@pmelab/gtd 60.1.0 → 62.0.0

package/dist/gtd.bundle.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from 'module';
 const require = __createRequire(import.meta.url);
-import { createRequire, isBuiltin } from "node:module";
+import { createRequire, isBuiltin, registerHooks } from "node:module";
 import * as OS from "node:os";
 import { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as NodeChildProcess from "node:child_process";
@@ -14,7 +14,7 @@ import * as NFS from "node:fs";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as Path from "node:path";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { gzipSync } from "node:zlib";
+import { gunzipSync, gzipSync } from "node:zlib";
 import * as NodeUrl from "node:url";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { stripVTControlCharacters } from "node:util";
@@ -12054,6 +12054,57 @@ const restorability = (git, headHash, tipHash) => gen(function* () {
 	};
 });
 //#endregion
+//#region src/platform/PinFile.ts
+const livePinFile = (cwd, path) => () => {
+	const file = join(cwd, path);
+	if (existsSync(file)) try {
+		return {
+			path: file,
+			bytes: readFileSync(file)
+		};
+	} catch {
+		return {
+			path: file,
+			bytes: /* @__PURE__ */ new Uint8Array()
+		};
+	}
+	try {
+		return {
+			path: file,
+			bytes: execFileSync("git", ["show", `HEAD:${path}`], {
+				cwd,
+				stdio: [
+					"ignore",
+					"pipe",
+					"ignore"
+				]
+			})
+		};
+	} catch {
+		return;
+	}
+};
+/**
+* Runs a pin's module as this process's main program. Node refuses an unknown
+* extension, so a load hook serves the unpacked source under the pin's own
+* URL — `import.meta.url` stays a file in the repository.
+*/
+const runPinModule = async (path, source) => {
+	const url = pathToFileURL(path).href;
+	registerHooks({
+		resolve: (specifier, context, nextResolve) => specifier === url ? {
+			url,
+			shortCircuit: true
+		} : nextResolve(specifier, context),
+		load: (requested, context, nextLoad) => requested === url ? {
+			format: "module",
+			source,
+			shortCircuit: true
+		} : nextLoad(requested, context)
+	});
+	await import(url);
+};
+//#endregion
 //#region src/flags/index.ts
 const FLAGS$1 = [];
 const BOOL = {
@@ -12326,7 +12377,13 @@ The \`kind\` field (\`--json=kind\`) selects what to do:
   Land it immediately, no display needed.
 - \`script\` — run \`--json=content\` with \`sh -c\`, appending its output to
   \`--json=log\`, and ignore its exit code — the outcome lives in the tree,
-  not in the exit code.
+  not in the exit code. Two script beats carry a \`pin\` mark: the **pin
+  beat** right after a process starts (\`pin: "add"\`, its script writes
+  \`gtd bundle\`'s output to \`.gtd/process.gtdpin\`) and the **unpin beat**
+  once the flow has ended (\`pin: "remove"\`, its script deletes that file).
+  Both run unattended, like any script beat. A driver may write or delete the
+  file its own way instead of running the script; either way it then lands,
+  and the unpin's landing is the commit that closes the process.
 - \`prompt\` — send plain \`gtd next\`'s own output to your agent CLI over
   stdin (it's the bare content at this kind, so no separate \`--json=content\`
   read is needed), using the accompanying \`session.id\`/\`session.resume\`/
@@ -12369,7 +12426,8 @@ skills, \`skills\` (an array of the skill names, already trimmed and split —
 \`label\`, \`file\`, \`mode\`, \`edges\`, \`judge\` (the pending judgment's rendered
 document). When a cost has been recorded (a prior \`gtd land --cost=<n>\`):
 \`cost\`, \`costByModel\`. Always \`approvals\` (an array of
-\`{step, name, email, commit}\`, \`[]\` when none).
+\`{step, name, email, commit}\`, \`[]\` when none). Only at a pin or unpin
+beat: \`pin\` (\`"add"\` or \`"remove"\`).
 
 \`gtd land\` fields, in fixed order: \`schema\`, \`script\` (the POSIX sh to run), \`settled\`
 (true for a no-op at a \`script\` rest — stop immediately, nothing more to
@@ -28942,6 +29000,8 @@ const renderFormat = (fmt, ...args) => {
 };
 /** The first line of the landing refusal for a turn that wrote outside its `write` access — a stable marker drivers and tests grep for. */
 const ACCESS_REFUSAL = "gtd land: this turn wrote outside its write access — revert these paths, then run `gtd land` again:";
+/** Where a process keeps its pin: the engine and workflow it runs on, as `gtd bundle` prints them. */
+const PIN_PATH = ".gtd/process.gtdpin";
 //#endregion
 //#region src/wire/Demand.ts
 /**
@@ -28982,14 +29042,20 @@ const demandOf = (input) => {
 		read: null,
 		write: null
 	};
-	return kind === "prompt" ? {
+	if (kind === "prompt") return {
 		kind,
 		content,
 		session,
 		validate,
 		skills,
 		access
-	} : {
+	};
+	if (kind === "script" && rendered.pin !== void 0) return {
+		kind,
+		content,
+		pin: rendered.pin
+	};
+	return {
 		kind,
 		content
 	};
@@ -29042,33 +29108,39 @@ const assertNeverDemand = (demand) => {
 * falling through to "no session."
 */
 const dispatchFieldsOf = (demand) => {
+	const none = {
+		session: void 0,
+		validate: void 0,
+		skills: void 0,
+		access: void 0,
+		pin: void 0
+	};
 	switch (demand.kind) {
 		case "prompt": return {
+			...none,
 			session: demand.session,
 			validate: demand.validate,
 			skills: demand.skills,
 			access: demand.access
 		};
+		case "script": return {
+			...none,
+			pin: demand.pin
+		};
 		case "capture":
 		case "message":
-		case "script":
-		case "stalled": return {
-			session: void 0,
-			validate: void 0,
-			skills: void 0,
-			access: void 0
-		};
+		case "stalled": return none;
 		default: return assertNeverDemand(demand);
 	}
 };
 /**
-* Flatten a `Demand` plus its `BeatStatus` into the single 25-key document
+* Flatten a `Demand` plus its `BeatStatus` into the single 26-key document
 * `gtd next --json` emits — the ONLY place the two are joined. `cost`/
 * `costByModel` are omitted together, exactly when no cost was recorded
 * (`cost <= 0`).
 */
 const beatDocument = (demand, status) => {
-	const { session, validate, skills, access } = dispatchFieldsOf(demand);
+	const { session, validate, skills, access, pin } = dispatchFieldsOf(demand);
 	const hasCost = status.cost > 0;
 	return {
 		schema: 1,
@@ -29080,6 +29152,7 @@ const beatDocument = (demand, status) => {
 		model: status.model,
 		system: status.system,
 		validate,
+		pin,
 		log: status.log,
 		state: status.state,
 		actor: status.actor,
@@ -29417,11 +29490,20 @@ const diffTrees = (before, after) => {
 	};
 };
 const isEmptyDiff = (diff) => diff.added.length === 0 && diff.modified.length === 0 && diff.deleted.length === 0;
+const withoutPath = (tree, hidden) => {
+	let paths;
+	return {
+		paths: () => paths ??= tree.paths().filter((path) => path !== hidden),
+		read: (path) => path === hidden ? void 0 : tree.read(path),
+		...tree.id !== void 0 ? { id: (path) => path === hidden ? void 0 : tree.id(path) } : {}
+	};
+};
+const OLDEST_READABLE_FORMAT = 1;
 const short$1 = (hash) => hash.slice(0, 7);
 const formatFault = (commits) => {
-	const foreign = commits.find((c) => c.format !== 1);
+	const foreign = commits.find((c) => c.format < OLDEST_READABLE_FORMAT || c.format > 2);
 	if (foreign === void 0) return void 0;
-	return `gtd: commit ${short$1(foreign.hash)} is written in history format ${foreign.format}, but this gtd reads format 1 — run a gtd release that reads format ${foreign.format} to continue this process`;
+	return `gtd: commit ${short$1(foreign.hash)} is written in history format ${foreign.format}, but this gtd reads formats ${OLDEST_READABLE_FORMAT} to 2 — run a gtd release that reads format ${foreign.format} to continue this process`;
 };
 //#endregion
 //#region src/replay/Trailers.ts
@@ -29458,6 +29540,11 @@ const parseStepId = (raw) => {
 		occurrence: Number(match[2])
 	};
 };
+/** What a pin and an unpin beat rest at, and their commits name — neither is a step of the workflow. */
+const PIN_STATES = {
+	add: "pin",
+	remove: "unpin"
+};
 const isVerdict = (value) => {
 	if (typeof value !== "object" || value === null) return false;
 	const v = value;
@@ -29477,13 +29564,7 @@ const parseJson = (raw) => {
 const TRAILER_RE = /^(Gtd-[A-Za-z-]+):[ \t]*(.*?)[ \t]*$/gm;
 const COST_RE = /^([0-9]+(?:\.[0-9]+)?)(?:[ \t]+(.+))?$/;
 const VAR_RE = /^([^=\s]+)=(.*)$/;
-const CONFIG_RE = /^([0-9a-f]{16}) (.+)$/;
 const CONTROL_CHARACTER$1 = /[\x00-\x1f\x7f-\x9f\u2028\u2029]/;
-const encodePath = (path) => path.trim() !== path || path.startsWith("\"") || CONTROL_CHARACTER$1.test(path) ? JSON.stringify(path) : path;
-const decodePath = (raw) => {
-	const path = raw.startsWith("\"") ? parseJson(raw) : raw;
-	return typeof path === "string" && path !== "" && !CONTROL_CHARACTER$1.test(path) ? path : void 0;
-};
 const decodeApproval = (raw) => {
 	const parsed = parseJson(raw);
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
@@ -29535,11 +29616,6 @@ const TRAILER_READERS = {
 		const kv = VAR_RE.exec(value);
 		if (kv !== null) into.vars[kv[1]] = kv[2];
 	},
-	"Gtd-Config": (value, into) => {
-		const entry = CONFIG_RE.exec(value);
-		const path = entry === null ? void 0 : decodePath(entry[2]);
-		if (path !== void 0) into.config[path] = entry[1];
-	},
 	"Gtd-Review-Base": (value, into) => {
 		into.reviewBase ??= value.split(/\s/)[0];
 	},
@@ -29555,6 +29631,9 @@ const TRAILER_READERS = {
 	"Gtd-Approved": (value, into) => {
 		into.approved ??= decodeApproval(value);
 	},
+	"Gtd-Pin": (value, into) => {
+		if (value === "add" || value === "remove") into.pin ??= value;
+	},
 	"Gtd-Format": (value, into) => {
 		if (FORMAT_RE.test(value)) into.format ??= Number(value);
 	},
@@ -29577,10 +29656,10 @@ const parseCommitMessage = (message) => {
 		version: void 0,
 		kept: void 0,
 		approved: void 0,
+		pin: void 0,
 		judge: [],
 		marks: [],
 		vars: {},
-		config: {},
 		cost: [],
 		format: void 0
 	};
@@ -29594,24 +29673,28 @@ const parseCommitMessage = (message) => {
 };
 const sortedEntries = (record = {}) => Object.entries(record).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
 /** Trailer order is fixed so the same spec always yields the same bytes. */
+const trailer = (name, value) => value === void 0 ? [] : [`Gtd-${name}: ${value}`];
+const costValue = (cost) => cost === void 0 ? void 0 : `${cost.cost}${cost.model !== void 0 ? ` ${cost.model}` : ""}`;
 const formatCommitMessage = (spec) => {
-	const lines = [];
-	if (spec.step !== void 0) lines.push(`Gtd-Step: ${formatStepId(spec.step)}`);
-	if (spec.workflow !== void 0) lines.push(`Gtd-Workflow: ${spec.workflow}`);
-	if (spec.reviewBase !== void 0) lines.push(`Gtd-Review-Base: ${spec.reviewBase}`);
-	for (const [name, value] of sortedEntries(spec.vars)) lines.push(`Gtd-Var: ${name}=${value}`);
-	for (const [path, hash] of sortedEntries(spec.config)) lines.push(`Gtd-Config: ${hash} ${encodePath(path)}`);
-	if (spec.cost !== void 0) lines.push(`Gtd-Cost: ${spec.cost.cost}${spec.cost.model !== void 0 ? ` ${spec.cost.model}` : ""}`);
-	for (const verdict of spec.judge ?? []) lines.push(`Gtd-Judge: ${JSON.stringify(verdict)}`);
-	for (const m of spec.marks ?? []) lines.push(`Gtd-Mark: ${m.name}=${m.value}`);
-	if (spec.approved !== void 0) lines.push(`Gtd-Approved: ${encodeApproval(spec.approved)}`);
-	if (spec.branch !== void 0) lines.push(`Gtd-Branch: ${spec.branch}`);
-	if (spec.version !== void 0) lines.push(`Gtd-Version: ${spec.version}`);
-	lines.push(`Gtd-Format: 1`);
+	const lines = [
+		...trailer("Step", spec.step && formatStepId(spec.step)),
+		...trailer("Workflow", spec.workflow),
