@plinth-music/cli 0.13.0 → 0.15.0

package/dist/cli.js

@@ -7584,7 +7584,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 // package.json
 var package_default = {
   name: "@plinth-music/cli",
-  version: "0.13.0",
+  version: "0.15.0",
   description: "Plinth capstone sync daemon and CLI",
   type: "module",
   private: false,
@@ -22434,7 +22434,8 @@ function stripFm(fm) {
   }
   return out;
 }
-var MIRROR_ANCHOR = "_artist.md";
+var ARTIST_ANCHOR_FILENAME = "_artist.md";
+var MIRROR_ANCHOR = ARTIST_ANCHOR_FILENAME;
 var artistsStrategy = {
   type: "artists",
   apiSegment: "artists",
@@ -25892,10 +25893,39 @@ function invocationFor(relPath) {
   const namespace = parts.pop() ?? "";
   return `/${namespace}:${name}`;
 }
+var GENERATED_COMMAND_RELS = [
+  START_COMMAND_REL,
+  CLOSE_COMMAND_REL,
+  ONBOARD_COMMAND_REL
+];
 var START_COMMAND_INVOCATION = invocationFor(START_COMMAND_REL);
 var CLOSE_COMMAND_INVOCATION = invocationFor(CLOSE_COMMAND_REL);
 var ONBOARD_COMMAND_INVOCATION = invocationFor(ONBOARD_COMMAND_REL);
 
+// src/lib/context/bars.ts
+var RULE_FILE_BAR_BYTES = 6000;
+var FACT_STORE_BAR_BYTES = 12000;
+var ROOT_CLAUDE_MD_LINE_BAR = 140;
+var COMMAND_BAR_BYTES = 24000;
+var INDEX_LINE_MAX_BYTES = 300;
+var MAX_NAMED_FACT_STORES = 5;
+var MAX_NAMED_LONG_INDEX_LINES = 3;
+function countRuleShapedLines(body) {
+  let count = 0;
+  for (const line of body.split(`
+`)) {
+    const trimmed = line.trim();
+    if (/^[-*+]\s/.test(trimmed))
+      count += 1;
+    else if (/^\*\*[^*]+\*\*/.test(trimmed))
+      count += 1;
+  }
+  return count;
+}
+function countParagraphs(body) {
+  return body.split(/\n\s*\n/).map((p) => p.trim()).filter((p) => p.length > 0).length;
+}
+
 // src/lib/context/grounding.ts
 var WORKSPACE_RULES_FILENAME = "workspace-rules.md";
 var HOUSE_STYLE_LEGACY_FILENAME = "house-style.md";
@@ -25959,6 +25989,7 @@ var GROUNDING_CATEGORY_ORDER = [
   "grounding",
   "identity",
   "budgetNote",
+  "sizeNote",
   "voice",
   "rules",
   "workspaceFacts",
@@ -25968,6 +25999,7 @@ var GROUNDING_CATEGORY_LABELS = {
   grounding: "Plinth's own grounding",
   identity: "who you are",
   budgetNote: "the trim notes",
+  sizeNote: "the size warning",
   voice: "voice pointer",
   rules: "this workspace's rules",
   workspaceFacts: "workspace facts",
@@ -25986,7 +26018,8 @@ function segmentBytes(lines, cats) {
     workspaceFacts: 0,
     personalFacts: 0,
     voice: 0,
-    budgetNote: 0
+    budgetNote: 0,
+    sizeNote: 0
   };
   lines.forEach((text, i) => {
     const cat = cats[i];
@@ -26156,7 +26189,7 @@ function titlesLeadIn(kept, named, unnamed, total, filename) {
     parts.push(`${unnamed} not shown at all`);
   return `Not all of this index fits. It holds ${total} facts: ${parts.join(", ")}. ` + `Every line below ends \`…\` because it is an opening and not the whole ` + `fact. They are all in \`${filename}\` at the mirror root: READ THAT FILE ` + `IN FULL before you answer that no fact covers something.`;
 }
-function composeGroundingBlock(today, workspaceRules, workspaceMemory, userMemory, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, workspaceMemoryNote, userMemoryNote, member, workspaceTitles = null, userTitles = null) {
+function composeGroundingBlock(today, workspaceRules, workspaceMemory, userMemory, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, workspaceMemoryNote, userMemoryNote, member, workspaceTitles = null, userTitles = null, filesPastBar = 0) {
   const gateFlag = workspaceSlug === null ? `--workspace="<this workspace>"` : `--workspace ${workspaceSlug}`;
   const identity = renderMemberIdentity(member, workspaceSlug);
   const block = [];
@@ -26210,14 +26243,24 @@ function composeGroundingBlock(today, workspaceRules, workspaceMemory, userMemor
     add("grounding", ``, `Dated recall. Every line in these indexes carries the date it was banked, ` + `and today's date is injected above, so the age of any line is ` + `computable. When you rely on a line in an answer, say how old it is - ` + `"banked 21 July, seventeen days ago" - rather than presenting it as ` + `current. Age is not a reason to distrust a line, it is what tells the ` + `reader whether to check: a working convention banked a year ago is ` + `probably still the convention, a fact about a live negotiation banked ` + `three weeks ago probably is not. And say what the indexes do NOT cover. ` + `If you are asked about something no line here addresses, say so plainly ` + `rather than answering only from what happens to be present - an index ` + `that is silent on a subject reads exactly like one that has settled it.`);
   }
   add("grounding", ``, `Declare a work product before you finish with it. Your scratchpad ` + `directory sits outside Plinth: temporary, scoped to this session, and ` + `invisible to the person who asked for the work. Prefer not to leave a ` + `deliverable there at all. If it belongs to this workspace, write it to ` + `a mirror file instead, where it syncs and is durable. When the ` + `scratchpad genuinely is a file's only home, meaning a document, ` + `profile, report or analysis that was the POINT of the work rather than ` + `a step toward it, declare it the moment you write it, with ` + `\`plinth declare "<path>" --scratchpad="<the scratchpad directory ` + `your harness told you to use>" --label='<short description>'\`. ` + `Declare only ` + `those. A file that already has another home is not a deliverable: not ` + `raw API dumps, thread JSON, helper scripts, or the body files you write ` + `for a tool that reads a path, where the durable deliverable is the ` + `draft the tool creates. Declaring everything you wrote buries the one ` + `that mattered, which is the failure this exists to prevent. ` + `Re-declaring a path replaces the earlier entry, so refine a label ` + `freely. This is about work products, not memory: durable facts still go ` + `to the index above. Like every rule here it is additive and ` + `subordinate, and never relaxes a safety primitive above.`);
+  if (filesPastBar > 0) {
+    add("sizeNote", ``, `${filesPastBar} of the files that guide you ${filesPastBar === 1 ? "is" : "are"} past ` + `${filesPastBar === 1 ? "its" : "their"} size bar. \`plinth status\` names ` + `${filesPastBar === 1 ? "it" : "them"} and which are yours alone to trim; ` + `${CLOSE_COMMAND_INVOCATION} proposes a trim for the ones it can, never unasked.`);
+  }
   if (shouldOfferOnboarding(rosterIsEmpty, member)) {
     add("grounding", ``, `This workspace has no artists in it yet. OFFER to set it up before you ` + `get into anything else, because an empty roster reported as a summary ` + `reads as a broken product rather than a new one. Say in one or two ` + `lines that ` + `${ONBOARD_COMMAND_INVOCATION} walks them through connecting their ` + `inbox, calendar and files, gets their roster in, and turns the work ` + `they already have running into projects and tasks, then ask whether ` + `to start now. Then STOP AND WAIT for their answer. Do not begin the ` + `interview, do not connect anything, and do not create an artist, a ` + `project or a task until they have said yes. If they say no, or they ` + `asked for something else in the same message, drop it and do the ` + `thing they asked for. Offer once, and never twice in one session. ` + `And a workspace can have no artists on purpose: if they have turned ` + `this down before, or this is not an artist workspace, leave it alone ` + `rather than raising it every time you open one.`);
   }
-  return { text: block.join(`
-`), split: segmentBytes(block, cats) };
+  const groundingText = block.filter((_, i) => cats[i] === "grounding").join(`
+`);
+  return {
+    text: block.join(`
+`),
+    split: segmentBytes(block, cats),
+    groundingParagraphs: countParagraphs(groundingText),
+    groundingRuleShaped: countRuleShapedLines(groundingText)
+  };
 }
-function buildGroundingReport(today, workspaceRules = null, workspaceMemory = null, userMemory = null, freshness = {}, rosterIsEmpty = false, voiceProfile = null, voiceMalformed = false, workspaceSlug = null, member = null) {
-  const compose = (wmBody, umBody, wmNote, umNote, wmTitles = null, umTitles = null) => composeGroundingBlock(today, workspaceRules, wmBody, umBody, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, wmNote, umNote, member, wmTitles, umTitles);
+function buildGroundingReport(today, workspaceRules = null, workspaceMemory = null, userMemory = null, freshness = {}, rosterIsEmpty = false, voiceProfile = null, voiceMalformed = false, workspaceSlug = null, member = null, filesPastBar = 0) {
+  const compose = (wmBody, umBody, wmNote, umNote, wmTitles = null, umTitles = null) => composeGroundingBlock(today, workspaceRules, wmBody, umBody, freshness, rosterIsEmpty, voiceProfile, voiceMalformed, workspaceSlug, wmNote, umNote, member, wmTitles, umTitles, filesPastBar);
   const whole = compose(workspaceMemory, userMemory, null, null);
   const untrimmed = () => {
     const all = (body) => {
