@poetic-ai/poetic 1.42.1-bootstrap.0

package/dist/chunk-SSB5UQHA.js

@@ -0,0 +1,4128 @@
+import {
+  recordReadinessDiagnostic
+} from "./chunk-IDCSOZVN.js";
+import {
+  formatPreflightIssue,
+  runExecutionRolesPreflight
+} from "./chunk-S77XPALC.js";
+import {
+  detectHostConcurrencyBudget
+} from "./chunk-PYITM4N2.js";
+import {
+  RuntimeRequirements,
+  ensurePoeticInitialized,
+  resolveRepoRootForPoeticDir
+} from "./chunk-7XV3QXLT.js";
+import {
+  readProviderDryRunFreshness
+} from "./chunk-IKFP2KUR.js";
+import {
+  formatDurationMs
+} from "./chunk-F5JO7HAS.js";
+import {
+  KNOWLEDGE_BLOCK_BEGIN,
+  KNOWLEDGE_BLOCK_END,
+  describeDimension,
+  detectStack,
+  readIntentContract,
+  readKnowledgeManifest,
+  resolveIntent
+} from "./chunk-TK644IOG.js";
+import {
+  getAvailableMemoryGB
+} from "./chunk-PTH5E5XO.js";
+import {
+  ConfigManager
+} from "./chunk-GJTWJNLV.js";
+import {
+  loadAllItems
+} from "./chunk-3BCUNHKF.js";
+import {
+  getPlanningRoot
+} from "./chunk-OPYFYTWQ.js";
+import {
+  getBucketArchivePathByKind,
+  getBucketPathByKind
+} from "./chunk-HOYBYAOA.js";
+import {
+  discoverOpencode
+} from "./chunk-IC7I6YIJ.js";
+import {
+  isCiEnvironment
+} from "./chunk-A722DEVA.js";
+import {
+  hasStrictMcpConfigBeenProbed,
+  isStrictMcpConfigSupported,
+  probeStrictMcpConfig
+} from "./chunk-TIBZPAD2.js";
+import {
+  SETUP_CHECK_READINESS_OPTIONS,
+  getProviderReadiness,
+  isGateReadyProvider,
+  probeProviderCli,
+  readinessProbeContextForOptions,
+  resolveNamedReadiness,
+  resolveProviderParityLabel,
+  resolveReadinessScope
+} from "./chunk-25QL3M3L.js";
+import {
+  invalidateAuthOutcome,
+  lookupAuthOutcome,
+  recordAuthOutcome
+} from "./chunk-R6W23LKN.js";
+import {
+  normalizeEngineId,
+  resolveProviderCliCommand
+} from "./chunk-SURZ2WFE.js";
+import {
+  SCHEMA_VERSION,
+  checkSchemaVersion
+} from "./chunk-3733QTI7.js";
+import {
+  formatSandboxDegradedSummary
+} from "./chunk-5WCQRDRB.js";
+import {
+  atomicWriteJsonSync
+} from "./chunk-A3YGID55.js";
+import {
+  detectProjectCapabilities
+} from "./chunk-GNH3QGTL.js";
+import {
+  getRuntimeEnv
+} from "./chunk-ENRGKNR5.js";
+import {
+  BooleanFlagSchema,
+  validateCommandOptions
+} from "./chunk-QOCOVLUH.js";
+import {
+  ProviderRegistry,
+  getProviderConfig,
+  isConfigValidityError
+} from "./chunk-AT4TNPWW.js";
+import {
+  resolveProvidersConfigPath
+} from "./chunk-L6OM4A22.js";
+import {
+  getPackageRoot,
+  getRejectedPathEnvWarnings
+} from "./chunk-XZE4XARH.js";
+import {
+  POETIC_CODEX_BACKEND,
+  readEnv
+} from "./chunk-5DLKYTQX.js";
+
+// src/cli/commands/doctor.ts
+import * as fs5 from "fs/promises";
+import * as os from "os";
+import * as path10 from "path";
+import { fileURLToPath } from "url";
+import chalk2 from "chalk";
+import { Command as Command2 } from "commander";
+import { execa } from "execa";
+import { z as z3 } from "zod";
+
+// src/core/init-drift/fingerprint.ts
+import { createHash } from "crypto";
+import { readdirSync, readFileSync, statSync } from "fs";
+import path from "path";
+var STACK_FINGERPRINT_VERSION = 1;
+var STACK_FILE_NAMES = [
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "bun.lock",
+  "bun.lockb",
+  "pyproject.toml",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile",
+  "Pipfile.lock",
+  "go.mod",
+  "go.sum",
+  "Cargo.toml",
+  "Cargo.lock",
+  "Package.swift",
+  "Package.resolved",
+  "Gemfile",
+  "Gemfile.lock",
+  "composer.json",
+  "composer.lock",
+  "Dockerfile"
+];
+var REQUIREMENTS_PATTERN = /^requirements[\w.-]*\.(?:txt|in)$/i;
+var FRAMEWORK_SIGNAL_KEYS = [
+  "tsconfig",
+  "gradle",
+  "pomXml",
+  "cmakeLists",
+  "mesonBuild",
+  "dotnetSolution",
+  "dotnetProject",
+  "pubspecYaml",
+  "dbtProject",
+  "terraform",
+  "kubernetesManifests"
+];
+function hashFileContent(filePath) {
+  try {
+    const content = readFileSync(filePath);
+    return createHash("sha256").update(content).digest("hex");