+		...trailer("Review-Base", spec.reviewBase),
+		...sortedEntries(spec.vars).map(([name, value]) => `Gtd-Var: ${name}=${value}`),
+		...trailer("Cost", costValue(spec.cost)),
+		...(spec.judge ?? []).map((verdict) => `Gtd-Judge: ${JSON.stringify(verdict)}`),
+		...(spec.marks ?? []).map((m) => `Gtd-Mark: ${m.name}=${m.value}`),
+		...trailer("Approved", spec.approved && encodeApproval(spec.approved)),
+		...trailer("Pin", spec.pin),
+		...trailer("Branch", spec.branch),
+		...trailer("Version", spec.version),
+		`Gtd-Format: 2`
+	];
 	return `${formatSubject(spec.actor, spec.to, spec.from)}\n\n${lines.join("\n")}`;
 };
 //#endregion
 //#region src/replay/Replay.ts
+const UNPIN_STATE = PIN_STATES.remove;
 const actorOfKind = (kind) => kind === "run" ? "check" : kind === "agent" ? "agent" : kind === "human" ? "human" : "judge";
 const memoryScopeOf = (name) => {
 	const dot = name.lastIndexOf(".");
@@ -29745,7 +29828,33 @@ const modeWithoutFile = (step) => {
 	if (options.mode === void 0 || options.file !== void 0) return void 0;
 	return `gtd: step "${step.name}": mode requires file in ${step.kind}() options — name the steering file the mode checks`;
 };
-const replay = async (input) => {
+const withoutPin = (input) => {
+	const hide = (tree) => withoutPath(tree, PIN_PATH);
+	return {
+		...input,
+		episode: {
+			base: {
+				...input.episode.base,
+				tree: hide(input.episode.base.tree)
+			},
+			commits: input.episode.commits.map((c) => ({
+				...c,
+				tree: hide(c.tree),
+				...c.kept !== void 0 ? { kept: {
+					...c.kept,
+					tree: hide(c.kept.tree)
+				} } : {}
+			}))
+		},
+		...input.startTree !== void 0 ? { startTree: hide(input.startTree) } : {},
+		...input.pending !== void 0 ? { pending: {
+			...input.pending,
+			tree: hide(input.pending.tree)
+		} } : {}
+	};
+};
+const replay = async (raw) => {
+	const input = withoutPin(raw);
 	const commits = input.episode.commits.map((c) => ({
 		...c,
 		parsed: parseCommitMessage(c.message)
@@ -29754,6 +29863,9 @@ const replay = async (input) => {
 	let cursor = 0;
 	let pendingUsed = false;
 	let position = input.episode.base;
+	const skipPins = () => {
+		while (cursor < commits.length && commits[cursor].parsed.pin !== void 0) cursor++;
+	};
 	let previousPosition = input.episode.base;
 	let expectedNext;
 	const occurrences = /* @__PURE__ */ new Map();
@@ -29935,19 +30047,24 @@ const replay = async (input) => {
 		if (unapproved !== void 0) return finish(unapproved);
 		cursor++;
 		advance(commit);
-		if (commit.parsed.kept !== void 0) if (commit.kept === void 0) keptTips.delete(step.name);
-		else keptTips.set(step.name, {
-			hash: commit.kept.hash,
-			before: commit.tree,
-			after: commit.kept.tree
-		});
+		skipPins();
+		noteKept(step, commit);
 		const to = commit.parsed.parsed?.to;
-		if (to !== void 0) expectedNext = {
+		if (to !== void 0 && to !== UNPIN_STATE) expectedNext = {
 			name: to,
 			hash: commit.hash
 		};
 		return replyFor(step.request, commit.parsed.judge);
 	};
+	const noteKept = (step, commit) => {
+		if (commit.parsed.kept === void 0) return;
+		if (commit.kept === void 0) keptTips.delete(step.name);
+		else keptTips.set(step.name, {
+			hash: commit.kept.hash,
+			before: commit.tree,
+			after: commit.kept.tree
+		});
+	};
 	const landPending = (step, pending) => {
 		pendingUsed = true;
 		landed = step;
@@ -29964,7 +30081,10 @@ const replay = async (input) => {
 		return replyFor(step.request, pending.verdicts ?? []);
 	};
 	const answer = (step) => {
-		while (cursor < commits.length && isAttemptAt(commits[cursor], step.name)) cursor++;
+		while (cursor < commits.length && isAttemptAt(commits[cursor], step.name)) {
+			cursor++;
+			skipPins();
+		}
 		const commit = commits[cursor];
 		if (commit !== void 0) return consumeCommit(step, commit);
 		if (input.pending === void 0 || pendingUsed) return finish({
@@ -29977,6 +30097,7 @@ const replay = async (input) => {
 		return landPending(step, input.pending);
 	};
 	const requestFault = (request) => {
+		if (Object.values(PIN_STATES).includes(scoped(request.name))) return `gtd: step "${scoped(request.name)}": the name is reserved for the pin and unpin beats — rename the step`;
 		if (request.kind === "run" && typeof request.body !== "string") return `gtd: step "${scoped(request.name)}": a run() body is a shell script string — decide in flow code, then render the script (see checkScript and friends)`;
 		if (request.kind !== "agent") return void 0;
 		const name = scoped(request.name);
@@ -30003,15 +30124,18 @@ const replay = async (input) => {
 		const blocker = blockerAt(step);
 		return blocker === void 0 ? answer(step) : finish(blocker);
 	};
-	const endOfFlow = (via) => cursor < commits.length ? {
-		kind: "divergence",
-		message: `gtd: the flow ended, but commit ${short(commits[cursor].hash)} continues the episode — ${DIVERGED}`
-	} : {
-		kind: "ended",
-		via,
-		trace,
-		landed,
-		marks
+	const endOfFlow = (via) => {
+		skipPins();
+		return cursor < commits.length ? {
+			kind: "divergence",
+			message: `gtd: the flow ended, but commit ${short(commits[cursor].hash)} continues the episode — ${DIVERGED}`
+		} : {
+			kind: "ended",
+			via,
+			trace,
+			landed,
+			marks
+		};
 	};
 	const changesSince = (hash) => {
 		const tree = treeAt(hash);
@@ -30074,10 +30198,11 @@ const replay = async (input) => {
 		skillsFor: (localName) => resolveSkills(memoryScopeOf(scoped(localName))) ?? [],
 		accessFor: (localName, file) => foldedAccessFor(resolveAccess(memoryScopeOf(scoped(localName))), file),
 		head: () => {
-			const rest = commits.slice(cursor);
+			const rest = commits.slice(cursor).filter((c) => c.parsed.pin === void 0);
 			return rest.length > 0 && rest.every((c) => c.parsed.step === void 0) ? rest[rest.length - 1].hash : position.hash;
 		}
 	};
+	skipPins();
 	installContext(context);
 	try {
 		const flowDone = input.flow({}).then(() => {
@@ -30477,7 +30602,8 @@ const load = gen(function* () {
 		},
 		...compiled.ui !== void 0 ? { ui: compiled.ui } : {},
 		warnings: diagnostics.filter((d) => d.severity === "warning"),
-		fingerprint: pinned?.fingerprint ?? configFingerprint(loaded.file.dependencyFiles, host.root, module.read ?? readFromDisk)
+		fingerprint: pinned?.fingerprint ?? configFingerprint(loaded.file.dependencyFiles, host.root, module.read ?? readFromDisk),
+		drift: pinned === void 0 ? [] : changedConfigFiles(pinned.fingerprint, configFingerprint(Object.keys(pinned.fingerprint).map((file) => resolve(host.root, file)), host.root, readFromDisk))
 	};
 });
 const readFromDisk = (path) => {
@@ -31131,8 +31257,6 @@ const knownModes = (def) => Object.keys(def.modes);
 //#endregion
 //#region src/workflow/pin.ts
 init_dist$1();
-/** Bumped when a launcher could no longer run an older pin the same way. */
-const PIN_FORMAT = 1;
 /**
 * The engine a pin carries, as ES module source. Live, the `gtd.core.mjs` the
 * running gtd ships beside its own bundle.
@@ -31158,7 +31282,505 @@ const pin = (module, root, version) => gen(function* () {
 		try: () => pinnedWorkflowSource(module, root, version),
 		catch: (e) => new GtdError(`gtd bundle: ${module.filepath}: ${e instanceof Error ? e.message : String(e)}`)
 	})) + core.replace(/^#!.*\n/, "");
-	return Buffer.concat([Buffer.from(`gtdpin ${PIN_FORMAT} gtd ${version}\n`), gzipSync(source, { level: 9 })]);
+	return Buffer.concat([Buffer.from(`gtdpin 1 gtd ${version}\n`), gzipSync(source, { level: 9 })]);
+});
+/** A pin's header line, read without unpacking it; undefined when the bytes are no pin. */
+const pinHeader = (bytes) => {
+	const end = bytes.indexOf(10);
+	const header = end < 0 ? null : /^gtdpin (\d+) gtd (\S+)$/.exec(Buffer.from(bytes.subarray(0, end)).toString());
+	return header === null ? void 0 : {
+		format: Number(header[1]),
+		version: header[2]
+	};
+};
+/** A pin's header and module source. */
+const readPin = (bytes) => {
+	const header = pinHeader(bytes);
+	if (header === void 0) throw new Error("not a gtd pin");
+	return {
+		...header,
+		source: gunzipSync(bytes.subarray(bytes.indexOf(10) + 1)).toString("utf8")
+	};
+};
+//#endregion
+//#region src/emit/GitScript.ts
+const shellQuote$1 = (value) => `'${value.replace(/'/g, "'\\''")}'`;
+/**
+* `--allow-empty` because gtd's workflow commits may be empty on purpose.
+* Mirrors `Git.ts`'s retry: only re-tries without hooks on the specific
+* "empty git commit" rejection message, discriminated from the captured
+* output rather than the exit code, so a genuinely rejected commit (a lint
+* error, a commit-msg hook) still fails.
+*/
+const commitAllowEmpty = (message, only) => {
+	const m = shellQuote$1(message);
+	const paths = only === void 0 ? "" : ` -- ${shellQuote$1(only)}`;
+	return [
+		`if ! out=$(git commit --allow-empty -m ${m}${paths} 2>&1); then`,
+		`  case "$out" in`,
+		`    *"empty git commit"*) git commit --allow-empty --no-verify -m ${m}${paths} || exit 1 ;;`,
+		`    *) printf '%s\\n' "$out" >&2; exit 1 ;;`,
+		`  esac`,
+		`fi`
+	].join("\n");
+};
+const CHANGED_SINCE_LAND = "gtd: the working tree changed since `gtd land` — revert the edits and run `gtd land` again to approve";
+/** `git add -A || exit 1` (an `&&` left side would not abort under `set -e`) then `commitAllowEmpty`. */
+const commitAll = (message) => `git add -A || exit 1\n${commitAllowEmpty(message)}`;
+/** Commits `path` alone, as the worktree has it; every other pending change stays pending. */
+const commitPath = (path, message) => `git add -A -- ${shellQuote$1(path)} || exit 1\n${commitAllowEmpty(message, path)}`;
+/** A pin beat's script. A failed `gtd bundle` leaves no half-written pin behind. */
+const pinScript = (path) => {
+	const p = shellQuote$1(path);
+	const slash = path.lastIndexOf("/");
+	return `${slash === -1 ? "" : `mkdir -p ${shellQuote$1(path.slice(0, slash))}\n`}gtd bundle >${p} || { rm -f -- ${p}; exit 1; }`;
+};
+/** An unpin beat's script, and `gtd abandon`'s removal of the pin. */
+const unpinScript = (path) => `rm -f -- ${shellQuote$1(path)}`;
+/**
+* An approval records exactly the judged tree: HEAD is pinned before the
+* clean check and the commit is built over its tree with `commit-tree`, so no
+* hook runs and none can add to it. A HEAD that moved fails the guarded
+* `update-ref`. `commit-tree` ignores `commit.gpgSign`, so it is read here.
+*/
+const commitClean = (message) => [
+	`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
+	`if [ -n "$(git status --porcelain --untracked-files=all --ignore-submodules=none)" ]; then`,
+	`  printf '%s\\n' ${shellQuote$1(CHANGED_SINCE_LAND)} >&2`,
+	`  exit 1`,
+	`fi`,
+	`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
+	`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
+	`gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m ${shellQuote$1(message)}) || exit 1`,
+	`git update-ref -m ${shellQuote$1(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head" || exit 1`
+].join("\n");
+const mixedResetTo = (ref) => `git reset --mixed ${shellQuote$1(ref)}`;
+const hardResetTo = (ref) => `git reset --hard ${shellQuote$1(ref)}`;
+/**
+* POSIX sh (runs under dash). The marker is a `commit-tree` over HEAD's own
+* tree, so no hook runs on it and its tree is the pre-turn tree by
+* construction; `commit-tree` ignores `commit.gpgSign`, hence the explicit
+* `-S`, read (and failing closed) before any object or ref is written; the
+* index is already staged by then, so an early exit leaves the turn staged.
+* The kept ref is deleted only after `reset -q` succeeds: it is then the
+* turn's only handle.