@@ -26227,6 +26270,8 @@ function buildGroundingReport(today, workspaceRules = null, workspaceMemory = nu
     return {
       block: whole.text,
       split: whole.split,
+      groundingParagraphs: whole.groundingParagraphs,
+      groundingRuleShaped: whole.groundingRuleShaped,
       picks: {
         wmPick: workspaceMemory === null ? null : all(workspaceMemory),
         umPick: userMemory === null ? null : all(userMemory)
@@ -26300,7 +26345,13 @@ function buildGroundingReport(today, workspaceRules = null, workspaceMemory = nu
   const fitting = candidates.filter((c) => c.bytes <= GROUNDING_BUDGET_BYTES);
   const better = (a, b) => b.named !== a.named ? b.named > a.named : b.whole > a.whole;
   const best = fitting.length > 0 ? fitting.reduce((a, b) => better(a, b) ? b : a) : candidates.reduce((a, b) => b.bytes < a.bytes ? b : a);
-  return { block: best.composed.text, picks: best.picks, split: best.composed.split };
+  return {
+    block: best.composed.text,
+    picks: best.picks,
+    split: best.composed.split,
+    groundingParagraphs: best.composed.groundingParagraphs,
+    groundingRuleShaped: best.composed.groundingRuleShaped
+  };
 }
 var buildGroundingReportFor = buildGroundingReport;
 function formatLocalDate(d) {
@@ -26478,6 +26529,11 @@ var TeamRejectedSchema = exports_external.object({
   fetched_at: exports_external.string().datetime({ offset: true }),
   rows: exports_external.array(TeamFileRejectionSchema)
 });
+var SizeAnchorSchema = exports_external.object({
+  at: exports_external.string().min(1),
+  kind: exports_external.enum(["session-end", "sync"]),
+  sizes: exports_external.record(exports_external.string(), exports_external.number().int().nonnegative()).default({})
+});
 var WorkspaceStateV2Schema = exports_external.object({
   version: exports_external.literal(2),
   workspace_slug: exports_external.string().min(1),
@@ -26491,7 +26547,9 @@ var WorkspaceStateV2Schema = exports_external.object({
   user_voice: UserVoiceStateSchema.optional(),
   derived_text_version: exports_external.number().int().nonnegative().optional(),
   frontmatter_id_backfill_version: exports_external.number().int().nonnegative().optional(),
-  team_rejected: TeamRejectedSchema.optional()
+  team_rejected: TeamRejectedSchema.optional(),
+  size_anchor: SizeAnchorSchema.optional(),
+  last_trim_at: exports_external.string().min(1).optional()
 });
 var WorkspaceStateV1Schema = exports_external.object({
   version: exports_external.literal(1),
@@ -26637,6 +26695,13 @@ function mergeVersioned(fresh, before, after) {
   }
   return { value: after, overruled: false };
 }
+function mergeAnchor(fresh, before, after) {
+  if (before === after)
+    return fresh;
+  if (after?.kind === "sync" && fresh !== undefined)
+    return fresh;
+  return after;
+}
 function commitState(before, after) {
   const fresh = loadState(after.workspace_slug);
   const entityTypes = new Set([
@@ -26674,7 +26739,9 @@ function commitState(before, after) {
     user_voice: userVoice.value,
     derived_text_version: mergeScalar(fresh.derived_text_version, before.derived_text_version, after.derived_text_version),
     frontmatter_id_backfill_version: mergeScalar(fresh.frontmatter_id_backfill_version, before.frontmatter_id_backfill_version, after.frontmatter_id_backfill_version),
-    team_rejected: mergeScalar(fresh.team_rejected, before.team_rejected, after.team_rejected)
+    team_rejected: mergeScalar(fresh.team_rejected, before.team_rejected, after.team_rejected),
+    size_anchor: mergeAnchor(fresh.size_anchor, before.size_anchor, after.size_anchor),
+    last_trim_at: mergeScalar(fresh.last_trim_at, before.last_trim_at, after.last_trim_at)
   };
   writeState(merged);
   const singletonOverruled = rules.overruled || memory.overruled || userMemory.overruled || userVoice.overruled;
@@ -26985,8 +27052,411 @@ function readMemoryFreshness(workspaceSlug) {
     userVoice: voice.success ? voice.data : null
   };
 }
+function setSizeAnchor(state, anchor) {
+  if (anchor.kind === "sync" && state.size_anchor !== undefined) {
+    return { state, changed: false };
+  }
+  const existing = state.size_anchor;
+  if (existing !== undefined && existing.kind === anchor.kind && existing.at === anchor.at && sizesEqual(existing.sizes, anchor.sizes)) {
+    return { state, changed: false };
+  }
+  return { state: { ...state, size_anchor: anchor }, changed: true };
+}
+function sizesEqual(a, b) {
+  const ak = Object.keys(a);
+  const bk = Object.keys(b);
+  if (ak.length !== bk.length)
+    return false;
+  return ak.every((k) => a[k] === b[k]);
+}
+function setLastTrimAt(state, at) {
+  if (state.last_trim_at === at)
+    return { state, changed: false };
+  return { state: { ...state, last_trim_at: at }, changed: true };
+}
+
+// src/lib/context/guiding-files.ts
+var CLAUDE_MD = "CLAUDE.md";
+var CLAUDE_LOCAL_MD = "CLAUDE.local.md";
+var ARTIST_CLAUDE_MD = "CLAUDE.md";
+var SETTINGS_REL = ".claude/settings.json";
+var ARTIST_SLUG_PLACEHOLDER = "<slug>";
+var artistFile = (name) => `artists/${ARTIST_SLUG_PLACEHOLDER}/${name}`;
+function withThousands(n) {
+  return String(n).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+}
+var NO_BAR = "none";
+var GUIDING_FILES = [
+  {
+    path: CLAUDE_MD,
+    writtenBy: "Plinth every sync; the block between the markers is yours",
+    readWhen: "loaded by Claude Code when a session starts here",
+    reach: "everyone",
+    bar: `${ROOT_CLAUDE_MD_LINE_BAR} lines of generated body`
+  },
+  {
+    path: CLAUDE_LOCAL_MD,
+    writtenBy: "you, by hand",
+    readWhen: `loaded after \`${CLAUDE_MD}\``,
+    reach: "this machine",
+    bar: NO_BAR
+  },
+  {
+    path: WORKSPACE_RULES_FILENAME,
+    writtenBy: "you; the agent proposes and never writes it",
+    readWhen: "injected at session start, whole",
+    reach: "everyone",
+    bar: `${withThousands(RULE_FILE_BAR_BYTES)} bytes`
+  },
+  {
+    path: WORKSPACE_MEMORY_FILENAME,
+    writtenBy: "you and the agent at a session close",
+    readWhen: "injected at session start, newest facts first",
+    reach: "everyone",
+    bar: `the ${withThousands(GROUNDING_BUDGET_BYTES)}-byte injection`
+  },
+  {
+    path: USER_MEMORY_FILENAME,
+    writtenBy: "the agent at a session close",
+    readWhen: "injected at session start, newest facts first",
+    reach: "you only",
+    bar: `the ${withThousands(GROUNDING_BUDGET_BYTES)}-byte injection`
+  },
+  {
+    path: VOICE_FILENAME,
+    writtenBy: "you only; the agent is denied editing it",
+    readWhen: "read on demand; only a pointer is injected",
+    reach: "you only",
+    bar: `${withThousands(RULE_FILE_BAR_BYTES)} bytes`
+  },
+  {
+    path: artistFile(ARTIST_ANCHOR_FILENAME),
+    writtenBy: "you and the agent; syncs both ways",
+    readWhen: "read on demand",
+    reach: "everyone",
+    bar: NO_BAR
+  },
+  {
+    path: artistFile(ARTIST_MEMORY_ANCHOR),
+    writtenBy: "the agent at a session close",
+    readWhen: "read on demand",
+    reach: "everyone",
+    bar: `${withThousands(FACT_STORE_BAR_BYTES)} bytes`
+  },
+  {
+    path: artistFile(ARTIST_CLAUDE_MD),
+    writtenBy: "Plinth every sync; the block between the markers is yours",
+    readWhen: "loaded when the agent opens that artist's folder",
+    reach: "everyone",
+    bar: NO_BAR
+  },
+  ...GENERATED_COMMAND_RELS.map((rel) => ({
+    path: rel,
+    writtenBy: "Plinth every sync; the block between the markers is yours",
+    readWhen: `read when you run \`${invocationFor(rel)}\``,
+    reach: "everyone",
+    bar: `${withThousands(COMMAND_BAR_BYTES)} bytes`
+  })),
+  {
+    path: SETTINGS_REL,
+    writtenBy: "Plinth every sync; your own hooks and permissions survive",
+    readWhen: "loaded by Claude Code from the folder a session starts in",
+    reach: "this machine",
+    bar: NO_BAR
+  }
+];
+var GROUNDING_SURFACE = {
+  path: "the session grounding (`plinth grounding`)",
+  writtenBy: "Plinth",
+  readWhen: "injected ahead of your first word, every session",
+  reach: "everyone",
+  bar: `${withThousands(GROUNDING_BUDGET_BYTES)} bytes`
+};
+var GUIDING_FILES_HEADING = "## The guiding files";
+function renderGuidingFilesSection() {
+  const rows = [...GUIDING_FILES, GROUNDING_SURFACE];
+  return [
+    GUIDING_FILES_HEADING,
+    `Every file that guides a session here, what writes it, when it is read, how far it reaches, and how big it may get. \`plinth status\` says which of these are past their size and what trimming each one buys.`,
+    ``,
+    `| File | Written by | Read | Reaches | Bar |`,
+    `|---|---|---|---|---|`,
+    ...rows.map((f) => `| ${f.path.startsWith("the ") ? f.path : `\`${f.path}\``} | ${f.writtenBy} | ${f.readWhen} | ${f.reach} | ${f.bar} |`)
+  ];
+}
+
+// src/lib/context/markers.ts
+var USER_BLOCK_BEGIN = "<!-- BEGIN: user-customisable -->";
+var USER_BLOCK_END = "<!-- END -->";
+var USER_BLOCK_PLACEHOLDER = "_Add workspace-specific guidance here. This block is the only part of " + "the file Plinth preserves across regenerations._";
+function extractUserBlock(content) {
+  const beginIdx = content.indexOf(USER_BLOCK_BEGIN);
