selectRecentLines(userMemory, umCap);
-    const umUsed = umPick === null ? 0 : Buffer.byteLength(umPick.text);
+    const umPick = userMemory === null ? null : selectIndexContent(userMemory, umCap);
+    const umUsed = umPick === null ? 0 : Buffer.byteLength(umPick.text) + Buffer.byteLength(umPick.titles);
     return {
-      wmPick: workspaceMemory === null ? null : selectRecentLines(workspaceMemory, remaining - umUsed),
+      wmPick: workspaceMemory === null ? null : selectIndexContent(workspaceMemory, Math.max(wmCap, remaining - umUsed)),
       umPick
     };
   };
-  const trimmed = (pick2) => pick2 !== null && pick2.kept !== pick2.total;
-  const noteFor = (pick2, filename) => pick2 === null || pick2.kept === pick2.total ? null : trimmedIndexNote(pick2.kept, pick2.total, filename);
-  const build = (picks) => compose(picks.wmPick === null ? null : picks.wmPick.text, picks.umPick === null ? null : picks.umPick.text, noteFor(picks.wmPick, WORKSPACE_MEMORY_FILENAME), noteFor(picks.umPick, USER_MEMORY_FILENAME));
-  const conservative = allocate(Math.max(0, GROUNDING_BUDGET_BYTES - measureFixed(true, true)));
-  const refined = allocate(Math.max(0, GROUNDING_BUDGET_BYTES - Buffer.byteLength(compose(workspaceMemory === null ? null : "", userMemory === null ? null : "", noteFor(conservative.wmPick, WORKSPACE_MEMORY_FILENAME), noteFor(conservative.umPick, USER_MEMORY_FILENAME)))));
-  const kept = (p) => (p.wmPick?.kept ?? 0) + (p.umPick?.kept ?? 0);
-  const candidates = [refined, conservative].map((picks) => ({ picks, text: build(picks) })).map((c) => ({ ...c, bytes: Buffer.byteLength(c.text), facts: kept(c.picks) }));
+  const build = (picks, withNotes2) => {
+    const keep = (pick2) => withNotes2 || pick2 !== null && pick2.named === 0;
+    return compose(picks.wmPick === null ? null : picks.wmPick.text, picks.umPick === null ? null : picks.umPick.text, keep(picks.wmPick) ? noteFor(picks.wmPick, WORKSPACE_MEMORY_FILENAME) : null, keep(picks.umPick) ? noteFor(picks.umPick, USER_MEMORY_FILENAME) : null, titlesFor(picks.wmPick, WORKSPACE_MEMORY_FILENAME), titlesFor(picks.umPick, USER_MEMORY_FILENAME));
+  };
+  const refine2 = (seed, withNotes2) => {
+    const asReserve = (section) => section === null ? null : { leadIn: section.leadIn, text: "" };
+    const keep = (pick2) => withNotes2 || pick2 !== null && pick2.named === 0;
+    const fixed = Buffer.byteLength(compose(workspaceMemory === null ? null : "", userMemory === null ? null : "", keep(seed.wmPick) ? noteFor(seed.wmPick, WORKSPACE_MEMORY_FILENAME) : null, keep(seed.umPick) ? noteFor(seed.umPick, USER_MEMORY_FILENAME) : null, asReserve(titlesFor(seed.wmPick, WORKSPACE_MEMORY_FILENAME)), asReserve(titlesFor(seed.umPick, USER_MEMORY_FILENAME))).text);
+    return allocate(Math.max(0, GROUNDING_BUDGET_BYTES - fixed));
+  };
+  const noNotes = allocate(Math.max(0, GROUNDING_BUDGET_BYTES - measureFixed(false, true)));
+  const withNotes = allocate(Math.max(0, GROUNDING_BUDGET_BYTES - measureFixed(true, true)));
+  const candidates = [
+    { picks: withNotes, composed: build(withNotes, true) },
+    { picks: noNotes, composed: build(noNotes, false) },
+    { picks: withNotes, composed: build(withNotes, false) }
+  ].concat([
+    { seed: noNotes, notes: false },
+    { seed: withNotes, notes: true }
+  ].map(({ seed, notes }) => {
+    const picks = refine2(seed, notes);
+    return { picks, composed: build(picks, notes) };
+  })).map((c) => ({
+    ...c,
+    bytes: Buffer.byteLength(c.composed.text),
+    named: (c.picks.wmPick?.kept ?? 0) + (c.picks.wmPick?.named ?? 0) + (c.picks.umPick?.kept ?? 0) + (c.picks.umPick?.named ?? 0),
+    whole: (c.picks.wmPick?.kept ?? 0) + (c.picks.umPick?.kept ?? 0)
+  }));
   const fitting = candidates.filter((c) => c.bytes <= GROUNDING_BUDGET_BYTES);
-  const best = fitting.length > 0 ? fitting.reduce((a, b) => b.facts > a.facts ? b : a) : candidates.reduce((a, b) => b.bytes < a.bytes ? b : a);
-  return { block: best.text, picks: best.picks };
+  const better = (a, b) => b.named !== a.named ? b.named > a.named : b.whole > a.whole;
+  const best = fitting.length > 0 ? fitting.reduce((a, b) => better(a, b) ? b : a) : candidates.reduce((a, b) => b.bytes < a.bytes ? b : a);
+  return { block: best.composed.text, picks: best.picks, split: best.composed.split };
 }
 var buildGroundingReportFor = buildGroundingReport;
 function formatLocalDate(d) {
@@ -26227,7 +26471,8 @@ var WorkspaceStateV2Schema = exports_external.object({
   workspace_memory: WorkspaceMemoryStateSchema.optional(),
   user_memory: UserMemoryStateSchema.optional(),
   user_voice: UserVoiceStateSchema.optional(),
-  derived_text_version: exports_external.number().int().nonnegative().optional()
+  derived_text_version: exports_external.number().int().nonnegative().optional(),
+  frontmatter_id_backfill_version: exports_external.number().int().nonnegative().optional()
 });
 var WorkspaceStateV1Schema = exports_external.object({
   version: exports_external.literal(1),
@@ -26408,7 +26653,8 @@ function commitState(before, after) {
     workspace_memory: memory.value,
     user_memory: userMemory.value,
     user_voice: userVoice.value,
-    derived_text_version: mergeScalar(fresh.derived_text_version, before.derived_text_version, after.derived_text_version)
+    derived_text_version: mergeScalar(fresh.derived_text_version, before.derived_text_version, after.derived_text_version),
+    frontmatter_id_backfill_version: mergeScalar(fresh.frontmatter_id_backfill_version, before.frontmatter_id_backfill_version, after.frontmatter_id_backfill_version)
   };
   writeState(merged);
   const singletonOverruled = rules.overruled || memory.overruled || userMemory.overruled || userVoice.overruled;
@@ -26531,6 +26777,14 @@ function allFileEntries(state) {
 function fileEntriesEqual(a, b) {
   return a.id === b.id && a.path === b.path && a.content_hash === b.content_hash && a.size_bytes === b.size_bytes && a.mime_type === b.mime_type && a.updated_at === b.updated_at && a.inode === b.inode;
 }
+function clearFrontmatterIdBackfillMarker(state) {
+  if (state.frontmatter_id_backfill_version === undefined) {
+    return { state, changed: false };
+  }
+  const next = { ...state };
+  delete next.frontmatter_id_backfill_version;
+  return { state: next, changed: true };
+}
 function listUnsynced(state) {
   return state.unsynced ?? [];
 }
@@ -26674,6 +26928,25 @@ function readUserMemoryFile(slug) {
 function readVoiceProfileFile(slug) {
   return readContextFile(slug, VOICE_FILENAME);
 }
+function readMemberFromConfig(slug) {
+  const entry = loadConfig()?.workspaces[slug];
+  const member = entry?.member;
+  if (!member)
+    return null;
+  return {
+    email: member.email,
+    displayName: member.display_name ?? null,
+    role: member.role ?? null,
+    onboardingCompletedAt: member.onboarding_completed_at ?? null
+  };
+}
+function readMachineTimezone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || null;
+  } catch {
+    return null;
+  }
+}
 function resolveUpdatedAt(raw, record2) {
   if (record2 === null || record2.updated_at === null || raw === null)
     return null;
@@ -26697,6 +26970,8 @@ function runGroundingReport(deps = {}) {
   const readVoiceProfile = deps.readVoiceProfile ?? readVoiceProfileFile;
   const readFreshness = deps.readFreshness ?? readMemoryFreshness;
   const readRosterIsEmpty = deps.readRosterIsEmpty ?? rosterIsEmpty;
+  const readMember = deps.readMember ?? readMemberFromConfig;
+  const readTimezone = deps.readTimezone ?? readMachineTimezone;
   let rawRules = null;
   let rawMemory = null;
   let rawUserMemory = null;
@@ -26707,6 +26982,7 @@ function runGroundingReport(deps = {}) {
     userVoice: null
   };
   let noArtists = false;
+  let member = null;
   const workspaceSlug = isValidWorkspaceSlug(deps.workspaceSlug ?? "") ? deps.workspaceSlug : null;
   if (workspaceSlug) {
     try {
@@ -26739,6 +27015,12 @@ function runGroundingReport(deps = {}) {
     } catch {
       noArtists = false;
     }
+    try {
+      const stored = readMember(workspaceSlug);
+      member = stored === null ? null : { ...stored, timezone: readTimezone() };
+    } catch {
+      member = null;
+    }
   }
   const rules = extractWorkspaceRules(rawRules);
   const memory = extractWorkspaceMemory(rawMemory);
@@ -26747,7 +27029,7 @@ function runGroundingReport(deps = {}) {
   return buildGroundingReportFor(formatLocalDate(now()), rules, memory, userMemory, {
     workspaceMemoryUpdatedAt: resolveUpdatedAt(rawMemory, freshness.workspaceMemory),
     userMemoryUpdatedAt: resolveUpdatedAt(rawUserMemory, freshness.userMemory)
-  }, noArtists, voiceProfile, resolveVoiceMalformed(rawVoiceProfile, freshness.userVoice), workspaceSlug);
+  }, noArtists, voiceProfile, resolveVoiceMalformed(rawVoiceProfile, freshness.userVoice), workspaceSlug, member);
 }
 var groundingCommand = defineCommand({
   meta: {
@@ -26822,6 +27104,21 @@ async function whoami(baseUrl, pat, fetchImpl = fetch) {
   }
   return parsed.data;
 }
+function memberPrincipalFrom(principal, now = () => new Date) {
+  const member = {
+    email: principal.profile.email,
+    fetched_at: now().toISOString()
+  };
+  if (principal.profile.display_name) {
+    member.display_name = principal.profile.display_name;
+  }
+  if (principal.role)
+    member.role = principal.role;
+  if (principal.profile.onboarding_completed_at) {
+    member.onboarding_completed_at = principal.profile.onboarding_completed_at;
+  }
+  return member;
+}
 async function syncEntity(args) {
   const { strategy, baseUrl, pat, cursor, limit, fetchImpl = fetch } = args;
   const params = new URLSearchParams;
@@ -27245,7 +27542,8 @@ async function runLogin(workspaceSlug, apiBaseUrl, deps = {}, options2 = {}) {
     user_id: principal.user_id,
     api_base_url: base2,
     last_synced_at: null,
-    workspace_name: principal.workspace_name
+    workspace_name: principal.workspace_name,
+    member: memberPrincipalFrom(principal)
   };
   let prior;
   try {
@@ -27853,7 +28151,7 @@ var memoryGateCommand = defineCommand({
 });
 
 // src/lib/context/artist-context.ts
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync12, unlinkSync as unlinkSync7 } from "node:fs";
 
 // src/lib/context/entity-catalog.ts
 var ENTITY_CATALOG = [
@@ -28010,8 +28308,8 @@ function buildBody(input) {
   lines.push(`- Master context (stable profile + current state) → \`./_artist.md\`; edit its body and the daemon syncs both ways. Blocks labelled "rendered from Plinth" are the exception: they are overwritten on the next sync`);
   lines.push(`- Closed/archived, meetings & full lists: \`mcp__plinth__list_projects\` / \`mcp__plinth__list_tasks\`${artistIdHint(uuid3)}`);
   lines.push(`- Schema: ${MCP_INTROSPECTION_POINTER}`);
-  lines.push(`- Long-term facts → \`./memory.md\`, which syncs to this artist's Plinth record. Most artists have none yet: the file appears once the record carries memory, and creating it here is how you start one. One line per fact with its source and an absolute date; when a fact goes wrong, edit that line rather than adding a second`);
-  lines.push(`- What a session did → a dated section under \`## Session log\` at the bottom of \`./_artist.md\` but ABOVE any \`<!-- BEGIN: contacts -->\` block, which is rendered from Plinth and overwrites anything inside it on the next sync. That body syncs, so a teammate opens the record in the app. Keep the five most recent; a fact that outlives them belongs in \`./memory.md\` above. \`./daily-log.md\` is local scratch, never synced; an older one may hold real history, and nothing writes there now`);
+  lines.push(`- Long-term facts → \`./memory.md\`, which syncs to this artist's Plinth record. Most artists have none yet: the file appears once the record carries memory, and creating it here is how you start one. The session grounding states how to write a fact; follow it rather than a copy`);
+  lines.push(`- What a session did → a dated section under \`## Session log\` at the bottom of \`./_artist.md\` but ABOVE any \`<!-- BEGIN: contacts -->\` block, which is rendered from Plinth and overwrites anything inside it on the next sync. That body syncs, so a teammate opens the record in the app. Keep the five most recent; a fact that outlives them belongs in \`./memory.md\` above`);
   lines.push("");
   lines.push(USER_BLOCK_BEGIN);
   lines.push(USER_BLOCK_PLACEHOLDER);
@@ -28258,7 +28556,16 @@ var MANAGED_COMMENT = [
   "or in .claude/settings.local.json.",
   "The permissions.deny entries below are managed the same way. They stop an agent",
   "in this workspace sending, replying to or forwarding mail and writing a calendar;",
-  "drafting and reading stay allowed. One more stops an agent EDITING voice.md, the",
+  "drafting and reading stay allowed. They match by VERB FAMILY rather than by",
+  "tool name - send_mail, sendEmail, send-mail and outlook_send_message are one",
+  "rule set, not four - and the matcher cannot express an alternation, so each",
+  "spelling needs its own line. That width also catches a few reads whose name",
+  "merely begins with a send verb - getForwardingSettings is the live example.",
+  "You cannot re-open one of these here: a deny beats an allow, including yours,",
+  "and this list is rewritten every sync. Tell us and we will narrow the pattern.",
+  "We took that trade knowingly - a refusal is visible and recoverable, and a",
+  "message that has gone cannot be recalled.",
+  "One more entry stops an agent EDITING voice.md, the",
   "voice profile it is judged against: that file is yours to write and theirs to read.",
   "Your own allow list is untouched, and your own",
   "deny rules are kept and listed first. One exception, stated because it is",
@@ -28269,7 +28576,11 @@ var MANAGED_COMMENT = [
   "since retired is removed here even if you wrote it yourself, because we cannot",
   "tell the two apart. Today that is `Edit(./voice.md)`, which Claude Code itself",
   "suggests - it is superseded by `Edit(//**/voice.md)` below, which is the same",
-  "protection at every depth. Put anything you want kept in settings.local.json."
+  "protection at every depth - plus the seven exact-verb rules the verb families",
+  "replaced (`mcp__*__reply`, `mcp__*__create_event` and five more of that shape).",
+  "Every one of those is still covered by a wider rule below, so nothing you were",
+  "protected from yesterday is allowed today. Put anything you want kept in",
+  "settings.local.json."
 ];
 var MANAGED_DENY = [
   "mcp__claude_ai_Gmail__send_message",
@@ -28279,17 +28590,70 @@ var MANAGED_DENY = [
   "mcp__claude_ai_Google_Calendar__update_event",
   "mcp__claude_ai_Google_Calendar__delete_event",
   "mcp__claude_ai_Google_Calendar__respond_to_event",
+  "mcp__*__send*",
+  "mcp__*__*_send*",
+  "mcp__*__*-send*",
+  "mcp__*__*Send*",
+  "mcp__*__reply*",
+  "mcp__*__*_reply*",
+  "mcp__*__*-reply*",
+  "mcp__*__*Reply*",
+  "mcp__*__forward*",
+  "mcp__*__*_forward*",
+  "mcp__*__*-forward*",
+  "mcp__*__*Forward*",
+  "mcp__*__respond*",
+  "mcp__*__*_respond*",
+  "mcp__*__*-respond*",
+  "mcp__*__*Respond*",
+  "mcp__*__rsvp*",
+  "mcp__*__*_rsvp*",
+  "mcp__*__*-rsvp*",
+  "mcp__*__*Rsvp*",
+  "mcp__*__*RSVP*",
+  "mcp__*__create*event*",
+  "mcp__*__*_create*event*",
+  "mcp__*__*-create*event*",
+  "mcp__*__*Create*event*",
+  "mcp__*__create*Event*",
+  "mcp__*__*_create*Event*",
+  "mcp__*__*-create*Event*",
+  "mcp__*__*Create*Event*",
+  "mcp__*__update*event*",
+  "mcp__*__*_update*event*",
+  "mcp__*__*-update*event*",
+  "mcp__*__*Update*event*",
+  "mcp__*__update*Event*",
+  "mcp__*__*_update*Event*",
+  "mcp__*__*-update*Event*",
+  "mcp__*__*Update*Event*",
+  "mcp__*__delete*event*",
+  "mcp__*__*_delete*event*",
+  "mcp__*__*-delete*event*",
+  "mcp__*__*Delete*event*",
+  "mcp__*__delete*Event*",
+  "mcp__*__*_delete*Event*",
+  "mcp__*__*-delete*Event*",
+  "mcp__*__*Delete*Event*",
+  "mcp__*__cancel*event*",
+  "mcp__*__*_cancel*event*",
+  "mcp__*__*-cancel*event*",
+  "mcp__*__*Cancel*event*",
+  "mcp__*__cancel*Event*",
+  "mcp__*__*_cancel*Event*",
+  "mcp__*__*-cancel*Event*",
+  "mcp__*__*Cancel*Event*",
+  "Edit(//**/voice.md)"
+];
+var RETIRED_DENY = [
+  "Edit(./voice.md)",
   "mcp__*__send_message",
   "mcp__*__reply",
   "mcp__*__forward",
   "mcp__*__create_event",
   "mcp__*__update_event",
   "mcp__*__delete_event",
-  "mcp__*__respond_to_event",
-  "Edit(//**/voice.md)"
-];
-var RETIRED_DENY = [
-  "Edit(./voice.md)"
+  "mcp__*__respond_to_event"
 ];
 var BIN_SENTINEL = "__PLINTH_BIN__";
 var ALL_SENTINEL = "__PLINTH_ALL__";
@@ -28553,6 +28917,7 @@ function ensurePerArtistContext(deps) {
   const resolved = resolvePlinthBinary();
   reportResolution(out, resolved);
   let created = 0;
+  let removedDailyLogs = 0;
   for (const artist of roster) {
     try {
       const entities = entityIndex.get(artist.slug) ?? {
@@ -28571,7 +28936,8 @@ function ensurePerArtistContext(deps) {
       if (regenerateClaudeMd(workspaceSlug, artist.slug, generated, force, out, now)) {
         created++;
       }
-      ensureStub(workspaceSlug, `artists/${artist.slug}/${ARTIST_DAILY_LOG_MD}`, dailyLogStub(artist.name));
+      if (retireDailyLog(workspaceSlug, artist.slug))
+        removedDailyLogs++;
       if (ensureSessionHook(workspaceSlug, `artists/${artist.slug}/`, out, resolved) === "skipped") {
         deps.onHookSkipped?.();
       }
@@ -28583,6 +28949,9 @@ function ensurePerArtistContext(deps) {
   if (created > 0) {
     out.info(`Scaffolded per-artist context for ${created} artist${created === 1 ? "" : "s"}.`);
   }
+  if (removedDailyLogs > 0) {
+    out.info(`Removed ${removedDailyLogs} unused daily-log.md file${removedDailyLogs === 1 ? "" : "s"} (never written to; any with your own notes in them were left alone).`);
+  }
 }
 function regenerateClaudeMd(workspaceSlug, artistSlug, generated, force, out, now) {
   const claudeRel = `artists/${artistSlug}/${ARTIST_CLAUDE_MD}`;
@@ -28604,17 +28973,55 @@ function regenerateClaudeMd(workspaceSlug, artistSlug, generated, force, out, no
   }
   return decision.action === "create";
 }
-function ensureStub(workspaceSlug, relativePath, content) {
-  if (existsSync(contextFilePath(workspaceSlug, relativePath)))
-    return;
-  writeContextFile(workspaceSlug, relativePath, content);
-}
-function dailyLogStub(name) {
-  return `# ${name} - Daily log
+var DAILY_LOG_STUB_TEMPLATES = [
+  (name) => `# ${name} - Daily log
 
 ` + `<!-- Your own scratch notes; edit freely, Plinth never overwrites this file. -->
 ` + `<!-- Nothing writes here now: a session's record goes under ## Session log in ./_artist.md, and durable facts in ./memory.md. Both sync; this file does not. -->
-`;
+`,
+  (name) => `# ${name} - Daily log
+
+` + `<!-- Rolling activity, newest first; edit freely, Plinth never overwrites this file. -->
+` + `<!-- Durable facts do not belong here - they go in ./memory.md, which syncs to this artist's Plinth record. -->
+`,
+  (name) => `# ${name} - Daily log
+
+` + `<!-- Rolling activity, newest first; edit freely, Plinth never overwrites this file. -->
+`,
+  (name) => `# ${name} — Daily log
+
+` + `<!-- Rolling activity, newest first; edit freely, Plinth never overwrites this file. -->
+`
+];
+var DAILY_LOG_H1_RE = /^# (.+) [-—] Daily log\n/;
+function isPristineDailyLogStub(content) {
+  const m = content.match(DAILY_LOG_H1_RE);
+  if (m === null)
+    return false;
+  const name = m[1];
+  return DAILY_LOG_STUB_TEMPLATES.some((t) => t(name) === content);
+}
+function retireDailyLog(workspaceSlug, artistSlug) {
+  let target;
+  try {
+    target = contextFilePath(workspaceSlug, `artists/${artistSlug}/${ARTIST_DAILY_LOG_MD}`);
+  } catch {
+    return false;
+  }
+  let content;
+  try {
+    content = readFileSync12(target, "utf8");
+  } catch {
+    return false;
+  }
+  if (!isPristineDailyLogStub(content))
+    return false;
+  try {
+    unlinkSync7(target);
+    return true;
+  } catch {
+    return false;
+  }
 }
 function backupStamp(d) {
   return d.toISOString().replace(/[-:.]/g, "").replace("Z", "");
@@ -28623,6 +29030,28 @@ function backupStamp(d) {
 // src/lib/context/generate.ts
 import { existsSync as existsSync2 } from "node:fs";
 