+* The branch moves before the final hard reset, so if that reset fails the
+* marker has landed and the turn is still in the working tree (kept ref
+* present); every other failure leaves the branch untouched.
+*/
+const keepTurn = (refPrefix, message) => {
+	const keptRef = `${shellQuote$1(`${refPrefix}/`)}"$gtd_kept"`;
+	return [
+		`git add -A || exit 1`,
+		`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
+		`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
+		`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
+		`gtd_tree=$(git write-tree) || exit 1`,
+		`gtd_kept=$(git commit-tree "$gtd_tree" -p "$gtd_head" -m ${shellQuote$1(message)}) || exit 1`,
+		`git update-ref ${keptRef} "$gtd_kept" || exit 1`,
+		`gtd_marker=$(printf '%s\\nGtd-Kept: %s' ${shellQuote$1(message)} "$gtd_kept")`,
+		`if ! gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m "$gtd_marker") || ! git update-ref -m ${shellQuote$1(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head"; then`,
+		`  git reset -q && git update-ref -d ${keptRef}`,
+		`  exit 1`,
+		`fi`,
+		`git reset --hard HEAD`
+	].join("\n");
+};
+const updateRef = (ref, hash) => `git update-ref ${shellQuote$1(ref)} ${shellQuote$1(hash)}`;
+/** `git update-ref -d <ref>` — idempotent: deleting a missing ref is already a no-op in real git. */
+const deleteRef = (ref) => `git update-ref -d ${shellQuote$1(ref)}`;
+/**
+* No `+` on the refspec: a local ref the remote's tip does not descend from
+* fails the fetch instead of being overwritten (a fast-forward still applies).
+*/
+const fetchHistoryRefs = (remote) => [
+	`set -eu`,
+	`before=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
+	`git fetch ${shellQuote$1(remote)} 'refs/gtd/history/*:refs/gtd/history/*'`,
+	`after=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
+	`printf '%s history refs arrived\\n' "$((after - before))"`
+].join("\n");
+/** Marks an emitted block as print-only — mirrors `OutcomeScript.ts`'s `OUTCOME_MARKER` verbatim, so `src/twins/EmittedScriptRecognizer.ts` recognizes either path's output identically. */
+const OUTCOME_MARKER$1 = "# gtd: outcome (print-only)";
+const printfLine$1 = (fmt, args) => `${OUTCOME_MARKER$1}\nprintf ${shellQuote$1(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
+const renderOutcome = (outcome) => {
+	switch (outcome.kind) {
+		case "transition": return printfLine$1("%s %s → %s\n", [
+			"'->'",
+			shellQuote$1(outcome.from),
+			shellQuote$1(outcome.to)
+		]);
+		case "commit": return printfLine$1("%s %s\n", ["'[commit]'", shellQuote$1(outcome.subject)]);
+		case "note": return printfLine$1("%s\n", [shellQuote$1(outcome.text)]);
+	}
+};
+const renderGitWrite = (write) => {
+	switch (write.kind) {
+		case "commitAll": return commitAll(write.message);
+		case "commitPath": return commitPath(write.path, write.message);
+		case "commitClean": return commitClean(write.message);
+		case "updateRef": return updateRef(write.ref, write.target);
+		case "keepTurn": return keepTurn(write.ref, write.message);
+	}
+};
+/**
+* Wraps `command` so a non-zero exit prints `prompt` plus the command's
+* captured output before propagating that exit code — mirrors `Emit.ts`'s
+* `failurePromptWrapper` (same reverse-import concern as `renderOutcome`
+* above: `Emit.ts` imports `shellQuote` from here already).
+*/
+const failurePromptWrapper$1 = (command, prompt) => {
+	return [
+		`gtd_validate_status=0`,
+		`gtd_validate_out="$( {`,
+		command,
+		`} 2>&1 )" || gtd_validate_status=$?`,
+		`if [ "$gtd_validate_status" -ne 0 ]; then`,
+		`  printf '%s\\n\\n%s\\n' ${shellQuote$1(prompt)} "$gtd_validate_out"`,
+		`  exit "$gtd_validate_status"`,
+		`fi`
+	].join("\n");
+};
+const renderLandStep = (step) => {
+	if (step.kind === "gitWrite") return renderGitWrite(step.write);
+	if (step.kind === "outcome") return renderOutcome(step.outcome);
+	if (step.kind === "uncheck") return `gtd uncheck ${shellQuote$1(step.file)}`;
+	return step.onFailure !== void 0 ? failurePromptWrapper$1(step.command, step.onFailure) : step.command;
+};
+const ScriptSurface = { render: (steps) => {
+	const rendered = steps.map(renderLandStep);
+	return rendered.length === 0 ? "" : ["set -eu", ...rendered].join("\n\n");
+} };
+//#endregion
+//#region src/emit/Emit.ts
+/** Exits 0 when the declared steering file is absent — nothing to format or validate yet. An OR list, not `if`: its left side failing never trips `set -e`. */
+const fileExistsGuard = (file) => `[ -f ${shellQuote$1(file)} ] || exit 0`;
+/** A mode or `ui.format` command finds the file it works on in `$GTD_FILE`. */
+const withFileVar$1 = (command, file) => `export GTD_FILE=${shellQuote$1(file)}\n${command}`;
+const SIMPLE_LEADING_WORD_RE = /^[A-Za-z0-9_./-]+(?=[ \t]|$)/;
+const SHELL_METACHARACTER_RE = /[|&;$<>(){}`]/;
+const FILE_VAR_RE = /"\$GTD_FILE"|"\$\{GTD_FILE\}"|\$GTD_FILE\b|\$\{GTD_FILE\}/g;
+/** `command` with `file` written in for `$GTD_FILE` — one line an agent can copy, equivalent to running it under `withFileVar`. */
+const commandForFile = (command, file) => command.replace(FILE_VAR_RE, shellQuote$1(file));
+/**
+* The leading word of a rendered `format:`/`validate:` command, when the
+* command has exactly one unambiguous binary to probe — `undefined` for
+* anything a shell metacharacter could hide a second command behind. A missing
+* guard degrades to a raw exit; a wrong guard would refuse a working command.
+*/
+const extractLeadingBinary = (command) => {
+	if (command.includes("\n")) return void 0;
+	if (SHELL_METACHARACTER_RE.test(command.replace(FILE_VAR_RE, ""))) return void 0;
+	const match = SIMPLE_LEADING_WORD_RE.exec(command);
+	return match === null ? void 0 : match[0];
+};
+/**
+* Names a typo'd or uninstalled binary and the `$PATH` it was looked up on.
+* `$PATH` is a shell word the DRIVER's shell expands at run time, so gtd never
+* resolves it in-process. Exits 127, matching bash's "command not found".
+*/
+const binaryGuard = (binary, mode, key) => {
+	const messageQ = shellQuote$1(`gtd: mode "${mode}": "${key}" command not found: ${binary}`);
+	return [
+		`command -v ${shellQuote$1(binary)} >/dev/null 2>&1 || {`,
+		`  printf '%s\\n%s\\n' ${messageQ} '$PATH: '"$PATH"`,
+		`  exit 127`,
+		`}`
+	].join("\n");
+};
+/**
+* Prints `prompt` plus the captured output on a non-zero exit, then propagates
+* it. The `{ … }` group inlines a multi-line `command` verbatim; the
+* assignment sits left of `||` so `set -e` never trips on the failure itself.
+*/
+const failurePromptWrapper = (command, prompt) => {
+	return [
+		`gtd_validate_status=0`,
+		`gtd_validate_out="$( {`,
+		command,
+		`} 2>&1 )" || gtd_validate_status=$?`,
+		`if [ "$gtd_validate_status" -ne 0 ]; then`,
+		`  printf '%s\\n\\n%s\\n' ${shellQuote$1(prompt)} "$gtd_validate_out"`,
+		`  exit "$gtd_validate_status"`,
+		`fi`
+	].join("\n");
+};
+const renderStep = (step) => {
+	if (step.kind === "command" && step.onFailure !== void 0) return failurePromptWrapper(step.command, step.onFailure);
+	return step.command;
+};
+const assembleScript = (steps) => steps.length === 0 ? "" : ["set -eu", ...steps.map(renderStep)].join("\n\n");
+/** Build both halves from already-rendered command strings; an empty (or omitted) array produces the empty-string result, so a driver checking `if [ -n "$required" ]` never has to special-case a bare preamble. */
+const emitScripts = (required = [], optional = []) => ({
+	required: assembleScript(required),
+	optional: assembleScript(optional)
+});
+/** Exported so `src/twins/EmittedScriptRecognizer.ts` can recognize these by exact string comparison. `printf`, not `echo`, avoids shell-specific backslash-escape quirks. */
+const DID_NOT_RUN_COMMENT = "# gtd emitted this and did NOT run it — run it with `sh` to apply it";
+const PRESENTATION_ONLY_COMMENT = "# presentation only — safe to skip";
+const PRESENTATION_FAILURE_WARNING = "printf 'gtd: presentation-only follow-up failed — continuing\\n' >&2";
+/**
+* A write command's single pasteable script (`gtd abandon | sh`,
+* `gtd land --json=script`'s own field). `optional`, when non-empty, is
+* wrapped in a subshell whose failure is swallowed — presentation-only, so it
+* must never turn a landed turn into a non-zero exit.
+*/
+const combinedScript = (required, optional) => {
+	if (required.length === 0) return "";
+	if (optional.length === 0) return `${DID_NOT_RUN_COMMENT}\n\n${required}`;
+	return [
+		DID_NOT_RUN_COMMENT,
+		"",
+		required,
+		"",
+		PRESENTATION_ONLY_COMMENT,
+		`(\n${optional}\n) || ${PRESENTATION_FAILURE_WARNING}`
+	].join("\n");
+};
+//#endregion
+//#region src/emit/OutcomeScript.ts
+/**
+* A `printf '<fmt>' <args...>` bash statement — `args` are already-valid bash
+* tokens (a `shellQuote`d literal, a `"$(git …)"` substitution), never
+* re-quoted here: a value reaches the script as a printf ARGUMENT, never
+* interpolated into the format itself, so a subject or state name containing
+* `%` can never be read as a conversion spec. Markers like `->` are arguments
+* too, keeping every format string free of a leading `-` that a shell's
+* `printf` could mistake for an option. A real newline in `fmt` is emitted as
+* the two-character `\n` escape `printf` itself expands, keeping every emitted
+* statement on one line.
+*/
+const printfLine = (fmt, args) => `${OUTCOME_MARKER}\nprintf ${shellQuote$1(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
+/**
+* Marks an emitted block as print-only. Load-bearing beyond documentation:
+* `src/twins/EmittedScriptRecognizer.ts` recognizes an outcome block by
+* this line, and a bare `printf` would be ambiguous with a workflow
+* `script:` command that happens to start the same way.
+*/
+const OUTCOME_MARKER = "# gtd: outcome (print-only)";
+const FMT_ABANDON_NOOP = "no gtd process is underway (resting at \"%s\") — nothing to abandon\n";
+const FMT_ABANDONED = "abandoned the process resting at \"%s\" — HEAD is back at %s (\"%s\"), resting at \"%s\".\nEverything the process produced is kept as uncommitted changes (`git status`); discard them with `git checkout -- . && git clean -fd .gtd` for a clean tree.\n";
+const FMT_RESTORED = "restored the retained history — HEAD is back at %s (\"%s\"), resting at \"%s\". Resume with the loop, or `git reset` to any earlier turn to restart from there.\n";
+/** `no gtd process is underway (resting at "<initial>") — nothing to abandon` — `gtd abandon`'s no-op plain-text line. */
+const abandonNoopText = (initial) => renderFormat(FMT_ABANDON_NOOP, initial);
+/** One already-rendered plain line. */
+const noteOutcome = (text) => printfLine("%s\n", [shellQuote$1(text)]);
+/**
+* Resolves the post-hoc short hash/subject from `head` (a commitish) in-script
+* — this line runs AFTER the reset that made `head` the new HEAD, so neither
+* value is knowable when gtd generates it.
+*/
+const abandonedOutcome = (from, head, state) => printfLine(FMT_ABANDONED, [
+	shellQuote$1(from),
+	`"$(git rev-parse --short ${shellQuote$1(head)})"`,
+	`"$(git log -1 --format=%s ${shellQuote$1(head)})"`,
+	shellQuote$1(state)
+]);
+/** `gtd abandon`'s no-op outcome — the same wording `abandonNoopText` renders. */
+const abandonNoopOutcome = (initial) => noteOutcome(abandonNoopText(initial));
+/** Resolves the post-hoc short hash/subject from `to` (a commitish) in-script, for the same reason `abandonedOutcome` does. */
+const restoredOutcome = (to, state) => printfLine(FMT_RESTORED, [
+	`"$(git rev-parse --short ${shellQuote$1(to)})"`,
+	`"$(git log -1 --format=%s ${shellQuote$1(to)})"`,
+	shellQuote$1(state)
+]);
+//#endregion
+//#region src/emit/ModeContradiction.ts
+/**
+* Written for two readers at once, since gtd validate's exit code carries no
+* second meaning to distinguish them: the agent (this is a CONFIGURATION BUG,
+* not the steering file — stop, don't edit it, or a fix-retry loop will
+* thrash on the document) and the human (which mode, and the exact rendered
+* `format:` command, to fix `gtd.config.ts` without reproducing the failure).