+  } catch {
+    return void 0;
+  }
+}
+function listRootEntries(root) {
+  try {
+    return readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function isDirectoryEntry(root, entry) {
+  if (entry.isDirectory()) return true;
+  if (!entry.isSymbolicLink()) return false;
+  try {
+    return statSync(path.join(root, entry.name)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function sortedRecord(record) {
+  const out = {};
+  for (const key of Object.keys(record).sort()) {
+    const value = record[key];
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function computeStackFingerprint(cwd) {
+  const root = path.resolve(cwd);
+  const manifests = {};
+  const fileHashes = {};
+  const recordFile = (relativeName) => {
+    const hash = hashFileContent(path.join(root, relativeName));
+    if (hash === void 0) return;
+    manifests[relativeName] = true;
+    fileHashes[relativeName] = hash;
+  };
+  for (const name of STACK_FILE_NAMES) {
+    recordFile(name);
+  }
+  const rootEntries = listRootEntries(root);
+  for (const entry of rootEntries) {
+    if (REQUIREMENTS_PATTERN.test(entry.name) && !manifests[entry.name]) {
+      recordFile(entry.name);
+      continue;
+    }
+    if (/\.xcodeproj$/i.test(entry.name) && isDirectoryEntry(root, entry)) {
+      manifests[entry.name] = true;
+      const pbxprojRelative = path.join(entry.name, "project.pbxproj");
+      const hash = hashFileContent(path.join(root, pbxprojRelative));
+      if (hash !== void 0) fileHashes[pbxprojRelative] = hash;
+      continue;
+    }
+    if (/\.xcworkspace$/i.test(entry.name) && isDirectoryEntry(root, entry)) {
+      manifests[entry.name] = true;
+    }
+  }
+  const capabilities = detectProjectCapabilities(root);
+  const languages = [...capabilities.languages].sort();
+  const capabilityManifests = capabilities.manifests;
+  const frameworks = FRAMEWORK_SIGNAL_KEYS.filter(
+    (key) => capabilityManifests[key] === true
+  ).sort();
+  return {
+    version: STACK_FINGERPRINT_VERSION,
+    languages,
+    frameworks,
+    manifests: sortedRecord(manifests),
+    fileHashes: sortedRecord(fileHashes)
+  };
+}
+function fingerprintDigest(fingerprint) {
+  return createHash("sha256").update(JSON.stringify(fingerprint)).digest("hex");
+}
+
+// src/core/init-drift/state.ts
+import fs from "fs";
+import path2 from "path";
+var DEFAULT_NUDGE_CAP = 100;
+var DELIVERED_NUDGE_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+function resolveStateDir(cwd) {
+  return path2.join(path2.resolve(cwd), ".poetic", "state");
+}
+function resolveInitFingerprintPath(cwd) {
+  return path2.join(resolveStateDir(cwd), "init-fingerprint.json");
+}
+function resolveInitNudgesPath(cwd) {
+  return path2.join(resolveStateDir(cwd), "init-nudges.json");
+}
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeJsonFile(filePath, value) {
+  fs.mkdirSync(path2.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
+`, "utf-8");
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function readStoredFingerprint(cwd) {
+  const parsed = readJsonFile(resolveInitFingerprintPath(cwd));
+  if (!isRecord(parsed)) return void 0;
+  const fingerprint = parsed.fingerprint;
+  if (!isRecord(fingerprint)) return void 0;
+  if (!Array.isArray(fingerprint.languages) || !Array.isArray(fingerprint.frameworks) || !isRecord(fingerprint.manifests) || !isRecord(fingerprint.fileHashes)) {
+    return void 0;
+  }
+  const stored = fingerprint;
+  return {
+    fingerprint: stored,
+    digest: typeof parsed.digest === "string" ? parsed.digest : fingerprintDigest(stored),
+    recordedAtMs: typeof parsed.recordedAtMs === "number" ? parsed.recordedAtMs : 0
+  };
+}
+function writeStoredFingerprint(cwd, fingerprint, options = {}) {
+  const now = options.now ?? Date.now;
+  const file = {
+    version: 1,
+    digest: fingerprintDigest(fingerprint),
+    recordedAtMs: now(),
+    fingerprint
+  };
+  writeJsonFile(resolveInitFingerprintPath(cwd), file);