+  if (beginIdx === -1)
+    return null;
+  const afterBegin = beginIdx + USER_BLOCK_BEGIN.length;
+  const endIdx = content.indexOf(USER_BLOCK_END, afterBegin);
+  if (endIdx === -1)
+    return null;
+  return content.slice(afterBegin, endIdx);
+}
+function injectUserBlock(generated, preserved) {
+  const beginIdx = generated.indexOf(USER_BLOCK_BEGIN);
+  if (beginIdx === -1) {
+    throw new Error("injectUserBlock: generated content has no BEGIN marker");
+  }
+  const afterBegin = beginIdx + USER_BLOCK_BEGIN.length;
+  const endIdx = generated.indexOf(USER_BLOCK_END, afterBegin);
+  if (endIdx === -1) {
+    throw new Error("injectUserBlock: generated content has no END marker");
+  }
+  return generated.slice(0, afterBegin) + preserved + generated.slice(endIdx);
+}
+
+// src/lib/context/memory-bars.ts
+function factBody(raw) {
+  return raw.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*$/, "").split(`
+`).filter((line) => !/^\s*#{1,6}\s/.test(line)).join(`
+`).trim();
+}
+var RULE_FILES = [
+  { filename: VOICE_FILENAME, agentMayEdit: false, memberOwned: true, ridesInjection: false },
+  { filename: WORKSPACE_RULES_FILENAME, agentMayEdit: true, memberOwned: false, ridesInjection: true }
+];
+function assessMemoryBars(workspaceSlug, deps = {}) {
+  const readContext = deps.readContext ?? readContextFile;
+  const readArtistMemory = deps.readArtistMemory ?? readArtistMemoryFile;
+  const rosterOf = deps.readRosterFn ?? readRoster;
+  const over = [];
+  for (const spec of RULE_FILES) {
+    let raw = null;
+    try {
+      raw = readContext(workspaceSlug, spec.filename);
+    } catch {
+      raw = null;
+    }
+    if (raw === null)
+      continue;
+    const bytes = Buffer.byteLength(raw);
+    if (bytes <= RULE_FILE_BAR_BYTES)
+      continue;
+    over.push({
+      path: spec.filename,
+      kind: "rule",
+      bytes,
+      bar: RULE_FILE_BAR_BYTES,
+      rules: countRuleShapedLines(raw),
+      facts: groupFacts(factBody(raw)).length,
+      agentMayEdit: spec.agentMayEdit,
+      memberOwned: spec.memberOwned,
+      buys: !spec.ridesInjection ? "per-read" : Buffer.byteLength(extractWorkspaceRules(raw) ?? "") > 0 ? "injection" : "nothing"
+    });
+  }
+  let roster;
+  try {
+    roster = rosterOf(workspaceSlug);
+  } catch {
+    roster = [];
+  }
+  const stores = [];
+  for (const artist of roster) {
+    let raw = null;
+    try {
+      raw = readArtistMemory(workspaceSlug, artist.slug);
+    } catch {
+      raw = null;
+    }
+    if (raw === null)
+      continue;
+    const bytes = Buffer.byteLength(raw);
+    if (bytes <= FACT_STORE_BAR_BYTES)
+      continue;
+    stores.push({
+      path: `artists/${artist.slug}/memory.md`,
+      kind: "fact",
+      bytes,
+      bar: FACT_STORE_BAR_BYTES,
+      rules: countRuleShapedLines(raw),
+      facts: groupFacts(factBody(raw)).length,
+      agentMayEdit: true,
+      memberOwned: true,
+      buys: "per-read"
+    });
+  }
+  stores.sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path));
+  const named = stores.slice(0, MAX_NAMED_FACT_STORES);
+  return { over: [...over, ...named], notNamed: stores.length - named.length };
+}
+function blockLineCount(block) {
+  const newlines = block.match(/\n/g)?.length ?? 0;
+  return Math.max(0, newlines - 1);
+}
+var generatedFileSpecs = [
+  { path: CLAUDE_MD, unit: "lines", bar: ROOT_CLAUDE_MD_LINE_BAR },
+  ...GENERATED_COMMAND_RELS.map((rel) => ({
+    path: rel,
+    unit: "bytes",
+    bar: COMMAND_BAR_BYTES
+  }))
+];
+function assessGeneratedFileBars(workspaceSlug, deps = {}) {
+  const readContext = deps.readContext ?? readContextFile;
+  const out = [];
+  for (const spec of generatedFileSpecs) {
+    let raw = null;
+    try {
+      raw = readContext(workspaceSlug, spec.path);
+    } catch {
+      raw = null;
+    }
+    if (raw === null)
+      continue;
+    const bytes = Buffer.byteLength(raw);
+    const lines = raw.split(`
+`).length;
+    const block = extractUserBlock(raw);
+    const blockBytes = block === null ? null : Buffer.byteLength(block);
+    const generatedBytes = blockBytes === null ? null : bytes - blockBytes;
+    const generatedLines = block === null ? null : lines - blockLineCount(block);
+    const measured = spec.unit === "lines" ? generatedLines ?? lines : bytes;
+    out.push({
+      path: spec.path,
+      unit: spec.unit,
+      measured,
+      bar: spec.bar,
+      over: measured > spec.bar,
+      bytes,
+      lines,
+      generatedBytes,
+      generatedLines,
+      blockBytes,
+      ruleShaped: countRuleShapedLines(raw)
+    });
+  }
+  return out;
+}
+var OPENING_MAX_BYTES = 90;
+function terminalSafeOpening(fact) {
+  const stripped = fact.replace(/[\x00-\x1F\x7F-\x9F]+/g, " ");
+  const folded = stripped.replace(/\s+/g, " ").trim();
+  let out = "";
+  for (const ch of folded) {
+    if (Buffer.byteLength(out + ch) > OPENING_MAX_BYTES)
+      return `${out.trimEnd()}…`;
+    out += ch;
+  }
+  return out;
+}
+function assessIndexLines(workspaceSlug, deps = {}) {
+  const readContext = deps.readContext ?? readContextFile;
+  const specs = [
+    { filename: WORKSPACE_MEMORY_FILENAME, reduce: extractWorkspaceMemory },
+    { filename: USER_MEMORY_FILENAME, reduce: extractUserMemory }
+  ];
+  const out = [];
+  for (const spec of specs) {
+    let raw = null;
+    try {
+      raw = readContext(workspaceSlug, spec.filename);
+    } catch {
+      raw = null;
+    }
+    const body = raw === null ? null : factBody(spec.reduce(raw) ?? "");
+    if (body === null)
+      continue;
+    const facts = groupFacts(body);
+    const long = facts.map((f) => ({ bytes: Buffer.byteLength(f), fact: f })).filter((f) => f.bytes > INDEX_LINE_MAX_BYTES).sort((a, b) => b.bytes - a.bytes);
+    if (long.length === 0)
+      continue;
+    out.push({
+      filename: spec.filename,
+      facts: facts.length,
+      over: long.length,
+      longest: long.slice(0, MAX_NAMED_LONG_INDEX_LINES).map((f) => ({ bytes: f.bytes, opening: terminalSafeOpening(f.fact) }))
+    });
+  }
+  return out;
+}
+function measureBarredFiles(workspaceSlug, deps = {}) {
+  const readContext = deps.readContext ?? readContextFile;
+  const readArtistMemory = deps.readArtistMemory ?? readArtistMemoryFile;
+  const rosterOf = deps.readRosterFn ?? readRoster;
+  const sizes = {};
+  const answered = [];
+  const record2 = (path3, read) => {
+    let raw;
+    try {
+      raw = read();
+    } catch {
+      return;
+    }
+    answered.push(path3);
+    if (raw === null)
+      return;
+    sizes[path3] = Buffer.byteLength(raw);
+  };
+  for (const name of [
+    VOICE_FILENAME,
+    WORKSPACE_RULES_FILENAME,
+    WORKSPACE_MEMORY_FILENAME,
+    USER_MEMORY_FILENAME,
+    CLAUDE_MD,
+    ...GENERATED_COMMAND_RELS
+  ]) {
+    record2(name, () => readContext(workspaceSlug, name));
+  }
+  let roster;
+  try {
+    roster = rosterOf(workspaceSlug);
+  } catch {
+    roster = [];
+  }
+  for (const artist of roster) {
+    record2(`artists/${artist.slug}/${ARTIST_MEMORY_ANCHOR}`, () => readArtistMemory(workspaceSlug, artist.slug));
+  }
+  return { sizes, answered };
+}
+var TRIM_DORMANCY_DAYS = 30;
+function lastTrimAtFromState(workspaceSlug) {
+  return loadState(workspaceSlug).last_trim_at ?? null;
+}
+function shouldOfferTrim(workspaceSlug, deps = {}) {
+  let over = 0;
+  try {
+    const bars = assessMemoryBars(workspaceSlug, deps);
+    over = bars.over.length + bars.notNamed;
+  } catch {
+    over = 0;
+  }
+  if (over > 0)
+    return true;
+  let longLines = 0;
+  try {
+    longLines = assessIndexLines(workspaceSlug, deps).length;
+  } catch {
+    longLines = 0;
+  }
+  if (longLines === 0)
+    return false;
+  let lastTrim = null;
+  try {
+    lastTrim = (deps.readLastTrimAt ?? lastTrimAtFromState)(workspaceSlug);
+  } catch {
+    lastTrim = null;
+  }
+  if (lastTrim === null)
+    return true;
+  const then = Date.parse(lastTrim);
+  if (Number.isNaN(then))
+    return true;
+  const now = (deps.now ?? (() => new Date))().getTime();
+  return now - then >= TRIM_DORMANCY_DAYS * 24 * 60 * 60 * 1000;
+}
 
 // src/commands/grounding.ts
+function countFilesPastBar(slug) {
+  const bars = assessMemoryBars(slug);
+  return bars.over.length + bars.notNamed;
+}
 function readWorkspaceRulesFile(slug) {
   return readContextFile(slug, WORKSPACE_RULES_FILENAME);
 }
@@ -27042,6 +27512,7 @@ function runGroundingReport(deps = {}) {
   const readFreshness = deps.readFreshness ?? readMemoryFreshness;
   const readRosterIsEmpty = deps.readRosterIsEmpty ?? rosterIsEmpty;
   const readMember = deps.readMember ?? readMemberFromConfig;
+  const readFilesPastBar = deps.readFilesPastBar ?? countFilesPastBar;
   const readTimezone = deps.readTimezone ?? readMachineTimezone;
   let rawRules = null;
   let rawMemory = null;
@@ -27054,6 +27525,7 @@ function runGroundingReport(deps = {}) {
   };
   let noArtists = false;
   let member = null;
+  let filesPastBar = 0;
   const workspaceSlug = isValidWorkspaceSlug(deps.workspaceSlug ?? "") ? deps.workspaceSlug : null;