+*/
+const contradictionMessage = (mode, formatCommand) => `gtd: mode "${mode}"'s format: command breaks its own validator — this is a CONFIGURATION BUG, not a problem with the steering file. Do NOT edit the steering file — stop and end your turn now.\nThe rendered format: command that ran:\n${formatCommand}\nWhat it turned mode "${mode}"'s own canonical sample into:`;
+/**
+* Formats a copy of the mode's own canonical sample and re-validates it with
+* `gtd check <mode>`, failing loudly when the round-trip breaks it — detects a
+* mode whose `format:` contradicts its own `validate:` without ever touching
+* the real steering file. `printf '%s'` over a `shellQuote`d sample, never a
+* heredoc, since no delimiter chosen ahead of time can collide with the
+* sample's own bytes. One bash fragment with no blank lines (so
+* `src/emit/Emit.ts`'s `assembleScript` never splits it from a sibling step), meant
+* to run BEFORE `[ -f <file> ] || exit 0` in the emitted validate script so it
+* still fires at a first-write beat where the real steering file doesn't
+* exist yet.
+*/
+const buildModeContradictionCheck = (inputs) => {
+	const { mode, samplePath, sample, formatCommand } = inputs;
+	const pathQ = shellQuote$1(samplePath);
+	const messageQ = shellQuote$1(contradictionMessage(mode, formatCommand));
+	return [
+		`printf '%s' ${shellQuote$1(sample)} > ${pathQ}`,
+		formatCommand,
+		`gtd check ${mode} ${pathQ} >/dev/null 2>&1 || {`,
+		`  printf '%s\\n' ${messageQ} >&2`,
+		`  cat ${pathQ} >&2`,
+		`  rm -f ${pathQ}`,
+		`  exit 1`,
+		`}`,
+		`rm -f ${pathQ}`
+	].join("\n");
+};
+/**
+* Skip notice for a mode whose validator is EXTERNAL (a user `validate:`
+* command, not one of the two built-in modes) — there's no in-process parser
+* to round-trip a sample through. Printed to stderr since silence would read
+* as a clean bill of health.
+*/
+const modeContradictionSkipNotice = (mode) => {
+	return `printf '%s\\n' ${shellQuote$1(`gtd: mode "${mode}" has an external validate: command — skipping the format/validate contradiction check`)} >&2`;
+};
+//#endregion
+//#region src/emit/SteeringMode.ts
+init_dist$1();
+init_steering();
+/**
+* `format` alone (no live/external verdict) when there's no validator at
+* all; a live in-process validator for a `"builtin"` validate OR a command
+* that is exactly the format's own seeded string; `externalValidate` for any
+* other command. Each arm returns directly — a flat sequence, not nested
+* ternaries — so the four outcomes stay each their own case to read, not a
+* boolean expression to re-derive.
+*/
+const capabilitiesFor = (mode, format, validate) => {
+	if (format === void 0) return validate?.kind === "command" ? { externalValidate: true } : {};
+	if (validate?.kind === "builtin") return {
+		format,
+		liveValidate: format.validate
+	};
+	if (validate === void 0) return { format };
+	if (isSeededValidateCommand(mode, validate.command)) return {
+		format,
+		liveValidate: format.validate
+	};
+	return {
+		format,
+		externalValidate: true
+	};
+};
+/**
+* Resolve a `mode:` name against `def.modes` plus the built-in registry
+* (`src/workflow/SteeringFormats.ts`) — half by half: a declared `format:`/`validate:`
+* wins, and an undeclared `validate:` falls back to the built-in format's own
+* parser when the name is registered. `format` is set from the registry
+* ALONE, independent of which half of `validate` wins — a declared validator
+* overrides validation, not the format identity.
+*
+* `def: undefined` is the LSP's built-in-only fallback — resolving `mode`
+* against the registry alone, with no workflow definition in hand (e.g. the
+* basename dispatch for a `REVIEW.md` no config maps).
+*
+* The `"unknown"` arm carries the whole refusal message, naming what IS known
+* when `def` is given — this is the one place that message is built, so it
+* can never drift from what actually resolved.
+*/
+const resolveMode = (def, state, mode) => {
+	const declared = def?.modes?.[mode];
+	const format = steeringFormatFor(mode);
+	if (declared === void 0 && format === void 0) return {
+		kind: "unknown",
+		message: def !== void 0 ? `state "${state}": mode "${mode}" is not defined by the active workflow (known modes: ${knownModes(def).join(", ")})` : `mode "${mode}" is not a built-in steering format`
+	};
+	const validate = declared?.validate !== void 0 ? {
+		kind: "command",
+		command: declared.validate
+	} : format !== void 0 ? {
+		kind: "builtin",
+		format
+	} : void 0;
+	return {
+		kind: "resolved",
+		mode,
+		...format !== void 0 ? { format } : {},
+		...declared?.format !== void 0 ? { formatCommand: declared.format } : {},
+		...validate !== void 0 ? { validate } : {},
+		capabilities: capabilitiesFor(mode, format, validate)
+	};
+};
+/** `gtd next`'s fix-retry instruction, printed ahead of the failing command's captured output. */
+const fixPromptInstruction = (file) => `Your last turn does not pass its own validation script. Fix these format violations in ${file}, then finish:`;
+/**
+* Pushes a `binaryGuard` step ahead of `command` when its own leading word
+* is unambiguous — BEFORE, not wrapped around: a guard that fails must stop
+* the script on its own `exit 127`, without touching `failurePromptWrapper`'s
+* captured-output path. Each command guards on its OWN leading word — a
+* guard naming the wrong binary is worse than none.
+*/
+const pushGuardedCommand = (steps, mode, key, command, file, onFailure) => {
+	const binary = extractLeadingBinary(command);
+	if (binary !== void 0) steps.push({
+		kind: "command",
+		command: binaryGuard(binary, mode, key)
+	});
+	steps.push({
+		kind: "command",
+		command: withFileVar$1(command, file),
+		...onFailure !== void 0 ? { onFailure } : {}
+	});
+};
+/**
+* `resolved`'s `format:`/`validate:` as `EmitStep[]` — format first,
+* validate last, the last one wrapped with `onFailure` when the validator is
+* a command (a built-in's own in-process parser has no shell step to wrap:
+* `gtd check`'s seeded command carries that instead). Each command gets its
+* own `binaryGuard` immediately ahead of it.
+*/
+const modeCommandSteps = (resolved, file) => {
+	const steps = [];
+	if (resolved.formatCommand !== void 0) pushGuardedCommand(steps, resolved.mode, "format", resolved.formatCommand, file, void 0);
+	if (resolved.validate?.kind === "command") pushGuardedCommand(steps, resolved.mode, "validate", resolved.validate.command, file, fixPromptInstruction(file));
+	return steps;
+};
+/** `<Host.scratchDir>/gtd-mode-sample-<mode>-<pid>.md` — an absolute literal baked in at emit time, never a shell variable. `<pid>` avoids collisions between concurrent `gtd` processes. Never a `/tmp` literal or `mktemp` (`tests/tooling/no-tmp-assumption.test.ts` scans for both). */
+const scratchSamplePath = (scratchDir, mode) => join(scratchDir, `gtd-mode-sample-${mode}-${process.pid}.md`);
+/**
+* The contradiction round-trip/skip-notice steps for `resolved`'s `mode:`.
+* No `formatCommand` means nothing to round-trip: empty. Otherwise: a live
+* built-in validator runs the round-trip against that format's own canonical
+* sample; an external validator prints a one-line skip notice instead, since
+* silence there would read as a clean bill of health; a format-only mode with
+* neither has nothing to round-trip either.
+*/
+const modeContradictionSteps = (resolved) => gen(function* () {
+	if (resolved.formatCommand === void 0) return [];
+	const { capabilities } = resolved;
+	if (capabilities.format !== void 0 && capabilities.liveValidate !== void 0) {
+		const { scratchDir } = yield* Host;
+		const samplePath = scratchSamplePath(scratchDir, resolved.mode);
+		const formatCommand = withFileVar$1(resolved.formatCommand, samplePath);
+		return [{
+			kind: "command",
+			command: buildModeContradictionCheck({
+				mode: resolved.mode,
+				samplePath,
+				sample: capabilities.format.sample,
+				formatCommand
+			})
+		}];
+	}
+	if (capabilities.externalValidate === true) return [{
+		kind: "command",
+		command: modeContradictionSkipNotice(resolved.mode)
+	}];
+	return [];
+});
+/**
+* Renders `resolved`'s complete validate script for `file`: the mode's
+* format/validate contradiction check, a guard for a not-yet-written file,
+* then the format/validate commands themselves (format first). gtd never
+* runs this script itself — `resolveMode`+`validateScriptFor` only render
+* text for a driver to execute (`gtd renders; the driver executes`).
+*/
+const validateScriptFor = (resolved, file) => gen(function* () {
+	return { script: emitScripts([
+		...yield* modeContradictionSteps(resolved),
+		{
+			kind: "command",
+			command: fileExistsGuard(file)
+		},
+		...modeCommandSteps(resolved, file)
+	]).required };
 });
 //#endregion
 //#region src/step/planStep.ts
@@ -31171,6 +31793,26 @@ const uncheckStep = (snapshot) => snapshot.stepDef.actor === "human" && snapshot
 	kind: "uncheck",
 	file: snapshot.file
 }] : [];
+const gitWriteOf = (landing, message) => {
+	if (landing.only !== void 0) return {
+		kind: "commitPath",
+		path: landing.only,
+		message
+	};
+	if (landing.keepTurn !== void 0) return {
+		kind: "keepTurn",
+		ref: landing.keepTurn,
+		message
+	};
+	if (landing.spec.approved !== void 0) return {
+		kind: "commitClean",
+		message
+	};
+	return {
+		kind: "commitAll",
+		message
+	};
+};
 const planStep = (snapshot, opts = {}) => {
 	const landing = snapshot.landing;
 	if (landing.kind === "refusal") return {
@@ -31241,17 +31883,7 @@ const planStep = (snapshot, opts = {}) => {
 			...uncheckStep(snapshot),
 			{
 				kind: "gitWrite",
-				write: landing.keepTurn !== void 0 ? {
-					kind: "keepTurn",
-					ref: landing.keepTurn,
-					message
-				} : landing.spec.approved !== void 0 ? {
-					kind: "commitClean",
-					message
-				} : {
-					kind: "commitAll",
-					message
-				}
+				write: gitWriteOf(landing, message)
 			},
 			...landing.keepHistory !== void 0 ? [{
 				kind: "gitWrite",
@@ -31299,8 +31931,7 @@ const checkOverrides = (commandLabel, varOverrides, declaredNames, envNames) =>
 * `gtd start <name>`: start a brand NEW process on a workflow, writing an
 * opening commit that names the workflow's first step and carries a
 * `Gtd-Workflow:` trailer, every process setting as a `Gtd-Var:` trailer, plus
-* a `Gtd-Review-Base:` trailer when the workflow fixes the process's diff base,
-* and a `Gtd-Config:` trailer per config file.
+* and a `Gtd-Review-Base:` trailer when the workflow fixes the process's diff base.
 * All validation is a REFUSAL, not an Effect failure.