+// src/lib/cli/command-names.ts
+var PLINTH_COMMAND_NAMES = [
+  "login",
+  "sync",
+  "start",
+  "status",
+  "confirm",
+  "version",
+  "refresh-context",
+  "grounding",
+  "voice-gate",
+  "backlinks",
+  "declare",
+  "review-tier",
+  "session",
+  "memory-gate"
+];
+function isPlinthCommand(token) {
+  const needle = token.trim().toLowerCase();
+  return PLINTH_COMMAND_NAMES.some((name) => name === needle);
+}
+
 // src/lib/context/skill-commands.ts
 var COMMAND_USER_BLOCK_PLACEHOLDER = "_This workspace's own steps go here: anything specific to your team, your " + "tools or your data. Plinth preserves this block verbatim on every " + "regeneration; everything outside it is overwritten._";
 var OWNERSHIP_NOTE = "<!-- Auto-generated by Plinth into every mirror on every sync. Edit only " + "between the BEGIN/END markers at the foot; everything else is overwritten. " + "Your own commands in `.claude/commands/` are never read or touched by " + "Plinth, only this `plinth/` folder is generated. -->";
@@ -28655,9 +29084,9 @@ function buildStartCommandMd(rosterIsEmpty2) {
     "",
     "## Step 1: use the two memory indexes you were already given",
     "",
-    "The SessionStart hook injects **both memory indexes in full**, above: the workspace index (durable facts and conventions that hold for anyone here) and your personal index (facts true of **this member**: their email address, how they work, what they prefer). **Do not re-read `workspace-memory.md` or `user-memory.md`.** They are already in this context window, and re-reading them is the single most expensive thing this command could do for nothing.",
+    "The SessionStart hook injects **both memory indexes**, above: the workspace index (durable facts and conventions that hold for anyone here) and your personal index (facts true of **this member**: how they work, what they prefer). They may arrive trimmed to their newest lines, and the injection says so where it happens. **Do not re-read `workspace-memory.md` or `user-memory.md` wholesale** - they are already in this context window and re-reading them is the single most expensive thing this command could do for nothing - but if the injection says an index was trimmed and you need what is missing, read that file.",
     "",
-    "**Use the second one. It is the one that gets skipped**, and it is the one carrying the member's own identity, including the email address that every task assignment needs. An agent that ignores it asks the user for something the workspace already told it.",
+    "**Who you are working for is in the grounding above, not in an index.** The hook renders the member, their email and the workspace from the credentials this machine logged in with, so do not go looking for identity in either memory file and do not ask the user for it. **Use the personal index for what it is actually for**, which is the half that gets skipped: how this member works and what they prefer.",
     "",
     "If neither index appears above, the hook did not run - then, and only then, read the two files at the **mirror root**, the workspace folder holding `CLAUDE.md` (if this session started inside `artists/<slug>/`, that is the parent). Read them silently; do not dump either file into the conversation.",
     "",
@@ -28705,7 +29134,7 @@ function buildStartCommandMd(rosterIsEmpty2) {
     "",
     "## Loading area context",
     "",
-    "Once the user names something, resolve it against the workspace before answering: search the Plinth MCP, or read the roster in `CLAUDE.md`. **Never answer from name recognition alone.** Then read the surfaces that carry it. An artist's master context is `artists/<slug>/_artist.md`, whose `## Session log` carries what recent sessions did; their durable facts are `artists/<slug>/memory.md`. Older local history may sit in `artists/<slug>/daily-log.md`, which nothing writes to any more. Brief on what is live, not on what you opened.",
+    "Once the user names something, resolve it against the workspace before answering: search the Plinth MCP, or read the roster in `CLAUDE.md`. **Never answer from name recognition alone.** Then read the surfaces that carry it. An artist's master context is `artists/<slug>/_artist.md`, whose `## Session log` carries what recent sessions did; their durable facts are `artists/<slug>/memory.md`. Older local history may sit in `artists/<slug>/daily-log.md`, which is no longer created and nothing writes to any more. Brief on what is live, not on what you opened.",
     "",
     "If nothing resolves, say so plainly and ask. Do not invent an entity.",
     "",
@@ -28835,7 +29264,7 @@ function buildCloseCommandMd(workspaceSlug) {
     "",
     "If the file is not there yet, create it the same way as the artist store: a one-line title, the same conventions in a comment, and a real fact in the same edit. **Check what the workspace already says before you write a personal line** - a convention that is already in `workspace-rules.md` or the workspace's own house-style file is in force for everyone, and copying it here duplicates a live rule into a second injected surface instead of adding anything.",
     "",
-    "## Step 5: summarise, then end the session",
+    "## Step 5: summarise",
     "",
     "**First, re-read the conflicts list.** Everything this close wrote - the session record in Step 3, the memory files in Step 4 - landed AFTER Step 2 looked, and a losing write is set aside within seconds of being made. Step 2 therefore cannot have seen it. Read the list again now:",
     "",
@@ -28851,6 +29280,38 @@ function buildCloseCommandMd(workspaceSlug) {
     "",
     "**Five to seven lines**, and no file-by-file dump: **where the session record went, named per artist**, what now lives on a durable surface, what is still in flight and on whom, **what was banked to memory and to which of the two piles**, anything you named as having no home yet, any fact you judged true of the whole team and left unwritten, any date you handed to a person, and the obvious next move. **This is how the user sees what was stored without opening a file**, so name the files rather than saying that memory was updated.",
     "",
+    "## Step 6: offer to trim what has outgrown its file, and do not trim it",
+    "",
+    "The `plinth status` you ran a moment ago has a row labelled **`Too long`**, with one line per file beneath it. **That row is this step's whole trigger.** If it is not there, **say nothing at all** - no line, no mention, and no note that there was nothing to say. This signal is worth reading precisely because it is rare, and one that fires at every close is one nobody reads.",
+    "",
+    "**Nothing on the `Injection` row above it is a trigger, whatever it says.** That row reports how much of an index rides the session start, in either of two wordings - `Only N of M facts ... fit in the injection`, and `NONE of ... fits in the injection: all N facts are read from the file on demand`. **The second reads like an emergency and is not one.** Most workspaces are partly trimmed most of the time, and the remedy there is shorter lines rather than fewer facts, which that row states itself. Treating either line as the bar turns a rare offer into one that fires at nearly every close, on the member's private index, which is the outcome this step exists to avoid.",
+    "",
+    "If it named one or more, **offer in a single clause and stop there**, then wait for an answer:",
+    "",
+    "> Two artist stores and `voice.md` are past the size they are useful at. Want me to propose a trim?",
+    "",
+    "**Name every file the status named, including the ones you cannot touch.** Some of them you may only report on, and which those are is settled below - but a member who is told about two files out of three has been given a worse answer than one who is told about all three, not a tidier one.",
+    "",
+    "**Running the trim on your own initiative is the failure this step exists to prevent**, and it is the same failure as reporting a sweep nobody asked for. A `no` ends it here, in one line, and the next close offers it again in the same clause without arguing.",
+    "",
+    "**On yes: propose the cut, and write nothing yet.** Take one file at a time and show the member what would change before anything does:",
+    "",
+    "- **Every surviving fact appears either unchanged or beside its rewrite**, so the member is reading a diff rather than trusting a summary of one.",
+    "- **A fact that is now wrong is edited where it stands, not deleted** - the correction and the date it changed are the record. The file's own header comment states its conventions and is the version that stays current; follow it rather than a copy.",
+    "- **Provenance and the absolute date survive on every line you keep.** A fact whose source you drop while shortening it has been damaged, not trimmed.",
+    "- **Nothing banked in the last 30 days is dropped**, measured against the date the session hook injected. Recent facts have not had time to prove whether they were durable, and a trim is not the place to decide.",
+    "- **Merging two facts into one is a rewrite and shows as one**, with both original lines visible in the proposal.",
+    "",
+    "**Then write only what the member confirms**, and only to the files this command can reach:",
+    "",
+    "- `artists/<slug>/memory.md` syncs, and a teammate may be in the same file. **Re-read it at the moment you write**, exactly as Step 4b requires, and change only the lines the proposal named. This is the only file this step ever writes.",
+    `- \`${VOICE_FILENAME}\` is named and nothing else. You are denied editing it, and that is deliberate: the profile a draft is judged against is not the drafter's to rewrite. Say its size, say the member edits it themselves, and propose nothing.`,
+    "- **A memory file the whole workspace shares is not this command's to trim.** `plinth status` names it and says how far over it is; trimming it is a deliberate act by a person who can see who else it belongs to, not a step at the end of somebody's session.",
+    "",
+    "**Anything you write here lands after Step 5 looked at the conflicts list**, so it can be set aside within seconds like any other write. If you wrote a trim, run the Step 5 check once more on what you wrote and report it the same way.",
+    "",
+    "## Step 7: end the session",
+    "",
     "Then, as the **very last step**:",
     "",
     "```sh",
@@ -28881,7 +29342,7 @@ function buildOnboardCommandMd(workspaceSlug) {
     "",
     "**Propose, then stop. Never sweep.** Every step below that creates anything puts the list to the user first and waits for an answer. This is not politeness and it is not a style: the first live run of the opening command on a real workspace created **63 tasks** against an explicit instruction to offer rather than run, and this command creates far more than that one did.",
     "",
-    "**And the tools will not save you.** Creating an artist makes you come back with a confirmation token, so the workspace itself blocks an unconfirmed write. **Creating a task or a project does not.** Those go straight through the moment you call them. So on the inbox-review step in particular, the only thing standing between this workspace and a hundred unwanted rows is you doing what this file says.",
+    "**And the tools will not agree to anything for you.** Creating an artist, a task or a project makes you come back with a confirmation token, so the workspace refuses a write you have not repeated. **What that token proves is that you called twice with the same arguments. It does not prove that anybody said yes** - nothing in that exchange asks the user a question. **A contact has no token at all** and is written the moment you call it. Either way, the only thing standing between this workspace and a hundred unwanted rows is you putting the list to them first and waiting for the answer.",
     "",
     "## Step 0: find out where they already are",
     "",
@@ -28936,7 +29397,7 @@ function buildOnboardCommandMd(workspaceSlug) {
     "- **Their name.**",
     "- **Their Spotify link.** Ask for it and take whatever they paste. The bit you need is the ID in the middle of the URL: from `open.spotify.com/artist/<the long string on the end>` the ID is that string. Pass it as `spotify_artist_id`. **If they do not have it to hand, create the artist without it and move on** rather than stalling the run; it can be added later.",
     "",
-    "Create each one with `create_artist`. **It will hand you back a confirmation token rather than creating anything**, which is the workspace insisting the user agrees before a row exists. Put it to them, then complete the write. If they say no to one, drop it.",
+    "Create each one with `create_artist`. **It will hand you back a confirmation token rather than creating anything**, so nothing exists until you call again with the same arguments and that token. **The token is not the user agreeing** - it asks you nothing about them - so put the artist to them first, and complete the write only once they have said yes. If they say no to one, drop it.",
     "",
     "**`create_artist` also requires a `slug`, and it is yours to derive rather than theirs to supply.** Do not ask for it: it is a detail of how the workspace stores things, and asking turns a two-question step into a three-question one for no gain.",
     "",
@@ -28962,7 +29423,7 @@ function buildOnboardCommandMd(workspaceSlug) {
     "",
     "**If you cannot name the role, do not propose the person.** An inbox is full of names, and a list of everyone who has ever appeared in a thread is worse than no list at all: it buries the eight people who matter and it makes the user do the sorting you were meant to do. A signature block, a company domain or the thread itself will usually tell you the role. When none of them does, leave the person out.",
     "",
-    "Put the ones you are sure of to the user with their role and email, per artist, and write only the ones they confirm with `create_artist_contact`.",
+    "Put the ones you are sure of to the user with their role and email, per artist, and write only the ones they confirm with `create_artist_contact`. **This is the one write in this run with no confirmation step**: it lands the moment you call it, so the user's yes has to come before the call rather than after it.",
     "",
     "**Every contact carries its artist, and the write REFUSES one without it.** `create_artist_contact` needs `artist_id` or `artist_name` and errors with `Either artist_id or artist_name is required` when neither is there, so this is not a field you can leave blank and tidy up later. A person who genuinely spans several artists is therefore a decision rather than an omission: name them to the user, file them under the artist they belong to most, or leave them out and say that you have.",
     "",
@@ -28977,10 +29438,10 @@ function buildOnboardCommandMd(workspaceSlug) {
     "**Show them the whole list before you create any of it**, numbered, and **name the thread each one came from** so every proposal can be traced back to something real. Then gate it:",
     "",
     "- Put it to them with **`AskUserQuestion`**: create all of them, pick through them, or none.",
-    "- **If they pick through them, walk the list in batches of four as multi-select questions** (the tool takes four options per question and four questions per ask). Selected means create it. Unselected means drop it.",
+    "- **If they pick through them, walk the list in batches of four as multi-select questions** (the tool takes four options per question and four questions per ask). Selected means create it. Unselected means drop it. **A batch with a single item left cannot be asked that way** - a one-option question is refused by the tool - so put that one to them in plain words instead and take the answer as given.",
     '- **The free-text "Other" choice is how they rewrite one in their own words**, and their wording wins over yours.',
     "",
-    "**Create nothing until an answer comes back, and create only what came back.** Creating a task or a project does not ask you to confirm the way creating an artist did, so there is no second chance here and nothing behind you to catch it. **If you find yourself about to create something nobody named, stop.**",
+    "**Create nothing until an answer comes back, and create only what came back.** A task and a project each answer your first call with a preview and a confirmation token, and write nothing at all until you call again with the same arguments plus that token. **The second call is yours to make and not another question for the user** - they have already answered. The token is single-use, expires in five minutes and is refused if any argument changed, so confirm each one as you go rather than previewing the whole batch and coming back to it. **If you find yourself about to create something nobody named, stop**: the token will not stop you, because you are the one holding it.",
     "",
     "**`create_project` requires a `category` and will refuse an invalid one**, so settle it before you start writing rather than guessing partway through a confirmed batch. **Read the exact values off the tool's own schema and pass one of them character for character.** Do not work from a list written down anywhere, including this file: the set changes, a near miss is refused, and the plural forms are not what you would guess.",
     "",
@@ -28988,7 +29449,19 @@ function buildOnboardCommandMd(workspaceSlug) {
     "",
     "**Where you know who owns something, put a real owner and a real due date on it.** Where you do not, leave them empty rather than guessing: a wrong due date on day one teaches them the dates here cannot be trusted.",
     "",
-    "## Step 7: tell them what they have, and what they have not",
+    "## Step 7: their voice, in their own words",
+    "",
+    `**One file here is theirs alone: \`${VOICE_FILENAME}\`, at the root of this folder.** It is how they write, and it is read before anything goes out in their name. **You cannot edit it** - the workspace denies that on purpose, so that what an agent is judged against is not something the agent can rewrite. Ask, and let them type.`,
+    "",
+    '**Ask for mechanical rules first, and only four or five of them.** The ones that are either followed or broken with no judgement in between: how they sign off, whether they use dashes, whether a signature block goes on the end, how long an opening paragraph runs, anything they know they always do. Those are worth more than a page about tone, because they can be checked against and "warm but direct" cannot.',
+    "",
+    "**Say where the rest goes: below the rules, not above them.** Examples, past emails and longer notes are useful and they are not the part that has to survive a reader who stops early. A profile is read top to bottom.",
+    "",
+    "**And say plainly that nothing checks a draft automatically.** No gate sits between what gets written and the person who reads it. That file and the agent applying it are the whole of it, which is exactly why the mechanical rules are worth the two minutes now.",
+    "",
+    "**If they would rather skip it, say what it costs in one line** and move on: everything drafted for them will read as the assistant's writing rather than theirs, and they will be correcting the same things by hand each time.",
+    "",
+    "## Step 8: tell them what they have, and what they have not",
     "",
     "**Five or six lines, no file-by-file dump:**",
     "",
@@ -29068,7 +29541,7 @@ function scanStaleUserBlocks(deps) {
     }
     checked++;
     const haystack = block.toLowerCase();
-    const tokens = retired.filter((r) => r.commandRel === rel && haystack.includes(r.token.toLowerCase()));
+    const tokens = retired.filter((r) => r.commandRel === rel && haystack.includes(r.token.toLowerCase())).map((r) => ({ ...r, stillACommand: isPlinthCommand(r.token) }));
     if (tokens.length > 0) {
       stale.push({ commandRel: rel, invocation: invocationFor(rel), tokens });
     }
@@ -29076,215 +29549,748 @@ function scanStaleUserBlocks(deps) {
   return { checked, unchecked, stale };
 }
 