   if (workspaceSlug) {
     try {
@@ -27086,6 +27558,11 @@ function runGroundingReport(deps = {}) {
     } catch {
       noArtists = false;
     }
+    try {
+      filesPastBar = readFilesPastBar(workspaceSlug);
+    } catch {
+      filesPastBar = 0;
+    }
     try {
       const stored = readMember(workspaceSlug);
       member = stored === null ? null : { ...stored, timezone: readTimezone() };
@@ -27100,7 +27577,7 @@ function runGroundingReport(deps = {}) {
   return buildGroundingReportFor(formatLocalDate(now()), rules, memory, userMemory, {
     workspaceMemoryUpdatedAt: resolveUpdatedAt(rawMemory, freshness.workspaceMemory),
     userMemoryUpdatedAt: resolveUpdatedAt(rawUserMemory, freshness.userMemory)
-  }, noArtists, voiceProfile, resolveVoiceMalformed(rawVoiceProfile, freshness.userVoice), workspaceSlug, member);
+  }, noArtists, voiceProfile, resolveVoiceMalformed(rawVoiceProfile, freshness.userVoice), workspaceSlug, member, filesPastBar);
 }
 var groundingCommand = defineCommand({
   meta: {
@@ -28286,33 +28763,6 @@ function normaliseGeneratedAt(content) {
   return content.replace(STAMP_SLOT_RE, GENERATED_AT_PREFIX + GENERATED_AT_PLACEHOLDER);
 }
 
-// src/lib/context/markers.ts
-var USER_BLOCK_BEGIN = "<!-- BEGIN: user-customisable -->";
-var USER_BLOCK_END = "<!-- END -->";
-var USER_BLOCK_PLACEHOLDER = "_Add workspace-specific guidance here. This block is the only part of " + "the file Plinth preserves across regenerations._";
-function extractUserBlock(content) {
-  const beginIdx = content.indexOf(USER_BLOCK_BEGIN);
-  if (beginIdx === -1)
-    return null;
-  const afterBegin = beginIdx + USER_BLOCK_BEGIN.length;
-  const endIdx = content.indexOf(USER_BLOCK_END, afterBegin);
-  if (endIdx === -1)
-    return null;
-  return content.slice(afterBegin, endIdx);
-}
-function injectUserBlock(generated, preserved) {
-  const beginIdx = generated.indexOf(USER_BLOCK_BEGIN);
-  if (beginIdx === -1) {
-    throw new Error("injectUserBlock: generated content has no BEGIN marker");
-  }
-  const afterBegin = beginIdx + USER_BLOCK_BEGIN.length;
-  const endIdx = generated.indexOf(USER_BLOCK_END, afterBegin);
-  if (endIdx === -1) {
-    throw new Error("injectUserBlock: generated content has no END marker");
-  }
-  return generated.slice(0, afterBegin) + preserved + generated.slice(endIdx);
-}
-
 // src/lib/context/artist-claude-md.ts
 var CONTEXT_VERSION_HEADER = "plinth-context-version";
 var TASK_DISPLAY_CAP = 10;
@@ -28580,7 +29030,7 @@ function strOrNull(value) {
 }
 
 // src/lib/context/schema-version.ts
-var TEMPLATE_VERSION = "4";
+var TEMPLATE_VERSION = "5";
 var HEADER_RE = /<!--\s*plinth-schema-version:\s*([a-f0-9]+)\s*-->/;
 function computeSchemaVersion(inputs) {
   return stableHash(inputs).slice(0, 12);
@@ -28617,7 +29067,6 @@ function decideRegen(input) {
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { accessSync, constants, realpathSync, statSync as statSync3 } from "node:fs";
 import { basename as basename2 } from "node:path";
-var SETTINGS_REL = ".claude/settings.json";
 var MANAGED_KEY = "_plinth";
 var COMMENT_SENTINEL = 'Managed by plinth-cli. Entries tagged "_plinth" are REGENERATED on every sync:';
 var MANAGED_COMMENT = [
@@ -29013,7 +29462,6 @@ function warnUnresolvedBinary(out) {
 }
 
 // src/lib/context/artist-context.ts
-var ARTIST_CLAUDE_MD = "CLAUDE.md";
 var ARTIST_DAILY_LOG_MD = "daily-log.md";
 function ensurePerArtistContext(deps) {
   const { workspaceSlug, force, out, now } = deps;
@@ -29169,7 +29617,7 @@ function withUserBlock(lines) {
 `) + `
 `;
 }
-function buildStartCommandMd(rosterIsEmpty2) {
+function buildStartCommandMd(rosterIsEmpty2, offerTrim = false) {
   return withUserBlock([
     "---",
     "description: Open a Plinth session in this workspace. Reads both memory files, pulls what is unread, reads the projected calendar and anything the sync set aside, gives a three-line brief, then asks what you want to work on.",
@@ -29189,6 +29637,14 @@ function buildStartCommandMd(rosterIsEmpty2) {
       "**Offer once, and never twice in one session.** And a workspace can have no artists on purpose: if they have declined before, or this is not an artist workspace, drop the offer and brief normally rather than raising it every time you open one.",
       ""
     ] : [],
+    ...offerTrim ? [
+      `**Some of the files that guide this workspace have outgrown what they are for.** Say so in ONE line beside the brief, say \`plinth status\` lists them and which are theirs alone to trim, and name ${CLOSE_COMMAND_INVOCATION} as the thing that proposes a trim for the ones it can. Then carry on.`,
+      "",
+      "**Offer it and wait; never trim anything here.** This command reads. If they want it now, run `plinth status` so they can see which files and by how much, and leave the trim itself to the close, which proposes each line and writes only what they accept.",
+      "",
+      "**Offer once, and never twice in one session.** If they say no, or they came here to do something else, drop it and do not raise it again in this session.",
+      ""
+    ] : [],
     "**Do not re-run `date`, and do not restate the grounding rules.** The Plinth SessionStart hook has already injected today's date, the entity-resolution rule and the write-confirmation rule, and the workspace `CLAUDE.md` (roster and folder map) is already in context. Repeating them spends the budget this command exists to protect.",
     "",
     "## Step 1: use the two memory indexes you were already given",
@@ -29434,6 +29890,7 @@ function buildCloseCommandMd(workspaceSlug) {
     "- **Nothing banked in the last 30 days is dropped**, measured against the date the session hook injected. Recent facts have not had time to prove whether they were durable, and a trim is not the place to decide.",
     "- **Merging two facts into one is a rewrite and shows as one**, with both original lines visible in the proposal.",
     "- **A contradicting pair is a supersede, not a cut**, resolved by Step 4b's order; the loser stays in the file.",
+    "- **An over-long line is a split wherever it lives.** `plinth status` has an **`Overlong`** row naming index lines past 300 bytes with their length. In an artist store, propose the split here. In either memory index, say it in the closing summary and edit nothing: the workspace one is a person's, and your own is Step 4b's.",
     "",
     "**Then write only what the member confirms**, and only to the files this command can reach:",
     "",
@@ -29450,6 +29907,8 @@ function buildCloseCommandMd(workspaceSlug) {
     "",
     "**Write the archive first and `artists/<slug>/memory.md` second, never the other way round** - two files cannot be one edit, and in this order a failure between them over-claims rather than losing lines. **Say plainly that the archive stays on this machine**: Plinth never syncs, reads or rewrites it, so a teammate sees the facts gone from `memory.md` and no trace of where they went. Undoing a trim is a copy back by hand. **The proposal is the control; the archive is only the undo.** **Report it when you report the trim, not in the Step 5 summary**, which is already written - name the file, and **if the `memory.md` write was set aside say so**, because the archive then lists lines still in the store.",
     "",
+    "**A trim you wrote is recorded by `--trimmed` on Step 7's `session end`**, which is what stops `/plinth:start` offering one again for the next 30 days. Leaving it off costs a repeated offer and nothing else.",
+    "",
     "**Anything you write here lands after Step 5 looked at the conflicts list**, so it can be set aside within seconds like any other write. If you wrote a trim, run the Step 5 check once more on what you wrote and report it the same way.",
     "",
     "## Step 7: end the session",
@@ -29460,6 +29919,8 @@ function buildCloseCommandMd(workspaceSlug) {
     `plinth session end ${ws} --summary="<one line>"`,
     "```",
     "",
+    "**If Step 6 wrote a trim, add `--trimmed` to that line.** It is a plain flag with no value, so it can go anywhere after `end`.",
+    "",
     "**The `=` in `--summary=` is load-bearing. Do not rewrite it as a space.** A summary line often starts with `- `, and in the space form the parser swallows a value beginning with a dash. `session end` will tell you it dropped it and end the session anyway, so the cost is a lost summary rather than a lost close - but the equals form simply never loses it.",
     "",
     "It **always exits 0**, whatever happens, and prints nothing on success. It marks this session ended, and when it is running inside the Plinth desktop dock it tells the dock the session is finished so the tab can close itself. **Outside the dock it does nothing visible, and that is correct.** Nothing in this command depends on the dock; it runs the same in a bare terminal. The one thing it will ever print is a warning on stderr saying your `--summary` was lost before it could be read; the session still ends."