 */
 const planStart = (current, actor, start) => gen(function* () {
@@ -31338,8 +31969,7 @@ const planStart = (current, actor, start) => gen(function* () {
 					to: firstStep,
 					workflow: name,
 					...base !== void 0 ? { reviewBase: base } : {},
-					vars,
-					config: start.config
+					vars
 				})
 			}
 		}, {
@@ -31382,6 +32012,8 @@ const ACTORS = /* @__PURE__ */ new Set([
 	"check",
 	"judge"
 ]);
+const isOpening = ({ parsed, step }) => parsed !== void 0 && step === void 0 && parsed.from === void 0 && parsed.actor === "human";
+const boundsEpisode = (def, { parsed, pin }) => pin !== "add" && (parsed === void 0 || !ACTORS.has(parsed.actor) || parsed.to === def.initial);
 /**
 * Where the episode HEAD belongs to begins, read off subjects alone. Walking
 * back from HEAD: a bare `gtd(human): <step>` commit with no `Gtd-Step` is what
@@ -31394,14 +32026,13 @@ const ACTORS = /* @__PURE__ */ new Set([
 const locateEpisode = (def, history) => {
 	for (let i = history.length - 1; i >= 0; i--) {
 		const message = parseCommitMessage(history[i].message);
-		const subject = message.parsed;
-		if (subject !== void 0 && message.step === void 0 && subject.from === void 0 && subject.actor === "human") return {
+		if (isOpening(message)) return {
 			workflow: message.workflow,
 			legacyOpening: message.workflow === void 0,
 			baseIndex: i,
 			processStart: i
 		};
-		if (subject === void 0 || !ACTORS.has(subject.actor) || subject.to === def.initial) return {
+		if (boundsEpisode(def, message)) return {
 			workflow: void 0,
 			legacyOpening: false,
 			baseIndex: i,
@@ -31419,7 +32050,7 @@ const headTurnOf = (head) => {
 	if (head === void 0) return void 0;
 	const message = parseCommitMessage(head.message);
 	const subject = message.parsed;
-	if (subject === void 0 || !ACTORS.has(subject.actor)) return void 0;
+	if (subject === void 0 || !ACTORS.has(subject.actor) || message.pin !== void 0) return void 0;
 	return {
 		state: subject.to,
 		actor: subject.actor,
@@ -31447,15 +32078,6 @@ const runOf = (history, location, closingHash = void 0) => {
 	const fault = historyFormatFault(history, location);
 	return fault === void 0 ? succeed$1(buildRun(history, location, closingHash)) : fail$8(new Error(fault));
 };
-const pinnedConfigOf = (history) => {
-	for (let i = history.length - 1; i >= 0; i--) {
-		const files = parseCommitMessage(history[i].message).config;
-		if (Object.keys(files).length > 0) return {
-			commit: history[i].hash,
-			files
-		};
-	}
-};
 const approvalEntryOf = (hash, message) => message.approved === void 0 ? [] : [{
 	step: formatStepId(message.approved.step),
 	name: message.approved.name,
@@ -31463,8 +32085,10 @@ const approvalEntryOf = (hash, message) => message.approved === void 0 ? [] : [{
 	commit: hash
 }];
 const buildRun = (history, location, closingHash) => {
-	const processCommits = history.slice(location.processStart);
-	const parsed = processCommits.map((c) => parseCommitMessage(c.message));
+	const allProcessCommits = history.slice(location.processStart);
+	const allParsed = allProcessCommits.map((c) => parseCommitMessage(c.message));
+	const processCommits = allProcessCommits.filter((_, i) => allParsed[i].pin !== "add");
+	const parsed = allParsed.filter((m) => m.pin !== "add");
 	const first = parsed[0];
 	const startParentHash = hashAt(history, location.processStart - 1) ?? EMPTY_TREE$1;
 	const head = history[history.length - 1];
@@ -31477,10 +32101,10 @@ const buildRun = (history, location, closingHash) => {
 		trace: processCommits.map((c, i) => traceEntryOf(c.hash, parsed[i])),
 		costEntries: parsed.flatMap((m, i) => costEntriesOf(processCommits[i].hash, m)),
 		judgeVerdicts: parsed.flatMap((m) => m.judge),
+		pinCommitted: allParsed.some((m) => m.pin === "add"),
 		marks: parsed.flatMap((m) => m.marks),
 		approvals: processCommits.flatMap((c, i) => approvalEntryOf(c.hash, parsed[i])),
 		pinnedVars: { ...first?.vars },
-		pinnedConfig: pinnedConfigOf(history.slice(Math.max(location.baseIndex, 0))),
 		headTurn: headTurnOf(head),
 		closingHash,
 		episode: {
@@ -31516,6 +32140,7 @@ const subjectIsBoundary = (def, subject) => {
 	const parsed = parseCommitMessage(subject).parsed;
 	if (parsed === void 0 || !ACTORS.has(parsed.actor)) return true;
 	if (parsed.actor === "human" && parsed.from === void 0) return false;
+	if (parsed.actor === "check" && parsed.from === PIN_STATES.add) return false;
 	return parsed.to === def.initial;
 };
 /** The last page index (walking newest→oldest, same direction as `locateEpisode`) whose subject is a boundary, or `undefined` if none in `page`. */
@@ -31569,18 +32194,6 @@ const findBoundaryBase = (git, def, head) => gen(function* () {
 });
 const historyUpTo = (git, def, head) => flatMap(findBoundaryBase(git, def, head), ({ base, head: resolvedHead }) => git.commitHistory(base, resolvedHead));
 const computeProcessRun = (git, def, head) => flatMap(historyUpTo(git, def, head), (history) => runOf(history, locateEpisode(def, history)));
-const changedSinceStart = (pinned, current, workspace) => {
-	if (pinned === void 0) return [];
-	return changedConfigFiles(pinned.files, current).filter((path) => {
-		const committed = workspace.readCommittedSync(path, pinned.commit);
-		return current[path] === void 0 || committed === void 0 || contentHash(committed) !== current[path];
-	});
-};
-const warnConfigChanges = (run, current, workspace) => gen(function* () {
-	const changed = changedSinceStart(run.pinnedConfig, current, workspace);
-	if (changed.length === 0) return;
-	yield* (yield* Narrator).warn(`gtd: warning: the config changed since this process started (${changed.join(", ")}) — the rest of the process replays under the changed config`);
-});
 /** The run alone, never replaying — `gtd abandon` must work even when replay would refuse, short of a history it cannot read. */
 const currentRun = gen(function* () {
 	const git = yield* GitService;
@@ -31884,31 +32497,32 @@ const restAt = (ref, startOverrides = {}) => gen(function* () {
 	const run = yield* computeProcessRun(git, config.workflow, ref);
 	const { resolved, def, vars, env, setup } = yield* setupFor(config, run, workspace, host, startOverrides);
 	const outcome = yield* promise(() => replayFor(setup));
-	const error = replayError(outcome);
-	if (error !== void 0 || outcome.kind !== "rest") return yield* fail$8(error ?? /* @__PURE__ */ new Error("gtd: replay found no rest"));
-	const step = outcome.rest;
-	yield* (yield* Narrator).narrate(`rest resolved: ${step.name} (awaits ${step.actor})`);
-	const stepDef = stepDefOf(step);
+	const pinned = headHasPin(workspace, run);
+	const pin = pinBeatAt(outcome, run, def, pinned);
+	const resting = restingOn(outcome, pin);
+	if (resting === void 0) return yield* fail$8(replayError(outcome) ?? /* @__PURE__ */ new Error("gtd: replay found no rest"));
+	const { reached, step } = resting;
+	const { stepDef, state, memory } = restFacts(pin, step, reached.trace, run);
+	yield* (yield* Narrator).narrate(`rest resolved: ${state} (awaits ${stepDef.actor})`);
 	if (stepDef.mode !== void 0 && def.modes[stepDef.mode] === void 0) return yield* fail$8(/* @__PURE__ */ new Error(`gtd: config: step "${step.name}": mode "${stepDef.mode}" is not a mode this workflow knows (${knownModes(def).join(", ")})`));
 	const changes = ref === void 0 ? (yield* pendingChanges(git, stepDef.approve === true)).map((e) => ({
 		status: normalizeStatus(e.status),
 		path: e.path
 	})) : [];
-	const memory = memoryOf(outcome.trace, run);
-	const configNow = config.fingerprint;
-	if (ref === void 0) yield* warnConfigChanges(run, configNow, workspace);
+	if (ref === void 0 && config.drift.length > 0) yield* (yield* Narrator).warn(`gtd: notice: the live config differs from the pinned one (${config.drift.join(", ")}); \`gtd repin\` to switch`);
 	return {
 		def,
 		workflowName: resolved.name,
-		state: step.name,
+		state,
 		stepDef,
-		actor: step.actor,
+		actor: stepDef.actor,
+		pin,
+		pinned,
 		step,
-		trace: outcome.trace,
+		trace: reached.trace,
 		run,
 		vars,
 		env,
-		config: configNow,
 		changes,
 		memory: memory.key,
 		memoryResumed: memory.resumed,
@@ -31918,6 +32532,52 @@ const restAt = (ref, startOverrides = {}) => gen(function* () {
 	};
 });
 const currentRest = restAt(void 0);
+/** The step the process rests at and the trace that reached it — at an unpin, the flow's last step. */
+const restingOn = (outcome, pin) => {
+	if (outcome.kind === "rest") return {
+		reached: outcome,
+		step: outcome.rest
+	};
+	if (outcome.kind !== "ended" || pin !== "remove") return void 0;
+	const step = outcome.trace.at(-1);
+	return step === void 0 ? void 0 : {
+		reached: outcome,
+		step
+	};
+};
+/** A pin or unpin beat has its own script, no step's, and no agent memory. */
+const restFacts = (pin, step, trace, run) => pin === void 0 ? {
+	stepDef: stepDefOf(step),
+	state: step.name,
+	memory: memoryOf(trace, run)
+} : {
+	stepDef: pinStepDef(pin),
+	state: PIN_STATES[pin],
+	memory: {
+		key: void 0,
+		resumed: false
+	}
+};
+const headHasPin = (workspace, run) => {
+	const head = run.episode.commits.at(-1)?.hash ?? run.episode.base;
+	return head !== void 0 && workspace.treeSync(head).has(".gtd/process.gtdpin");
+};
+const underwayAt = (run, step, def) => run.workflow !== void 0 || step.name !== def.initial || step.id.occurrence !== 1;
+/**
+* A started process pins first — again, should a turn have deleted the pin;
+* a pinned flow that ended unpins before the closing commit.
+*/
+const pinBeatAt = (outcome, run, def, pinned) => {
+	if (flowEnded(outcome, run, def)) return pinned || run.pinCommitted ? "remove" : void 0;
+	if (outcome.kind !== "rest" || pinned) return void 0;
+	return underwayAt(run, outcome.rest, def) ? "add" : void 0;
+};
+const flowEnded = (outcome, run, def) => outcome.kind === "ended" || outcome.kind === "rest" && run.workflow === void 0 && outcome.rest.name === def.initial && underwayAt(run, outcome.rest, def);
+const pinStepDef = (pin) => ({
+	actor: "check",
+	kind: "script",
+	content: pin === "add" ? pinScript(PIN_PATH) : unpinScript(PIN_PATH)
+});
 /**
 * Whether `gtd start <name>` can start a process here: the workflow must
 * reach a step from the tree the opening commit would capture. That step is
@@ -31961,7 +32621,8 @@ const renderRest = (rest) => succeed$1({
 	content: rest.stepDef.content,
 	...rest.hints,
 	...rest.memory !== void 0 ? { memory: rest.memory } : {},
-	memoryResumed: rest.memoryResumed
+	memoryResumed: rest.memoryResumed,
+	...rest.pin !== void 0 ? { pin: rest.pin } : {}
 });
 /**
 * Derived, restart-proof stall detection: the tree is clean, HEAD is an empty
@@ -31969,7 +32630,7 @@ const renderRest = (rest) => succeed$1({
 */
 const stalledAt = (rest) => rest.changes.length === 0 && rest.stepDef.kind === "prompt" && rest.stepDef.allowEmpty !== true && rest.run.headTurn?.state === rest.state && rest.run.headTurn.actor === rest.actor && !rest.run.headTurn.step && rest.run.headTurn.empty;
 /** No process is underway: the default workflow's first step, first visit — a dirty tree there is a turn not yet landed, not a process. */
-const noProcessUnderway = (rest) => rest.run.workflow === void 0 && rest.state === rest.def.initial && rest.step.id.occurrence === 1;
+const noProcessUnderway = (rest) => rest.pin === void 0 && !underwayAt(rest.run, rest.step, rest.def);
 /** `idle` means exactly one thing: no process underway, clean tree. */
 const restIsIdle = (rest) => noProcessUnderway(rest) && rest.changes.length === 0;
 const isHumanReviewGate = (def) => def.actor === "human" && def.mode === "review";
@@ -32059,14 +32720,14 @@ const landingTo = (rest, to, branch, approver, marks) => {
 	const starts = !underway && to !== rest.def.initial;
 	const refused = starts ? multilineRefusal(rest.vars) : void 0;
 	if (refused !== void 0) return refused;
-	const finishes = underway && to === rest.def.initial;
+	const { finishes, landsAt } = endingOf(rest, to, underway);
 	return {
 		kind: "commit",
-		to,
+		to: landsAt,
 		spec: {
 			actor: rest.actor,
 			from: rest.state,
-			to,
+			to: landsAt,
 			step: rest.step.id,
 			...marks.length > 0 && { marks },
 			...approvedTrailer(rest, approver),
@@ -32077,10 +32738,55 @@ const landingTo = (rest, to, branch, approver, marks) => {
 		...keptTurn(rest)
 	};
 };
-const startTrailers = (rest, starts) => starts ? {
-	vars: rest.vars,
-	config: rest.config
-} : {};
+const endingOf = (rest, to, underway) => {
+	const ends = underway && to === rest.def.initial;
+	return {
+		finishes: ends && !rest.pinned,
+		landsAt: ends && rest.pinned ? PIN_STATES.remove : to
+	};
+};
+/** A pin or unpin commit carries the pin alone; the unpin commit closes the process. */
+const pinLanding = (rest, pin, branch) => {
+	const change = rest.changes.find((c) => c.path === PIN_PATH)?.status;
+	return pin === "add" ? pinCommit(rest, change) : unpinCommit(rest, change, branch);
+};
+const pinCommit = (rest, change) => {
+	if (change === void 0 || change === "D") return pinRefusal("add");
+	const to = rest.step.name;
+	return {
+		kind: "commit",
+		to,
+		spec: {
+			actor: rest.actor,
+			from: rest.state,
+			to,
+			pin: "add"
+		},
+		only: PIN_PATH
+	};
+};
+const unpinCommit = (rest, change, branch) => {
+	if (change !== "D" && rest.pinned) return pinRefusal("remove");
+	const to = rest.def.initial;
+	return {
+		kind: "commit",
+		to,
+		spec: {
+			actor: rest.actor,
+			from: rest.state,
+			to,
+			pin: "remove",
+			...closingTrailers(branch)
+		},
+		keepHistory: processHistoryRef(rest.run.startHash),
+		...rest.pinned ? { only: PIN_PATH } : {}
+	};
+};
+const pinRefusal = (pin) => ({
+	kind: "refusal",
+	message: pin === "add" ? `gtd land: ${PIN_PATH} is missing — run the pin beat's script (\`gtd next --json=content\`); if its \`gtd bundle\` fails, fix what it reports, or run \`gtd abandon\`` : `gtd land: ${PIN_PATH} is still there — run the unpin beat's script (\`gtd next --json=content\`), then land`
+});
+const startTrailers = (rest, starts) => starts ? { vars: rest.vars } : {};
 const outcomeMarks = (outcome) => outcome.kind === "rest" || outcome.kind === "ended" ? outcome.marks : [];
 /**
 * What landing the pending turn at `rest` does — a pure decision from a
@@ -32088,6 +32794,7 @@ const outcomeMarks = (outcome) => outcome.kind === "rest" || outcome.kind === "e
 * computed by replaying, never matched.