-// src/lib/context/workspace-claude-md.ts
-var EXTRACTED_TEXT_DIR = extractedTextRelPath("x").replace(/x\.md$/, "");
-function rosterBlock(roster, activeProjectCountBySlug) {
-  if (roster.length === 0)
-    return "_No artists synced yet._";
-  return roster.map((a) => {
-    const statusPart = a.status ? `, ${a.status}` : "";
-    const n = activeProjectCountBySlug.get(a.slug) ?? 0;
-    const projects = `${n} active project${n === 1 ? "" : "s"}`;
-    return `- **${a.name}** (\`${a.slug}\`${statusPart}) · ${projects} · master context → \`artists/${a.slug}/_artist.md\``;
-  }).join(`
-`);
+// src/lib/files/api.ts
+var MAX_WORKSPACE_FILE_BYTES = 4000000;
+var HASH_RE = /^[0-9a-f]{64}$/;
+var TextQualitySchema = exports_external.enum(["ok", "partial", "garbled"]);
+var FileLiveSchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  path: exports_external.string().min(1),
+  mime_type: exports_external.string(),
+  size_bytes: exports_external.number().int().nonnegative(),
+  content_hash: exports_external.string().regex(HASH_RE),
+  artist_id: exports_external.string().uuid().nullable(),
+  project_id: exports_external.string().uuid().nullable(),
+  updated_at: exports_external.string().datetime({ offset: true }),
+  deleted_at: exports_external.null(),
+  last_edited_by: exports_external.string().uuid().nullable(),
+  content_quality: TextQualitySchema.nullable().optional().default(null).catch(null),
+  has_extracted_text: exports_external.boolean().optional().catch(undefined),
+  has_stored_bytes: exports_external.boolean().optional().catch(undefined)
+});
+function storedBytesSignal(row) {
+  if (row.has_stored_bytes === true)
+    return "present";
+  if (row.has_stored_bytes === false)
+    return "absent";
+  return "unknown";
 }
-function buildWorkspaceClaudeMd(input) {
-  const {
-    workspaceName,
-    workspaceSlug,
-    roster,
-    activeProjectCountBySlug,
-    schemaVersion
-  } = input;
-  const entityLines = ENTITY_CATALOG.map((e) => `- **${e.label}**: ${e.blurb}${e.file ? "" : " _(MCP only)_"}`);
-  const skillLines = SKILL_LOCATIONS.map((s) => `- ${s.label}: ${s.detail}`);
-  const skillCount = SKILL_LOCATIONS.length;
-  const lines = [
-    `<!-- plinth-schema-version: ${schemaVersion} -->`,
-    `<!-- Auto-generated by Plinth. ${GENERATED_AT_PREFIX}${GENERATED_AT_PLACEHOLDER}; ` + `that stamp moves only when this file's content changes, so an unchanged file keeps an older one ` + `and is still re-checked against Plinth on every sync. Run \`plinth status\` for when the mirror last synced. ` + `Edit only between the BEGIN/END markers below; everything else is overwritten on sync. -->`,
-    ``,
-    `# ${workspaceName} · Plinth workspace`,
-    ``,
-    `Local mirror of the **${workspaceName}** workspace (\`${workspaceSlug}\`). ${SECURITY_NOTE}`,
-    ``,
-    `> **Session grounding**: the current date, an entity-resolution rule, and a write-confirmation rule are injected at every session start by the Plinth hook in \`.claude/settings.json\` (and each \`artists/<slug>/.claude/settings.json\`).`,
-    ``,
-    `> **Filing a file the user hands you - BOTH halves, and the first one is unconditional**: put a copy in \`files/\`, which is how Plinth gets the text (folder map below) - do this even if everything else here fails. Then put the **original** in the user's own file storage with whatever tool you have for that, and write down where it went somewhere durable: \`artists/<slug>/memory.md\` if it is that artist's, otherwise your own \`user-memory.md\`. A pointer that exists only in this conversation is lost when it ends. If you have no tool that reaches their file storage, SAY SO - do not leave them believing the original was filed.`,
-    ``,
-    `## Folder map`,
-    `- \`artists/<slug>/\` one folder per artist, the working dir for artist-scoped sessions · \`threads/<slug>/_thread.md\` one folder per thread`,
-    `- \`projects/\` \`tasks/\` \`documents/\` \`meetings/\` workspace-root flat entity files (one \`.md\` per entity, NOT nested under \`artists/\`)`,
-    `- \`files/\` free-form document store: PDFs, executed agreements, spreadsheets, anything that is a FILE rather than an entity. Mirrored byte-for-byte both ways, folders and all`,
-    `- \`${extractedTextRelPath("<path>")}\` where \`<path>\` is the file's path under \`files/\`: the text Plinth extracted from that file, so a PDF's contents can be searched. Not every file has one - text files are already their own text, and extraction can fail. Where it produced junk the file exists and says so instead of carrying it, so read what is there before trusting a silence. Derived: edits here are overwritten and never reach Plinth`,
-    `- \`.claude/commands/\` local skills, incl. generated \`${START_COMMAND_INVOCATION}\` + \`${CLOSE_COMMAND_INVOCATION}\` + \`${ONBOARD_COMMAND_INVOCATION}\` · at the mirror root: \`workspace-memory.md\` \`workspace-rules.md\` (workspace-wide) + \`user-memory.md\` (yours), synced to Plinth · \`voice.md\` (yours: how you write, read by the agent, edited only by you) · \`CLAUDE.local.md\` private, gitignored`,
-    ``,
-    `## Where key context lives: look here before hunting`,
-    `- Each artist's **master context** (stable profile + current state) → \`artists/<slug>/_artist.md\`; edit its body and the daemon syncs both ways. Blocks labelled "rendered from Plinth" are the exception: they are overwritten on the next sync`,
-    `- **Contracts, executed agreements & any PDF** → \`files/\` (search here first; \`documents/\` holds markdown bodies, not attachments)`,
-    `- Workspace-wide **notes, briefs, bios & context docs** → \`documents/\` (one markdown file per doc, shared across artists)`,
-    `- Per-artist long-term facts → \`artists/<slug>/memory.md\`, which syncs to that artist's Plinth record; most have none yet, and creating the file is how you start one · what a session did → a dated section under \`## Session log\` in \`artists/<slug>/_artist.md\`, which syncs too · \`artists/<slug>/daily-log.md\` is local scratch, never synced; an older one may hold real history, and nothing writes there now`,
-    `- ${MCP_AVAILABILITY_POINTER}`,
-    ``,
-    `## Navigating the corpus`,
-    `- **What points at X?** → \`plinth backlinks "<name>"\`, a mirror path, or a wikilink target as written. Render-only blocks, code spans and comments are narrowed out; \`--unfiltered\` shows them. A bare name several files answer to is refused with the candidates listed, so re-run with the path it names`,
-    `- **What does this file link to?** → grep \`[[\` in it`,
-    `- **Find a file by name** → glob under \`files/\` \`documents/\` \`artists/\` · **text inside a PDF** → \`${EXTRACTED_TEXT_DIR}\` (folder map above) · **write to a row you have the mirror file for** → pass its frontmatter \`id:\` to the \`mcp__plinth__*\` write tool; if you do not have the file, find it with \`search_entities\` / \`list_*\``,
-    ``,
-    `## Entity model: ${MCP_INTROSPECTION_POINTER}`,
-    ...entityLines,
-    ``,
-    `## Roster (${roster.length})`,
-    rosterBlock(roster, activeProjectCountBySlug),
-    ``,
-    `## Skills: ${skillCount} discoverable location${skillCount === 1 ? "" : "s"}`,
-    ...skillLines,
-    ``,
-    USER_BLOCK_BEGIN,
-    USER_BLOCK_PLACEHOLDER,
-    USER_BLOCK_END
-  ];
-  return lines.join(`
-`) + `
-`;
+function extractedTextSignal(row) {
+  if (row.has_extracted_text === true)
+    return "present";
+  if (row.has_extracted_text === false)
+    return "absent";
+  return "unknown";
 }
-
-// src/lib/context/generate.ts
-var CLAUDE_MD = "CLAUDE.md";
-var CLAUDE_LOCAL_MD = "CLAUDE.local.md";
-var GITIGNORE = ".gitignore";
-var GITIGNORE_ENTRIES = [
-  CLAUDE_LOCAL_MD,
-  "**/.claude/settings.json",
-  "**/.claude/settings.local.json"
-];
-var CLAUDE_LOCAL_STUB = "<!-- Per-user overrides for this workspace. Private, gitignored, and " + `never overwritten by Plinth. Run /onboard to populate, or edit freely. -->
-`;
-function currentSchemaVersion() {
-  return computeSchemaVersion({
-    templateVersion: TEMPLATE_VERSION,
-    entityCatalog: ENTITY_CATALOG,
-    skillLocations: SKILL_LOCATIONS,
-    securityNote: SECURITY_NOTE,
-    mcpAvailabilityPointer: MCP_AVAILABILITY_POINTER
-  });
+var FileTombstoneSchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  path: exports_external.string().min(1),
+  updated_at: exports_external.string().datetime({ offset: true }),
+  deleted_at: exports_external.string().datetime({ offset: true })
+});
+var FileRowSchema = exports_external.union([FileLiveSchema, FileTombstoneSchema]);
+var FilesPageSchema = exports_external.object({
+  files: exports_external.array(FileRowSchema),
+  next_cursor: exports_external.string().nullable()
+});
+var FileWithDownloadSchema = FileLiveSchema.extend({
+  download_url: exports_external.string().url().nullable()
+});
+var FileTextSchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  path: exports_external.string().min(1),
+  mime_type: exports_external.string(),
+  updated_at: exports_external.string().datetime({ offset: true }),
+  content_quality: TextQualitySchema.nullable(),
+  source_uri: exports_external.string().nullable(),
+  text: exports_external.string().nullable(),
+  chars: exports_external.number().int().nonnegative(),
+  withheld: exports_external.enum(["bytes_are_text", "no_text"]).nullable()
+});
+var PreconditionSchema = exports_external.object({
+  code: exports_external.literal("precondition_failed"),
+  current_updated_at: exports_external.string()
+});
+function baseHeaders(pat) {
+  return { Authorization: `Bearer ${pat}`, Accept: "application/json" };
 }
-function ensureWorkspaceContext(deps) {
-  const { workspaceSlug, workspaceName, force, out, now } = deps;
-  const version2 = currentSchemaVersion();
-  const roster = readRoster(workspaceSlug);
-  const activeProjectCountBySlug = activeProjectCountsBySlug(workspaceSlug, loadState(workspaceSlug));
-  const generated = buildWorkspaceClaudeMd({
-    workspaceName,
-    workspaceSlug,
-    roster,
-    activeProjectCountBySlug,
-    schemaVersion: version2
-  });
-  const existing = readContextFile(workspaceSlug, CLAUDE_MD);
-  const decision = decideRegen({
-    existing,
-    currentVersion: "",
-    generated,
-    force,
-    normalise: normaliseGeneratedAt
-  });
-  if (decision.action === "backup-regen" && decision.backup !== undefined) {
-    const bakRel = `${CLAUDE_MD}.bak-${backupStamp3(now())}`;
-    writeContextFile(workspaceSlug, bakRel, decision.backup);
-    out.warn(`${CLAUDE_MD} had no recognisable BEGIN/END markers; backed your copy ` + `up to ${bakRel} before regenerating.`);
+async function syncFilesPage(args) {
+  const { baseUrl, pat, cursor, limit, fetchImpl = fetch } = args;
+  const params = new URLSearchParams;
+  if (cursor)
+    params.set("since", cursor);
+  if (limit)
+    params.set("limit", String(limit));
+  const qs = params.toString();
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files` + (qs.length > 0 ? `?${qs}` : "");
+  let res;
+  try {
+    res = await fetchImpl(url2, { method: "GET", headers: baseHeaders(pat) });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
   }
-  if (decision.content !== null) {
-    writeContextFile(workspaceSlug, CLAUDE_MD, renderGeneratedAt(decision.content, now()));
+  if (res.status === 401) {
+    throw new ApiError(401, "Token was rejected by the server. Run `plinth login --workspace <slug>` to refresh.");
   }
-  if (!existsSync2(contextFilePath(workspaceSlug, CLAUDE_LOCAL_MD))) {
-    writeContextFile(workspaceSlug, CLAUDE_LOCAL_MD, CLAUDE_LOCAL_STUB);
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server. Wait a few seconds and retry.", parseRetryAfterMs(res.headers.get("retry-after")));
   }
-  ensureWorkspaceCommands({ workspaceSlug, force, out, now });
-  ensureGitignore(workspaceSlug);
-  const resolved = resolvePlinthBinary();
-  reportResolution(out, resolved);
-  if (ensureSessionHook(workspaceSlug, "", out, resolved) === "skipped") {
-    deps.onHookSkipped?.();
+  if (!res.ok) {
+    throw new ApiError(res.status, `sync files failed with HTTP ${res.status}`);
   }
-  if (decision.action === "create") {
-    out.info(`Generated ${CLAUDE_MD} (${roster.length} artists).`);
-  } else if (decision.action === "regen" || decision.action === "backup-regen") {
-    out.info(`Refreshed ${CLAUDE_MD} (your edits preserved).`);
+  const body = await res.json();
+  const parsed = FilesPageSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new ApiError(res.status, `sync files response did not match the expected shape: ${parsed.error.message}`);
   }
+  return { rows: parsed.data.files, next_cursor: parsed.data.next_cursor };
 }
-function ensureGitignore(workspaceSlug) {
-  const existing = readContextFile(workspaceSlug, GITIGNORE);
-  const present2 = new Set((existing ?? "").split(`
-`).map((l) => l.trim()).filter(Boolean));
-  const missing = GITIGNORE_ENTRIES.filter((e) => !present2.has(e));
-  if (missing.length === 0)
-    return;
-  const block = `${missing.join(`
-`)}
-`;
-  if (existing === null || existing === "") {
-    writeContextFile(workspaceSlug, GITIGNORE, block);
-    return;
+async function getFile(args) {
+  const { baseUrl, pat, id, fetchImpl = fetch } = args;
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files/${id}`;
+  let res;
+  try {
+    res = await fetchImpl(url2, { method: "GET", headers: baseHeaders(pat) });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
   }
-  const lead = existing.endsWith(`
-`) ? "" : `
-`;
-  writeContextFile(workspaceSlug, GITIGNORE, `${existing}${lead}${block}`);
-}
-function backupStamp3(d) {
-  return d.toISOString().replace(/[-:.]/g, "").replace("Z", "");
-}
-
-// src/commands/refresh-context.ts
-init_output();
-function runRefreshContext(workspaceSlug, deps = {}) {
-  const out = new Output({ sink: deps.sink, noColor: deps.noColor });
-  const now = deps.now ?? (() => new Date);
-  const config2 = loadConfig();
-  if (!config2) {
-    out.error("No workspace configured. Run `plinth login --workspace <slug>` first.");
-    return 1;
+  if (res.status === 404)
+    return { ok: false, code: 404 };
+  if (res.status === 401) {
+    throw new ApiError(401, "Token was rejected by the server.");
   }
-  const slug = workspaceSlug ?? config2.active_workspace;
-  const entry2 = config2.workspaces[slug];
-  if (!entry2) {
-    out.error(`Workspace "${slug}" not found. Run \`plinth login --workspace ${slug}\` first.`);
-    return 1;
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
   }
-  let skipped = 0;
-  const onHookSkipped = () => {
-    skipped++;
-  };
+  if (!res.ok) {
+    throw new ApiError(res.status, `get file failed with HTTP ${res.status}`);
+  }
+  const body = await res.json();
+  const parsed = FileWithDownloadSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new ApiError(res.status, `get file response did not match the expected shape`);
+  }
+  return { ok: true, row: parsed.data };
+}
+async function getFileText(args) {
+  const { baseUrl, pat, id, fetchImpl = fetch } = args;
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files/${id}/text`;
+  let res;
   try {
-    ensureWorkspaceContext({
-      workspaceSlug: slug,
-      workspaceName: entry2.workspace_name ?? slug,
-      force: true,
-      out,
-      now,
-      onHookSkipped
-    });
-    ensurePerArtistContext({
-      workspaceSlug: slug,
-      force: true,
-      out,
-      now,
-      onHookSkipped
-    });
+    res = await fetchImpl(url2, { method: "GET", headers: baseHeaders(pat) });
   } catch (err) {
-    const msg = err instanceof Error ? err.message : "unknown error";
-    out.error(`Could not refresh context: ${msg}`);
-    return 1;
+    const msg = err instanceof Error ? err.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
   }
-  if (skipped > 0) {
-    out.error(`Context refreshed, but ${skipped} Claude Code hook mount${skipped === 1 ? " was" : "s were"} ` + `SKIPPED — ${skipped === 1 ? "that location is" : "those locations are"} ungrounded and ` + `agent-originated drafts there are UNGATED. See the errors above.`);
-    return 1;
+  if (res.status === 404)
+    return { ok: false, code: 404 };
+  if (res.status === 401) {
+    throw new ApiError(401, "Token was rejected by the server. Run `plinth login --workspace <slug>` to refresh.");
   }
-  out.success(`Context up to date for ${slug}.`);
-  return 0;
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, `get file text failed with HTTP ${res.status}`);
+  }
+  const body = await res.json();
+  const parsed = FileTextSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new ApiError(res.status, `get file text response did not match the expected shape: ${parsed.error.message}`);
+  }
+  return { ok: true, row: parsed.data };
 }
-var refreshContextCommand = defineCommand({
+async function downloadBytes(downloadUrl, fetchImpl = fetch) {
+  let res;
+  try {
+    res = await fetchImpl(downloadUrl, { method: "GET" });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "network error";
+    throw new ApiError(0, `Could not download bytes: ${msg}`);
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, `download failed with HTTP ${res.status}`);
+  }
+  const ab = await res.arrayBuffer();
+  return Buffer.from(ab);
+}
+async function postFile(args) {
+  const {
+    baseUrl,
+    pat,
+    relPath,
+    bytes,
+    contentHash,
+    mimeType,
+    expectedUpdatedAt,
+    fetchImpl = fetch
+  } = args;
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files`;
+  const headers = {
+    Authorization: `Bearer ${pat}`,
+    Accept: "application/json",
+    "Content-Type": mimeType,
+    "X-Plinth-File-Path": encodeURIComponent(relPath),
+    "X-Plinth-Content-Hash": contentHash
+  };
+  if (expectedUpdatedAt)
+    headers["X-Plinth-Expected-Updated-At"] = expectedUpdatedAt;
+  let res;
+  try {
+    res = await fetchImpl(url2, { method: "POST", headers, body: bytes });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
+  }
+  if (res.status === 200 || res.status === 201) {
+    const body = await res.json();
+    const parsed = FileLiveSchema.safeParse(body);
+    if (!parsed.success) {
+      throw new ApiError(res.status, `post file response did not match the expected shape`);
+    }
+    return { ok: true, row: parsed.data };
+  }
+  if (res.status === 413) {
+    let maxBytes = null;
+    try {
+      const json2 = await res.json();
+      if (typeof json2.max_bytes === "number")
+        maxBytes = json2.max_bytes;
+    } catch {}
+    return { ok: false, code: 413, maxBytes };
+  }
+  if (res.status === 409) {
+    const json2 = await res.json();
+    const parsed = PreconditionSchema.safeParse(json2);
+    if (!parsed.success) {
+      throw new ApiError(409, `post file 409 body did not match precondition_failed shape`);
+    }
+    return { ok: false, code: 409, currentUpdatedAt: parsed.data.current_updated_at };
+  }
+  if (res.status === 400) {
+    let code;
+    try {
+      const json2 = await res.json();
+      code = json2.code;
+    } catch {}
+    if (code === "hash_mismatch")
+      return { ok: false, code: 400, reason: "hash_mismatch" };
+    throw new ApiError(400, "post file rejected as bad request");
+  }
+  if (res.status === 401) {
+    throw new ApiError(401, "Token was rejected by the server.");
+  }
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+  }
+  throw new ApiError(res.status, `post file failed with HTTP ${res.status}`);
+}
+async function deleteFile(args) {
+  const { baseUrl, pat, id, expectedUpdatedAt, fetchImpl = fetch } = args;
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files/${id}`;
+  let res;
+  try {
+    res = await fetchImpl(url2, {
+      method: "DELETE",
+      headers: { ...baseHeaders(pat), "X-Plinth-Expected-Updated-At": expectedUpdatedAt }
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
+  }
+  if (res.status === 200) {
+    const body = await res.json();
+    const parsed = FileTombstoneSchema.safeParse(body);
+    if (!parsed.success) {
+      throw new ApiError(200, `delete file response did not match the expected tombstone shape`);
+    }
+    return { ok: true, tombstone: parsed.data };
+  }
+  if (res.status === 404)
+    return { ok: false, code: 404 };
+  if (res.status === 409) {
+    const json2 = await res.json();
+    const parsed = PreconditionSchema.safeParse(json2);
+    if (!parsed.success) {
+      throw new ApiError(409, `delete file 409 body did not match precondition_failed shape`);
+    }
+    return { ok: false, code: 409, currentUpdatedAt: parsed.data.current_updated_at };
+  }
+  if (res.status === 401) {
+    throw new ApiError(401, "Token was rejected by the server.");
+  }
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+  }
+  throw new ApiError(res.status, `delete file failed with HTTP ${res.status}`);
+}
+
+// src/lib/rejected.ts
+import { relative as relative3 } from "node:path";
+
+// src/lib/log-tokens.ts
+function categorizeError(err) {
+  if (err instanceof FrontmatterValidationError) {
+    return { status: 422, reason: "invalid_frontmatter", detail: err.detail };
+  }
+  if (err instanceof ApiError) {
+    const { status } = err;
+    if (status === 0)
+      return { status, reason: "network" };
+    if (status === 401 || status === 403)
+      return { status, reason: "auth" };
+    if (status === 429)
+      return { status, reason: "rate_limit" };
+    if (status === 400 || status === 422) {
+      const serverMessage = sanitizeServerMessage(err.message);
+      return serverMessage ? { status, reason: "bad_request", serverMessage } : { status, reason: "bad_request" };
+    }
+    if (status >= 500 && status <= 599)
+      return { status, reason: "server" };
+    return { status, reason: "http" };
+  }
+  return { status: 0, reason: "unexpected" };
+}
+function sanitizeServerMessage(message) {
+  const oneLine2 = message.replace(/\s+/g, " ").trim();