+}
+function isDriftRecord(value) {
+  if (!isRecord(value)) return false;
+  return typeof value.key === "string" && typeof value.kind === "string" && typeof value.subject === "string" && (value.change === "added" || value.change === "removed") && Array.isArray(value.evidence) && typeof value.detectedAtMs === "number";
+}
+function isDeliveryRecord(value) {
+  if (!isRecord(value)) return false;
+  return typeof value.key === "string" && typeof value.deliveredAtMs === "number" && typeof value.driftDetectedAtMs === "number";
+}
+function readNudgeState(cwd) {
+  const parsed = readJsonFile(resolveInitNudgesPath(cwd));
+  const state = { version: 1, drift: {}, deliveries: {} };
+  if (!isRecord(parsed)) return state;
+  if (isRecord(parsed.drift)) {
+    for (const [key, value] of Object.entries(parsed.drift)) {
+      if (isDriftRecord(value)) state.drift[key] = value;
+    }
+  }
+  if (isRecord(parsed.deliveries)) {
+    for (const [key, value] of Object.entries(parsed.deliveries)) {
+      if (isDeliveryRecord(value)) state.deliveries[key] = value;
+    }
+  }
+  return state;
+}
+function isDelivered(record, deliveries) {
+  const delivery = deliveries[record.key];
+  return delivery !== void 0 && delivery.driftDetectedAtMs === record.detectedAtMs;
+}
+function pruneNudgeState(state, nowMs, cap, ttlMs) {
+  const drift = {};
+  for (const [key, record] of Object.entries(state.drift)) {
+    if (isDelivered(record, state.deliveries)) {
+      const delivery = state.deliveries[key];
+      const age = nowMs - (delivery?.deliveredAtMs ?? nowMs);
+      if (age >= ttlMs) continue;
+    }
+    drift[key] = record;
+  }
+  const entries = Object.entries(drift);
+  if (entries.length > cap) {
+    const byOldestFirst = (a, b) => a[1].detectedAtMs - b[1].detectedAtMs;
+    const delivered = entries.filter(([, r]) => isDelivered(r, state.deliveries));
+    const undelivered = entries.filter(([, r]) => !isDelivered(r, state.deliveries));
+    delivered.sort(byOldestFirst);
+    undelivered.sort(byOldestFirst);
+    let excess = entries.length - cap;
+    for (const [key] of delivered) {
+      if (excess <= 0) break;
+      delete drift[key];
+      excess -= 1;
+    }
+    for (const [key] of undelivered) {
+      if (excess <= 0) break;
+      delete drift[key];
+      excess -= 1;
+    }
+  }
+  const deliveries = {};
+  for (const [key, delivery] of Object.entries(state.deliveries)) {
+    if (drift[key] !== void 0) deliveries[key] = delivery;
+  }
+  return { version: 1, drift, deliveries };
+}
+function writeNudgeState(cwd, state, options) {
+  const now = options.now ?? Date.now;
+  const cap = options.cap ?? DEFAULT_NUDGE_CAP;
+  const ttlMs = options.ttlMs ?? DELIVERED_NUDGE_TTL_MS;
+  writeJsonFile(resolveInitNudgesPath(cwd), pruneNudgeState(state, now(), cap, ttlMs));
+}
+function recordDriftRecords(cwd, records, options = {}) {
+  if (records.length === 0) return;
+  const state = readNudgeState(cwd);
+  for (const record of records) {
+    state.drift[record.key] = record;
+  }
+  writeNudgeState(cwd, state, options);
+}
+function listPendingDrift(cwd, options = {}) {
+  const now = options.now ?? Date.now;
+  const nowMs = now();
+  const state = readNudgeState(cwd);
+  return Object.values(state.drift).filter((record) => !isDelivered(record, state.deliveries)).sort((a, b) => a.detectedAtMs - b.detectedAtMs).map((record) => ({ ...record, ageMs: Math.max(0, nowMs - record.detectedAtMs) }));
+}
+function recordDelivery(cwd, keys, options = {}) {
+  if (keys.length === 0) return;
+  const now = options.now ?? Date.now;
+  const nowMs = now();
+  const state = readNudgeState(cwd);
+  let changed = false;
+  for (const key of keys) {
+    const record = state.drift[key];
+    if (record === void 0) continue;
+    state.deliveries[key] = {
+      key,
+      deliveredAtMs: nowMs,
+      driftDetectedAtMs: record.detectedAtMs
+    };
+    changed = true;
+  }
+  if (changed) writeNudgeState(cwd, state, options);