 */
 const decideLanding = (rest, verdicts, branch, approver) => gen(function* () {
+	if (rest.pin !== void 0) return pinLanding(rest, rest.pin, branch);
 	const unapproved = approvalRefusal(rest, approver);
 	if (unapproved !== void 0) return unapproved;
 	const early = cleanLanding(rest);
@@ -32150,16 +32857,20 @@ const summaryFor = (run) => gen(function* () {
 	if (summary === void 0 || run.trace.length === 0) return { prompt: void 0 };
 	return { prompt: summary(summaryInput(run, settingsFor(resolved, run.pinnedVars, host.env, {}, {}))) };
 });
-/** Repository-relative paths of the config files today's config and the process's own record name; one outside the repository cannot be read at a ref, so it is left out. */
-const inRepoConfigPaths = (root, files, recorded) => {
-	const paths = new Set(Object.keys(recorded));
+/**
+* Repository-relative paths of today's config files; one outside the
+* repository cannot be read at a ref, so it is left out. A file only the old
+* config read needs no check: whichever file imported it differs too.
+*/
+const inRepoConfigPaths = (root, files) => {
+	const paths = /* @__PURE__ */ new Set();
 	for (const file of files) paths.add(relative(root, resolve(root, file)).split(sep).join("/"));
 	return [...paths].filter((p) => p !== "" && !p.startsWith("..") && !isAbsolute(p)).sort();
 };
 const configRefusal = (command, tip, paths, reason = "A history ref replays under today's config, so it is unreadable after the config changes") => /* @__PURE__ */ new Error(`${command}: refused — config differs at ${tip.slice(0, 7)}: ${paths.join(", ")}. ${reason}`);
-const differingConfigPaths = (git, workspace, root, config, run, hash) => gen(function* () {
+const differingConfigPaths = (git, workspace, root, config, hash) => gen(function* () {
 	const differing = [];
-	for (const path of inRepoConfigPaths(root, Object.keys(config.fingerprint), run.pinnedConfig?.files ?? {})) if ((yield* orElseSucceed(git.readFileAtRef(hash, path), () => void 0)) !== workspace.readSync(path)) differing.push(path);
+	for (const path of inRepoConfigPaths(root, Object.keys(config.fingerprint))) if ((yield* orElseSucceed(git.readFileAtRef(hash, path), () => void 0)) !== workspace.readSync(path)) differing.push(path);
 	return differing;
 });
 const notClosedError = (hash, outcome) => outcome.kind === "rest" ? /* @__PURE__ */ new Error(`gtd history: ${hash.slice(0, 7)} does not close a process under today's config`) : replayError(outcome) ?? /* @__PURE__ */ new Error("gtd history: replay failed");
@@ -32216,7 +32927,7 @@ const replayFinishedProcess = (config, run, hash, how) => gen(function* () {
 	const recorded = parseCommitMessage(run.episode.commits.find((c) => c.hash === hash)?.message ?? "").version;
 	const versionWarning = versionWarningFor(recorded);
 	const withWarning = (err) => versionWarning === void 0 ? err : /* @__PURE__ */ new Error(`${err.message}\n${versionWarning}`);
-	const differing = yield* differingConfigPaths(git, workspace, host.root, config, run, hash);
+	const differing = yield* differingConfigPaths(git, workspace, host.root, config, hash);
 	if (differing.length > 0) return yield* fail$8(withWarning(configRefusal(how.command, hash, differing, how.configReason)));
 	const { setup } = yield* setupFor(config, run, workspace, host);
 	const outcome = yield* promise(() => replayFor(setup));
@@ -32228,474 +32939,6 @@ const replayFinishedProcess = (config, run, hash, how) => gen(function* () {
 	};
 });
 //#endregion
-//#region src/emit/GitScript.ts
-const shellQuote$1 = (value) => `'${value.replace(/'/g, "'\\''")}'`;
-/**
-* `--allow-empty` because gtd's workflow commits may be empty on purpose.
-* Mirrors `Git.ts`'s retry: only re-tries without hooks on the specific
-* "empty git commit" rejection message, discriminated from the captured
-* output rather than the exit code, so a genuinely rejected commit (a lint
-* error, a commit-msg hook) still fails.
-*/
-const commitAllowEmpty = (message) => {
-	const m = shellQuote$1(message);
-	return [
-		`if ! out=$(git commit --allow-empty -m ${m} 2>&1); then`,
-		`  case "$out" in`,
-		`    *"empty git commit"*) git commit --allow-empty --no-verify -m ${m} || exit 1 ;;`,
-		`    *) printf '%s\\n' "$out" >&2; exit 1 ;;`,
-		`  esac`,
-		`fi`
-	].join("\n");
-};
-const CHANGED_SINCE_LAND = "gtd: the working tree changed since `gtd land` — revert the edits and run `gtd land` again to approve";
-/** `git add -A || exit 1` (an `&&` left side would not abort under `set -e`) then `commitAllowEmpty`. */
-const commitAll = (message) => `git add -A || exit 1\n${commitAllowEmpty(message)}`;
-/**
-* An approval records exactly the judged tree: HEAD is pinned before the
-* clean check and the commit is built over its tree with `commit-tree`, so no
-* hook runs and none can add to it. A HEAD that moved fails the guarded
-* `update-ref`. `commit-tree` ignores `commit.gpgSign`, so it is read here.
-*/
-const commitClean = (message) => [
-	`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
-	`if [ -n "$(git status --porcelain --untracked-files=all --ignore-submodules=none)" ]; then`,
-	`  printf '%s\\n' ${shellQuote$1(CHANGED_SINCE_LAND)} >&2`,
-	`  exit 1`,
-	`fi`,
-	`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
-	`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
-	`gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m ${shellQuote$1(message)}) || exit 1`,
-	`git update-ref -m ${shellQuote$1(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head" || exit 1`
-].join("\n");
-const mixedResetTo = (ref) => `git reset --mixed ${shellQuote$1(ref)}`;
-const hardResetTo = (ref) => `git reset --hard ${shellQuote$1(ref)}`;
-/**
-* POSIX sh (runs under dash). The marker is a `commit-tree` over HEAD's own
-* tree, so no hook runs on it and its tree is the pre-turn tree by
-* construction; `commit-tree` ignores `commit.gpgSign`, hence the explicit
-* `-S`, read (and failing closed) before any object or ref is written; the
-* index is already staged by then, so an early exit leaves the turn staged.
-* The kept ref is deleted only after `reset -q` succeeds: it is then the
-* turn's only handle.
-* The branch moves before the final hard reset, so if that reset fails the
-* marker has landed and the turn is still in the working tree (kept ref
-* present); every other failure leaves the branch untouched.
-*/
-const keepTurn = (refPrefix, message) => {
-	const keptRef = `${shellQuote$1(`${refPrefix}/`)}"$gtd_kept"`;
-	return [
-		`git add -A || exit 1`,
-		`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
-		`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
-		`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
-		`gtd_tree=$(git write-tree) || exit 1`,
-		`gtd_kept=$(git commit-tree "$gtd_tree" -p "$gtd_head" -m ${shellQuote$1(message)}) || exit 1`,
-		`git update-ref ${keptRef} "$gtd_kept" || exit 1`,
-		`gtd_marker=$(printf '%s\\nGtd-Kept: %s' ${shellQuote$1(message)} "$gtd_kept")`,
-		`if ! gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m "$gtd_marker") || ! git update-ref -m ${shellQuote$1(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head"; then`,
-		`  git reset -q && git update-ref -d ${keptRef}`,
-		`  exit 1`,
-		`fi`,
-		`git reset --hard HEAD`
-	].join("\n");
-};
-const updateRef = (ref, hash) => `git update-ref ${shellQuote$1(ref)} ${shellQuote$1(hash)}`;
-/** `git update-ref -d <ref>` — idempotent: deleting a missing ref is already a no-op in real git. */
-const deleteRef = (ref) => `git update-ref -d ${shellQuote$1(ref)}`;
-/**
-* No `+` on the refspec: a local ref the remote's tip does not descend from
-* fails the fetch instead of being overwritten (a fast-forward still applies).
-*/
-const fetchHistoryRefs = (remote) => [
-	`set -eu`,
-	`before=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
-	`git fetch ${shellQuote$1(remote)} 'refs/gtd/history/*:refs/gtd/history/*'`,
-	`after=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
-	`printf '%s history refs arrived\\n' "$((after - before))"`
-].join("\n");
-/** Marks an emitted block as print-only — mirrors `OutcomeScript.ts`'s `OUTCOME_MARKER` verbatim, so `src/twins/EmittedScriptRecognizer.ts` recognizes either path's output identically. */
-const OUTCOME_MARKER$1 = "# gtd: outcome (print-only)";
-const printfLine$1 = (fmt, args) => `${OUTCOME_MARKER$1}\nprintf ${shellQuote$1(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
-const renderOutcome = (outcome) => {
-	switch (outcome.kind) {
-		case "transition": return printfLine$1("%s %s → %s\n", [
-			"'->'",
-			shellQuote$1(outcome.from),
-			shellQuote$1(outcome.to)
-		]);
-		case "commit": return printfLine$1("%s %s\n", ["'[commit]'", shellQuote$1(outcome.subject)]);
-		case "note": return printfLine$1("%s\n", [shellQuote$1(outcome.text)]);
-	}
-};
-const renderGitWrite = (write) => {
-	switch (write.kind) {
-		case "commitAll": return commitAll(write.message);
-		case "commitClean": return commitClean(write.message);
-		case "updateRef": return updateRef(write.ref, write.target);
-		case "keepTurn": return keepTurn(write.ref, write.message);
-	}
-};
-/**
-* Wraps `command` so a non-zero exit prints `prompt` plus the command's
-* captured output before propagating that exit code — mirrors `Emit.ts`'s
-* `failurePromptWrapper` (same reverse-import concern as `renderOutcome`
-* above: `Emit.ts` imports `shellQuote` from here already).
-*/
-const failurePromptWrapper$1 = (command, prompt) => {
-	return [
-		`gtd_validate_status=0`,
-		`gtd_validate_out="$( {`,
-		command,
-		`} 2>&1 )" || gtd_validate_status=$?`,
-		`if [ "$gtd_validate_status" -ne 0 ]; then`,
-		`  printf '%s\\n\\n%s\\n' ${shellQuote$1(prompt)} "$gtd_validate_out"`,
-		`  exit "$gtd_validate_status"`,
-		`fi`
-	].join("\n");
-};
-const renderLandStep = (step) => {
-	if (step.kind === "gitWrite") return renderGitWrite(step.write);
-	if (step.kind === "outcome") return renderOutcome(step.outcome);
-	if (step.kind === "uncheck") return `gtd uncheck ${shellQuote$1(step.file)}`;
-	return step.onFailure !== void 0 ? failurePromptWrapper$1(step.command, step.onFailure) : step.command;
-};
-const ScriptSurface = { render: (steps) => {
-	const rendered = steps.map(renderLandStep);
-	return rendered.length === 0 ? "" : ["set -eu", ...rendered].join("\n\n");
-} };
-//#endregion
-//#region src/emit/Emit.ts
-/** Exits 0 when the declared steering file is absent — nothing to format or validate yet. An OR list, not `if`: its left side failing never trips `set -e`. */
-const fileExistsGuard = (file) => `[ -f ${shellQuote$1(file)} ] || exit 0`;
-/** A mode or `ui.format` command finds the file it works on in `$GTD_FILE`. */
-const withFileVar$1 = (command, file) => `export GTD_FILE=${shellQuote$1(file)}\n${command}`;
-const SIMPLE_LEADING_WORD_RE = /^[A-Za-z0-9_./-]+(?=[ \t]|$)/;
-const SHELL_METACHARACTER_RE = /[|&;$<>(){}`]/;
-const FILE_VAR_RE = /"\$GTD_FILE"|"\$\{GTD_FILE\}"|\$GTD_FILE\b|\$\{GTD_FILE\}/g;
-/** `command` with `file` written in for `$GTD_FILE` — one line an agent can copy, equivalent to running it under `withFileVar`. */
-const commandForFile = (command, file) => command.replace(FILE_VAR_RE, shellQuote$1(file));
-/**
-* The leading word of a rendered `format:`/`validate:` command, when the
-* command has exactly one unambiguous binary to probe — `undefined` for
-* anything a shell metacharacter could hide a second command behind. A missing
-* guard degrades to a raw exit; a wrong guard would refuse a working command.