+  if (oneLine2.length === 0)
+    return "";
+  return oneLine2.length > 200 ? `${oneLine2.slice(0, 197)}...` : oneLine2;
+}
+function pushFailedLine(f) {
+  const idPart = f.id ? ` id=${f.id}` : "";
+  const detailPart = f.detail ? ` detail=${f.detail}` : "";
+  const serverPart = f.serverMessage ? ` server_msg="${f.serverMessage}"` : "";
+  return `[PUSH_FAILED entityType=${f.entityType} slug=${f.slug}${idPart} status=${f.status} reason=${f.reason}${detailPart}${serverPart}]`;
+}
+function pullFailedLine(f) {
+  return `[PULL_FAILED status=${f.status} reason=${f.reason}]`;
+}
+function contextDocConflictLine(f) {
+  const localIdPart = f.localId ? ` localId=${f.localId}` : "";
+  const reasonPart = f.reason ? ` reason=${f.reason}` : "";
+  const stashPart = f.stash ? ` stash=${f.stash}` : "";
+  return `[CONTEXT_DOC_CONFLICT entityType=${f.entityType} localSlug=${f.localSlug}${localIdPart} ` + `existingSlug=${f.existingSlug} existingId=${f.existingId} scope=${f.scope} ` + `action=${f.action}${reasonPart}${stashPart}]`;
+}
+function syncErrorLine(f) {
+  return `[SYNC_ERROR entityType=${f.entityType} slug=${f.slug} id=${f.id} ` + `fields=${f.fields.join(",")} pushed=${f.pushed}]`;
+}
+function filePushLine(f) {
+  return `[FILE_PUSH path=${f.path} id=${f.id} action=${f.action}]`;
+}
+function fileDeleteLine(f) {
+  const notePart = f.note ? ` note=${f.note}` : "";
+  return `[FILE_DELETE path=${f.path} id=${f.id}${notePart}]`;
+}
+function fileDeleteSuppressedLine(f) {
+  return `[FILE_DELETE_SUPPRESSED path=${f.path} reason=${f.reason}]`;
+}
+function entityDeleteSuppressedLine(f) {
+  return `[ENTITY_DELETE_SUPPRESSED entityType=${f.entityType} slug=${f.slug} reason=${f.reason}]`;
+}
+function fileOverCapLine(f) {
+  return `[FILE_OVER_CAP path=${f.path} size=${f.size} max=${f.max} max_from=${f.source}]`;
+}
+function fileConflictLine(f) {
+  return `[FILE_CONFLICT path=${f.path} stash=${f.stash}]`;
+}
+function conflictsViewFailedLine(f) {
+  const msg = f.message === undefined ? "" : sanitizeServerMessage(f.message);
+  const msgPart = msg === "" ? "" : ` message="${msg.replace(/"/g, "'")}"`;
+  return `[CONFLICTS_VIEW_FAILED path=${f.path} reason=${f.reason}${msgPart}]`;
+}
+function fileFailedLine(f) {
+  const detailPart = f.detail ? ` detail=${f.detail}` : "";
+  const serverPart = f.serverMessage ? ` server_msg="${f.serverMessage}"` : "";
+  return `[FILE_PUSH_FAILED path=${f.path} status=${f.status} reason=${f.reason}${detailPart}${serverPart}]`;
+}
+function frontmatterIdBackfillLine(r) {
+  return `[FRONTMATTER_ID_BACKFILL scanned=${r.scanned} written=${r.written} ` + `blocks_created=${r.blocksCreated} ` + `inodes_restamped=${r.inodesRestamped} failed=${r.failed} ` + `skipped_frozen=${r.skipped.frozen} ` + `skipped_foreign_id=${r.skipped.foreignId} ` + `skipped_unwritable=${r.skipped.unwritable} ` + `skipped_slug_collision=${r.skipped.slugCollision} ` + `skipped_diverged=${r.skipped.diverged}]`;
+}
+function pullNoticeLine(kind) {
+  const token = kind === "auth" ? "PULL_PAUSED" : "PULL_DEGRADED";
+  return `[${token} reason=${kind}]`;
+}
+function calendarProjectedLine(f) {
+  return `[CALENDAR_PROJECTED written=${f.written} pruned=${f.pruned} ` + `calendars=${f.calendars} not_read=${f.notRead}]`;
+}
+function calendarFailedLine(f) {
+  const serverPart = f.serverMessage ? ` server_msg="${f.serverMessage}"` : "";
+  return `[CALENDAR_FAILED status=${f.status} reason=${f.reason} staled=${f.staled}${serverPart}]`;
+}
+function calendarNoticeLine(kind) {
+  const token = kind === "auth" ? "CALENDAR_PAUSED" : kind === "unsupported" ? "CALENDAR_UNSUPPORTED" : "CALENDAR_DEGRADED";
+  return `[${token} reason=${kind}]`;
+}
+
+// src/lib/rejected.ts
+var PERMANENT_REJECT_REASONS = new Set(["bad_request", "invalid_frontmatter"]);
+function isPermanentReject(err) {
+  return PERMANENT_REJECT_REASONS.has(categorizeError(err).reason);
+}
+function persist(state, next) {
+  if (!next.changed)
+    return state;
+  return commitState(state, next.state);
+}
+function recordEntityRejected(args) {
+  const cat = categorizeError(args.err);
+  let path3;
+  try {
+    path3 = relative3(workspaceMirrorPath(args.workspaceSlug), args.absolutePath);
+  } catch {
+    path3 = args.absolutePath;
+  }
+  const withoutStale = removeUnsynced(args.state, "entity", path3).state;
+  return persist(withoutStale, upsertRejected(withoutStale, {
+    target: "entity",
+    op: args.op,
+    path: path3,
+    status: cat.status,
+    reason: cat.reason,
+    detail: cat.detail,
+    message: cat.serverMessage,
+    rejected_at: args.now().toISOString()
+  }));
+}
+function recordFileRejected(args) {
+  const cat = categorizeError(args.err);
+  const withoutStale = removeUnsynced(args.state, "file", args.relPath).state;
+  return persist(withoutStale, upsertRejected(withoutStale, {
+    target: "file",
+    op: args.op,
+    path: args.relPath,
+    status: cat.status,
+    reason: cat.reason,
+    detail: cat.detail,
+    message: cat.serverMessage,
+    rejected_at: args.now().toISOString()
+  }));
+}
+var CLOUD_ROW_DELETED_REASON = "cloud_row_deleted";
+function recordEntityCloudRowDeleted(args) {
+  let path3;
+  try {
+    path3 = relative3(workspaceMirrorPath(args.workspaceSlug), args.absolutePath);
+  } catch {
+    path3 = args.absolutePath;
+  }
+  const withoutStale = removeUnsynced(args.state, "entity", path3).state;
+  return persist(withoutStale, upsertRejected(withoutStale, {
+    target: "entity",
+    op: "upsert",
+    path: path3,
+    status: 404,
+    reason: CLOUD_ROW_DELETED_REASON,
+    message: "This was deleted in Plinth, and your copy has changes the cloud never " + "saw. Nothing can push it back — Plinth has no row for it. Keep the " + "file as your own, or delete it. To put the text into Plinth again, " + "copy it into a NEW file with a different name and no `id:`, `slug:` " + "or `revision:` lines.",
+    rejected_at: args.now().toISOString()
+  }));
+}
+function clearEntityCloudRowDeleted(state, path3) {
+  const list = state.rejected ?? [];
+  const next = list.filter((o) => !(o.target === "entity" && o.path === path3 && o.reason === CLOUD_ROW_DELETED_REASON));
+  if (next.length === list.length)
+    return state;
+  return commitState(state, { ...state, rejected: next });
+}
+function humanBytes(bytes) {
+  if (bytes >= 1e6)
+    return `${(bytes / 1e6).toFixed(1)} MB`;
+  if (bytes >= 1000)
+    return `${Math.round(bytes / 1000)} KB`;
+  return `${bytes} bytes`;
+}
+function recordFileOverCap(args) {
+  const withoutStale = removeUnsynced(args.state, "file", args.relPath).state;
+  const ceiling = args.source === "server" ? `the ${humanBytes(args.max)} server limit` : `the ${humanBytes(args.max)} upload ceiling (measured platform limit)`;
+  const message = args.tracked ? `Your local change to this file (${humanBytes(args.size)}) exceeds ${ceiling}, ` + `so it cannot be pushed. The copy in Plinth is unchanged; your edit is on disk here only.` : `${humanBytes(args.size)} exceeds ${ceiling}. The file is still on disk ` + `here but is not in Plinth; shrink or split it to sync it.`;
+  return persist(withoutStale, upsertRejected(withoutStale, {
+    target: "file",
+    op: "upsert",
+    path: args.relPath,
+    status: 413,
+    reason: "over_cap",
+    message,
+    rejected_at: args.now().toISOString()
+  }));
+}
+function recordFileSymlinkRefused(args) {
+  const withoutStale = removeUnsynced(args.state, "file", args.relPath).state;
+  return persist(withoutStale, upsertRejected(withoutStale, {
+    target: "file",
+    op: args.op,
+    path: args.relPath,
+    status: 0,
+    reason: "symlink",
+    message: `A symlink on the path to files/${args.relPath} means syncing it would ` + `read or write outside your Plinth folder, so it was left alone. ` + `Replace the link with a real folder or file to sync it.`,
+    rejected_at: args.now().toISOString()
+  }));
+}
+function recordEntitySymlinkRefused(args) {
+  const path3 = args.mirrorRelativePath;
+  const withoutStale = removeUnsynced(args.state, "entity", path3).state;
+  return persist(withoutStale, upsertRejected(withoutStale, {
+    target: "entity",
+    op: args.op,
+    path: path3,
+    status: 0,
+    reason: "symlink",
+    message: `A symlink on the path to ${path3} means syncing it would read or write ` + `outside your Plinth folder, so it was left alone. Replace the link ` + `with a real folder or file to sync it.`,
+    rejected_at: args.now().toISOString()
+  }));
+}
+function clearSymlinkRefused(state, target, path3) {
+  const list = state.rejected ?? [];
+  const next = list.filter((o) => !(o.target === target && o.path === path3 && o.reason === "symlink"));
+  if (next.length === list.length)
+    return state;
+  return commitState(state, { ...state, rejected: next });
+}
+function clearEntityRejected(state, workspaceSlug, absolutePath) {
+  let path3;
+  try {
+    path3 = relative3(workspaceMirrorPath(workspaceSlug), absolutePath);
+  } catch {
+    path3 = absolutePath;
+  }
+  const next = removeRejected(state, "entity", path3);
+  if (!next.changed)
+    return state;
+  return commitState(state, next.state);
+}
+function clearFileRejected(state, relPath) {
+  const next = removeRejected(state, "file", relPath);
+  if (!next.changed)
+    return state;
+  return commitState(state, next.state);
+}
+
+// src/lib/context/workspace-claude-md.ts
+var EXTRACTED_TEXT_DIR = extractedTextRelPath("x").replace(/x\.md$/, "");
+function rosterBlock(roster, activeProjectCountBySlug) {
+  if (roster.length === 0)
+    return "_No artists synced yet._";
+  return roster.map((a) => {
+    const statusPart = a.status ? `, ${a.status}` : "";
+    const n = activeProjectCountBySlug.get(a.slug) ?? 0;
+    const projects = `${n} active project${n === 1 ? "" : "s"}`;
+    return `- **${a.name}** (\`${a.slug}\`${statusPart}) · ${projects} · master context → \`artists/${a.slug}/_artist.md\``;
+  }).join(`
+`);
+}
+function emptyNote(folders, names) {
+  if (folders === undefined)
+    return "";
+  const byName = new Map(folders.map((f) => [f.name, f.empty]));
+  const empty = names.filter((n) => byName.get(n) === true);
+  if (empty.length === 0)
+    return "";
+  const list = empty.map((n) => `\`${n}/\``).join(" ");
+  return ` · empty so far: ${list}`;
+}
+function buildWorkspaceClaudeMd(input) {
+  const {
+    workspaceName,
+    workspaceSlug,
+    roster,
+    activeProjectCountBySlug,
+    schemaVersion,
+    folders
+  } = input;
+  const entityLines = ENTITY_CATALOG.map((e) => `- **${e.label}**: ${e.blurb}${e.file ? "" : " _(MCP only)_"}`);
+  const skillLines = SKILL_LOCATIONS.map((s) => `- ${s.label}: ${s.detail}`);
+  const skillCount = SKILL_LOCATIONS.length;
+  const lines = [
+    `<!-- plinth-schema-version: ${schemaVersion} -->`,
+    `<!-- Auto-generated by Plinth. ${GENERATED_AT_PREFIX}${GENERATED_AT_PLACEHOLDER}; ` + `that stamp moves only when this file's content changes, so an unchanged file keeps an older one ` + `and is still re-checked against Plinth on every sync. Run \`plinth status\` for when the mirror last synced. ` + `Edit only between the BEGIN/END markers below; everything else is overwritten on sync. -->`,
+    ``,
+    `# ${workspaceName} · Plinth workspace`,
+    ``,
+    `Local mirror of the **${workspaceName}** workspace (\`${workspaceSlug}\`). ${SECURITY_NOTE}`,
+    ``,
+    `> **Session grounding**: the current date, an entity-resolution rule, and a write-confirmation rule are injected at every session start by the Plinth hook in \`.claude/settings.json\` (and each \`artists/<slug>/.claude/settings.json\`).`,
+    ``,
+    `> **Filing a file the user hands you - BOTH halves, and the first one is unconditional**: put a copy in \`files/\`, which is how Plinth gets the text (folder map below) - do this even if everything else here fails. **A file over ${humanBytes(MAX_WORKSPACE_FILE_BYTES)} is refused and never reaches Plinth at all**, so its copy stays on this machine only and \`plinth status\` lists it as rejected; that ceiling decides whether the file syncs, and is not the separate limit on how much text is extracted from one. Over it, the second half below stops being the tidy option and becomes the only record that survives. Then put the **original** in the user's own file storage with whatever tool you have for that, and write down where it went in a memory file, routed by the scope rule in your session grounding. A pointer that exists only in this conversation is lost when it ends. If you have no tool that reaches their file storage, SAY SO - do not leave them believing the original was filed.`,
+    ``,
+    `## Folder map`,
+    `- \`artists/<slug>/\` one folder per artist, the working dir for artist-scoped sessions · \`threads/<slug>/_thread.md\` one folder per thread${emptyNote(folders, ["artists", "threads"])}`,
+    `- \`projects/\` \`tasks/\` \`documents/\` \`meetings/\` workspace-root flat entity files (one \`.md\` per entity, NOT nested under \`artists/\`, so one artist's rows are found by matching \`artist_id:\` in their frontmatter against that artist's own \`id:\` in \`artists/<slug>/_artist.md\`, never by matching the artist's name: a name match returned 16 of one artist's 46 projects and read as "no such project")${emptyNote(folders, ["projects", "tasks", "documents", "meetings"])}`,
+    `- \`files/\` free-form document store: PDFs, executed agreements, spreadsheets, anything that is a FILE rather than an entity. Mirrored byte-for-byte both ways, folders and all${emptyNote(folders, [FILES_SUBTREE_DIR])}`,
+    `- \`${extractedTextRelPath("<path>")}\` where \`<path>\` is the file's path under \`files/\`: the text Plinth extracted from that file, so a PDF's contents can be searched. Not every file has one - text files are already their own text, and extraction can fail. Where it produced junk the file exists and says so instead of carrying it, so read what is there before trusting a silence. Derived: edits here are overwritten and never reach Plinth`,
+    `- \`.claude/commands/\` local skills, incl. generated \`${START_COMMAND_INVOCATION}\` + \`${CLOSE_COMMAND_INVOCATION}\` + \`${ONBOARD_COMMAND_INVOCATION}\` · at the mirror root: \`workspace-memory.md\` \`workspace-rules.md\` (workspace-wide) + \`user-memory.md\` (yours), synced to Plinth · \`voice.md\` (yours: how you write, read by the agent, edited only by you) · \`CLAUDE.local.md\` private, gitignored`,
+    ``,
+    `## Where key context lives: look here before hunting`,
+    `- Each artist's **master context** (stable profile + current state) → \`artists/<slug>/_artist.md\`; edit its body and the daemon syncs both ways. Blocks labelled "rendered from Plinth" are the exception: they are overwritten on the next sync`,
+    `- **Contracts, executed agreements & any PDF** → \`files/\` (search here first; \`documents/\` holds markdown bodies, not attachments)`,
+    `- Workspace-wide **notes, briefs, bios & context docs** → \`documents/\` (one markdown file per doc, shared across artists)`,
+    `- Per-artist long-term facts → \`artists/<slug>/memory.md\`, which syncs to that artist's Plinth record; most have none yet, and creating the file is how you start one · what a session did → a dated section under \`## Session log\` in \`artists/<slug>/_artist.md\`, which syncs too · which fact belongs in which file is stated once in your session grounding · \`artists/<slug>/daily-log.md\` is local scratch, never synced and no longer created; an older one may hold real history, and nothing writes there now`,
+    `- ${MCP_AVAILABILITY_POINTER}`,
+    ``,
+    `## Navigating the corpus`,
+    `- **What points at X?** → \`plinth backlinks "<name>"\`, a mirror path, or a wikilink target as written. Render-only blocks, code spans and comments are narrowed out; \`--unfiltered\` shows them. A bare name several files answer to is refused with the candidates listed, so re-run with the path it names`,
+    `- **What does this file link to?** → grep \`[[\` in it`,
+    `- **Find a file by name** → glob under \`files/\` \`documents/\` \`artists/\` · **text inside a PDF** → \`${EXTRACTED_TEXT_DIR}\` (folder map above) · **write to a row you have the mirror file for** → pass its frontmatter \`id:\` to the \`mcp__plinth__*\` write tool; if you do not have the file, find it with \`search_entities\` / \`list_*\``,
+    ``,
+    `## Entity model: ${MCP_INTROSPECTION_POINTER}`,
+    ...entityLines,
+    ``,
+    `## Roster (${roster.length})`,
+    rosterBlock(roster, activeProjectCountBySlug),
+    ``,
+    `## Skills: ${skillCount} discoverable location${skillCount === 1 ? "" : "s"}`,
+    ...skillLines,
+    ``,
+    USER_BLOCK_BEGIN,
+    USER_BLOCK_PLACEHOLDER,
+    USER_BLOCK_END
+  ];
+  return lines.join(`
+`) + `
+`;
+}
+
+// src/lib/context/generate.ts
+var CLAUDE_MD = "CLAUDE.md";
+var CLAUDE_LOCAL_MD = "CLAUDE.local.md";
+var GITIGNORE = ".gitignore";
+var GITIGNORE_ENTRIES = [
+  CLAUDE_LOCAL_MD,
+  "**/.claude/settings.json",
+  "**/.claude/settings.local.json"
+];
+var CLAUDE_LOCAL_STUB = "<!-- Per-user overrides for this workspace. Private, gitignored, and " + `never overwritten by Plinth. Run /onboard to populate, or edit freely. -->
+`;
+function currentSchemaVersion() {
+  return computeSchemaVersion({
+    templateVersion: TEMPLATE_VERSION,
+    entityCatalog: ENTITY_CATALOG,
+    skillLocations: SKILL_LOCATIONS,
+    securityNote: SECURITY_NOTE,
+    mcpAvailabilityPointer: MCP_AVAILABILITY_POINTER
+  });
+}
+function ensureWorkspaceContext(deps) {
+  const { workspaceSlug, workspaceName, force, out, now } = deps;
+  const version2 = currentSchemaVersion();
+  const roster = readRoster(workspaceSlug);
+  const activeProjectCountBySlug = activeProjectCountsBySlug(workspaceSlug, loadState(workspaceSlug));
+  const generated = buildWorkspaceClaudeMd({
+    workspaceName,
+    workspaceSlug,
+    roster,
+    activeProjectCountBySlug,
+    schemaVersion: version2,
+    folders: observeMirrorFolders(workspaceSlug, [
+      ...allEntityTypes(),
+      FILES_SUBTREE_DIR
+    ])
+  });
+  const existing = readContextFile(workspaceSlug, CLAUDE_MD);
+  const decision = decideRegen({
+    existing,
+    currentVersion: "",
+    generated,
+    force,
+    normalise: normaliseGeneratedAt
+  });
+  if (decision.action === "backup-regen" && decision.backup !== undefined) {
+    const bakRel = `${CLAUDE_MD}.bak-${backupStamp3(now())}`;
+    writeContextFile(workspaceSlug, bakRel, decision.backup);
+    out.warn(`${CLAUDE_MD} had no recognisable BEGIN/END markers; backed your copy ` + `up to ${bakRel} before regenerating.`);
+  }
+  if (decision.content !== null) {
+    writeContextFile(workspaceSlug, CLAUDE_MD, renderGeneratedAt(decision.content, now()));
+  }
+  if (!existsSync2(contextFilePath(workspaceSlug, CLAUDE_LOCAL_MD))) {
+    writeContextFile(workspaceSlug, CLAUDE_LOCAL_MD, CLAUDE_LOCAL_STUB);
+  }
+  ensureWorkspaceCommands({ workspaceSlug, force, out, now });
+  ensureGitignore(workspaceSlug);
+  const resolved = resolvePlinthBinary();
+  reportResolution(out, resolved);
+  if (ensureSessionHook(workspaceSlug, "", out, resolved) === "skipped") {
+    deps.onHookSkipped?.();
+  }
+  if (decision.action === "create") {
+    out.info(`Generated ${CLAUDE_MD} (${roster.length} artists).`);
+  } else if (decision.action === "regen" || decision.action === "backup-regen") {
+    out.info(`Refreshed ${CLAUDE_MD} (your edits preserved).`);
+  }
+}
+function ensureGitignore(workspaceSlug) {
+  const existing = readContextFile(workspaceSlug, GITIGNORE);
+  const present2 = new Set((existing ?? "").split(`
+`).map((l) => l.trim()).filter(Boolean));
+  const missing = GITIGNORE_ENTRIES.filter((e) => !present2.has(e));
+  if (missing.length === 0)
+    return;
+  const block = `${missing.join(`
+`)}
+`;
+  if (existing === null || existing === "") {
+    writeContextFile(workspaceSlug, GITIGNORE, block);
+    return;
+  }
+  const lead = existing.endsWith(`
+`) ? "" : `
+`;
+  writeContextFile(workspaceSlug, GITIGNORE, `${existing}${lead}${block}`);
+}
+function backupStamp3(d) {
+  return d.toISOString().replace(/[-:.]/g, "").replace("Z", "");
+}
+
+// src/commands/refresh-context.ts
+init_output();
+function runRefreshContext(workspaceSlug, deps = {}) {
+  const out = new Output({ sink: deps.sink, noColor: deps.noColor });
+  const now = deps.now ?? (() => new Date);
+  const config2 = loadConfig();
+  if (!config2) {
+    out.error("No workspace configured. Run `plinth login --workspace <slug>` first.");
+    return 1;
+  }
+  const slug = workspaceSlug ?? config2.active_workspace;
+  const entry2 = config2.workspaces[slug];
+  if (!entry2) {
+    out.error(`Workspace "${slug}" not found. Run \`plinth login --workspace ${slug}\` first.`);
+    return 1;
+  }
+  let skipped = 0;
+  const onHookSkipped = () => {
+    skipped++;
+  };
+  try {
+    ensureWorkspaceContext({
+      workspaceSlug: slug,
+      workspaceName: entry2.workspace_name ?? slug,
+      force: true,
+      out,
+      now,
+      onHookSkipped
+    });
+    ensurePerArtistContext({
+      workspaceSlug: slug,
+      force: true,
+      out,
+      now,
+      onHookSkipped
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "unknown error";
+    out.error(`Could not refresh context: ${msg}`);
+    return 1;
+  }
+  if (skipped > 0) {
+    out.error(`Context refreshed, but ${skipped} Claude Code hook mount${skipped === 1 ? " was" : "s were"} ` + `SKIPPED — ${skipped === 1 ? "that location is" : "those locations are"} ungrounded and ` + `agent-originated drafts there are UNGATED. See the errors above.`);
+    return 1;
+  }
+  out.success(`Context up to date for ${slug}.`);
+  return 0;
+}
+var refreshContextCommand = defineCommand({
   meta: {
     name: "refresh-context",
     description: "Regenerate CLAUDE.md from the current Plinth schema + workspace"
@@ -29930,8 +30936,8 @@ var sessionCommand = defineCommand({
 });
 