+}
+
+// src/core/init-drift/nudge.ts
+function diffSets(before, after) {
+  const beforeSet = new Set(before);
+  const afterSet = new Set(after);
+  return {
+    added: after.filter((item) => !beforeSet.has(item)),
+    removed: before.filter((item) => !afterSet.has(item))
+  };
+}
+function newManifests(stored, current) {
+  return Object.keys(current.manifests).filter((name) => stored.manifests[name] !== true);
+}
+function detectDrift(stored, current) {
+  const detectedAtMs = 0;
+  const records = [];
+  const appearedManifests = newManifests(stored, current);
+  const languages = diffSets(stored.languages, current.languages);
+  for (const language of languages.added) {
+    records.push({
+      key: `language:${language}`,
+      kind: "language-added",
+      subject: language,
+      change: "added",
+      evidence: appearedManifests,
+      detectedAtMs
+    });
+  }
+  for (const language of languages.removed) {
+    records.push({
+      key: `language:${language}`,
+      kind: "language-removed",
+      subject: language,
+      change: "removed",
+      evidence: [],
+      detectedAtMs
+    });
+  }
+  const frameworks = diffSets(stored.frameworks, current.frameworks);
+  for (const framework of frameworks.added) {
+    records.push({
+      key: `framework:${framework}`,
+      kind: "framework-changed",
+      subject: framework,
+      change: "added",
+      evidence: appearedManifests,
+      detectedAtMs
+    });
+  }
+  for (const framework of frameworks.removed) {
+    records.push({
+      key: `framework:${framework}`,
+      kind: "framework-changed",
+      subject: framework,
+      change: "removed",
+      evidence: [],
+      detectedAtMs
+    });
+  }
+  const explained = new Set(records.flatMap((record) => record.evidence));
+  for (const manifest of appearedManifests) {
+    if (explained.has(manifest)) continue;
+    records.push({
+      key: `manifest:${manifest}`,
+      kind: "manifest-appeared",
+      subject: manifest,
+      change: "added",
+      evidence: [manifest],
+      detectedAtMs
+    });
+  }
+  return records;
+}
+function checkDrift(cwd, options = {}) {
+  const now = options.now ?? Date.now;
+  const current = computeStackFingerprint(cwd);
+  const currentDigest = fingerprintDigest(current);
+  const stored = readStoredFingerprint(cwd);
+  if (stored === void 0) {
+    writeStoredFingerprint(cwd, current, options);
+    return {
+      hadBaseline: false,
+      newDrift: [],
+      pending: listPendingDrift(cwd, options),
+      currentDigest
+    };
+  }
+  if (stored.digest === currentDigest) {
+    return {
+      hadBaseline: true,
+      newDrift: [],
+      pending: listPendingDrift(cwd, options),
+      currentDigest
+    };
+  }
+  const nowMs = now();
+  const newDrift = detectDrift(stored.fingerprint, current).map((record) => ({
+    ...record,
+    detectedAtMs: nowMs
+  }));
+  if (newDrift.length > 0) {
+    recordDriftRecords(cwd, newDrift, options);
+  }
+  writeStoredFingerprint(cwd, current, options);
+  return {
+    hadBaseline: true,
+    newDrift,
+    pending: listPendingDrift(cwd, options),
+    currentDigest
+  };
+}
+var LANGUAGE_LABELS = {
+  python: { label: "Python", artifacts: "recommend Python docs/resources for coding agents" },
+  go: { label: "Go", artifacts: "recommend Go docs/resources for coding agents" },
+  rust: { label: "Rust", artifacts: "recommend Rust docs/resources for coding agents" },
+  swift: { label: "Swift", artifacts: "recommend Swift/Apple docs/resources for coding agents" },
+  typescript: {
+    label: "TypeScript",
+    artifacts: "recommend TypeScript docs/resources for coding agents"
+  },
+  javascript: {
+    label: "JavaScript",
+    artifacts: "recommend JavaScript docs/resources for coding agents"
+  },
+  node: { label: "Node.js", artifacts: "recommend Node.js docs/resources for coding agents" },
+  java: { label: "Java", artifacts: "recommend Java docs/resources for coding agents" },