@@ -29620,8 +30081,14 @@ function ensureWorkspaceCommands(deps) {
   const created = [];
   const refreshed = [];
   const noArtists = (deps.readRosterIsEmpty ?? rosterIsEmpty)(workspaceSlug);
+  let offerTrim = false;
+  try {
+    offerTrim = (deps.readShouldOfferTrim ?? shouldOfferTrim)(workspaceSlug);
+  } catch {
+    offerTrim = false;
+  }
   const bodies = {
-    [START_COMMAND_REL]: buildStartCommandMd(noArtists),
+    [START_COMMAND_REL]: buildStartCommandMd(noArtists, offerTrim),
     [CLOSE_COMMAND_REL]: buildCloseCommandMd(workspaceSlug),
     [ONBOARD_COMMAND_REL]: buildOnboardCommandMd(workspaceSlug)
   };
@@ -29655,11 +30122,6 @@ function backupStamp2(d) {
 var RETIRED_COMMAND_TOKENS = [
   { commandRel: CLOSE_COMMAND_REL, token: "memory-gate", version: "0.11.0" }
 ];
-var GENERATED_COMMAND_RELS = [
-  START_COMMAND_REL,
-  CLOSE_COMMAND_REL,
-  ONBOARD_COMMAND_REL
-];
 function scanStaleUserBlocks(deps) {
   const retired = deps.retired ?? RETIRED_COMMAND_TOKENS;
   const read = deps.read ?? readContextFile;
@@ -30079,6 +30541,108 @@ function calendarNoticeLine(kind) {
   return `[${token} reason=${kind}]`;
 }
 
+// src/lib/context/secret-scan.ts
+var HOLD_ON_SECRET = true;
+var ALLOW_SECRET_MARKER = "plinth-allow-secret";
+var SECRET_HELD_REASON = "possible_secret";
+var SECRET_RULES = [
+  {
+    id: "aws-access-key-id",
+    label: "an AWS access key id",
+    pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/
+  },
+  {
+    id: "github-token",
+    label: "a GitHub token",
+    pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/
+  },
+  {
+    id: "slack-token",
+    label: "a Slack token",
+    pattern: /\bxox[baprse]-[0-9A-Za-z-]{10,}/
+  },
+  {
+    id: "google-api-key",
+    label: "a Google API key",
+    pattern: /\bAIza[0-9A-Za-z_-]{35}\b/
+  },
+  {
+    id: "anthropic-openai-key",
+    label: "an Anthropic or OpenAI API key",
+    pattern: /\bsk-(?:ant-|proj-)?(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[0-9])[A-Za-z0-9_-]{20,}/
+  },
+  {
+    id: "stripe-secret-key",
+    label: "a Stripe secret key",
+    pattern: /\b[sr]k_live_[0-9A-Za-z]{16,}\b/
+  },
+  {
+    id: "private-key-block",
+    label: "a private key block",
+    pattern: /-----BEGIN(?: [A-Z]+)* PRIVATE KEY-----/
+  },
+  {
+    id: "jwt",
+    label: "a JSON Web Token",
+    pattern: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}/
+  },
+  {
+    id: "signed-url",
+    label: "a signed URL carrying its own credential",
+    pattern: /[?&](?:X-Amz-Signature|X-Goog-Signature|Signature|sig)=[A-Za-z0-9%._-]{16,}/i
+  }
+];
+function redactMatch(match) {
+  const prefix = match.length >= 12 ? match.slice(0, 4) : "";
+  return `${prefix}… ${match.length} characters`;
+}
+function lineIsAllowed(line) {
+  return line.toLowerCase().includes(ALLOW_SECRET_MARKER);
+}
+function scanForSecrets(raw) {
+  const findings = [];
+  const lines = raw.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (lineIsAllowed(line))
+      continue;
+    for (const rule of SECRET_RULES) {
+      const m = rule.pattern.exec(line);
+      if (!m)
+        continue;
+      findings.push({
+        line: i + 1,
+        ruleId: rule.id,
+        label: rule.label,
+        excerpt: redactMatch(m[0])
+      });
+      break;
+    }
+  }
+  return findings;
+}
+var MAX_NAMED_SECRET_FINDINGS = 3;
+function secretHoldReason(findings, hold = HOLD_ON_SECRET) {
+  const named = findings.slice(0, MAX_NAMED_SECRET_FINDINGS);
+  const rest = findings.length - named.length;
+  const detail = named.map((f) => `line ${f.line} looks like ${f.label} (${f.excerpt})`).join("; ");
+  const more = rest > 0 ? `, and ${rest} more` : "";
+  return `${detail.charAt(0).toUpperCase()}${detail.slice(1)}${more}. ` + `Plinth is not approved to store credentials yet, so ` + (hold ? `this file stays on this machine until you say otherwise. ` + `Remove the value, or add ${ALLOW_SECRET_MARKER} to that line to ` + `store it anyway. ` : `it has already reached Plinth on this sync. Rotate it if it is ` + `live, then remove the value — or add ${ALLOW_SECRET_MARKER} to that ` + `line to stop being told. `) + `Nothing is changed in your file either way.`;
+}
+function secretHoldSummary(findings) {
+  const n = findings.length;
+  return `${n} possible credential${n === 1 ? "" : "s"} found`;
+}
+function secretHoldMessage(filename, findings, hold = HOLD_ON_SECRET) {
+  const verb = hold ? "was not synced" : "was synced";
+  return `${filename} ${verb}. ${secretHoldReason(findings, hold)}`;
+}
+function secretHoldRecord(findings, hold = HOLD_ON_SECRET) {
+  const verdict = hold ? "so this file was not synced" : "and it synced anyway";
+  return `${secretHoldSummary(findings)}, ${verdict}. ${secretHoldReason(findings, hold)}`;
+}
+
 // src/lib/rejected.ts
 var PERMANENT_REJECT_REASONS = new Set(["bad_request", "invalid_frontmatter"]);
 function isPermanentReject(err) {
@@ -30228,6 +30792,45 @@ function clearReportedSafeFileRejected(state, relPath) {
     return state;
   return clearFileRejected(state, relPath);
 }
+function recordMemorySecretHeld(args) {
+  let path3;
+  try {
+    path3 = relative3(workspaceMirrorPath(args.workspaceSlug), args.absolutePath);
+  } catch {
+    path3 = args.absolutePath;
+  }
+  const withoutStale = removeUnsynced(args.state, "entity", path3).state;
+  return persist(withoutStale, upsertRejected(withoutStale, {
+    target: "entity",
+    op: "upsert",
+    path: path3,
+    reason: SECRET_HELD_REASON,
+    message: args.record,
+    rejected_at: args.now().toISOString()
+  }));
+}
+function secretHoldRecordFor(state, workspaceSlug, absolutePath) {
+  let path3;
+  try {
+    path3 = relative3(workspaceMirrorPath(workspaceSlug), absolutePath);
+  } catch {
+    path3 = absolutePath;
+  }
+  return (state.rejected ?? []).find((o) => o.target === "entity" && o.path === path3 && o.reason === SECRET_HELD_REASON);
+}
+function clearMemorySecretHeld(state, workspaceSlug, absolutePath) {
+  let path3;
+  try {
+    path3 = relative3(workspaceMirrorPath(workspaceSlug), absolutePath);
+  } catch {
+    path3 = absolutePath;
+  }
+  const list = state.rejected ?? [];
+  const next = list.filter((o) => !(o.target === "entity" && o.path === path3 && o.reason === SECRET_HELD_REASON));
+  if (next.length === list.length)
+    return state;
+  return commitState(state, { ...state, rejected: next });
+}
 
 // src/lib/context/workspace-claude-md.ts
 var EXTRACTED_TEXT_DIR = extractedTextRelPath("x").replace(/x\.md$/, "");
@@ -30283,6 +30886,8 @@ function buildWorkspaceClaudeMd(input) {
     `- \`${extractedTextRelPath("<path>")}\` where \`<path>\` is the file's path under \`files/\`: the text Plinth extracted from that file, so a PDF's contents can be searched. Not every file has one - text files are already their own text, and extraction can fail. Where it produced junk the file exists and says so instead of carrying it, so read what is there before trusting a silence. Derived: edits here are overwritten and never reach Plinth`,
     `- \`.claude/commands/\` local skills, incl. generated \`${START_COMMAND_INVOCATION}\` + \`${CLOSE_COMMAND_INVOCATION}\` + \`${ONBOARD_COMMAND_INVOCATION}\` · at the mirror root: \`workspace-memory.md\` \`workspace-rules.md\` (workspace-wide) + \`user-memory.md\` (yours), synced to Plinth · \`voice.md\` (yours: how you write, read by the agent, edited only by you) · \`CLAUDE.local.md\` private, gitignored`,
     ``,
+    ...renderGuidingFilesSection(),
+    ``,
     `## Where key context lives: look here before hunting`,
     `- Each artist's **master context** (stable profile + current state) → \`artists/<slug>/_artist.md\`; edit its body and the daemon syncs both ways. Blocks labelled "rendered from Plinth" are the exception: they are overwritten on the next sync`,