 // src/commands/start.ts
-var import_gray_matter12 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync23, statSync as statSync15 } from "node:fs";
+var import_gray_matter13 = __toESM(require_gray_matter(), 1);
+import { existsSync as existsSync8, readFileSync as readFileSync24, statSync as statSync16 } from "node:fs";
 
 // src/lib/daemon-log.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9, renameSync as renameSync7, statSync as statSync4 } from "node:fs";
@@ -29998,7 +31004,7 @@ class DaemonLog {
 
 // src/lib/destructive-gate.ts
 var import_gray_matter7 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync12, statSync as statSync5 } from "node:fs";
+import { readFileSync as readFileSync13, statSync as statSync5 } from "node:fs";
 import { basename as basename3 } from "node:path";
 var GUTTING_RATIO_DEFAULT = 0.5;
 var GUTTING_MIN_PRIOR_BYTES = 200;
@@ -30042,7 +31048,7 @@ function classifyDestructive(event, entityType, state, deps = {}) {
       absolutePath: event.absolutePath
     };
   }
-  const readFile = deps.readFile ?? ((p) => readFileSync12(p, "utf8"));
+  const readFile = deps.readFile ?? ((p) => readFileSync13(p, "utf8"));
   const statInode = deps.statInode ?? ((p) => {
     try {
       return statSync5(p).ino;
@@ -30081,670 +31087,186 @@ function classifyDestructive(event, entityType, state, deps = {}) {
     newLen
   };
 }
-function defaultThresholds() {
-  return {
-    absCount: envInt("PLINTH_GATE_ABS_COUNT", 3),
-    propMinOps: envInt("PLINTH_GATE_PROP_MIN_OPS", 2),
-    propPct: envFloat("PLINTH_GATE_PROP_PCT", 0.5)
-  };
-}
-function evaluateBatch(ops, typePopulations, thresholds = defaultThresholds()) {
-  const count = ops.length;
-  if (count === 0)
-    return { tripped: false };
-  if (count >= thresholds.absCount) {
-    return { tripped: true, reason: { kind: "count", count } };
-  }
-  const byType = new Map;
-  for (const op of ops) {
-    byType.set(op.entityType, (byType.get(op.entityType) ?? 0) + 1);
-  }
-  for (const [entityType, typeCount] of byType) {
-    const typePopulation = typePopulations[entityType] ?? typeCount;
-    if (typeCount >= thresholds.propMinOps && typePopulation > 0 && typeCount >= thresholds.propPct * typePopulation) {
-      return {
-        tripped: true,
-        reason: {
-          kind: "proportion",
-          count,
-          entityType,
-          typeCount,
-          typePopulation,
-          pct: typeCount / typePopulation
-        }
-      };
-    }
-  }
-  return { tripped: false };
-}
-function dedupeOps(ops) {
-  const byKey = new Map;
-  for (const op of ops)
-    byKey.set(`${op.entityType}:${op.id}`, op);
-  return Array.from(byKey.values());
-}
-var DEFAULT_SETTLE_MS = 600;
-var DEFAULT_MAX_BATCH = 500;
-
-class DestructiveGate {
-  pending = [];
-  timer = null;
-  settleMs;
-  maxBatch;
-  onSettle;
-  onError;
-  constructor(opts) {
-    this.settleMs = opts.settleMs ?? DEFAULT_SETTLE_MS;
-    this.maxBatch = opts.maxBatch ?? DEFAULT_MAX_BATCH;
-    this.onSettle = opts.onSettle;
-    this.onError = opts.onError;
-  }
-  consider(op) {
-    this.pending.push(op);
-    if (this.pending.length >= this.maxBatch) {
-      this.flush();
-      return;
-    }
-    if (this.timer)
-      clearTimeout(this.timer);
-    this.timer = setTimeout(() => {
-      this.flush();
-    }, this.settleMs);
-  }
-  async drain() {
-    await this.flush();
-  }
-  size() {
-    return this.pending.length;
-  }
-  async flush() {
-    if (this.timer) {
-      clearTimeout(this.timer);
-      this.timer = null;
-    }
-    if (this.pending.length === 0)
-      return;
-    const batch = this.pending;
-    this.pending = [];
-    try {
-      await this.onSettle(batch);
-    } catch (err) {
-      this.onError?.(err);
-    }
-  }
-}
-
-// src/lib/resolve-pending.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-
-// src/lib/conflicts.ts
-import { mkdirSync as mkdirSync10, readdirSync as readdirSync5, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname7, join as join11 } from "node:path";
-function conflictsRoot(workspaceSlug) {
-  return join11(plinthHome(), "_conflicts", workspaceSlug);
-}
-function conflictFilePath(args) {
-  const { workspaceSlug, entityType, entitySlug, timestamp } = args;
-  const iso = timestamp.toISOString().replace(/[:.]/g, "-");
-  return join11(conflictsRoot(workspaceSlug), `${entityType}.${entitySlug}.${iso}.md`);
-}
-function stashConflict(args) {
-  const target = conflictFilePath(args);
-  mkdirSync10(dirname7(target), { recursive: true, mode: 448 });
-  writeFileSync7(target, args.contents, { mode: 384 });
-  return target;
-}
-function fileConflictPath(args) {
-  const { workspaceSlug, relPath, timestamp } = args;
-  const iso = timestamp.toISOString().replace(/[:.]/g, "-");
-  const safe = relPath.replace(/[/\\]/g, "__");
-  return join11(conflictsRoot(workspaceSlug), `files.${safe}.${iso}`);
-}
-function stashFileConflict(args) {
-  const target = fileConflictPath(args);
-  mkdirSync10(dirname7(target), { recursive: true, mode: 448 });
-  writeFileSync7(target, args.bytes, { mode: 384 });
-  return target;
-}
-var STAMP_RE2 = /\.(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)(\.md)?$/;
-function parseStamp(stamp) {
-  const iso = stamp.replace(/T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/, "T$1:$2:$3.$4Z");
-  const d = new Date(iso);
-  return Number.isNaN(d.getTime()) ? null : d;
-}
-function labelFor(file2) {
-  const m = STAMP_RE2.exec(file2);
-  if (!m)
-    return file2;
-  const head = file2.slice(0, m.index);
-  if (head.startsWith("files.")) {
-    return `files/${head.slice("files.".length).replace(/__/g, "/")}`;
-  }
-  const dot = head.indexOf(".");
-  if (dot === -1)
-    return head;
-  return `${head.slice(0, dot)}/${head.slice(dot + 1)}`;
-}
-function listConflictStashes(workspaceSlug) {
-  const dir = conflictsRoot(workspaceSlug);
-  let names;
-  try {
-    names = readdirSync5(dir);
-  } catch {
-    return [];
-  }
-  const out = [];
-  for (const file2 of names) {
-    const absPath = join11(dir, file2);
-    let st;
-    try {
-      st = statSync6(absPath);
-    } catch {
-      continue;
-    }
-    if (!st.isFile())
-      continue;
-    if (file2.startsWith("."))
-      continue;
-    const m = STAMP_RE2.exec(file2);
-    out.push({
-      file: file2,
-      absPath,
-      label: labelFor(file2),
-      stashedAt: m ? parseStamp(m[1]) : null,
-      mtimeMs: st.mtimeMs
-    });
-  }
-  return out.sort((a, b) => (b.stashedAt?.getTime() ?? b.mtimeMs) - (a.stashedAt?.getTime() ?? a.mtimeMs));
-}
-
-// src/lib/files/push.ts
-import { readFileSync as readFileSync13, statSync as statSync7 } from "node:fs";
-
-// src/lib/log-tokens.ts
-function categorizeError(err) {
-  if (err instanceof FrontmatterValidationError) {
-    return { status: 422, reason: "invalid_frontmatter", detail: err.detail };
-  }
-  if (err instanceof ApiError) {
-    const { status } = err;
-    if (status === 0)
-      return { status, reason: "network" };
-    if (status === 401 || status === 403)
-      return { status, reason: "auth" };
-    if (status === 429)
-      return { status, reason: "rate_limit" };
-    if (status === 400 || status === 422) {
-      const serverMessage = sanitizeServerMessage(err.message);
-      return serverMessage ? { status, reason: "bad_request", serverMessage } : { status, reason: "bad_request" };
-    }
-    if (status >= 500 && status <= 599)
-      return { status, reason: "server" };
-    return { status, reason: "http" };
-  }
-  return { status: 0, reason: "unexpected" };
-}
-function sanitizeServerMessage(message) {
-  const oneLine = message.replace(/\s+/g, " ").trim();
-  if (oneLine.length === 0)
-    return "";
-  return oneLine.length > 200 ? `${oneLine.slice(0, 197)}...` : oneLine;
-}
-function pushFailedLine(f) {
-  const idPart = f.id ? ` id=${f.id}` : "";
-  const detailPart = f.detail ? ` detail=${f.detail}` : "";
-  const serverPart = f.serverMessage ? ` server_msg="${f.serverMessage}"` : "";
-  return `[PUSH_FAILED entityType=${f.entityType} slug=${f.slug}${idPart} status=${f.status} reason=${f.reason}${detailPart}${serverPart}]`;
-}
-function pullFailedLine(f) {
-  return `[PULL_FAILED status=${f.status} reason=${f.reason}]`;
-}
-function contextDocConflictLine(f) {
-  const localIdPart = f.localId ? ` localId=${f.localId}` : "";
-  const reasonPart = f.reason ? ` reason=${f.reason}` : "";
-  const stashPart = f.stash ? ` stash=${f.stash}` : "";
-  return `[CONTEXT_DOC_CONFLICT entityType=${f.entityType} localSlug=${f.localSlug}${localIdPart} ` + `existingSlug=${f.existingSlug} existingId=${f.existingId} scope=${f.scope} ` + `action=${f.action}${reasonPart}${stashPart}]`;
-}
-function syncErrorLine(f) {
-  return `[SYNC_ERROR entityType=${f.entityType} slug=${f.slug} id=${f.id} ` + `fields=${f.fields.join(",")} pushed=${f.pushed}]`;
-}
-function filePushLine(f) {
-  return `[FILE_PUSH path=${f.path} id=${f.id} action=${f.action}]`;
-}
-function fileDeleteLine(f) {
-  const notePart = f.note ? ` note=${f.note}` : "";
-  return `[FILE_DELETE path=${f.path} id=${f.id}${notePart}]`;
-}
-function fileOverCapLine(f) {
-  return `[FILE_OVER_CAP path=${f.path} size=${f.size} max=${f.max} max_from=${f.source}]`;
-}
-function fileConflictLine(f) {
-  return `[FILE_CONFLICT path=${f.path} stash=${f.stash}]`;
-}
-function conflictsViewFailedLine(f) {
-  const msg = f.message === undefined ? "" : sanitizeServerMessage(f.message);
-  const msgPart = msg === "" ? "" : ` message="${msg.replace(/"/g, "'")}"`;
-  return `[CONFLICTS_VIEW_FAILED path=${f.path} reason=${f.reason}${msgPart}]`;
-}
-function fileFailedLine(f) {
-  const detailPart = f.detail ? ` detail=${f.detail}` : "";
-  const serverPart = f.serverMessage ? ` server_msg="${f.serverMessage}"` : "";
-  return `[FILE_PUSH_FAILED path=${f.path} status=${f.status} reason=${f.reason}${detailPart}${serverPart}]`;
-}
-function frontmatterIdBackfillLine(r) {
-  return `[FRONTMATTER_ID_BACKFILL scanned=${r.scanned} written=${r.written} ` + `inodes_restamped=${r.inodesRestamped} failed=${r.failed} ` + `skipped_frozen=${r.skipped.frozen} ` + `skipped_foreign_id=${r.skipped.foreignId} ` + `skipped_no_frontmatter=${r.skipped.noFrontmatter} ` + `skipped_slug_collision=${r.skipped.slugCollision} ` + `skipped_diverged=${r.skipped.diverged}]`;
-}
-function pullNoticeLine(kind) {
-  const token = kind === "auth" ? "PULL_PAUSED" : "PULL_DEGRADED";
-  return `[${token} reason=${kind}]`;
-}
-function calendarProjectedLine(f) {
-  return `[CALENDAR_PROJECTED written=${f.written} pruned=${f.pruned} ` + `calendars=${f.calendars} not_read=${f.notRead}]`;
-}
-function calendarFailedLine(f) {
-  const serverPart = f.serverMessage ? ` server_msg="${f.serverMessage}"` : "";
-  return `[CALENDAR_FAILED status=${f.status} reason=${f.reason} staled=${f.staled}${serverPart}]`;
-}
-function calendarNoticeLine(kind) {
-  const token = kind === "auth" ? "CALENDAR_PAUSED" : kind === "unsupported" ? "CALENDAR_UNSUPPORTED" : "CALENDAR_DEGRADED";
-  return `[${token} reason=${kind}]`;
-}
-
-// src/lib/rejected.ts
-import { relative as relative3 } from "node:path";
-var PERMANENT_REJECT_REASONS = new Set(["bad_request", "invalid_frontmatter"]);
-function isPermanentReject(err) {
-  return PERMANENT_REJECT_REASONS.has(categorizeError(err).reason);
-}
-function persist(state, next) {
-  if (!next.changed)
-    return state;
-  return commitState(state, next.state);
-}
-function recordEntityRejected(args) {
-  const cat = categorizeError(args.err);
-  let path5;
-  try {
-    path5 = relative3(workspaceMirrorPath(args.workspaceSlug), args.absolutePath);
-  } catch {
-    path5 = args.absolutePath;
-  }
-  const withoutStale = removeUnsynced(args.state, "entity", path5).state;
-  return persist(withoutStale, upsertRejected(withoutStale, {
-    target: "entity",
-    op: args.op,
-    path: path5,
-    status: cat.status,
-    reason: cat.reason,
-    detail: cat.detail,
-    message: cat.serverMessage,
-    rejected_at: args.now().toISOString()
-  }));
-}
-function recordFileRejected(args) {
-  const cat = categorizeError(args.err);
-  const withoutStale = removeUnsynced(args.state, "file", args.relPath).state;
-  return persist(withoutStale, upsertRejected(withoutStale, {
-    target: "file",
-    op: args.op,
-    path: args.relPath,
-    status: cat.status,
-    reason: cat.reason,
-    detail: cat.detail,
-    message: cat.serverMessage,
-    rejected_at: args.now().toISOString()
-  }));
-}
-function humanBytes(bytes) {
-  if (bytes >= 1e6)
-    return `${(bytes / 1e6).toFixed(1)} MB`;
-  if (bytes >= 1000)
-    return `${Math.round(bytes / 1000)} KB`;
-  return `${bytes} bytes`;
-}
-function recordFileOverCap(args) {
-  const withoutStale = removeUnsynced(args.state, "file", args.relPath).state;
-  const ceiling = args.source === "server" ? `the ${humanBytes(args.max)} server limit` : `the ${humanBytes(args.max)} upload ceiling (measured platform limit)`;
-  const message = args.tracked ? `Your local change to this file (${humanBytes(args.size)}) exceeds ${ceiling}, ` + `so it cannot be pushed. The copy in Plinth is unchanged; your edit is on disk here only.` : `${humanBytes(args.size)} exceeds ${ceiling}. The file is still on disk ` + `here but is not in Plinth; shrink or split it to sync it.`;
-  return persist(withoutStale, upsertRejected(withoutStale, {
-    target: "file",
-    op: "upsert",
-    path: args.relPath,
-    status: 413,
-    reason: "over_cap",
-    message,
-    rejected_at: args.now().toISOString()
-  }));
-}
-function recordFileSymlinkRefused(args) {
-  const withoutStale = removeUnsynced(args.state, "file", args.relPath).state;
-  return persist(withoutStale, upsertRejected(withoutStale, {
-    target: "file",
-    op: args.op,
-    path: args.relPath,
-    status: 0,
-    reason: "symlink",
-    message: `A symlink on the path to files/${args.relPath} means syncing it would ` + `read or write outside your Plinth folder, so it was left alone. ` + `Replace the link with a real folder or file to sync it.`,
-    rejected_at: args.now().toISOString()
-  }));
-}
-function recordEntitySymlinkRefused(args) {
-  const path5 = args.mirrorRelativePath;
-  const withoutStale = removeUnsynced(args.state, "entity", path5).state;
-  return persist(withoutStale, upsertRejected(withoutStale, {
-    target: "entity",
-    op: args.op,
-    path: path5,
-    status: 0,
-    reason: "symlink",
-    message: `A symlink on the path to ${path5} means syncing it would read or write ` + `outside your Plinth folder, so it was left alone. Replace the link ` + `with a real folder or file to sync it.`,
-    rejected_at: args.now().toISOString()
-  }));
-}
-function clearSymlinkRefused(state, target, path5) {
-  const list = state.rejected ?? [];
-  const next = list.filter((o) => !(o.target === target && o.path === path5 && o.reason === "symlink"));
-  if (next.length === list.length)
-    return state;
-  return commitState(state, { ...state, rejected: next });
-}
-function clearEntityRejected(state, workspaceSlug, absolutePath) {
-  let path5;
-  try {
-    path5 = relative3(workspaceMirrorPath(workspaceSlug), absolutePath);
-  } catch {
-    path5 = absolutePath;
-  }
-  const next = removeRejected(state, "entity", path5);
-  if (!next.changed)
-    return state;
-  return commitState(state, next.state);
-}
-function clearFileRejected(state, relPath) {
-  const next = removeRejected(state, "file", relPath);
-  if (!next.changed)
-    return state;
-  return commitState(state, next.state);
-}
-
-// src/lib/files/api.ts
-var MAX_WORKSPACE_FILE_BYTES = 4000000;
-var HASH_RE = /^[0-9a-f]{64}$/;
-var TextQualitySchema = exports_external.enum(["ok", "partial", "garbled"]);
-var FileLiveSchema = exports_external.object({
-  id: exports_external.string().uuid(),
-  path: exports_external.string().min(1),
-  mime_type: exports_external.string(),
-  size_bytes: exports_external.number().int().nonnegative(),
-  content_hash: exports_external.string().regex(HASH_RE),
-  artist_id: exports_external.string().uuid().nullable(),
-  project_id: exports_external.string().uuid().nullable(),
-  updated_at: exports_external.string().datetime({ offset: true }),
-  deleted_at: exports_external.null(),
-  last_edited_by: exports_external.string().uuid().nullable(),
-  content_quality: TextQualitySchema.nullable().optional().default(null).catch(null),
-  has_extracted_text: exports_external.boolean().optional().catch(undefined),
-  has_stored_bytes: exports_external.boolean().optional().catch(undefined)
-});
-function storedBytesSignal(row) {
-  if (row.has_stored_bytes === true)
-    return "present";
-  if (row.has_stored_bytes === false)
-    return "absent";
-  return "unknown";
-}
-function extractedTextSignal(row) {
-  if (row.has_extracted_text === true)
-    return "present";
-  if (row.has_extracted_text === false)
-    return "absent";
-  return "unknown";
-}
-var FileTombstoneSchema = exports_external.object({
-  id: exports_external.string().uuid(),
-  path: exports_external.string().min(1),
-  updated_at: exports_external.string().datetime({ offset: true }),
-  deleted_at: exports_external.string().datetime({ offset: true })
-});
-var FileRowSchema = exports_external.union([FileLiveSchema, FileTombstoneSchema]);
-var FilesPageSchema = exports_external.object({
-  files: exports_external.array(FileRowSchema),
-  next_cursor: exports_external.string().nullable()
-});
-var FileWithDownloadSchema = FileLiveSchema.extend({
-  download_url: exports_external.string().url().nullable()
-});
-var FileTextSchema = exports_external.object({
-  id: exports_external.string().uuid(),
-  path: exports_external.string().min(1),
-  mime_type: exports_external.string(),
-  updated_at: exports_external.string().datetime({ offset: true }),
-  content_quality: TextQualitySchema.nullable(),
-  source_uri: exports_external.string().nullable(),
-  text: exports_external.string().nullable(),
-  chars: exports_external.number().int().nonnegative(),
-  withheld: exports_external.enum(["bytes_are_text", "no_text"]).nullable()
-});
-var PreconditionSchema = exports_external.object({
-  code: exports_external.literal("precondition_failed"),
-  current_updated_at: exports_external.string()
-});
-function baseHeaders(pat) {
-  return { Authorization: `Bearer ${pat}`, Accept: "application/json" };
-}
-async function syncFilesPage(args) {
-  const { baseUrl, pat, cursor, limit, fetchImpl = fetch } = args;
-  const params = new URLSearchParams;
-  if (cursor)
-    params.set("since", cursor);
-  if (limit)
-    params.set("limit", String(limit));
-  const qs = params.toString();
-  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files` + (qs.length > 0 ? `?${qs}` : "");
-  let res;
-  try {
-    res = await fetchImpl(url2, { method: "GET", headers: baseHeaders(pat) });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "network error";
-    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
-  }
-  if (res.status === 401) {
-    throw new ApiError(401, "Token was rejected by the server. Run `plinth login --workspace <slug>` to refresh.");
-  }
-  if (res.status === 429) {
-    throw new ApiError(429, "Rate limited by the server. Wait a few seconds and retry.", parseRetryAfterMs(res.headers.get("retry-after")));
-  }
-  if (!res.ok) {
-    throw new ApiError(res.status, `sync files failed with HTTP ${res.status}`);
-  }
-  const body = await res.json();
-  const parsed = FilesPageSchema.safeParse(body);
-  if (!parsed.success) {
-    throw new ApiError(res.status, `sync files response did not match the expected shape: ${parsed.error.message}`);
-  }
-  return { rows: parsed.data.files, next_cursor: parsed.data.next_cursor };
-}
-async function getFile(args) {
-  const { baseUrl, pat, id, fetchImpl = fetch } = args;
-  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files/${id}`;
-  let res;
-  try {
-    res = await fetchImpl(url2, { method: "GET", headers: baseHeaders(pat) });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "network error";
-    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
-  }
-  if (res.status === 404)
-    return { ok: false, code: 404 };
-  if (res.status === 401) {
-    throw new ApiError(401, "Token was rejected by the server.");
-  }
-  if (res.status === 429) {
-    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
-  }
-  if (!res.ok) {
-    throw new ApiError(res.status, `get file failed with HTTP ${res.status}`);
-  }
-  const body = await res.json();
-  const parsed = FileWithDownloadSchema.safeParse(body);
-  if (!parsed.success) {
-    throw new ApiError(res.status, `get file response did not match the expected shape`);
-  }
-  return { ok: true, row: parsed.data };
-}
-async function getFileText(args) {
-  const { baseUrl, pat, id, fetchImpl = fetch } = args;
-  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files/${id}/text`;
-  let res;
-  try {
-    res = await fetchImpl(url2, { method: "GET", headers: baseHeaders(pat) });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "network error";
-    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
-  }
-  if (res.status === 404)
-    return { ok: false, code: 404 };
-  if (res.status === 401) {
-    throw new ApiError(401, "Token was rejected by the server. Run `plinth login --workspace <slug>` to refresh.");
-  }
-  if (res.status === 429) {
-    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+function defaultThresholds() {
+  return {
+    absCount: envInt("PLINTH_GATE_ABS_COUNT", 3),
+    propMinOps: envInt("PLINTH_GATE_PROP_MIN_OPS", 2),
+    propPct: envFloat("PLINTH_GATE_PROP_PCT", 0.5)
+  };
+}
+function evaluateBatch(ops, typePopulations, thresholds = defaultThresholds()) {
+  const count = ops.length;
+  if (count === 0)
+    return { tripped: false };
+  if (count >= thresholds.absCount) {
+    return { tripped: true, reason: { kind: "count", count } };
   }
-  if (!res.ok) {
-    throw new ApiError(res.status, `get file text failed with HTTP ${res.status}`);
+  const byType = new Map;
+  for (const op of ops) {
+    byType.set(op.entityType, (byType.get(op.entityType) ?? 0) + 1);
   }
-  const body = await res.json();
-  const parsed = FileTextSchema.safeParse(body);
-  if (!parsed.success) {
-    throw new ApiError(res.status, `get file text response did not match the expected shape: ${parsed.error.message}`);
+  for (const [entityType, typeCount] of byType) {
+    const typePopulation = typePopulations[entityType] ?? typeCount;
+    if (typeCount >= thresholds.propMinOps && typePopulation > 0 && typeCount >= thresholds.propPct * typePopulation) {
+      return {
+        tripped: true,
+        reason: {
+          kind: "proportion",
+          count,
+          entityType,
+          typeCount,
+          typePopulation,
+          pct: typeCount / typePopulation
+        }
+      };
+    }
   }
-  return { ok: true, row: parsed.data };
+  return { tripped: false };
 }
-async function downloadBytes(downloadUrl, fetchImpl = fetch) {
-  let res;
-  try {
-    res = await fetchImpl(downloadUrl, { method: "GET" });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "network error";
-    throw new ApiError(0, `Could not download bytes: ${msg}`);
-  }
-  if (!res.ok) {
-    throw new ApiError(res.status, `download failed with HTTP ${res.status}`);
-  }
-  const ab = await res.arrayBuffer();
-  return Buffer.from(ab);
+function dedupeOps(ops) {
+  const byKey = new Map;
+  for (const op of ops)
+    byKey.set(`${op.entityType}:${op.id}`, op);
+  return Array.from(byKey.values());
 }
-async function postFile(args) {
-  const {
-    baseUrl,
-    pat,
-    relPath,
-    bytes,
-    contentHash,
-    mimeType,
-    expectedUpdatedAt,
-    fetchImpl = fetch
-  } = args;
-  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files`;
-  const headers = {
-    Authorization: `Bearer ${pat}`,
-    Accept: "application/json",
-    "Content-Type": mimeType,
-    "X-Plinth-File-Path": encodeURIComponent(relPath),
-    "X-Plinth-Content-Hash": contentHash
-  };
-  if (expectedUpdatedAt)
-    headers["X-Plinth-Expected-Updated-At"] = expectedUpdatedAt;
-  let res;
-  try {
-    res = await fetchImpl(url2, { method: "POST", headers, body: bytes });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "network error";
-    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
+var DEFAULT_SETTLE_MS = 600;
+var DEFAULT_MAX_BATCH = 500;
+
+class DestructiveGate {
+  pending = [];
+  timer = null;
+  settleMs;
+  maxBatch;
+  onSettle;
+  onError;
+  constructor(opts) {
+    this.settleMs = opts.settleMs ?? DEFAULT_SETTLE_MS;
+    this.maxBatch = opts.maxBatch ?? DEFAULT_MAX_BATCH;
+    this.onSettle = opts.onSettle;
+    this.onError = opts.onError;
   }
-  if (res.status === 200 || res.status === 201) {
-    const body = await res.json();
-    const parsed = FileLiveSchema.safeParse(body);
-    if (!parsed.success) {
-      throw new ApiError(res.status, `post file response did not match the expected shape`);
+  consider(op) {
+    this.pending.push(op);
+    if (this.pending.length >= this.maxBatch) {
+      this.flush();
+      return;
     }
-    return { ok: true, row: parsed.data };
+    if (this.timer)
+      clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      this.flush();
+    }, this.settleMs);
   }
-  if (res.status === 413) {
-    let maxBytes = null;
-    try {
-      const json2 = await res.json();
-      if (typeof json2.max_bytes === "number")
-        maxBytes = json2.max_bytes;
-    } catch {}
-    return { ok: false, code: 413, maxBytes };
+  async drain() {
+    await this.flush();
   }
-  if (res.status === 409) {
-    const json2 = await res.json();
-    const parsed = PreconditionSchema.safeParse(json2);
-    if (!parsed.success) {
-      throw new ApiError(409, `post file 409 body did not match precondition_failed shape`);
-    }
-    return { ok: false, code: 409, currentUpdatedAt: parsed.data.current_updated_at };
+  size() {
+    return this.pending.length;
   }
-  if (res.status === 400) {
-    let code;
+  async flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    if (this.pending.length === 0)
+      return;
+    const batch = this.pending;
+    this.pending = [];
     try {
-      const json2 = await res.json();
-      code = json2.code;
-    } catch {}
-    if (code === "hash_mismatch")
-      return { ok: false, code: 400, reason: "hash_mismatch" };
-    throw new ApiError(400, "post file rejected as bad request");
-  }
-  if (res.status === 401) {
-    throw new ApiError(401, "Token was rejected by the server.");
+      await this.onSettle(batch);
+    } catch (err) {
+      this.onError?.(err);
+    }
   }
-  if (res.status === 429) {
-    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+}
+
+// src/lib/resolve-pending.ts
+import { readFileSync as readFileSync17 } from "node:fs";
+
+// src/lib/conflicts.ts
+import { mkdirSync as mkdirSync10, readdirSync as readdirSync5, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname7, join as join11 } from "node:path";
+function conflictsRoot(workspaceSlug) {
+  return join11(plinthHome(), "_conflicts", workspaceSlug);
+}
+function conflictFilePath(args) {
+  const { workspaceSlug, entityType, entitySlug, timestamp } = args;
+  const iso = timestamp.toISOString().replace(/[:.]/g, "-");
+  return join11(conflictsRoot(workspaceSlug), `${entityType}.${entitySlug}.${iso}.md`);
+}
+function stashConflict(args) {
+  const target = conflictFilePath(args);
+  mkdirSync10(dirname7(target), { recursive: true, mode: 448 });
+  writeFileSync7(target, args.contents, { mode: 384 });
+  return target;
+}
+function fileConflictPath(args) {
+  const { workspaceSlug, relPath, timestamp } = args;
+  const iso = timestamp.toISOString().replace(/[:.]/g, "-");
+  const safe = relPath.replace(/[/\\]/g, "__");
+  return join11(conflictsRoot(workspaceSlug), `files.${safe}.${iso}`);
+}
+function stashFileConflict(args) {
+  const target = fileConflictPath(args);
+  mkdirSync10(dirname7(target), { recursive: true, mode: 448 });
+  writeFileSync7(target, args.bytes, { mode: 384 });
+  return target;
+}
+var STAMP_RE2 = /\.(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)(\.md)?$/;
+function parseStamp(stamp) {
+  const iso = stamp.replace(/T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/, "T$1:$2:$3.$4Z");
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? null : d;
+}
+function labelFor(file2) {
+  const m = STAMP_RE2.exec(file2);
+  if (!m)
+    return file2;
+  const head = file2.slice(0, m.index);
+  if (head.startsWith("files.")) {
+    return `files/${head.slice("files.".length).replace(/__/g, "/")}`;
   }
-  throw new ApiError(res.status, `post file failed with HTTP ${res.status}`);
+  const dot = head.indexOf(".");
+  if (dot === -1)
+    return head;
+  return `${head.slice(0, dot)}/${head.slice(dot + 1)}`;
 }
-async function deleteFile(args) {
-  const { baseUrl, pat, id, expectedUpdatedAt, fetchImpl = fetch } = args;
-  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files/${id}`;
-  let res;
+function listConflictStashes(workspaceSlug) {
+  const dir = conflictsRoot(workspaceSlug);
+  let names;
   try {
-    res = await fetchImpl(url2, {
-      method: "DELETE",
-      headers: { ...baseHeaders(pat), "X-Plinth-Expected-Updated-At": expectedUpdatedAt }
-    });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "network error";
-    throw new ApiError(0, `Could not reach ${url2}: ${msg}`);
-  }
-  if (res.status === 200) {
-    const body = await res.json();
-    const parsed = FileTombstoneSchema.safeParse(body);
-    if (!parsed.success) {
-      throw new ApiError(200, `delete file response did not match the expected tombstone shape`);
-    }
-    return { ok: true, tombstone: parsed.data };
+    names = readdirSync5(dir);
+  } catch {
+    return [];
   }
-  if (res.status === 404)
-    return { ok: false, code: 404 };
-  if (res.status === 409) {
-    const json2 = await res.json();
-    const parsed = PreconditionSchema.safeParse(json2);
-    if (!parsed.success) {
-      throw new ApiError(409, `delete file 409 body did not match precondition_failed shape`);
+  const out = [];
+  for (const file2 of names) {
+    const absPath = join11(dir, file2);
+    let st;
+    try {
+      st = statSync6(absPath);
+    } catch {
+      continue;
     }
-    return { ok: false, code: 409, currentUpdatedAt: parsed.data.current_updated_at };
-  }
-  if (res.status === 401) {
-    throw new ApiError(401, "Token was rejected by the server.");
-  }
-  if (res.status === 429) {
-    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+    if (!st.isFile())
+      continue;
+    if (file2.startsWith("."))
+      continue;
+    const m = STAMP_RE2.exec(file2);
+    out.push({
+      file: file2,
+      absPath,
+      label: labelFor(file2),
+      stashedAt: m ? parseStamp(m[1]) : null,
+      mtimeMs: st.mtimeMs
+    });
   }
-  throw new ApiError(res.status, `delete file failed with HTTP ${res.status}`);
+  return out.sort((a, b) => (b.stashedAt?.getTime() ?? b.mtimeMs) - (a.stashedAt?.getTime() ?? a.mtimeMs));
 }
 
+// src/lib/files/push.ts
+import { readFileSync as readFileSync14, statSync as statSync7 } from "node:fs";
+
 // src/lib/files/content-hash.ts
 import { createHash as createHash2 } from "node:crypto";
 function sha256Bytes(bytes) {
@@ -30899,7 +31421,7 @@ async function pushFilesUpsert(args) {
         state: next
       };
     }
-    bytes = readFileSync13(absolutePath);
+    bytes = readFileSync14(absolutePath);
     hash2 = sha256Bytes(bytes);
     inode = st.ino;
   }
@@ -31067,15 +31589,60 @@ class PerIdMutex {
 }
 
 // src/lib/push.ts
-var import_gray_matter9 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync15, statSync as statSync8 } from "node:fs";
+var import_gray_matter10 = __toESM(require_gray_matter(), 1);
+import { readFileSync as readFileSync16, statSync as statSync8 } from "node:fs";
 import { basename as basename4, relative as relative4 } from "node:path";
 