-*/
-const extractLeadingBinary = (command) => {
-	if (command.includes("\n")) return void 0;
-	if (SHELL_METACHARACTER_RE.test(command.replace(FILE_VAR_RE, ""))) return void 0;
-	const match = SIMPLE_LEADING_WORD_RE.exec(command);
-	return match === null ? void 0 : match[0];
-};
-/**
-* Names a typo'd or uninstalled binary and the `$PATH` it was looked up on.
-* `$PATH` is a shell word the DRIVER's shell expands at run time, so gtd never
-* resolves it in-process. Exits 127, matching bash's "command not found".
-*/
-const binaryGuard = (binary, mode, key) => {
-	const messageQ = shellQuote$1(`gtd: mode "${mode}": "${key}" command not found: ${binary}`);
-	return [
-		`command -v ${shellQuote$1(binary)} >/dev/null 2>&1 || {`,
-		`  printf '%s\\n%s\\n' ${messageQ} '$PATH: '"$PATH"`,
-		`  exit 127`,
-		`}`
-	].join("\n");
-};
-/**
-* Prints `prompt` plus the captured output on a non-zero exit, then propagates
-* it. The `{ … }` group inlines a multi-line `command` verbatim; the
-* assignment sits left of `||` so `set -e` never trips on the failure itself.
-*/
-const failurePromptWrapper = (command, prompt) => {
-	return [
-		`gtd_validate_status=0`,
-		`gtd_validate_out="$( {`,
-		command,
-		`} 2>&1 )" || gtd_validate_status=$?`,
-		`if [ "$gtd_validate_status" -ne 0 ]; then`,
-		`  printf '%s\\n\\n%s\\n' ${shellQuote$1(prompt)} "$gtd_validate_out"`,
-		`  exit "$gtd_validate_status"`,
-		`fi`
-	].join("\n");
-};
-const renderStep = (step) => {
-	if (step.kind === "command" && step.onFailure !== void 0) return failurePromptWrapper(step.command, step.onFailure);
-	return step.command;
-};
-const assembleScript = (steps) => steps.length === 0 ? "" : ["set -eu", ...steps.map(renderStep)].join("\n\n");
-/** Build both halves from already-rendered command strings; an empty (or omitted) array produces the empty-string result, so a driver checking `if [ -n "$required" ]` never has to special-case a bare preamble. */
-const emitScripts = (required = [], optional = []) => ({
-	required: assembleScript(required),
-	optional: assembleScript(optional)
-});
-/** Exported so `src/twins/EmittedScriptRecognizer.ts` can recognize these by exact string comparison. `printf`, not `echo`, avoids shell-specific backslash-escape quirks. */
-const DID_NOT_RUN_COMMENT = "# gtd emitted this and did NOT run it — run it with `sh` to apply it";
-const PRESENTATION_ONLY_COMMENT = "# presentation only — safe to skip";
-const PRESENTATION_FAILURE_WARNING = "printf 'gtd: presentation-only follow-up failed — continuing\\n' >&2";
-/**
-* A write command's single pasteable script (`gtd abandon | sh`,
-* `gtd land --json=script`'s own field). `optional`, when non-empty, is
-* wrapped in a subshell whose failure is swallowed — presentation-only, so it
-* must never turn a landed turn into a non-zero exit.
-*/
-const combinedScript = (required, optional) => {
-	if (required.length === 0) return "";
-	if (optional.length === 0) return `${DID_NOT_RUN_COMMENT}\n\n${required}`;
-	return [
-		DID_NOT_RUN_COMMENT,
-		"",
-		required,
-		"",
-		PRESENTATION_ONLY_COMMENT,
-		`(\n${optional}\n) || ${PRESENTATION_FAILURE_WARNING}`
-	].join("\n");
-};
-//#endregion
-//#region src/emit/OutcomeScript.ts
-/**
-* A `printf '<fmt>' <args...>` bash statement — `args` are already-valid bash
-* tokens (a `shellQuote`d literal, a `"$(git …)"` substitution), never
-* re-quoted here: a value reaches the script as a printf ARGUMENT, never
-* interpolated into the format itself, so a subject or state name containing
-* `%` can never be read as a conversion spec. Markers like `->` are arguments
-* too, keeping every format string free of a leading `-` that a shell's
-* `printf` could mistake for an option. A real newline in `fmt` is emitted as
-* the two-character `\n` escape `printf` itself expands, keeping every emitted
-* statement on one line.
-*/
-const printfLine = (fmt, args) => `${OUTCOME_MARKER}\nprintf ${shellQuote$1(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
-/**
-* Marks an emitted block as print-only. Load-bearing beyond documentation:
-* `src/twins/EmittedScriptRecognizer.ts` recognizes an outcome block by
-* this line, and a bare `printf` would be ambiguous with a workflow
-* `script:` command that happens to start the same way.
-*/
-const OUTCOME_MARKER = "# gtd: outcome (print-only)";
-const FMT_ABANDON_NOOP = "no gtd process is underway (resting at \"%s\") — nothing to abandon\n";
-const FMT_ABANDONED = "abandoned the process resting at \"%s\" — HEAD is back at %s (\"%s\"), resting at \"%s\".\nEverything the process produced is kept as uncommitted changes (`git status`); discard them with `git checkout -- . && git clean -fd .gtd` for a clean tree.\n";
-const FMT_RESTORED = "restored the retained history — HEAD is back at %s (\"%s\"), resting at \"%s\". Resume with the loop, or `git reset` to any earlier turn to restart from there.\n";
-/** `no gtd process is underway (resting at "<initial>") — nothing to abandon` — `gtd abandon`'s no-op plain-text line. */
-const abandonNoopText = (initial) => renderFormat(FMT_ABANDON_NOOP, initial);
-/** One already-rendered plain line. */
-const noteOutcome = (text) => printfLine("%s\n", [shellQuote$1(text)]);
-/**
-* Resolves the post-hoc short hash/subject from `head` (a commitish) in-script
-* — this line runs AFTER the reset that made `head` the new HEAD, so neither
-* value is knowable when gtd generates it.
-*/
-const abandonedOutcome = (from, head, state) => printfLine(FMT_ABANDONED, [
-	shellQuote$1(from),
-	`"$(git rev-parse --short ${shellQuote$1(head)})"`,
-	`"$(git log -1 --format=%s ${shellQuote$1(head)})"`,
-	shellQuote$1(state)
-]);
-/** `gtd abandon`'s no-op outcome — the same wording `abandonNoopText` renders. */
-const abandonNoopOutcome = (initial) => noteOutcome(abandonNoopText(initial));
-/** Resolves the post-hoc short hash/subject from `to` (a commitish) in-script, for the same reason `abandonedOutcome` does. */
-const restoredOutcome = (to, state) => printfLine(FMT_RESTORED, [
-	`"$(git rev-parse --short ${shellQuote$1(to)})"`,
-	`"$(git log -1 --format=%s ${shellQuote$1(to)})"`,
-	shellQuote$1(state)
-]);
-//#endregion
-//#region src/emit/ModeContradiction.ts
-/**
-* Written for two readers at once, since gtd validate's exit code carries no
-* second meaning to distinguish them: the agent (this is a CONFIGURATION BUG,
-* not the steering file — stop, don't edit it, or a fix-retry loop will
-* thrash on the document) and the human (which mode, and the exact rendered
-* `format:` command, to fix `gtd.config.ts` without reproducing the failure).
-*/
-const contradictionMessage = (mode, formatCommand) => `gtd: mode "${mode}"'s format: command breaks its own validator — this is a CONFIGURATION BUG, not a problem with the steering file. Do NOT edit the steering file — stop and end your turn now.\nThe rendered format: command that ran:\n${formatCommand}\nWhat it turned mode "${mode}"'s own canonical sample into:`;
-/**
-* Formats a copy of the mode's own canonical sample and re-validates it with
-* `gtd check <mode>`, failing loudly when the round-trip breaks it — detects a
-* mode whose `format:` contradicts its own `validate:` without ever touching
-* the real steering file. `printf '%s'` over a `shellQuote`d sample, never a
-* heredoc, since no delimiter chosen ahead of time can collide with the
-* sample's own bytes. One bash fragment with no blank lines (so
-* `src/emit/Emit.ts`'s `assembleScript` never splits it from a sibling step), meant
-* to run BEFORE `[ -f <file> ] || exit 0` in the emitted validate script so it
-* still fires at a first-write beat where the real steering file doesn't
-* exist yet.
-*/
-const buildModeContradictionCheck = (inputs) => {
-	const { mode, samplePath, sample, formatCommand } = inputs;
-	const pathQ = shellQuote$1(samplePath);
-	const messageQ = shellQuote$1(contradictionMessage(mode, formatCommand));
-	return [
-		`printf '%s' ${shellQuote$1(sample)} > ${pathQ}`,
-		formatCommand,
-		`gtd check ${mode} ${pathQ} >/dev/null 2>&1 || {`,
-		`  printf '%s\\n' ${messageQ} >&2`,
-		`  cat ${pathQ} >&2`,
-		`  rm -f ${pathQ}`,
-		`  exit 1`,
-		`}`,
-		`rm -f ${pathQ}`
-	].join("\n");
-};
-/**
-* Skip notice for a mode whose validator is EXTERNAL (a user `validate:`
-* command, not one of the two built-in modes) — there's no in-process parser
-* to round-trip a sample through. Printed to stderr since silence would read
-* as a clean bill of health.
-*/
-const modeContradictionSkipNotice = (mode) => {
-	return `printf '%s\\n' ${shellQuote$1(`gtd: mode "${mode}" has an external validate: command — skipping the format/validate contradiction check`)} >&2`;
-};
-//#endregion
-//#region src/emit/SteeringMode.ts
-init_dist$1();
-init_steering();
-/**
-* `format` alone (no live/external verdict) when there's no validator at
-* all; a live in-process validator for a `"builtin"` validate OR a command
-* that is exactly the format's own seeded string; `externalValidate` for any
-* other command. Each arm returns directly — a flat sequence, not nested
-* ternaries — so the four outcomes stay each their own case to read, not a
-* boolean expression to re-derive.
-*/
-const capabilitiesFor = (mode, format, validate) => {
-	if (format === void 0) return validate?.kind === "command" ? { externalValidate: true } : {};
-	if (validate?.kind === "builtin") return {
-		format,
-		liveValidate: format.validate
-	};
-	if (validate === void 0) return { format };
-	if (isSeededValidateCommand(mode, validate.command)) return {
-		format,
-		liveValidate: format.validate
-	};
-	return {
-		format,
-		externalValidate: true
-	};
-};
-/**
-* Resolve a `mode:` name against `def.modes` plus the built-in registry
-* (`src/workflow/SteeringFormats.ts`) — half by half: a declared `format:`/`validate:`
-* wins, and an undeclared `validate:` falls back to the built-in format's own
-* parser when the name is registered. `format` is set from the registry
-* ALONE, independent of which half of `validate` wins — a declared validator
-* overrides validation, not the format identity.
-*
-* `def: undefined` is the LSP's built-in-only fallback — resolving `mode`
-* against the registry alone, with no workflow definition in hand (e.g. the
-* basename dispatch for a `REVIEW.md` no config maps).
-*
-* The `"unknown"` arm carries the whole refusal message, naming what IS known
-* when `def` is given — this is the one place that message is built, so it
-* can never drift from what actually resolved.
-*/
-const resolveMode = (def, state, mode) => {
-	const declared = def?.modes?.[mode];
-	const format = steeringFormatFor(mode);
-	if (declared === void 0 && format === void 0) return {
-		kind: "unknown",
-		message: def !== void 0 ? `state "${state}": mode "${mode}" is not defined by the active workflow (known modes: ${knownModes(def).join(", ")})` : `mode "${mode}" is not a built-in steering format`
-	};
-	const validate = declared?.validate !== void 0 ? {
-		kind: "command",
-		command: declared.validate
-	} : format !== void 0 ? {
-		kind: "builtin",
-		format
-	} : void 0;
-	return {
-		kind: "resolved",
-		mode,
-		...format !== void 0 ? { format } : {},
-		...declared?.format !== void 0 ? { formatCommand: declared.format } : {},
-		...validate !== void 0 ? { validate } : {},
-		capabilities: capabilitiesFor(mode, format, validate)
-	};
-};
-/** `gtd next`'s fix-retry instruction, printed ahead of the failing command's captured output. */
-const fixPromptInstruction = (file) => `Your last turn does not pass its own validation script. Fix these format violations in ${file}, then finish:`;
-/**
-* Pushes a `binaryGuard` step ahead of `command` when its own leading word
-* is unambiguous — BEFORE, not wrapped around: a guard that fails must stop
-* the script on its own `exit 127`, without touching `failurePromptWrapper`'s
-* captured-output path. Each command guards on its OWN leading word — a
-* guard naming the wrong binary is worse than none.