     `- **Contracts, executed agreements & any PDF** → \`files/\` (search here first; \`documents/\` holds markdown bodies, not attachments)`,
@@ -30314,8 +30919,6 @@ function buildWorkspaceClaudeMd(input) {
 }
 
 // src/lib/context/generate.ts
-var CLAUDE_MD = "CLAUDE.md";
-var CLAUDE_LOCAL_MD = "CLAUDE.local.md";
 var GITIGNORE = ".gitignore";
 var GITIGNORE_ENTRIES = [
   CLAUDE_LOCAL_MD,
@@ -30979,6 +31582,27 @@ async function runSessionEnd(args, deps = {}) {
       } catch {}
     }
   }
+  const anchorSlug = resolveSlug(args.workspace);
+  if (anchorSlug.ok) {
+    try {
+      const before = loadState(anchorSlug.slug);
+      let next = before;
+      const anchored = setSizeAnchor(next, {
+        at: now.toISOString(),
+        kind: "session-end",
+        sizes: measureBarredFiles(anchorSlug.slug).sizes
+      });
+      next = anchored.state;
+      let changed = anchored.changed;
+      if (args.trimmed === true) {
+        const stamped = setLastTrimAt(next, now.toISOString());
+        next = stamped.state;
+        changed = changed || stamped.changed;
+      }
+      if (changed)
+        commitState(before, next);
+    } catch {}
+  }
   const dock = readDockSignalEnv(env2);
   if (dock === null)
     return { exitCode: 0 };
@@ -31080,6 +31704,10 @@ var sessionCommand = defineCommand({
       },
       args: {
         workspace: { type: "string", description: "Workspace slug" },
+        trimmed: {
+          type: "boolean",
+          description: "This close wrote a memory trim; records the date so /plinth:start stops offering one"
+        },
         summary: {
           type: "string",
           description: "One-line summary of the session, forwarded to the dock",
@@ -31089,7 +31717,8 @@ var sessionCommand = defineCommand({
       async run({ args }) {
         const result = await runSessionEnd({
           workspace: args.workspace,
-          summary: args.summary
+          summary: args.summary,
+          trimmed: args.trimmed === true
         });
         process.exitCode = result.exitCode;
       }
@@ -35698,6 +36327,41 @@ async function reconcileFilesSubtree(args) {
 
 // src/lib/artist-memory/sync.ts
 import { relative as relative9 } from "node:path";
+
+// src/lib/context/secret-gate.ts
+function applySecretGate(args) {
+  const hold = args.hold ?? HOLD_ON_SECRET;
+  const release = () => ({
+    state: clearMemorySecretHeld(args.state, args.workspaceSlug, args.absolutePath),
+    held: false,
+    findings: []
+  });
+  if (args.alreadyAcked)
+    return release();
+  const findings = scanForSecrets(args.body);
+  if (findings.length === 0)
+    return release();
+  const record2 = secretHoldRecord(findings, hold);
+  const standing = secretHoldRecordFor(args.state, args.workspaceSlug, args.absolutePath);
+  if (standing?.message === record2) {
+    return { state: args.state, held: hold, findings };
+  }
+  args.output?.warn(secretHoldMessage(args.filename, findings, hold));
+  args.output?.log(`[${args.logTag}_SECRET_HELD ws=${args.workspaceSlug} ` + `findings=${findings.length} held=${hold}]`);
+  return {
+    state: recordMemorySecretHeld({
+      state: args.state,
+      workspaceSlug: args.workspaceSlug,
+      absolutePath: args.absolutePath,
+      record: record2,
+      now: args.now
+    }),
+    held: hold,
+    findings
+  };
+}
+
+// src/lib/artist-memory/sync.ts
 var MAX_MEMORY_PUSH_ATTEMPTS = 3;
 var ENTITY_TYPE = "artists";
 function conflictSlug(slug) {
@@ -35805,11 +36469,26 @@ async function pushArtistMemory(args) {
   }
   const localHash = stableHash(local);
   const runPatch = async () => {
-    const base2 = args.mutex ? loadState(workspaceSlug) : state;
+    let base2 = args.mutex ? loadState(workspaceSlug) : state;
     const entry2 = getEntryBySlug(base2, ENTITY_TYPE, slug);
     if (!entry2)
       return { state: base2, outcome: { kind: "ignored", slug } };
-    if (entry2.memory_hash === localHash) {
+    const alreadyAcked = entry2.memory_hash === localHash;
+    const gate = applySecretGate({
+      state: base2,
+      workspaceSlug,
+      absolutePath: artistMemoryFilePath(workspaceSlug, slug),
+      filename: `artists/${slug}/${ARTIST_MEMORY_ANCHOR}`,
+      body: local,
+      alreadyAcked,
+      output,
+      logTag: "ARTIST_MEMORY",
+      now
+    });
+    base2 = gate.state;
+    if (gate.held)
+      return { state: base2, outcome: { kind: "secret_held", slug } };
+    if (alreadyAcked) {
       return { state: base2, outcome: { kind: "noop", slug } };
     }
     const acked = entry2.memory_hash;
@@ -38093,11 +38772,26 @@ async function pushWorkspaceMemory(args) {
   }
   const localHash = stableHash(local);
   const acked = getWorkspaceMemoryState(state);
-  if (acked && acked.body_hash === localHash) {
-    return { state, outcome: { kind: "noop" } };
+  const alreadyAcked = Boolean(acked && acked.body_hash === localHash);
+  const gate = applySecretGate({
+    state,
+    workspaceSlug,
+    absolutePath: contextFilePath(workspaceSlug, WORKSPACE_MEMORY_FILENAME),
+    filename: WORKSPACE_MEMORY_FILENAME,
+    body: local,
+    alreadyAcked,
+    output,
+    logTag: "WORKSPACE_MEMORY",
+    now
+  });
+  const gated = gate.state;
+  if (gate.held)
+    return { state: gated, outcome: { kind: "secret_held" } };
+  if (alreadyAcked) {
+    return { state: gated, outcome: { kind: "noop" } };
   }
   if (extractWorkspaceMemory(local) === null && (acked?.updated_at ?? null) === null) {
-    const next2 = persistMemory(state, { body_hash: localHash, updated_at: null });
+    const next2 = persistMemory(gated, { body_hash: localHash, updated_at: null });
     return { state: next2, outcome: { kind: "noop" } };
   }
   const res = await putWorkspaceMemory({
@@ -38108,7 +38802,7 @@ async function pushWorkspaceMemory(args) {
     fetchImpl
   });
   if (res.ok) {
-    const next2 = persistMemory(state, {
+    const next2 = persistMemory(gated, {
       body_hash: localHash,
       updated_at: res.row.updated_at
     });
@@ -38117,7 +38811,7 @@ async function pushWorkspaceMemory(args) {
   }
   if (res.code === 413) {
     output?.warn(`${WORKSPACE_MEMORY_FILENAME} is over the ${Math.round(MAX_WORKSPACE_MEMORY_BYTES / 1024)}KB cap — not synced.`);
-    return { state, outcome: { kind: "over_cap" } };
+    return { state: gated, outcome: { kind: "over_cap" } };
   }
   {
     const probe2 = await getWorkspaceMemory({ baseUrl, pat, fetchImpl });
@@ -38130,7 +38824,7 @@ async function pushWorkspaceMemory(args) {
         fetchImpl
       });
       if (retry.ok) {
-        const next2 = persistMemory(state, {
+        const next2 = persistMemory(gated, {
           body_hash: localHash,
           updated_at: retry.row.updated_at
         });
@@ -38139,7 +38833,7 @@ async function pushWorkspaceMemory(args) {
       }
       if (retry.code === 413) {
         output?.warn(`${WORKSPACE_MEMORY_FILENAME} is over the ${Math.round(MAX_WORKSPACE_MEMORY_BYTES / 1024)}KB cap — not synced.`);
-        return { state, outcome: { kind: "over_cap" } };
+        return { state: gated, outcome: { kind: "over_cap" } };
       }
     }
   }
@@ -38151,7 +38845,7 @@ async function pushWorkspaceMemory(args) {
     contents: local,
     side: "local"
   });
-  const next = await restoreFromCloud2(args);
+  const next = await restoreFromCloud2({ ...args, state: gated });
   output?.warn(`Conflict on ${WORKSPACE_MEMORY_FILENAME} -> stashed local edit to ${stashPath} (cloud-wins; cloud copy restored).`);
   return { state: next, outcome: { kind: "conflict", stashPath } };
 }
@@ -38363,11 +39057,29 @@ async function pushSingleton(descriptor, args) {
   }
   const localHash = stableHash(local);
   const acked = descriptor.getState(state);