-// src/lib/pull-write.ts
+// src/lib/frontmatter-id.ts
 var import_gray_matter8 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync14 } from "node:fs";
+function eolOf(content) {
+  return /\r\n/.test(content) ? `\r
+` : `
+`;
+}
+function spliceFrontmatterId(content, id) {
+  const eol = /^---\r\n/.test(content) ? `\r
+` : `
+`;
+  if (!content.startsWith(`---${eol}`))
+    return null;
+  const closeAt = content.indexOf(`${eol}---`, 3);
+  if (closeAt === -1)
+    return null;
+  return `${content.slice(0, closeAt)}${eol}id: ${id}${content.slice(closeAt)}`;
+}
+function prependFrontmatterBlock(content, id) {
+  const eol = eolOf(content);
+  return `---${eol}id: ${id}${eol}---${eol}${content}`;
+}
+function isFrontmatterless(raw, parsed) {
+  return parsed.content === raw;
+}
+function withFrontmatterId(raw, parsed, id) {
+  if (parsed.data?.["id"] !== undefined) {
+    return null;
+  }
+  const spliced = spliceFrontmatterId(raw, id);
+  if (spliced !== null)
+    return { content: spliced, blockCreated: false };
+  if (!isFrontmatterless(raw, parsed))
+    return null;
+  return { content: prependFrontmatterBlock(raw, id), blockCreated: true };
+}
+function frontmatterIdWriteIsSound(next, id, expectedBody) {
+  try {
+    const check2 = import_gray_matter8.default(next);
+    return check2.data?.["id"] === id && check2.content === expectedBody;
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/pull-write.ts
+var import_gray_matter9 = __toESM(require_gray_matter(), 1);
+import { readFileSync as readFileSync15 } from "node:fs";
 function computeMirrorHashes(strategy, content) {
-  const parsed = import_gray_matter8.default(content);
+  const parsed = import_gray_matter9.default(content);
   const fm = parsed.data ?? {};
   const lifted = splitUserFrontmatter(strategy, fm);
   const userFm = userFrontmatter(strategy, lifted.frontmatter);
@@ -31083,7 +31650,8 @@ function computeMirrorHashes(strategy, content) {
   return {
     bodyHash: stableHash(hashBody),
     frontmatterHash: stableHash({ ...userFm, ...lifted.topLevel }),
-    bodyLen: hashBody.length
+    bodyLen: hashBody.length,
+    frontmatterId: fm["id"]
   };
 }
 function hashableBody(strategy, body) {
@@ -31095,15 +31663,15 @@ function writeMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, suppressor)
     const target = entityFilePath(workspaceSlug, strategy.type, doc2.slug);
     let existing = null;
     try {
-      existing = readFileSync14(target, "utf8");
+      existing = readFileSync15(target, "utf8");
     } catch (err) {
       if (err?.code !== "ENOENT")
         throw err;
     }
     if (existing !== null) {
-      const existingParsed = import_gray_matter8.default(existing);
-      const cloudParsed = import_gray_matter8.default(content);
-      const stitched = import_gray_matter8.default.stringify(existingParsed.content, cloudParsed.data);
+      const existingParsed = import_gray_matter9.default(existing);
+      const cloudParsed = import_gray_matter9.default(content);
+      const stitched = import_gray_matter9.default.stringify(existingParsed.content, cloudParsed.data);
       content = stitched.endsWith(`
 `) ? stitched : stitched + `
 `;
@@ -31222,8 +31790,8 @@ function cloudMatchesAcked(strategy, cloud, acked) {
 function stampStateFromMirror(args) {
   const { strategy, workspaceSlug, doc: doc2, state, priorMemoryHash } = args;
   const mirrorPath = entityFilePath(workspaceSlug, strategy.type, doc2.slug);
-  const mirrorRaw = readFileSync15(mirrorPath, "utf8");
-  const mirrorParsed = import_gray_matter9.default(mirrorRaw);
+  const mirrorRaw = readFileSync16(mirrorPath, "utf8");
+  const mirrorParsed = import_gray_matter10.default(mirrorRaw);
   const mirrorFm = mirrorParsed.data ?? {};
   const mirrorLifted = splitUserFrontmatter(strategy, mirrorFm);
   const mirrorUserFm = userFrontmatter(strategy, mirrorLifted.frontmatter);
@@ -31275,6 +31843,7 @@ async function pushFile(args) {
   const now = deps?.now ?? (() => new Date);
   const mutex = deps?.mutex ?? new PerIdMutex;
   const output = deps?.output;
+  const suppressor = deps?.suppressor;
   const strategy = getStrategy(entityType);
   if (!strategy) {
     return {
@@ -31302,7 +31871,7 @@ async function pushFile(args) {
   }
   let raw;
   try {
-    raw = readFileSync15(absolutePath, "utf8");
+    raw = readFileSync16(absolutePath, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") {
       return runPushDelete({
@@ -31322,7 +31891,7 @@ async function pushFile(args) {
   }
   let parsed;
   try {
-    parsed = import_gray_matter9.default(raw);
+    parsed = import_gray_matter10.default(raw);
   } catch {
     return {
       outcome: { kind: "ignored", absolutePath, reason: "frontmatter parse error" },
@@ -31350,14 +31919,14 @@ async function pushFile(args) {
   if (strategy.classifyFieldErrors) {
     const desiredBody = spliceSyncErrorBlock(parsed.content, fieldErrors);
     if (desiredBody.replace(/\s+$/, "") !== parsed.content.replace(/\s+$/, "")) {
-      let rewritten = import_gray_matter9.default.stringify(desiredBody, parsed.data ?? {});
+      let rewritten = import_gray_matter10.default.stringify(desiredBody, parsed.data ?? {});
       if (!rewritten.endsWith(`
 `))
         rewritten += `
 `;
       writeMirrorFile(workspaceSlug, entityType, slug, rewritten);
       raw = rewritten;
-      parsed = import_gray_matter9.default(rewritten);
+      parsed = import_gray_matter10.default(rewritten);
     }
   }
   const liveInode = safeInode2(absolutePath);
@@ -31379,7 +31948,9 @@ async function pushFile(args) {
       now,
       output,
       quarantinedKeys,
-      identity
+      identity,
+      suppressor,
+      writeBackReadBack: deps?.writeBackReadBack
     });
   }
   return runPushUpsert({
@@ -31604,6 +32175,15 @@ async function runPushUpsert(args) {
     const liveEntry = getEntry(args.state, strategy.type, args.stateEntry.id) ?? args.stateEntry;
     const bodyChanged = newBodyHash !== liveEntry.body_hash;
     const frontmatterChanged = newFrontmatterHash !== liveEntry.frontmatter_hash;
+    let workingState = args.state;
+    if (fm["id"] === undefined && workingState.frontmatter_id_backfill_version !== undefined) {
+      const cleared = clearFrontmatterIdBackfillMarker(workingState);
+      if (cleared.changed) {
+        try {
+          workingState = commitState(workingState, cleared.state);
+        } catch {}
+      }
+    }
     if (!bodyChanged && !frontmatterChanged) {
       return {
         outcome: {
@@ -31611,7 +32191,7 @@ async function runPushUpsert(args) {
           entityType: strategy.type,
           entitySlug: liveEntry.slug
         },
-        state: args.state
+        state: workingState
       };
     }
     const wireBodyFields = bodyChanged ? strategy.bodyToWire(bodyMarkdown) : undefined;
@@ -31630,7 +32210,7 @@ async function runPushUpsert(args) {
           entityType: strategy.type,
           entitySlug: liveEntry.slug
         },
-        state: persistEntry(args.state, strategy.type, updated)
+        state: persistEntry(workingState, strategy.type, updated)
       };
     }
     const mergedTopLevel = split || wireBodyFields?.topLevel ? {
@@ -31649,7 +32229,7 @@ async function runPushUpsert(args) {
         inode: safeInode2(args.absolutePath),
         body_len: hashBody.length
       };
-      const nextState2 = persistEntry(args.state, strategy.type, parked);
+      const nextState2 = persistEntry(workingState, strategy.type, parked);
       const fields = [...quarantined];
       args.output?.log(syncErrorLine({
         entityType: strategy.type,
@@ -31720,7 +32300,7 @@ async function runPushUpsert(args) {
         body_len: hashBody.length,
         memory_hash: liveEntry.memory_hash
       };
-      const nextState2 = persistEntry(args.state, strategy.type, updated);
+      const nextState2 = persistEntry(workingState, strategy.type, updated);
       args.output?.log(`[PATCH entityType=${strategy.type} slug=${updated.slug} id=${updated.id} revision=${updated.revision}]`);
       if (quarantined.size > 0) {
         const fields = [...quarantined];
@@ -31758,7 +32338,7 @@ async function runPushUpsert(args) {
           entityType: strategy.type,
           entitySlug: liveEntry.slug
         },
-        state: args.state
+        state: workingState
       };
     }
     if (patchResult.reason === "slug_conflict") {
@@ -31776,7 +32356,7 @@ async function runPushUpsert(args) {
         existing: patchResult.existing,
         scope: patchResult.scope,
         staleEntryId: liveEntry.id,
-        state: args.state,
+        state: workingState,
         fetchImpl: args.fetchImpl,
         now: args.now,
         output: args.output
@@ -31793,7 +32373,7 @@ async function runPushUpsert(args) {
         parsed: args.parsed,
         liveEntry,
         currentUpdatedAt: patchResult.currentUpdatedAt,
-        state: args.state,
+        state: workingState,
         fetchImpl: args.fetchImpl,
         now: args.now,
         output: args.output
@@ -31812,7 +32392,7 @@ async function runPushUpsert(args) {
       baseUrl: args.baseUrl,
       pat: args.pat,
       id: liveEntry.id,
-      state: args.state,
+      state: workingState,
       fetchImpl: args.fetchImpl
     });
     return {
@@ -31928,6 +32508,24 @@ async function reconcileTaskConflict(args) {
     state
   };
 }
+function writeCreatedIdBack(args) {
+  const write = withFrontmatterId(args.raw, args.parsed, args.id);
+  if (write === null)
+    return;
+  if (!frontmatterIdWriteIsSound(write.content, args.id, args.parsed.content)) {
+    return;
+  }
+  try {
+    if (entityFilePath(args.workspaceSlug, args.strategy.type, args.slug) !== args.absolutePath) {
+      return;
+    }
+    const readBack = args.readBack ?? ((p) => readFileSync16(p, "utf8"));
+    if (readBack(args.absolutePath) !== args.raw)
+      return;
+    args.suppressor?.registerWrite(args.absolutePath, computeMirrorHashes(args.strategy, write.content));
+    writeMirrorFile(args.workspaceSlug, args.strategy.type, args.slug, write.content);
+  } catch {}
+}
 async function runPushCreate(args) {
   const strategy = args.strategy;
   const key = `create:${strategy.type}:${args.slug}`;
@@ -31978,6 +32576,17 @@ async function runPushCreate(args) {
       const createLifted = splitUserFrontmatter(strategy, createFm);
       const userFm = userFrontmatter(strategy, createLifted.frontmatter);
       const createHashBody = hashableBody(strategy, args.parsed.content);
+      writeCreatedIdBack({
+        strategy,
+        workspaceSlug: args.workspaceSlug,
+        absolutePath: args.absolutePath,
+        raw: args.raw,
+        parsed: args.parsed,
+        slug: doc2.slug,
+        id: doc2.id,
+        suppressor: args.suppressor,
+        readBack: args.writeBackReadBack
+      });
       const nextState2 = persistEntry(args.state, strategy.type, {
         id: doc2.id,
         slug: doc2.slug,
@@ -32225,8 +32834,8 @@ async function pushRename(args) {
       };
       if (!updated.body_hash || !updated.frontmatter_hash) {
         try {
-          const mirrorRaw = readFileSync15(toPath, "utf8");
-          const mirrorParsed = import_gray_matter9.default(mirrorRaw);
+          const mirrorRaw = readFileSync16(toPath, "utf8");
+          const mirrorParsed = import_gray_matter10.default(mirrorRaw);
           const renameFm = mirrorParsed.data ?? {};
           const renameLifted = splitUserFrontmatter(strategy, renameFm);
           const renameUserFm = userFrontmatter(strategy, renameLifted.frontmatter);
@@ -32260,7 +32869,7 @@ async function pushRename(args) {
     if (patchResult.reason === "slug_conflict") {
       let contents2 = "";
       try {
-        contents2 = readFileSync15(toPath, "utf8");
+        contents2 = readFileSync16(toPath, "utf8");
       } catch {}
       const stashPath2 = stashConflict({
         workspaceSlug,
@@ -32300,7 +32909,7 @@ async function pushRename(args) {
     }
     let contents = "";
     try {
-      contents = readFileSync15(toPath, "utf8");
+      contents = readFileSync16(toPath, "utf8");
     } catch {}
     const stashPath = stashConflict({
       workspaceSlug,
@@ -32421,7 +33030,7 @@ async function discardBatchOps(batch, deps) {
         const path5 = opPath(deps.workspaceSlug, op);
         let local = null;
         try {
-          local = readFileSync16(path5, "utf8");
+          local = readFileSync17(path5, "utf8");
         } catch {
           local = null;
         }
@@ -32455,7 +33064,7 @@ async function discardFileOp(op, deps) {
   const abs = filesSubtreePath(deps.workspaceSlug, op.path);
   let local = null;
   try {
-    local = readFileSync16(abs);
+    local = readFileSync17(abs);
   } catch {
     local = null;
   }
@@ -32643,7 +33252,7 @@ class FileDestructiveGate {
 }
 
 // src/lib/files/reconcile.ts
-import { readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync18, statSync as statSync10 } from "node:fs";
 
 // src/lib/unsynced.ts
 import { join as join12, relative as relative6 } from "node:path";
@@ -34669,7 +35278,7 @@ function readBlobForPush(args) {
   }
   let bytes;
   try {
-    bytes = readFileSync17(absolutePath);
+    bytes = readFileSync18(absolutePath);
   } catch (err) {
     if (err?.code === "ENOENT")
       return { kind: "gone" };
@@ -35530,7 +36139,7 @@ var FULL_BAND_DAYS = 14;
 function yamlString(value) {
   return JSON.stringify(value);
 }
-function oneLine(value, maxLength = 200) {
+function oneLine2(value, maxLength = 200) {
   const flattened = value.replace(/[\u0000-\u001F\u007F]+/g, " ").replace(/<!--/g, "<! --").replace(/\s+/g, " ").trim();
   if (flattened.length === 0)
     return "(untitled)";
@@ -35579,7 +36188,7 @@ function sortInstant(event) {
 function describeWhen(event, referenceYear) {
   const start = dateParts(event.start);
   if (!start)
-    return oneLine(event.start, 60);
+    return oneLine2(event.start, 60);
   if (event.all_day) {
     const end2 = dateParts(event.end);
     const last = end2 ? shiftDays(end2, -1) : start;
@@ -35605,19 +36214,19 @@ function fullLine(event, referenceYear, artistPrefix, includeUrl) {
   const parts = [
     `**${describeWhen(event, referenceYear)}**`,
     artistPrefix,
-    `${oneLine(event.title)} (${event.booking_status})`
+    `${oneLine2(event.title)} (${event.booking_status})`
   ].filter((p) => p.length > 0);
   if (event.location)
-    parts.push(oneLine(event.location, 80));
+    parts.push(oneLine2(event.location, 80));
   if (includeUrl && event.url)
-    parts.push(oneLine(event.url, 300));
+    parts.push(oneLine2(event.url, 300));
   return `- ${parts.join(" - ")}`;
 }
 function compactLine(event, referenceYear, artistPrefix) {
   const parts = [
     describeWhen(event, referenceYear),
     artistPrefix,
-    `${oneLine(event.title)} (${event.booking_status})`
+    `${oneLine2(event.title)} (${event.booking_status})`
   ].filter((p) => p.length > 0);
   return `- ${parts.join(" - ")}`;
 }
@@ -35653,7 +36262,7 @@ function statusLine(args) {
     case "token-expired":
       return `**NOT READ - the Google connection for ${userLabel} has expired.** Plinth ` + `still holds a connection but could not refresh it, so nothing below is ` + `current. Reconnect Google in Plinth. Treat this calendar as unknown ` + `rather than empty.`;
     case "google-error":
-      return `**NOT READ - Google refused the request` + `${error52 ? ` (HTTP ${error52.upstream_status})` : ""}.** ` + `${error52 ? oneLine(error52.message, 300) : "No detail was returned."} ` + `A calendar that was unshared or deleted in Google reads exactly like this. ` + `Nothing below is current; treat this calendar as unknown rather than empty.`;
+      return `**NOT READ - Google refused the request` + `${error52 ? ` (HTTP ${error52.upstream_status})` : ""}.** ` + `${error52 ? oneLine2(error52.message, 300) : "No detail was returned."} ` + `A calendar that was unshared or deleted in Google reads exactly like this. ` + `Nothing below is current; treat this calendar as unknown rather than empty.`;
   }
 }
 function shortStatus(row) {
@@ -35669,7 +36278,7 @@ function shortStatus(row) {
     case "token-expired":
       return "NOT READ - the Google connection has expired; unknown, not empty";
     case "google-error":
-      return `NOT READ - Google refused` + `${row.error ? ` (HTTP ${row.error.upstream_status}): ${oneLine(row.error.message, 120)}` : ""}` + `; unknown, not empty`;
+      return `NOT READ - Google refused` + `${row.error ? ` (HTTP ${row.error.upstream_status}): ${oneLine2(row.error.message, 120)}` : ""}` + `; unknown, not empty`;
   }
 }
 function rowFileName(row, internalName) {
@@ -35677,8 +36286,8 @@ function rowFileName(row, internalName) {
 }
 function rowDisplayName(row) {
   if (row.artist_name)
-    return oneLine(row.artist_name, 80);
-  return `${oneLine(row.calendar_name, 80)} (internal)`;
+    return oneLine2(row.artist_name, 80);
+  return `${oneLine2(row.calendar_name, 80)} (internal)`;
 }
 function splitBands(events, generatedAt) {
   const base2 = Date.parse(generatedAt);
@@ -35816,8 +36425,8 @@ function renderUpcoming(args) {
     "",
     "## Calendar status",
     "",
-    ...rows.map((row) => `- **${rowDisplayName(row)}**` + `${row.artist_slug ? ` (\`${oneLine(row.artist_slug, 80)}\`)` : ""}` + ` - ${shortStatus(row)} - \`views/calendar/${rowFileName(row, internalName)}.md\``),
-    ...unmappedArtists.map((a) => `- **${oneLine(a.name, 80)}** (\`${oneLine(a.slug, 80)}\`) - NO CALENDAR MAPPED in Plinth, so there is nothing to read and no file for them. Map one in Plinth if they should have dates.`),
+    ...rows.map((row) => `- **${rowDisplayName(row)}**` + `${row.artist_slug ? ` (\`${oneLine2(row.artist_slug, 80)}\`)` : ""}` + ` - ${shortStatus(row)} - \`views/calendar/${rowFileName(row, internalName)}.md\``),
+    ...unmappedArtists.map((a) => `- **${oneLine2(a.name, 80)}** (\`${oneLine2(a.slug, 80)}\`) - NO CALENDAR MAPPED in Plinth, so there is nothing to read and no file for them. Map one in Plinth if they should have dates.`),
     ""
   ].join(`
 `);
@@ -35886,14 +36495,14 @@ function renderStaleFile(existing, args) {
     ...carried,
     "fetch_state: stale",
     `last_refresh_attempt: ${yamlString(args.attemptedAt)}`,
-    `last_refresh_error: ${yamlString(oneLine(args.reason, 300))}`,
+    `last_refresh_error: ${yamlString(oneLine2(args.reason, 300))}`,
     "---",
     "",
     OWNERSHIP_NOTE2,
     "",
     `# ${title}`,
     "",
-    `**STALE - the last refresh FAILED and nothing below was updated.** Attempted ` + `${humanStamp(args.attemptedAt)} and it did not succeed: ` + `${oneLine(args.reason, 300)}`,
+    `**STALE - the last refresh FAILED and nothing below was updated.** Attempted ` + `${humanStamp(args.attemptedAt)} and it did not succeed: ` + `${oneLine2(args.reason, 300)}`,
     "",
     `**What is below was last read at ${stamp}** and has not moved since. Anything ` + `changed in Google after that is not here, and something cancelled after that ` + `is still listed. Say the age out loud rather than briefing it as current.`,
     ""
@@ -36075,8 +36684,8 @@ class PullSuppressor {
 }
 
 // src/lib/discover-entities.ts
-var import_gray_matter10 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync18, statSync as statSync11 } from "node:fs";
+var import_gray_matter11 = __toESM(require_gray_matter(), 1);
+import { readFileSync as readFileSync19, statSync as statSync11 } from "node:fs";
 var DISCOVERY_WRITE_CAP_DEFAULT = 10;
 function discoveryWriteCap() {
   const raw = process.env.PLINTH_DISCOVERY_WRITE_CAP;
@@ -36175,7 +36784,7 @@ function planDiscoveryWrites(args) {
     counts.discovered++;
     let frontmatter;
     try {
-      frontmatter = import_gray_matter10.default(readFileSync18(absolutePath, "utf8")).data ?? {};
+      frontmatter = import_gray_matter11.default(readFileSync19(absolutePath, "utf8")).data ?? {};
     } catch {
       counts.discovered--;
       continue;
@@ -36403,21 +37012,23 @@ function recordDiscoveryFailure(args) {
 }
 
 // src/lib/frontmatter-id-backfill.ts
-var import_gray_matter11 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync19, statSync as statSync12 } from "node:fs";
+var import_gray_matter12 = __toESM(require_gray_matter(), 1);
+import { readFileSync as readFileSync20, statSync as statSync12 } from "node:fs";
+var FRONTMATTER_ID_BACKFILL_VERSION = 1;
 function backfillWorthReporting(r) {
-  return r.written > 0 || r.failed > 0 || r.skipped.foreignId > 0;
+  return r.written > 0 || r.failed > 0 || r.skipped.foreignId > 0 || r.skipped.unwritable > 0 || r.skipped.slugCollision > 0;
 }
 function emptyResult() {
   return {
     scanned: 0,
     written: 0,
+    blocksCreated: 0,
     alreadyPresent: 0,
     missing: 0,
     skipped: {
       frozen: 0,
       foreignId: 0,
-      noFrontmatter: 0,
+      unwritable: 0,
       slugCollision: 0,
       diverged: 0
     },
@@ -36442,21 +37053,14 @@ function safeInode3(path5) {
     return;
   }
 }
-function spliceFrontmatterId(content, id) {
-  const eol = /^---\r\n/.test(content) ? `\r
-` : `
-`;
-  if (!content.startsWith(`---${eol}`))
-    return null;
-  const closeAt = content.indexOf(`${eol}---`, 3);
-  if (closeAt === -1)
-    return null;
-  return `${content.slice(0, closeAt)}${eol}id: ${id}${content.slice(closeAt)}`;
-}
 function backfillFrontmatterIds(args) {
   const { workspaceSlug, state } = args;
-  const splice = args.splice ?? spliceFrontmatterId;
+  const compose = args.compose ?? withFrontmatterId;
+  const readRaw = args.readFile ?? ((p) => readFileSync20(p, "utf8"));
   const result = emptyResult();
+  if (state.frontmatter_id_backfill_version === FRONTMATTER_ID_BACKFILL_VERSION) {
+    return result;
+  }
   let held;
   try {
     held = heldByAnyBatch(workspaceSlug);
@@ -36465,10 +37069,13 @@ function backfillFrontmatterIds(args) {
   }
   let nextState = state;
   let stateChanged = false;
+  let sawUnknownType = false;
   for (const [entityType, bucket] of Object.entries(state.entries)) {
     const strategy = getStrategy(entityType);
-    if (!strategy)
+    if (!strategy) {
+      sawUnknownType = true;
       continue;
+    }
     const slugCounts = new Map;
     for (const e of Object.values(bucket)) {
       slugCounts.set(e.slug, (slugCounts.get(e.slug) ?? 0) + 1);
@@ -36485,7 +37092,7 @@ function backfillFrontmatterIds(args) {
       }
       let raw;
       try {
-        raw = readFileSync19(entityFilePath(workspaceSlug, entityType, entry2.slug), "utf8");
+        raw = readRaw(entityFilePath(workspaceSlug, entityType, entry2.slug));
       } catch (err) {
         if (err?.code === "ENOENT") {
           result.missing++;
@@ -36496,9 +37103,11 @@ function backfillFrontmatterIds(args) {
       }
       let existing;
       let rawBody;
+      let parsedData;
       try {
-        const parsed = import_gray_matter11.default(raw);
-        existing = (parsed.data ?? {})["id"];
+        const parsed = import_gray_matter12.default(raw);
+        parsedData = parsed.data ?? {};
+        existing = parsedData["id"];
         rawBody = parsed.content;
       } catch {
         result.failed++;
@@ -36516,30 +37125,27 @@ function backfillFrontmatterIds(args) {
         result.skipped.diverged++;
         continue;
       }
-      const next = splice(raw, id);
-      if (next === null) {
-        result.skipped.noFrontmatter++;
+      const write = compose(raw, { data: parsedData, content: rawBody }, id);
+      if (write === null) {
+        result.skipped.unwritable++;
         continue;
       }
-      try {
-        const check2 = import_gray_matter11.default(next);
-        if (check2.data?.["id"] !== id || check2.content !== rawBody) {
-          result.failed++;
-          continue;
-        }
-      } catch {
+      const next = write.content;
+      if (!frontmatterIdWriteIsSound(next, id, rawBody)) {
         result.failed++;
         continue;
       }
       let ino;
       try {
-        const stillRaw = readFileSync19(entityFilePath(workspaceSlug, entityType, entry2.slug), "utf8");
+        const stillRaw = readRaw(entityFilePath(workspaceSlug, entityType, entry2.slug));
         if (stillRaw !== raw) {
           result.skipped.diverged++;
           continue;
         }
         writeMirrorFile(workspaceSlug, entityType, entry2.slug, next);
         result.written++;
+        if (write.blockCreated)
+          result.blocksCreated++;
         ino = safeInode3(entityFilePath(workspaceSlug, entityType, entry2.slug));
       } catch {
         result.failed++;
@@ -36555,6 +37161,17 @@ function backfillFrontmatterIds(args) {
       }
     }
   }
+  const retryable = result.written + result.failed + result.skipped.frozen + result.skipped.diverged + result.skipped.unwritable + result.skipped.slugCollision;
+  if (retryable === 0 && !sawUnknownType) {
+    const stamped = {
+      ...nextState,
+      frontmatter_id_backfill_version: FRONTMATTER_ID_BACKFILL_VERSION
+    };
+    if (stamped.frontmatter_id_backfill_version !== nextState.frontmatter_id_backfill_version) {
+      nextState = stamped;
+      stateChanged = true;
+    }
+  }
   if (stateChanged) {
     try {
       commitState(state, nextState);
@@ -36567,7 +37184,7 @@ function backfillFrontmatterIds(args) {
 }
 