-*/
-const pushGuardedCommand = (steps, mode, key, command, file, onFailure) => {
-	const binary = extractLeadingBinary(command);
-	if (binary !== void 0) steps.push({
-		kind: "command",
-		command: binaryGuard(binary, mode, key)
-	});
-	steps.push({
-		kind: "command",
-		command: withFileVar$1(command, file),
-		...onFailure !== void 0 ? { onFailure } : {}
-	});
-};
-/**
-* `resolved`'s `format:`/`validate:` as `EmitStep[]` — format first,
-* validate last, the last one wrapped with `onFailure` when the validator is
-* a command (a built-in's own in-process parser has no shell step to wrap:
-* `gtd check`'s seeded command carries that instead). Each command gets its
-* own `binaryGuard` immediately ahead of it.
-*/
-const modeCommandSteps = (resolved, file) => {
-	const steps = [];
-	if (resolved.formatCommand !== void 0) pushGuardedCommand(steps, resolved.mode, "format", resolved.formatCommand, file, void 0);
-	if (resolved.validate?.kind === "command") pushGuardedCommand(steps, resolved.mode, "validate", resolved.validate.command, file, fixPromptInstruction(file));
-	return steps;
-};
-/** `<Host.scratchDir>/gtd-mode-sample-<mode>-<pid>.md` — an absolute literal baked in at emit time, never a shell variable. `<pid>` avoids collisions between concurrent `gtd` processes. Never a `/tmp` literal or `mktemp` (`tests/tooling/no-tmp-assumption.test.ts` scans for both). */
-const scratchSamplePath = (scratchDir, mode) => join(scratchDir, `gtd-mode-sample-${mode}-${process.pid}.md`);
-/**
-* The contradiction round-trip/skip-notice steps for `resolved`'s `mode:`.
-* No `formatCommand` means nothing to round-trip: empty. Otherwise: a live
-* built-in validator runs the round-trip against that format's own canonical
-* sample; an external validator prints a one-line skip notice instead, since
-* silence there would read as a clean bill of health; a format-only mode with
-* neither has nothing to round-trip either.
-*/
-const modeContradictionSteps = (resolved) => gen(function* () {
-	if (resolved.formatCommand === void 0) return [];
-	const { capabilities } = resolved;
-	if (capabilities.format !== void 0 && capabilities.liveValidate !== void 0) {
-		const { scratchDir } = yield* Host;
-		const samplePath = scratchSamplePath(scratchDir, resolved.mode);
-		const formatCommand = withFileVar$1(resolved.formatCommand, samplePath);
-		return [{
-			kind: "command",
-			command: buildModeContradictionCheck({
-				mode: resolved.mode,
-				samplePath,
-				sample: capabilities.format.sample,
-				formatCommand
-			})
-		}];
-	}
-	if (capabilities.externalValidate === true) return [{
-		kind: "command",
-		command: modeContradictionSkipNotice(resolved.mode)
-	}];
-	return [];
-});
-/**
-* Renders `resolved`'s complete validate script for `file`: the mode's
-* format/validate contradiction check, a guard for a not-yet-written file,
-* then the format/validate commands themselves (format first). gtd never
-* runs this script itself — `resolveMode`+`validateScriptFor` only render
-* text for a driver to execute (`gtd renders; the driver executes`).
-*/
-const validateScriptFor = (resolved, file) => gen(function* () {
-	return { script: emitScripts([
-		...yield* modeContradictionSteps(resolved),
-		{
-			kind: "command",
-			command: fileExistsGuard(file)
-		},
-		...modeCommandSteps(resolved, file)
-	]).required };
-});
-//#endregion
 //#region src/cli/ToolCommands.ts
 init_dist$1();
 /**
@@ -32753,7 +32996,7 @@ const runStraysCommand = (command, json, out) => gen(function* () {
 	const narrator = yield* Narrator;
 	const base = yield* resolveSide(git, command.base);
 	const tip = yield* resolveSide(git, command.tip);
-	const touched = yield* git.diffPaths(base, tip);
+	const touched = (yield* git.diffPaths(base, tip)).filter((path) => path !== PIN_PATH);
 	const strays = strayPaths(touched, command.globs);
 	const total = touched.length;
 	if (json.kind === "select") yield* writeSelection(out, strays, json.path).pipe(catchIf((error) => error instanceof SelectorUsageError && /^\d+$/.test(json.path), () => void_));
@@ -33655,8 +33898,7 @@ const startWorkflow = (workflow, varOverrides, json, out, commandLabel) => gen(f
 		workflow: resolved,
 		first: started,
 		commandLabel,
-		vars: varOverrides,
-		config: rest.config
+		vars: varOverrides
 	});
 	if (plan.kind === "refusal") return yield* fail$8(new Error(plan.message));
 	yield* writeScript(json, out, listingCommitted(landingScript(ScriptSurface.render(plan.steps)), rest.changes));
@@ -33768,6 +34010,10 @@ const runAbandonCommand = (json, out) => gen(function* () {
 			kind: "gitWrite",
 			command: mixedResetTo(run.startParentHash)
 		},
+		{
+			kind: "gitWrite",
+			command: unpinScript(PIN_PATH)
+		},
 		{
 			kind: "outcome",
 			command: abandonedOutcome(restState, run.startParentHash, initial)
@@ -33925,7 +34171,7 @@ const runCodeThreadsCheckCommand = () => gen(function* () {
 	if (rest.run.trace.length === 0) return;
 	const git = yield* GitService;
 	const workspace = yield* Workspace;
-	const lines = (yield* git.changedPaths(rest.run.diffBase)).filter((c) => c.status !== "D").flatMap(({ path }) => {
+	const lines = (yield* git.changedPaths(rest.run.diffBase)).filter((c) => c.status !== "D" && c.path !== ".gtd/process.gtdpin").flatMap(({ path }) => {
 		const { threads, findings } = parseCodeThreads(path, workspace.atPath(path) ?? "");
 		return [...threads.filter((t) => t.waitingOn === "human").map((t) => `${path}:${t.line + 1}: ${t.entries[0].text}`), ...findings.map((f) => `${path}:${(f.line ?? 0) + 1}: ${f.message}`)];
 	});
@@ -34655,6 +34901,7 @@ const flagHeader = (row) => {
 };
 const GLOBAL_OPTIONS = [
 	["-v, --verbose", "Narrate on stderr what gtd resolved"],
+	["--live", "Run this gtd, not the process's pin; it may misread the process"],
 	["-h, --help", "Print help; gtd <command> --help for one command"],
 	["-V, --version", "Print the version"],
 	["--", "End the options: every word after it is an argument"]
@@ -34666,7 +34913,7 @@ const EXTRA_TOPICS = [[
 ], [
 	"version",
 	"Print the version",
-	"Print gtd's version."
+	"Print gtd's version, and the version of a pinned process's gtd."
 ]];
 const EXAMPLES = `  $ gtd start                                   list what can start
   $ gtd start <name>                            start a process
@@ -35164,6 +35411,108 @@ const runCli = (argv, io) => {
 	}), provide(io.layers(plan.verbose)), sandbox, catch_((cause) => hasInterruptsOnly(cause) ? failCause$1(cause) : report(io, plan.json.kind !== "off")(cause)));
 };
 //#endregion
+//#region src/cli/Launch.ts
+/** What the core a pin carries lacks, or what must read the live state: these never hand over. */
+const LIVE_KINDS = /* @__PURE__ */ new Set([
+	"ui",
+	"lsp",
+	"guide",
+	"bundle",
+	"historyList",
+	"historyShow",
+	"historyMetrics",
+	"historyJudges",
+	"historyFetch"
+]);
+const LIVE_FLAG = "--live";
+const optionWords = (argv) => {
+	const end = argv.indexOf("--", 2);
+	return argv.slice(2, end < 0 ? void 0 : end);
+};
+const withoutLiveFlag = (argv) => {
+	const end = argv.indexOf("--", 2);
+	return argv.filter((word, i) => word !== LIVE_FLAG || i < 2 || end >= 0 && i > end);
+};
+/**
+* Whether this gtd runs the command or hands it to the process's pin. A pin
+* this gtd cannot run is refused, never guessed at; a usage error the live
+* parser finds is still the pin's to judge, since its engine may read
+* another CLI.
+*/
+const launchFor = (argv, pinFile) => {
+	if (globalThis[PIN_KEY] !== void 0) return {
+		kind: "live",
+		argv
+	};
+	const live = optionWords(argv).includes(LIVE_FLAG);
+	const rest = withoutLiveFlag(argv);
+	if (live) return {
+		kind: "live",
+		argv: rest
+	};
+	const plan = parseArgv(rest);
+	const version = plan.kind === "output" && plan.stdout === `${GTD_VERSION}\n`;
+	if (plan.kind === "output" && !version) return {
+		kind: "live",
+		argv: rest
+	};
+	if (plan.kind === "command" && LIVE_KINDS.has(plan.command.kind)) return {
+		kind: "live",
+		argv: rest
+	};
+	const found = pinFile();
+	if (found === void 0) return {
+		kind: "live",
+		argv: rest
+	};
+	const header = pinHeader(found.bytes);
+	if (version) return {
+		kind: "output",
+		stdout: header === void 0 ? plan.stdout : `${GTD_VERSION} (this process is pinned to gtd ${header.version})\n`
+	};
+	if (header === void 0 || header.format !== 1) {
+		const what = header === void 0 ? "is no pin this gtd can read" : `is pin format ${header.format}, made by gtd ${header.version}`;
+		return {
+			kind: "refuse",
+			message: `gtd: ${found.path} ${what}; gtd ${GTD_VERSION} runs pin format 1 — upgrade gtd (\`gtd --live\` runs this gtd instead, and may misread the process)`
+		};
+	}
+	return {
+		kind: "pin",
+		argv: rest,
+		path: found.path,
+		version: header.version,
+		source: () => readPin(found.bytes).source
+	};
+};
+const isJsonFlag = (word) => word === "--json" || word.startsWith("--json=");
+const refusalText = (argv, message) => (optionWords(argv).some(isJsonFlag) ? `${JSON.stringify({
+	state: "error",
+	prompt: message
+})}\n` : "") + `${message}\n`;
+const runPin = async (launch, launcher) => {
+	const words = optionWords(launch.argv);
+	if (words.includes("--verbose") || words.includes("-v")) launcher.stderr(`launcher: running the pin ${launch.path} (gtd ${launch.version})\n`);
+	try {
+		await launcher.pin(launch);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		launcher.stderr(`gtd: could not run the pin ${launch.path}: ${reason}\n`);
+		launcher.exit(1);
+	}
+};
+const runLauncher = async (argv, pinFile, launcher) => {
+	const launch = launchFor(argv, pinFile);
+	switch (launch.kind) {
+		case "live": return launcher.live(launch.argv);
+		case "output": return launcher.stdout(launch.stdout);
+		case "refuse":
+			launcher.stderr(refusalText(argv, launch.message));
+			return launcher.exit(1);
+		case "pin": return runPin(launch, launcher);
+	}
+};
+//#endregion
 //#region node_modules/@trpc/server/dist/codes-DagpWZLc.mjs
 /**
 * Ensures there are no duplicate keys when building a procedure.
@@ -51190,25 +51539,40 @@ const liveToolCommands = effect(ToolCommands, gen(function* () {
 //#endregion
 //#region src/main.ts
 init_dist$1();
-let deathSignal;
-process.once("SIGINT", () => {
-	deathSignal = "SIGINT";
-});
-process.once("SIGTERM", () => {
-	deathSignal ??= "SIGTERM";
-});
-process.once("SIGHUP", () => {
-	deathSignal = "SIGHUP";
-	process.kill(process.pid, "SIGTERM");
+const runLive = (argv) => {
+	let deathSignal;
+	process.once("SIGINT", () => {
+		deathSignal = "SIGINT";
+	});
+	process.once("SIGTERM", () => {
+		deathSignal ??= "SIGTERM";
+	});
+	process.once("SIGHUP", () => {
+		deathSignal = "SIGHUP";
+		process.kill(process.pid, "SIGTERM");
+	});
+	runMain(runCli(argv, nodeCliIo(liveToolCommands)), { teardown: (exit, onExit) => {
+		if (deathSignal === void 0) {
+			defaultTeardown(exit, onExit);
+			return;
+		}
+		const signal = deathSignal;
+		process.removeAllListeners(signal);
+		process.kill(process.pid, signal);
+	} });
+};
+await runLauncher(process.argv, livePinFile(process.cwd(), PIN_PATH), {
+	stdout: (chunk) => {
+		process.stdout.write(chunk);
+	},
+	stderr: (chunk) => {
+		process.stderr.write(chunk);
+	},
+	exit: (code) => {
+		process.exitCode = code;
+	},
+	live: runLive,
+	pin: (launch) => runPinModule(launch.path, launch.source())
 });
-runMain(runCli(process.argv, nodeCliIo(liveToolCommands)), { teardown: (exit, onExit) => {
-	if (deathSignal === void 0) {
-		defaultTeardown(exit, onExit);
-		return;
-	}
-	const signal = deathSignal;
-	process.removeAllListeners(signal);
-	process.kill(process.pid, signal);
-} });
 //#endregion
 export {};