-  if (acked && acked.body_hash === localHash) {
-    return { state, outcome: { kind: "noop" } };
+  const alreadyAcked = Boolean(acked && acked.body_hash === localHash);
+  let gated = state;
+  if (descriptor.secretScanned) {
+    const gate = applySecretGate({
+      state,
+      workspaceSlug,
+      absolutePath: filePath(descriptor, workspaceSlug),
+      filename: descriptor.filename,
+      body: local,
+      alreadyAcked,
+      output,
+      logTag: descriptor.logTag,
+      now
+    });
+    gated = gate.state;
+    if (gate.held)
+      return { state: gated, outcome: { kind: "secret_held" } };
+  }
+  if (alreadyAcked) {
+    return { state: gated, outcome: { kind: "noop" } };
   }
   if (descriptor.extractActive(local) === null && (acked?.updated_at ?? null) === null) {
-    const next2 = persist2(descriptor, state, { body_hash: localHash, updated_at: null });
+    const next2 = persist2(descriptor, gated, { body_hash: localHash, updated_at: null });
     return { state: next2, outcome: { kind: "noop" } };
   }
   const res = await descriptor.api.put({
@@ -38378,13 +39090,13 @@ async function pushSingleton(descriptor, args) {
     fetchImpl
   });
   if (res.ok) {
-    const next2 = persist2(descriptor, state, ackedFrom(res.row, localHash));
+    const next2 = persist2(descriptor, gated, ackedFrom(res.row, localHash));
     output?.log(`[${descriptor.logTag}_PUT ws=${workspaceSlug} is_empty=${res.row.is_empty}` + `${res.row.status ? ` status=${res.row.status}` : ""}]`);
     return { state: next2, outcome: { kind: "pushed" } };
   }
   if (res.code === 413) {
     output?.warn(`${descriptor.filename} is over the ${Math.round(descriptor.maxBytes / 1024)}KB cap — not synced.`);
-    return { state, outcome: { kind: "over_cap" } };
+    return { state: gated, outcome: { kind: "over_cap" } };
   }
   {
     const probe2 = await descriptor.api.get({ baseUrl, pat, fetchImpl });
@@ -38397,13 +39109,13 @@ async function pushSingleton(descriptor, args) {
         fetchImpl
       });
       if (retry.ok) {
-        const next2 = persist2(descriptor, state, ackedFrom(retry.row, localHash));
+        const next2 = persist2(descriptor, gated, ackedFrom(retry.row, localHash));
         output?.log(`[${descriptor.logTag}_PUT ws=${workspaceSlug} is_empty=${retry.row.is_empty}` + `${retry.row.status ? ` status=${retry.row.status}` : ""}]`);
         return { state: next2, outcome: { kind: "pushed" } };
       }
       if (retry.code === 413) {
         output?.warn(`${descriptor.filename} is over the ${Math.round(descriptor.maxBytes / 1024)}KB cap — not synced.`);
-        return { state, outcome: { kind: "over_cap" } };
+        return { state: gated, outcome: { kind: "over_cap" } };
       }
     }
   }
@@ -38415,7 +39127,7 @@ async function pushSingleton(descriptor, args) {
     contents: local,
     side: "local"
   });
-  const next = await restoreFromCloud3(descriptor, args);
+  const next = await restoreFromCloud3(descriptor, { ...args, state: gated });
   output?.warn(`Conflict on ${descriptor.filename} -> stashed local edit to ${stashPath} (cloud-wins; cloud copy restored).`);
   return { state: next, outcome: { kind: "conflict", stashPath } };
 }
@@ -38437,6 +39149,7 @@ var USER_MEMORY_DESCRIPTOR = {
   mutexKey: USER_MEMORY_MUTEX_KEY,
   logTag: "USER_MEMORY",
   maxBytes: MAX_USER_MEMORY_BYTES,
+  secretScanned: true,
   extractActive: extractUserMemory,
   getState: getUserMemoryState,
   setState: setUserMemoryState,
@@ -38469,6 +39182,7 @@ var VOICE_DESCRIPTOR = {
   mutexKey: VOICE_MUTEX_KEY,
   logTag: "VOICE",
   maxBytes: MAX_USER_VOICE_BYTES,
+  secretScanned: false,
   extractActive: extractVoiceProfile,
   getState: getUserVoiceState,
   setState: setUserVoiceState,
@@ -39855,6 +40569,22 @@ async function runSync(workspaceSlug, deps = {}) {
     const msg = err instanceof Error ? err.message : "unknown error";
     out.warn(`Context generation skipped: ${msg}`);
   }
+  try {
+    const measureSizes = deps.measureSizes ?? measureBarredFiles;
+    const beforeAnchor = loadState(slug);
+    if (beforeAnchor.size_anchor === undefined) {
+      const seeded = setSizeAnchor(beforeAnchor, {
+        at: now().toISOString(),
+        kind: "sync",
+        sizes: measureSizes(slug).sizes
+      });
+      if (seeded.changed)
+        commitState(beforeAnchor, seeded.state);
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "unknown error";
+    out.warn(`Could not record the file-size anchor: ${msg}`);
+  }
   const lastFailure = memberRefreshFailedAt.get(slug);
   const failureCooling = lastFailure !== undefined && now().getTime() - lastFailure < MEMBER_REFRESH_RETRY_AFTER_MS;
   if (!failureCooling && memberNeedsRefresh(entry2, now)) {
@@ -41623,6 +42353,7 @@ function reportWorkspaceMemoryOutcome(spinner, slug, state, outcome) {
       spinner.warn(`Conflict on ${WORKSPACE_MEMORY_FILENAME} → ${outcome.stashPath} (cloud-wins; local copy stashed)`);
       spinner.update(`Watching ${slug} · ${summary}`);
       return;
+    case "secret_held":
     case "over_cap":
     case "noop":
       return;
@@ -41639,6 +42370,7 @@ function reportUserMemoryOutcome(spinner, slug, state, outcome) {
       spinner.warn(`Conflict on ${USER_MEMORY_FILENAME} → ${outcome.stashPath} (cloud-wins; local copy stashed)`);
       spinner.update(`Watching ${slug} · ${summary}`);
       return;
+    case "secret_held":
     case "over_cap":
     case "noop":
       return;
@@ -41691,6 +42423,7 @@ function reportArtistMemoryOutcome(spinner, slug, state, outcome) {
       spinner.warn(`Conflict on artists/${outcome.slug}/memory.md → ${outcome.stashPath} (cloud-wins; local copy stashed)`);
       spinner.update(`Watching ${slug} · ${summary}`);
       return;
+    case "secret_held":
     case "not_found":
     case "noop":
     case "ignored":
@@ -41726,96 +42459,6 @@ var startCommand = defineCommand({
 // src/commands/status.ts
 import { statSync as statSync19 } from "node:fs";
 
-// src/lib/context/memory-bars.ts
-var RULE_FILE_BAR_BYTES = 6000;
-var FACT_STORE_BAR_BYTES = 12000;
-var MAX_NAMED_FACT_STORES = 5;
-function countRuleShapedLines(body) {
-  let count = 0;
-  for (const line of body.split(`
-`)) {
-    const trimmed = line.trim();
-    if (/^[-*+]\s/.test(trimmed))
-      count += 1;
-    else if (/^\*\*[^*]+\*\*/.test(trimmed))
-      count += 1;
-  }
-  return count;
-}
-function factBody(raw) {
-  return raw.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*$/, "").split(`
-`).filter((line) => !/^\s*#{1,6}\s/.test(line)).join(`
-`).trim();
-}
-var RULE_FILES = [
-  { filename: VOICE_FILENAME, agentMayEdit: false, memberOwned: true, ridesInjection: false },
-  { filename: WORKSPACE_RULES_FILENAME, agentMayEdit: true, memberOwned: false, ridesInjection: true }
-];
-function assessMemoryBars(workspaceSlug, deps = {}) {
-  const readContext = deps.readContext ?? readContextFile;
-  const readArtistMemory = deps.readArtistMemory ?? readArtistMemoryFile;
-  const rosterOf = deps.readRosterFn ?? readRoster;
-  const over = [];
-  for (const spec of RULE_FILES) {
-    let raw = null;
-    try {
-      raw = readContext(workspaceSlug, spec.filename);
-    } catch {
-      raw = null;
-    }
-    if (raw === null)
-      continue;
-    const bytes = Buffer.byteLength(raw);
-    if (bytes <= RULE_FILE_BAR_BYTES)
-      continue;
-    over.push({
-      path: spec.filename,
-      kind: "rule",
-      bytes,
-      bar: RULE_FILE_BAR_BYTES,
-      rules: countRuleShapedLines(raw),
-      facts: groupFacts(factBody(raw)).length,
-      agentMayEdit: spec.agentMayEdit,
-      memberOwned: spec.memberOwned,
-      buys: !spec.ridesInjection ? "per-read" : Buffer.byteLength(extractWorkspaceRules(raw) ?? "") > 0 ? "injection" : "nothing"