 // src/lib/reconcile.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21, statSync as statSync13 } from "node:fs";
 async function reconcileDivergedRows(args) {
   const { workspaceSlug, baseUrl, pat, fetchImpl, output, isFrozen } = args;
   const now = args.now ?? (() => new Date);
@@ -36609,6 +37226,14 @@ async function reconcileDivergedRows(args) {
         case "noop":
           noop++;
           break;
+        case "not_found":
+          state = recordEntityCloudRowDeleted({
+            state,
+            workspaceSlug,
+            absolutePath,
+            now
+          });
+          break;
         default:
           break;
       }
@@ -36635,6 +37260,7 @@ async function reconcileDivergedRows(args) {
     }
   };
   const guttingCandidates = [];
+  let sawTrackedFileWithoutId = false;
   for (const [entityType, bucket] of Object.entries(state.entries)) {
     const strategy = getStrategy(entityType);
     if (!strategy)
@@ -36651,15 +37277,32 @@ async function reconcileDivergedRows(args) {
           continue;
         throw err;
       }
+      let liveInode;
+      try {
+        liveInode = statSync13(absolutePath).ino;
+      } catch {
+        liveInode = undefined;
+      }
+      if (liveInode !== undefined && entry2.inode !== liveInode) {
+        const trueOwner = getEntryByInode(state, entityType, liveInode);
+        if (trueOwner) {
+          output?.log(`[RECONCILE_SKIP entityType=${entityType} slug=${entry2.slug} ` + `id=${entry2.id} owner_id=${trueOwner.id} reason=path_owned_by_other_row]`);
+          continue;
+        }
+      }
       let content;
       try {
-        content = readFileSync20(absolutePath, "utf8");
+        content = readFileSync21(absolutePath, "utf8");
       } catch (err) {
-        if (err?.code === "ENOENT")
+        if (err?.code === "ENOENT") {
+          state = clearEntityCloudRowDeleted(state, strategy.mirrorRelativePath(entry2.slug));
           continue;
+        }
         throw err;
       }
       const hashes = computeMirrorHashes(strategy, content);
+      if (hashes.frontmatterId === undefined)
+        sawTrackedFileWithoutId = true;
       const isDiverged = hashes.bodyHash !== entry2.body_hash || hashes.frontmatterHash !== entry2.frontmatter_hash;
       if (!isDiverged)
         continue;
@@ -36726,6 +37369,14 @@ async function reconcileDivergedRows(args) {
     isFrozen
   });
   state = discovery.state;
+  if (sawTrackedFileWithoutId) {
+    const cleared = clearFrontmatterIdBackfillMarker(state);
+    if (cleared.changed) {
+      try {
+        state = commitState(state, cleared.state);
+      } catch {}
+    }
+  }
   return {
     state,
     scanned,
@@ -37734,9 +38385,9 @@ function createThrottledFetch(baseFetch, opts = {}) {
 import {
   existsSync as existsSync7,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync22,
-  statSync as statSync14,
-  unlinkSync as unlinkSync7
+  readFileSync as readFileSync23,
+  statSync as statSync15,
+  unlinkSync as unlinkSync8
 } from "node:fs";
 import { join as join16 } from "node:path";
 
@@ -37861,7 +38512,7 @@ function refreshConflictsView(workspaceSlug) {
 }
 
 // src/lib/files/pull.ts
-import { existsSync as existsSync6, readFileSync as readFileSync21, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync22, statSync as statSync14 } from "node:fs";
 
 // src/lib/files/extracted-text.ts
 import { createHash as createHash3 } from "node:crypto";
@@ -38132,7 +38783,7 @@ async function applyFileRow(args) {
     }
     let localBytes;
     try {
-      localBytes = readFileSync21(abs);
+      localBytes = readFileSync22(abs);
     } catch {
       localBytes = undefined;
     }
@@ -38229,7 +38880,7 @@ async function applyFileRow(args) {
   }
   if (!suppressor && existing && existing.content_hash !== row.content_hash && existsSync6(abs)) {
     try {
-      const localBytes = readFileSync21(abs);
+      const localBytes = readFileSync22(abs);
       if (sha256Bytes(localBytes) !== existing.content_hash) {
         const stashPath = stashFileConflict({ workspaceSlug, relPath, timestamp: now(), bytes: localBytes });
         output?.warn(`Conflict on files/${relPath} → stashed local edit to ${stashPath} (cloud-wins on boot).`);
@@ -38270,7 +38921,7 @@ async function applyFileRow(args) {
   }
   let inode;
   try {
-    inode = statSync13(abs).ino;
+    inode = statSync14(abs).ino;
   } catch {
     inode = undefined;
   }
@@ -38339,6 +38990,8 @@ function textIsCurrent(existing, row, workspaceSlug, relPath) {
 
 // src/commands/sync.ts
 init_output();
+var memberRefreshFailedAt = new Map;
+var MEMBER_REFRESH_RETRY_AFTER_MS = 60 * 60 * 1000;
 function classifyApiError(err) {
   if (err.status === 401 || err.status === 403) {
     return { kind: "auth", status: err.status };
@@ -38367,31 +39020,50 @@ function hasExistingContent(workspacePath) {
     return false;
   }
 }
-function unlinkIfInodeMatches(workspaceSlug, entityType, entrySlug, expectedInode, suppressor) {
+function otherEntryAtSlug(state, entityType, slug, exceptId) {
+  const bucket = state.entries[entityType];
+  if (!bucket)
+    return;
+  for (const candidate of Object.values(bucket)) {
+    if (candidate.id !== exceptId && candidate.slug === slug)
+      return candidate;
+  }
+  return;
+}
+function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
   let target;
   try {
-    target = entityFilePath(workspaceSlug, entityType, entrySlug);
+    target = entityFilePath(workspaceSlug, strategy.type, entry2.slug);
   } catch (err) {
     if (err instanceof MirrorPathError)
       return { didUnlink: false };
     throw err;
   }
-  let liveInode;
+  let raw;
+  try {
+    raw = readFileSync23(target, "utf8");
+  } catch (err) {
+    if (err?.code === "ENOENT") {
+      return { didUnlink: false };
+    }
+    return { didUnlink: false, refusedReason: "unreadable" };
+  }
+  let hashes;
   try {
-    liveInode = statSync14(target).ino;
+    hashes = computeMirrorHashes(strategy, raw);
   } catch {
-    return { didUnlink: false, skippedReason: "absent" };
+    return { didUnlink: false, refusedReason: "unreadable" };
   }
-  if (expectedInode !== undefined && expectedInode !== liveInode) {
-    return { didUnlink: false, skippedReason: "inode_mismatch" };
+  if (hashes.bodyHash !== entry2.body_hash || hashes.frontmatterHash !== entry2.frontmatter_hash) {
+    return { didUnlink: false, refusedReason: "diverged" };
   }
   try {
     suppressor?.registerDelete(target);
-    unlinkSync7(target);
+    unlinkSync8(target);
     return { didUnlink: true };
   } catch (err) {
     if (err?.code === "ENOENT") {
-      return { didUnlink: false, skippedReason: "absent" };
+      return { didUnlink: false };
     }
     throw err;
   }
@@ -38475,7 +39147,7 @@ async function runSync(workspaceSlug, deps = {}) {
           ctr.fetched++;
           let outcome;
           try {
-            outcome = applyRow(slug, strategy, row, state, out, deps.suppressor, now, deps.isFrozen);
+            outcome = applyRow(slug, strategy, row, state, out, deps.suppressor, now, deps.isFrozen, deps.loggedTombstoneSkips);
           } catch (err) {
             if (!(err instanceof MirrorSymlinkError))
               throw err;
@@ -38633,6 +39305,18 @@ async function runSync(workspaceSlug, deps = {}) {
     out.error(`Sync state could not be persisted: ${msg}`);
     return { exitCode: 1 };
   }
+  try {
+    ensureFilesSubtree(slug);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "unknown error";
+    out.warn(`Could not create the files/ folder in this workspace mirror: ${msg}`);
+  }
+  try {
+    ensureEntityFolders(slug);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "unknown error";
+    out.warn(`Could not scaffold the workspace entity folders: ${msg}`);
+  }
   const generateContext = deps.generateContext ?? ensureWorkspaceContext;
   try {
     generateContext({
@@ -38646,6 +39330,17 @@ async function runSync(workspaceSlug, deps = {}) {
     const msg = err instanceof Error ? err.message : "unknown error";
     out.warn(`Context generation skipped: ${msg}`);
   }
+  const lastFailure = memberRefreshFailedAt.get(slug);
+  const failureCooling = lastFailure !== undefined && now().getTime() - lastFailure < MEMBER_REFRESH_RETRY_AFTER_MS;
+  if (!failureCooling && memberNeedsRefresh(entry2, now)) {
+    try {
+      const principal = await whoami(entry2.api_base_url, pat, fetchImpl);
+      setMemberPrincipal(slug, memberPrincipalFrom(principal, now));
+      memberRefreshFailedAt.delete(slug);
+    } catch {
+      memberRefreshFailedAt.set(slug, now().getTime());
+    }
+  }
   const generatePerArtistContext = deps.generatePerArtistContext ?? ensurePerArtistContext;
   try {
     generatePerArtistContext({ workspaceSlug: slug, force: false, out, now });
@@ -38674,48 +39369,58 @@ async function runSync(workspaceSlug, deps = {}) {
   out.success(`Done in ${elapsed}s.`);
   return { exitCode: 0, applied: totalWritten + totalDeleted };
 }
-function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = () => new Date, isFrozen) {
+function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = () => new Date, isFrozen, loggedTombstoneSkips) {
   if (isFrozen?.(strategy.type, row.id)) {
     return { state, action: "skipped" };
   }
   if (row.deleted_at !== null) {
     const bucket = state.entries[strategy.type];
     const entry2 = bucket?.[row.id];
-    let didUnlink = false;
-    if (entry2) {
-      const tombstone = unlinkIfInodeMatches(workspaceSlug, strategy.type, entry2.slug, entry2.inode, suppressor);
-      didUnlink = tombstone.didUnlink;
-      if (tombstone.skippedReason === "inode_mismatch") {
-        out.log(`[TOMBSTONE_SKIP entityType=${strategy.type} slug=${entry2.slug} id=${row.id} reason=inode_mismatch expected=${entry2.inode} live_inode_present=true]`);
-      } else if (didUnlink) {
-        out.log(`[TOMBSTONE_UNLINK entityType=${strategy.type} slug=${entry2.slug} id=${row.id}]`);
+    const targetSlug = entry2?.slug ?? row.slug;
+    const dropEntry2 = () => {
+      if (!entry2)
+        return state;
+      const nextBucket = { ...bucket };
+      delete nextBucket[row.id];
+      const cleared = clearEntityCloudRowDeleted({ ...state, entries: { ...state.entries, [strategy.type]: nextBucket } }, strategy.mirrorRelativePath(entry2.slug));
+      return cleared;
+    };
+    const logOnce = (line, key) => {
+      if (loggedTombstoneSkips) {
+        if (loggedTombstoneSkips.has(key))
+          return;
+        loggedTombstoneSkips.add(key);
       }
-    } else {
+      out.log(line);
+    };
+    const owner = otherEntryAtSlug(state, strategy.type, targetSlug, row.id);
+    if (owner) {
+      logOnce(`[TOMBSTONE_SKIP entityType=${strategy.type} slug=${targetSlug} id=${row.id} owner_id=${owner.id} reason=slug_owned_by_other_row]`, `entity:${strategy.type}:${row.id}:${owner.id}:${targetSlug}`);
+      const next = dropEntry2();
+      return { state: next, action: "tombstone_noop" };
+    }
+    if (!entry2) {
+      let present2 = false;
       try {
-        const target = entityFilePath(workspaceSlug, strategy.type, row.slug);
-        suppressor?.registerDelete(target);
-        didUnlink = deleteMirrorFile(workspaceSlug, strategy.type, row.slug);
+        present2 = existsSync7(entityFilePath(workspaceSlug, strategy.type, row.slug));
       } catch (err) {
         if (!(err instanceof MirrorPathError))
           throw err;
       }
+      if (present2) {
+        logOnce(`[TOMBSTONE_KEEP entityType=${strategy.type} slug=${row.slug} id=${row.id} reason=untracked]`, `entity:${strategy.type}:${row.id}:untracked:${row.slug}`);
+      }
+      return { state, action: "tombstone_noop" };
     }
-    const wasTracked = !!entry2;
-    if (!wasTracked && !didUnlink) {
+    const tombstone = unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor);
+    if (tombstone.refusedReason) {
+      logOnce(`[TOMBSTONE_KEEP entityType=${strategy.type} slug=${entry2.slug} id=${row.id} reason=${tombstone.refusedReason}]`, `entity:${strategy.type}:${row.id}:${tombstone.refusedReason}:${entry2.slug}`);
       return { state, action: "tombstone_noop" };
     }
-    if (!wasTracked) {
-      return { state, action: "deleted" };
+    if (tombstone.didUnlink) {
+      out.log(`[TOMBSTONE_UNLINK entityType=${strategy.type} slug=${entry2.slug} id=${row.id}]`);
     }
-    const nextBucket = { ...bucket };
-    delete nextBucket[row.id];
-    return {
-      state: {
-        ...state,
-        entries: { ...state.entries, [strategy.type]: nextBucket }
-      },
-      action: "deleted"
-    };
+    return { state: dropEntry2(), action: "deleted" };
   }
   const live = row;
   const existingEntry = state.entries[strategy.type]?.[live.id];
@@ -38741,7 +39446,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
   if (!suppressor && existingEntry && existingEntry.updated_at !== live.updated_at) {
     let localRaw = null;
     try {
-      localRaw = readFileSync22(entityFilePath(workspaceSlug, strategy.type, live.slug), "utf8");
+      localRaw = readFileSync23(entityFilePath(workspaceSlug, strategy.type, live.slug), "utf8");
     } catch {
       localRaw = null;
     }
@@ -38764,7 +39469,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
   const hashes = computeMirrorHashes(strategy, content);
   let inode;
   try {
-    inode = statSync14(entityFilePath(workspaceSlug, strategy.type, live.slug)).ino;
+    inode = statSync15(entityFilePath(workspaceSlug, strategy.type, live.slug)).ino;
   } catch {
     inode = undefined;
   }
@@ -38857,7 +39562,7 @@ var syncCommand = defineCommand({
 // src/commands/start.ts
 var SHUTDOWN_DRAIN_TIMEOUT_MS = 5000;
 var PULL_HEARTBEAT_MS = 900000;
-function backfillStateInodes(workspaceSlug, state, statFn = (p) => statSync15(p)) {
+function backfillStateInodes(workspaceSlug, state, statFn = (p) => statSync16(p)) {
   let changed = false;
   const nextEntries = {};
   for (const [entityType, bucket] of Object.entries(state.entries)) {
@@ -38890,7 +39595,7 @@ function backfillStateInodes(workspaceSlug, state, statFn = (p) => statSync15(p)
     return { state, changed: false };
   return { state: { ...state, entries: nextEntries }, changed: true };
 }
-function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync23(p, "utf8")) {
+function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync24(p, "utf8")) {
   let changed = false;
   const nextEntries = {};
   for (const [entityType, bucket] of Object.entries(state.entries)) {
@@ -38902,7 +39607,7 @@ function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync2
       }
       try {
         const path5 = entityFilePath(workspaceSlug, entityType, entry2.slug);
-        const bodyLen = import_gray_matter12.default(readFn(path5)).content.length;
+        const bodyLen = import_gray_matter13.default(readFn(path5)).content.length;
         nextBucket[id] = { ...entry2, body_len: bodyLen };
         changed = true;
       } catch {
@@ -38953,8 +39658,14 @@ function makeWatchHandler(deps) {
         return;
       }
       if (!exists) {
-        if (suppressor?.shouldSuppressDelete(absolutePath))
+        if (suppressor?.shouldSuppressDelete(absolutePath)) {
+          output?.log(fileDeleteSuppressedLine({ path: relPath, reason: "pull_echo" }));
+          return;
+        }
+        if (existsSync8(absolutePath)) {
+          output?.log(fileDeleteSuppressedLine({ path: relPath, reason: "path_exists" }));
           return;
+        }
         if (fileGate) {
           const op = classifyFileDestructive({ relPath, absolutePath, exists: false }, getState());
           if (op) {
@@ -38978,7 +39689,7 @@ function makeWatchHandler(deps) {
       }
       let st;
       try {
-        st = statSync15(absolutePath);
+        st = statSync16(absolutePath);
       } catch (err) {
         if (err?.code === "ENOENT")
           return;
@@ -39009,7 +39720,7 @@ function makeWatchHandler(deps) {
         spinner.update(`Watching ${workspaceSlug} · ${watchingSummary(getState())}`);
         return;
       }
-      const bytes = readFileSync23(absolutePath);
+      const bytes = readFileSync24(absolutePath);
       const hash2 = sha256Bytes(bytes);
       if (suppressor?.shouldSuppressUpsert(absolutePath, {
         bodyHash: hash2,
@@ -39067,7 +39778,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync23(absolutePath, "utf8");
+        raw = readFileSync24(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -39105,7 +39816,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync23(absolutePath, "utf8");
+        raw = readFileSync24(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -39143,7 +39854,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync23(absolutePath, "utf8");
+        raw = readFileSync24(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -39181,7 +39892,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync23(absolutePath, "utf8");
+        raw = readFileSync24(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -39219,7 +39930,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync23(absolutePath, "utf8");
+        raw = readFileSync24(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -39251,7 +39962,7 @@ function makeWatchHandler(deps) {
       spinner.warn(`Push failed for artists/${slug}/memory.md: ${msg}`);
     }
   };
-  return async (event) => {
+  const handle = async (event) => {
     try {
       if (event.kind === "renamed") {
         const classifiedFrom = classifyMirrorPath({
@@ -39321,14 +40032,20 @@ function makeWatchHandler(deps) {
       }
       if (suppressor) {
         if (event.kind === "unlink") {
-          if (suppressor.shouldSuppressDelete(absolutePath))
+          if (suppressor.shouldSuppressDelete(absolutePath)) {
+            output?.log(entityDeleteSuppressedLine({
+              entityType: classified.entityType,
+              slug: classified.entitySlug,
+              reason: "pull_echo"
+            }));
             return;
+          }
         } else if (event.kind === "upsert") {
           const strategy = getStrategy(classified.entityType);
           if (strategy) {
             let raw = null;
             try {
-              raw = readFileSync23(absolutePath, "utf8");
+              raw = readFileSync24(absolutePath, "utf8");
             } catch {
               raw = null;
             }
@@ -39338,6 +40055,15 @@ function makeWatchHandler(deps) {
           }
         }
       }
+      if (event.kind === "unlink" && existsSync8(absolutePath)) {
+        output?.log(entityDeleteSuppressedLine({
+          entityType: classified.entityType,
+          slug: classified.entitySlug,
+          reason: "path_exists"
+        }));
+        await handle({ kind: "upsert", absolutePath });
+        return;
+      }
       if (event.kind === "unlink" && event.renameFallback) {
         const slugHint = event.stateEntry?.slug ? `${classified.entityType}/${event.stateEntry.slug}` : absolutePath;
         spinner.warn(`Rename pair miss for ${slugHint} — no inode in state, treated as delete (classifier degraded to create+delete). ` + `If you just ran \`mv\`, the cloud row was likely tombstoned; check ~/.plinth/_conflicts/ or restore from cloud.`);
@@ -39364,7 +40090,7 @@ function makeWatchHandler(deps) {
           slug: event.stateEntry.slug,
           updated_at: event.stateEntry.updated_at
         } : null,
-        deps: { fetchImpl, now, mutex, output }
+        deps: { fetchImpl, now, mutex, output, suppressor }
       });
       setState(clearEntityRejected(result.state, workspaceSlug, absolutePath));
       reportOutcome(spinner, workspaceSlug, getState(), result.outcome);
@@ -39403,6 +40129,7 @@ function makeWatchHandler(deps) {
       spinner.warn(`Push failed for ${path5}: ${msg}`);
     }
   };
+  return handle;
 }
 function discardSink() {
   const stream = { write: () => true };
@@ -40459,11 +41186,101 @@ var startCommand = defineCommand({
 });
 
 // src/commands/status.ts
-import { statSync as statSync17 } from "node:fs";
+import { statSync as statSync18 } from "node:fs";
+
+// src/lib/context/memory-bars.ts
+var RULE_FILE_BAR_BYTES = 6000;
+var FACT_STORE_BAR_BYTES = 12000;
+var MAX_NAMED_FACT_STORES = 5;
+function countRuleShapedLines(body) {
+  let count = 0;
+  for (const line of body.split(`
+`)) {
+    const trimmed = line.trim();
+    if (/^[-*+]\s/.test(trimmed))
+      count += 1;
+    else if (/^\*\*[^*]+\*\*/.test(trimmed))
+      count += 1;
+  }
+  return count;
+}
+function factBody(raw) {
+  return raw.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*$/, "").split(`
+`).filter((line) => !/^\s*#{1,6}\s/.test(line)).join(`
+`).trim();
+}
+var RULE_FILES = [
+  { filename: VOICE_FILENAME, agentMayEdit: false, memberOwned: true, ridesInjection: false },
+  { filename: WORKSPACE_RULES_FILENAME, agentMayEdit: true, memberOwned: false, ridesInjection: true }
+];
+function assessMemoryBars(workspaceSlug, deps = {}) {
+  const readContext = deps.readContext ?? readContextFile;
+  const readArtistMemory = deps.readArtistMemory ?? readArtistMemoryFile;
+  const rosterOf = deps.readRosterFn ?? readRoster;
+  const over = [];
+  for (const spec of RULE_FILES) {
+    let raw = null;
+    try {
+      raw = readContext(workspaceSlug, spec.filename);
+    } catch {
+      raw = null;
+    }
+    if (raw === null)
+      continue;
+    const bytes = Buffer.byteLength(raw);
+    if (bytes <= RULE_FILE_BAR_BYTES)
+      continue;
+    over.push({
+      path: spec.filename,
+      kind: "rule",
+      bytes,
+      bar: RULE_FILE_BAR_BYTES,
+      rules: countRuleShapedLines(raw),
+      facts: groupFacts(factBody(raw)).length,
+      agentMayEdit: spec.agentMayEdit,
+      memberOwned: spec.memberOwned,
+      buys: !spec.ridesInjection ? "per-read" : Buffer.byteLength(extractWorkspaceRules(raw) ?? "") > 0 ? "injection" : "nothing"
+    });
+  }
+  let roster;
+  try {
+    roster = rosterOf(workspaceSlug);
+  } catch {
+    roster = [];
+  }
+  const stores = [];
+  for (const artist of roster) {
+    let raw = null;
+    try {
+      raw = readArtistMemory(workspaceSlug, artist.slug);
+    } catch {
+      raw = null;
+    }
+    if (raw === null)
+      continue;
+    const bytes = Buffer.byteLength(raw);
+    if (bytes <= FACT_STORE_BAR_BYTES)
+      continue;
+    stores.push({
+      path: `artists/${artist.slug}/memory.md`,
+      kind: "fact",
+      bytes,
+      bar: FACT_STORE_BAR_BYTES,
+      rules: countRuleShapedLines(raw),
+      facts: groupFacts(factBody(raw)).length,
+      agentMayEdit: true,
+      memberOwned: true,
+      buys: "per-read"
+    });
+  }
+  stores.sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path));
+  const named = stores.slice(0, MAX_NAMED_FACT_STORES);
+  return { over: [...over, ...named], notNamed: stores.length - named.length };
+}
 
 // src/lib/build-stamp.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync11, readFileSync as readFileSync24, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync11, readFileSync as readFileSync25, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname10, join as join17 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUILD_STAMP_FILENAME = "build-stamp.json";
@@ -40487,7 +41304,7 @@ function readHead(repoDir) {
 }
 function readBuildStamp(distDir) {
   try {
-    const parsed = JSON.parse(readFileSync24(stampPath(distDir), "utf8"));
+    const parsed = JSON.parse(readFileSync25(stampPath(distDir), "utf8"));
     if (parsed && typeof parsed.sha === "string" && parsed.sha.length > 0 && typeof parsed.dirty === "boolean" && typeof parsed.built_at === "string") {
       return { sha: parsed.sha, dirty: parsed.dirty, built_at: parsed.built_at };
     }
@@ -40499,7 +41316,7 @@ function readBuildStamp(distDir) {
 function findRepoRoot(fromDir) {
   let dir = fromDir;
   for (;; ) {
-    if (existsSync8(join17(dir, ".git")))
+    if (existsSync9(join17(dir, ".git")))
       return dir;
     const parent = dirname10(dir);
     if (parent === dir)
@@ -40547,13 +41364,59 @@ function checkBuildStaleness(deps = {}) {
   return { kind: "fresh", stamp, head };
 }
 
+// src/lib/memory-links.ts
+import { readFileSync as readFileSync26 } from "node:fs";
+import { relative as relative13, sep as sep5 } from "node:path";
+var MEMORY_FILE_RE = /^(workspace-memory\.md|artists\/[^/]+\/memory\.md)$/i;
+function scanMemoryLinks(deps) {
+  const listFiles = deps.listFiles ?? ((r) => walkSubtreeFiles(r, isVcsInternal));
+  const readFile = deps.readFile ?? ((p) => readFileSync26(p, "utf8"));
+  let root;
+  let absPaths;
+  try {
+    root = workspaceMirrorPath(deps.workspaceSlug);
+    absPaths = listFiles(root);
+  } catch {
+    return { scanned: 0, unreadable: [], dead: [] };
+  }
+  const relPaths = absPaths.map((p) => relative13(root, p).split(sep5).join("/"));
+  const artists = buildArtistIndex(relPaths, root, (abs) => readFile(abs));
+  const dead = [];
+  const unreadable = [];
+  let scanned = 0;
+  for (let i = 0;i < relPaths.length; i++) {
+    const rel = relPaths[i];
+    if (!MEMORY_FILE_RE.test(rel))
+      continue;
+    let body;
+    try {
+      body = readFile(absPaths[i]);
+    } catch {
+      unreadable.push(rel);
+      continue;
+    }
+    scanned++;
+    for (const link of parseMirrorLinks(body)) {
+      if (link.kind !== "prose")
+        continue;
+      const resolution = resolveTarget(link.matchTarget, relPaths, artists);
+      if (resolution.kind !== "unresolved")
+        continue;
+      dead.push({ file: rel, line: link.line, target: link.target });
+    }
+  }
+  dead.sort((a, b) => a.file === b.file ? a.line - b.line : a.file.localeCompare(b.file));
+  unreadable.sort();
+  return { scanned, unreadable, dead };
+}
+
 // src/commands/status.ts
 init_output();
 
 // src/lib/pending-writes.ts
-import { readFileSync as readFileSync25, statSync as statSync16 } from "node:fs";
-import { relative as relative13 } from "node:path";
-var import_gray_matter13 = __toESM(require_gray_matter(), 1);
+import { readFileSync as readFileSync27, statSync as statSync17 } from "node:fs";
+import { relative as relative14 } from "node:path";
+var import_gray_matter14 = __toESM(require_gray_matter(), 1);
 var EMPTY2 = { writes: [], count: 0 };
 function reportedElsewhere(state) {
   const entities = new Set;
@@ -40581,7 +41444,7 @@ function scanPendingWrites(args) {
   const writes = [];
   const discovered = [];
   for (const absolutePath of walkSubtreeFiles(mirrorRootPath, ignored)) {
-    const relPath = relative13(mirrorRootPath, absolutePath);
+    const relPath = relative14(mirrorRootPath, absolutePath);
     const fileMatch = classifyFilesPath({ workspaceSlug, absolutePath });
     if (fileMatch) {
       if (frozenFiles.has(fileMatch.relPath))
@@ -40591,7 +41454,7 @@ function scanPendingWrites(args) {
       const entry3 = getFileEntry(state, fileMatch.relPath);
       let size;
       try {
-        size = statSync16(absolutePath).size;
+        size = statSync17(absolutePath).size;
       } catch {
         continue;
       }
@@ -40599,7 +41462,7 @@ function scanPendingWrites(args) {
         continue;
       let hash2;
       try {
-        hash2 = sha256Bytes(readFileSync25(absolutePath));
+        hash2 = sha256Bytes(readFileSync27(absolutePath));
       } catch {
         continue;
       }
@@ -40620,7 +41483,7 @@ function scanPendingWrites(args) {
       continue;
     let liveInode;
     try {
-      liveInode = statSync16(absolutePath).ino;
+      liveInode = statSync17(absolutePath).ino;
     } catch {
       liveInode = undefined;
     }
@@ -40630,14 +41493,14 @@ function scanPendingWrites(args) {
       continue;
     let content;
     try {
-      content = readFileSync25(absolutePath, "utf8");
+      content = readFileSync27(absolutePath, "utf8");
     } catch {
       continue;
     }
     if (!entry2) {
       let frontmatter;
       try {
-        frontmatter = import_gray_matter13.default(content).data ?? {};
+        frontmatter = import_gray_matter14.default(content).data ?? {};
       } catch {
         continue;
       }
@@ -40799,6 +41662,15 @@ function formatAbsolute(date5) {
   const pad3 = (n) => String(n).padStart(2, "0");
   return `${date5.getFullYear()}-${pad3(date5.getMonth() + 1)}-${pad3(date5.getDate())} ` + `${pad3(date5.getHours())}:${pad3(date5.getMinutes())}:${pad3(date5.getSeconds())}`;
 }
+function describeTokens(tokens) {
+  const versions2 = new Set(tokens.map((t) => t.version));
+  const names = tokens.map((t) => versions2.size === 1 ? `\`${t.token}\`` : `\`${t.token}\` (${t.version})`);
+  const joined = names.length === 1 ? names[0] : `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+  return {
+    joined,
+    inVersion: versions2.size === 1 ? ` in ${tokens[0].version}` : ""
+  };
+}
 function short(sha) {
   return sha.slice(0, 7);
 }
@@ -40820,7 +41692,7 @@ function renderBuild(out, staleness) {
 }
 function lastActivity(now) {
   try {
-    const mtimeMs = statSync17(daemonLogPath()).mtimeMs;
+    const mtimeMs = statSync18(daemonLogPath()).mtimeMs;
     return formatRelative(now.getTime() - mtimeMs);
   } catch {
     return null;
@@ -41003,17 +41875,60 @@ async function runStatus(args, deps = {}) {
     out.info(cont(`Full list with restore commands: ${CONFLICTS_VIEW_REL_PATH} (written by the sync, so this line is the fresher of the two)`));
   }
   out.info("");
-  const commandScan = scanStaleUserBlocks({ workspaceSlug: slug });
+  const links = scanMemoryLinks({ workspaceSlug: slug });
+  const unreadableLinkLines = () => {
+    const n = links.unreadable.length;
+    return [
+      `${n} memory file${n === 1 ? "" : "s"} could not be read, so ${n === 1 ? "its" : "their"} pointers are unchecked.`,
+      ...links.unreadable
+    ];
+  };
+  if (links.dead.length > 0) {
+    const n = links.dead.length;
+    out.info(row("Links", `${n} memory pointer${n === 1 ? "" : "s"} resolve${n === 1 ? "s" : ""} to nothing.`));
+    const MAX_LINKS_SHOWN = 10;
+    for (const d of links.dead.slice(0, MAX_LINKS_SHOWN)) {
+      out.info(cont(`${d.file}:${d.line} — [[${d.target}]]`));
+    }
+    if (n > MAX_LINKS_SHOWN) {
+      out.info(cont(`…and ${n - MAX_LINKS_SHOWN} more.`));
+    }
+    out.info(cont("The fact's pointer is its source. Restore the document, repoint the link, or fold what the pointer was carrying into the fact itself."));
+    if (links.unreadable.length > 0) {
+      for (const line of unreadableLinkLines())
+        out.info(cont(line));
+    }
+  } else if (links.unreadable.length > 0) {
+    const [head, ...rest] = unreadableLinkLines();
+    out.info(row("Links", head));
+    for (const line of rest)
+      out.info(cont(line));
+  } else if (links.scanned === 0) {
+    out.info(row("Links", "No memory files yet. They arrive on the next sync."));
+  } else {
+    out.info(row("Links", "Every memory pointer resolves."));
+  }
+  out.info("");
+  const commandScan = scanStaleUserBlocks({
+    workspaceSlug: slug,
+    retired: deps.retiredTokens
+  });
   const unchecked = commandScan.unchecked;
   if (commandScan.stale.length > 0) {
     const n = commandScan.stale.length;
     out.info(row("Commands", n === 1 ? `1 customisable block names machinery ${commandScan.stale[0].invocation} no longer uses.` : `${n} customisable blocks name machinery their commands no longer use.`));
     for (const f of commandScan.stale) {
-      const versions2 = new Set(f.tokens.map((t) => t.version));
-      const names = f.tokens.map((t) => versions2.size === 1 ? `\`${t.token}\`` : `\`${t.token}\` (${t.version})`);
-      const joined = names.length === 1 ? names[0] : `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
-      const inVersion = versions2.size === 1 ? ` in ${f.tokens[0].version}` : "";
-      out.info(cont(`${f.commandRel} names ${joined}, retired from ${f.invocation}` + `${inVersion}. Review it.`));
+      const stillLive = f.tokens.filter((t) => t.stillACommand);
+      const gone = f.tokens.filter((t) => !t.stillACommand);
+      if (gone.length > 0) {
+        const { joined, inVersion } = describeTokens(gone);
+        out.info(cont(`${f.commandRel} names ${joined}, retired from ${f.invocation}` + `${inVersion}. Review it.`));
+      }
+      if (stillLive.length > 0) {
+        const { joined, inVersion } = describeTokens(stillLive);
+        const noun = stillLive.length === 1 ? "Still a working command" : "Still working commands";
+        out.info(cont(`${f.commandRel} names ${joined}, which ${f.invocation} stopped ` + `running${inVersion}. ${noun} — keep the step if you want it.`));
+      }
     }
     if (unchecked.length > 0) {
       for (const line of uncheckedLines(unchecked))
@@ -41054,7 +41969,7 @@ async function runStatus(args, deps = {}) {
   out.info("");
   let report = null;
   try {
-    report = runGroundingReport({ workspaceSlug: slug });
+    report = (deps.groundingReport ?? (() => runGroundingReport({ workspaceSlug: slug })))();
   } catch {
     report = null;
   }
@@ -41065,6 +41980,16 @@ async function runStatus(args, deps = {}) {
     const bytes = Buffer.byteLength(injected);
     const overBudget = bytes > GROUNDING_BUDGET_BYTES;
     out.info(row("Injection", `${bytes.toLocaleString("en-GB")} bytes at every session start` + (overBudget ? "" : ` (budget ${GROUNDING_BUDGET_BYTES.toLocaleString("en-GB")})`)));
+    const split = report.split;
+    const spent = GROUNDING_CATEGORY_ORDER.filter((c) => split[c] > 0);
+    if (spent.length > 0) {
+      out.info(cont("Where those bytes go:"));
+      const width = Math.max(...spent.map((c) => GROUNDING_CATEGORY_LABELS[c].length));
+      for (const c of spent) {
+        out.info(cont(`  ${GROUNDING_CATEGORY_LABELS[c].padEnd(width)}  ` + `${split[c].toLocaleString("en-GB").padStart(6)}` + (MEMBER_EDITABLE_CATEGORIES.includes(c) ? "  *" : "")));
+      }
+      out.info(cont(`A * marks what is yours to change; the rest is Plinth's own ` + `grounding and is the same on every workspace.`));
+    }
     const contributors = [];
     const rides = (name, reduce) => {
       let raw = null;
@@ -41085,8 +42010,8 @@ async function runStatus(args, deps = {}) {
       { name: WORKSPACE_MEMORY_FILENAME, pick: report.picks.wmPick },
       { name: USER_MEMORY_FILENAME, pick: report.picks.umPick }
     ].flatMap((i) => i.pick === null ? [] : [{ name: i.name, ...i.pick }]);
-    const dropped = indexes.filter((i) => i.kept === 0 && i.total > 0);
-    const partial2 = indexes.filter((i) => i.kept > 0 && i.kept < i.total);
+    const dropped = indexes.filter((i) => i.kept === 0 && i.named === 0 && i.total > 0);
+    const partial2 = indexes.filter((i) => i.kept + i.named > 0 && i.kept < i.total);
     if (overBudget) {
       out.info(cont(`Over the ${GROUNDING_BUDGET_BYTES.toLocaleString("en-GB")}-byte budget.` + (indexes.length > 0 ? " Your memory indexes are already trimmed as far as they go, so the rest is Plinth's own grounding." : " There is no memory index to trim, so all of it is Plinth's own grounding and this workspace's rules.") + " Report it."));
     } else if (dropped.length > 0 || partial2.length > 0) {
@@ -41094,7 +42019,10 @@ async function runStatus(args, deps = {}) {
         out.info(cont(`NONE of ${i.name} fits in the injection: all ${i.total} facts are read from the file on demand, not recalled.`));
       }
       for (const i of partial2) {
-        out.info(cont(`Only ${i.kept} of ${i.total} facts in ${i.name} fit in the injection. The rest stay in the file and are read on demand.`));
+        const unnamed = i.total - i.kept - i.named;
+        const head = i.kept === 0 ? `No fact in ${i.name} fits whole, but ${i.named} of ${i.total} ride as their opening line, so the agent knows they exist.` : `Only ${i.kept} of ${i.total} facts in ${i.name} fit in the injection.` + (i.named > 0 ? ` Another ${i.named} ride as their opening line, so the agent knows they exist.` : ``);
+        const tail = unnamed > 0 ? ` The remaining ${unnamed} stay in the file and are read on demand.` : ` The full text of all of them stays in the file.`;
+        out.info(cont(`${head}${tail}`));
       }
       if (largest !== undefined) {
         out.info(cont(`${largest.name} is the largest of these at ${largest.bytes.toLocaleString("en-GB")} bytes. Shorter lines fit more facts: the convention is one line per fact, a hook and a [[pointer]], not a paragraph.`));
@@ -41103,6 +42031,45 @@ async function runStatus(args, deps = {}) {
       out.info(cont("Every memory fact fits; nothing is being trimmed."));
     }
   }
+  let bars = { over: [], notNamed: 0 };
+  try {
+    bars = assessMemoryBars(slug);
+  } catch {
+    bars = { over: [], notNamed: 0 };
+  }
+  if (bars.over.length > 0) {
+    const overCount = bars.over.length;
+    out.info(row("Too long", `${overCount} file${overCount === 1 ? " is" : "s are"} past the size ` + `${overCount === 1 ? "it is" : "they are"} useful at.`));
+    const size = (n) => n.toLocaleString("en-GB");
+    const buys = (f) => {
+      if (f.buys === "injection") {
+        return " It rides the injection and is never trimmed, so those bytes come off your memory facts.";
+      }
+      if (f.buys === "nothing") {
+        return " None of it rides the injection today: it reduces to comments and headings, so trimming it buys nothing until it holds a rule.";
+      }
+      return "";
+    };
+    for (const f of bars.over.filter((o) => o.kind === "rule")) {
+      const tail = !f.agentMayEdit ? " Yours to edit; the agent is denied." : f.memberOwned ? "" : " It belongs to the workspace, so a person trims it and no session close does.";
+      out.info(cont(`${f.path} is ${size(f.bytes)} bytes against a ${size(f.bar)}-byte bar, ` + `about ${f.rules} rules.${buys(f)}${tail}`));
+    }
+    if (bars.over.some((o) => o.kind === "rule")) {
+      out.info(cont("A rule file gets the tighter bar because it spends the instruction " + "budget: a model follows about 150 reliably and the harness already " + "takes 50. Facts cost room, not instructions."));
+    }
+    for (const f of bars.over.filter((o) => o.kind === "fact")) {
+      out.info(cont(`${f.path} is ${size(f.bytes)} bytes against a ${size(f.bar)}-byte bar, ` + `${f.facts} facts.${buys(f)}`));
+    }
+    if (bars.notNamed > 0) {
+      out.info(cont(`And ${bars.notNamed} more artist ${bars.notNamed === 1 ? "store" : "stores"} past the bar, not named here.`));
+    }
+    if (bars.over.some((o) => o.buys === "per-read")) {
+      out.info(cont((bars.over.some((o) => o.buys !== "per-read") ? "The others are" : "These are") + " read whole when something opens them rather than injected, so" + " trimming them buys context on every read and no injection room."));
+    }
+    if (bars.over.some((o) => o.kind === "fact")) {
+      out.info(cont(`Ending a session with ${CLOSE_COMMAND_INVOCATION} offers to propose a trim for the artist stores.`));
+    }
+  }
   out.info("");
   return { exitCode: 0 };
 }
@@ -41143,7 +42110,7 @@ var versionCommand = defineCommand({
 });
 
 // src/commands/voice-gate.ts
-import { readFileSync as readFileSync28 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 
 // src/lib/voice-gate/api.ts
 var VoiceGateSurfaces = [
@@ -41248,9 +42215,9 @@ async function callVoiceGate(req) {
 import { createHash as createHash4 } from "node:crypto";
 import {
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync26,
+  readFileSync as readFileSync28,
   renameSync as renameSync8,
-  unlinkSync as unlinkSync8,
+  unlinkSync as unlinkSync9,
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { join as join18 } from "node:path";
@@ -41279,7 +42246,7 @@ function emptyFile() {
 }
 function load2(workspaceSlug) {
   try {
-    const raw = readFileSync26(attemptsPath(workspaceSlug), "utf8");
+    const raw = readFileSync28(attemptsPath(workspaceSlug), "utf8");
     const parsed = AttemptsFileSchema.safeParse(JSON.parse(raw));
     return parsed.success ? parsed.data : emptyFile();
   } catch {
@@ -41306,7 +42273,7 @@ function save(workspaceSlug, file2) {
     renameSync8(tmp, target);
   } catch (err) {
     try {
-      unlinkSync8(tmp);
+      unlinkSync9(tmp);
     } catch {}
     throw err;
   }
@@ -41442,7 +42409,7 @@ function denyUngated(detail) {
 }
 
 // src/lib/voice-gate/payload.ts
-import { readFileSync as readFileSync27, statSync as statSync18 } from "node:fs";
+import { readFileSync as readFileSync29, statSync as statSync19 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { isAbsolute as isAbsolute3, resolve as resolve4 } from "node:path";
 var MAX_BODY_BYTES = 256 * 1024;
@@ -41599,11 +42566,11 @@ function isHelperInvocation(tokens) {
   return helperIndex === start + 1 && /(^|\/)python[0-9.]*$/.test(prev);
 }
 function defaultReadBodyFile(path5) {
-  const stat4 = statSync18(path5);
+  const stat4 = statSync19(path5);
   if (stat4.size > MAX_BODY_BYTES) {
     throw new Error(`draft body is ${stat4.size} bytes, over the ${MAX_BODY_BYTES}-byte gate limit`);
   }
-  return readFileSync27(path5, "utf8");
+  return readFileSync29(path5, "utf8");
 }
 function parseRecipients(...raw) {
   const all = raw.filter((v) => typeof v === "string").flatMap((v) => v.split(",")).map((v) => v.trim().toLowerCase()).filter((v) => v.length > 0);
@@ -41963,7 +42930,7 @@ async function runVoiceGateDirect(args, deps = {}) {
   let text;
   if (args.file) {
     try {
-      text = readFileSync28(args.file, "utf8");
+      text = readFileSync30(args.file, "utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown error";
       out.error(`Could not read ${args.file}: ${msg}`);
@@ -42023,12 +42990,12 @@ async function runVoiceGateCommand(args, deps = {}) {
 var voiceGateCommand = defineCommand({
   meta: {
     name: "voice-gate",
-    description: "Gate agent-originated copy against the workspace voice rubric. Use --hook as a Claude Code PreToolUse hook on Gmail draft creation."
+    description: "Check agent-written copy against this workspace's voice rubric, on demand. Nothing gates drafting automatically: Plinth stopped mounting this as a hook and un-mounts the entry it used to write, so applying the rubric is the agent's own job."
   },
   args: {
     hook: {
       type: "boolean",
-      description: "PreToolUse hook mode: read the hook payload on stdin and block non-compliant Gmail drafts.",
+      description: "PreToolUse hook mode: read a hook payload on stdin and block non-compliant Gmail drafts. Plinth does not mount this and un-mounts the entry it used to write; one you add by hand is left alone and still runs.",
       required: false
     },
     workspace: {
@@ -42083,6 +43050,24 @@ var voiceGateCommand = defineCommand({
   }
 });
 
+// src/commands/registry.ts
+var subCommands = {
+  login: loginCommand,
+  sync: syncCommand,
+  start: startCommand,
+  status: statusCommand,
+  confirm: confirmCommand,
+  version: versionCommand,
+  "refresh-context": refreshContextCommand,
+  grounding: groundingCommand,
+  "voice-gate": voiceGateCommand,
+  backlinks: backlinksCommand,
+  declare: declareCommand,
+  "review-tier": reviewTierCommand,
+  session: sessionCommand,
+  "memory-gate": memoryGateCommand
+};
+
 // src/cli.ts
 var argv = process.argv.slice(2);
 var main = defineCommand({
@@ -42091,22 +43076,7 @@ var main = defineCommand({
     version: package_default.version,
     description: "Plinth capstone sync daemon and CLI"
   },
-  subCommands: {
-    login: loginCommand,
-    sync: syncCommand,
-    start: startCommand,
-    status: statusCommand,
-    confirm: confirmCommand,
-    version: versionCommand,
-    "refresh-context": refreshContextCommand,
-    grounding: groundingCommand,
-    "voice-gate": voiceGateCommand,
-    backlinks: backlinksCommand,
-    declare: declareCommand,
-    "review-tier": reviewTierCommand,
-    session: sessionCommand,
-    "memory-gate": memoryGateCommand
-  }
+  subCommands
 });
 var globalSlotEnd = 0;
 while (globalSlotEnd < argv.length && argv[globalSlotEnd].startsWith("-"))