-    });
-  }
-  let roster;
-  try {
-    roster = rosterOf(workspaceSlug);
-  } catch {
-    roster = [];
-  }
-  const stores = [];
-  for (const artist of roster) {
-    let raw = null;
-    try {
-      raw = readArtistMemory(workspaceSlug, artist.slug);
-    } catch {
-      raw = null;
-    }
-    if (raw === null)
-      continue;
-    const bytes = Buffer.byteLength(raw);
-    if (bytes <= FACT_STORE_BAR_BYTES)
-      continue;
-    stores.push({
-      path: `artists/${artist.slug}/memory.md`,
-      kind: "fact",
-      bytes,
-      bar: FACT_STORE_BAR_BYTES,
-      rules: countRuleShapedLines(raw),
-      facts: groupFacts(factBody(raw)).length,
-      agentMayEdit: true,
-      memberOwned: true,
-      buys: "per-read"
-    });
-  }
-  stores.sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path));
-  const named = stores.slice(0, MAX_NAMED_FACT_STORES);
-  return { over: [...over, ...named], notNamed: stores.length - named.length };
-}
-
 // src/lib/build-stamp.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync9, mkdirSync as mkdirSync11, readFileSync as readFileSync26, writeFileSync as writeFileSync8 } from "node:fs";
@@ -42127,6 +42770,8 @@ function scanPendingWrites(args) {
       continue;
     if (Buffer.byteLength(local) > lane.maxBytes)
       continue;
+    if (reported.entities.has(lane.filename))
+      continue;
     const localHash = stableHash(local);
     if (lane.acked && lane.acked.body_hash === localHash)
       continue;
@@ -42152,6 +42797,8 @@ function scanPendingWrites(args) {
       continue;
     if (isPristineMemoryStub(local))
       continue;
+    if (reported.entities.has(`artists/${entry2.slug}/memory.md`))
+      continue;
     const localHash = stableHash(local);
     if (entry2.memory_hash === localHash)
       continue;
@@ -42166,6 +42813,7 @@ function scanPendingWrites(args) {
 }
 
 // src/commands/status.ts
+var MAX_NAMED_GROWTH_FILES = 5;
 var LABEL_WIDTH = 9;
 function row(label, value) {
   return `${label.padEnd(LABEL_WIDTH)}  ${value}`;
@@ -42584,6 +43232,13 @@ async function runStatus(args, deps = {}) {
         out.info(cont(`  ${GROUNDING_CATEGORY_LABELS[c].padEnd(width)}  ` + `${split[c].toLocaleString("en-GB").padStart(6)}` + (MEMBER_EDITABLE_CATEGORIES.includes(c) ? "  *" : "")));
       }
       out.info(cont(`A * marks what is yours to change; the rest is Plinth's own ` + `grounding and is the same on every workspace.`));
+      const groundingBytes = split.grounding;
+      if (groundingBytes > 0) {
+        const paras = report.groundingParagraphs;
+        const shaped = report.groundingRuleShaped;
+        const proxyClause = shaped === 0 ? `It is prose, so the rule-shaped line count used on the files below ` + `scores it zero and is not the measure here.` : `The rule-shaped line count used on the files below scores it ` + `${shaped.toLocaleString("en-GB")}; on prose that count is a floor, ` + `so paragraphs are the measure here.`;
+        out.info(cont(`Plinth's own grounding is ${groundingBytes.toLocaleString("en-GB")} bytes ` + `across ${paras} paragraphs, about one rule each. ${proxyClause}`));
+      }
     }
     const contributors = [];
     const rides = (name, reduce) => {
@@ -42665,6 +43320,82 @@ async function runStatus(args, deps = {}) {
       out.info(cont(`Ending a session with ${CLOSE_COMMAND_INVOCATION} offers to propose a trim for the artist stores.`));
     }
   }
+  let generated = [];
+  try {
+    generated = assessGeneratedFileBars(slug);
+  } catch {
+    generated = [];
+  }
+  const generatedOver = generated.filter((g) => g.over);
+  if (generatedOver.length > 0) {
+    out.info(row("Generated", `${generatedOver.length} file${generatedOver.length === 1 ? " Plinth writes is" : "s Plinth writes are"} ` + `past ${generatedOver.length === 1 ? "its" : "their"} bar. Yours to report, not to fix.`));
+    const n = (v) => v.toLocaleString("en-GB");
+    for (const g of generatedOver) {
+      const unit = g.unit === "lines" ? "lines" : "bytes";
+      const measure = `${g.path} is ${n(g.measured)} ${unit} against a ${n(g.bar)}-${g.unit === "lines" ? "line" : "byte"} bar`;
+      const shares = g.generatedBytes === null || g.blockBytes === null ? `. Its BEGIN/END markers are missing, so Plinth's share and yours cannot be told apart here` : `: ${n(g.generatedBytes)} bytes of it is Plinth's own text and ${n(g.blockBytes)} is your customisable block`;
+      out.info(cont(`${measure}${shares}. About ${g.ruleShaped} rule-shaped lines.`));
+    }
+    const within = generated.filter((g) => !g.over).map((g) => g.path);
+    if (within.length > 0) {
+      out.info(cont(`${within.join(", ")} ${within.length === 1 ? "is" : "are"} within bar.`));
+    }
+    out.info(cont("Plinth's own text here is regenerated on every sync, so trimming it is " + "a change to Plinth and not to this workspace. Only the block between " + "the markers is yours."));
+  }
+  let longLines = [];
+  try {
+    longLines = assessIndexLines(slug);
+  } catch {
+    longLines = [];
+  }
+  if (longLines.length > 0) {
+    const total = longLines.reduce((sum, l) => sum + l.over, 0);
+    out.info(row("Overlong", `${total} memory ${total === 1 ? "fact is" : "facts are"} longer than ` + `${INDEX_LINE_MAX_BYTES} bytes. Split ${total === 1 ? "it" : "them"}, never cut.`));
+    for (const l of longLines) {
+      out.info(cont(`${l.filename}: ${l.over} of ${l.facts}.`));
+      for (const line of l.longest) {
+        out.info(cont(`  ${line.bytes.toLocaleString("en-GB")} bytes  ${line.opening}`));
+      }
+    }
+    out.info(cont("The convention is one line per fact: a hook and a [[pointer]], not a " + "paragraph. A line this long is usually several facts, so splitting it " + "keeps all of them and cutting it loses some."));
+  }
+  const anchor = localState.size_anchor;
+  if (anchor !== undefined) {
+    let now2 = {
+      sizes: {},
+      answered: []
+    };
+    try {
+      now2 = measureBarredFiles(slug);
+    } catch {
+      now2 = { sizes: {}, answered: [] };
+    }
+    const answered = new Set(now2.answered);
+    const nowSizes = now2.sizes;
+    const deltas = Object.entries(anchor.sizes).flatMap(([path5, then]) => {
+      const bytes = nowSizes[path5];
+      if (bytes === undefined) {
+        return answered.has(path5) ? [{ path: path5, bytes: 0, delta: -then, gone: true }] : [];
+      }
+      const delta = bytes - then;
+      return delta === 0 ? [] : [{ path: path5, bytes, delta, gone: false }];
+    }).sort((a, b) => Math.abs(b.delta) - Math.abs(a.delta));
+    if (deltas.length > 0) {
+      const when = shortDate(anchor.at);
+      const since = anchor.kind === "session-end" ? `since your last session close${when === undefined ? "" : ` on ${when}`}` : `since this workspace first synced on this machine${when === undefined ? "" : ` on ${when}`}, because no session has ended here yet`;
+      const named = deltas.slice(0, MAX_NAMED_GROWTH_FILES);
+      out.info(row("Growth", `${deltas.length} file${deltas.length === 1 ? " has" : "s have"} changed size ${since}.`));
+      for (const d of named) {
+        const sign = d.delta > 0 ? "+" : "-";
+        const size = Math.abs(d.delta).toLocaleString("en-GB");
+        out.info(cont(d.gone ? `${d.path}  GONE  (was ${size} bytes)` : `${d.path}  ${sign}${size} bytes  (now ${d.bytes.toLocaleString("en-GB")})`));
+      }
+      if (deltas.length > named.length) {
+        out.info(cont(`And ${deltas.length - named.length} more, not named here.`));
+      }
+      out.info(cont(`Growth is in bytes for every file, including \`${CLAUDE_MD}\`, whose own ` + `bar is a line count on the part Plinth generates.`));
+    }
+  }
   out.info("");
   return { exitCode: 0 };
 }