+  kotlin: { label: "Kotlin", artifacts: "recommend Kotlin docs/resources for coding agents" },
+  ruby: { label: "Ruby", artifacts: "recommend Ruby docs/resources for coding agents" },
+  php: { label: "PHP", artifacts: "recommend PHP docs/resources for coding agents" },
+  dart: { label: "Dart", artifacts: "recommend Dart/Flutter docs/resources for coding agents" },
+  dotnet: { label: ".NET", artifacts: "recommend .NET docs/resources for coding agents" },
+  c: { label: "C", artifacts: "recommend C docs/resources for coding agents" },
+  cpp: { label: "C++", artifacts: "recommend C++ docs/resources for coding agents" }
+};
+function languageLabel(subject) {
+  return LANGUAGE_LABELS[subject] ?? {
+    label: subject,
+    artifacts: `recommend ${subject} docs/resources for coding agents`
+  };
+}
+function evidenceSuffix(record) {
+  if (record.evidence.length === 0) return "";
+  return ` (${record.evidence.join(", ")} added)`;
+}
+function composeNudgeMessage(record) {
+  const previewPromise = "Run 'poetic init' when ready \u2014 it will show you exactly what it proposes before changing anything.";
+  switch (record.kind) {
+    case "language-added": {
+      const { label, artifacts } = languageLabel(record.subject);
+      return `Notice: New since last check: ${label}${evidenceSuffix(record)}. Poetic can update the agent instructions (AGENTS.md) and ${artifacts}. ` + previewPromise;
+    }
+    case "language-removed": {
+      const { label } = languageLabel(record.subject);
+      return `Notice: Changed since last check: ${label} no longer detected in this repo. Poetic can update the agent instructions (AGENTS.md) and retire stale ${label} guidance for coding agents. ` + previewPromise;
+    }
+    case "framework-changed": {
+      const direction = record.change === "added" ? "added" : "removed";
+      return `Notice: Changed since last check: ${record.subject} toolchain signal ${direction}${evidenceSuffix(record)}. Poetic can update the agent instructions (AGENTS.md) and adjust the recommended docs/resources for coding agents. ` + previewPromise;
+    }
+    case "manifest-appeared":
+      return `Notice: New since last check: ${record.subject} appeared. Poetic can update the agent instructions (AGENTS.md) and recommend docs/resources matching the new stack surface. ` + previewPromise;
+  }
+}
+
+// src/core/init-drift/render.ts
+function shouldSuppressNudges(policy, options = {}) {
+  if (policy.json || policy.quiet) return true;
+  if (isCiEnvironment(options.env ?? process.env)) return true;
+  const stderrIsTty = options.stderrIsTty ?? Boolean(process.stderr.isTTY);
+  return !stderrIsTty;
+}
+function formatAge(ageMs) {
+  const days = Math.floor(ageMs / (24 * 60 * 60 * 1e3));
+  if (days >= 2) return `${days} days`;
+  if (days === 1) return "1 day";
+  const hours = Math.floor(ageMs / (60 * 60 * 1e3));
+  if (hours >= 1) return hours === 1 ? "1 hour" : `${hours} hours`;
+  return "less than an hour";
+}
+function defaultWriteLine(line) {
+  process.stderr.write(`${line}
+`);
+}
+function renderPendingNudges(cwd, streamPolicy, options = {}) {
+  const pending = listPendingDrift(cwd, options);
+  if (shouldSuppressNudges(streamPolicy, options)) {
+    return { rendered: false, deliveredKeys: [], pendingCount: pending.length };
+  }
+  if (pending.length === 0) {
+    return { rendered: false, deliveredKeys: [], pendingCount: 0 };
+  }
+  const writeLine = options.writeLine ?? defaultWriteLine;
+  for (const record of pending) {
+    const message = composeNudgeMessage(record);
+    const suffix = options.includeAge === true ? ` (not yet reviewed, ${formatAge(record.ageMs)})` : "";
+    writeLine(`${message}${suffix}`);
+  }
+  const deliveredKeys = pending.map((record) => record.key);
+  recordDelivery(cwd, deliveredKeys, options);
+  return { rendered: true, deliveredKeys, pendingCount: 0 };
+}
+function pendingNoticesCount(cwd, options = {}) {
+  return listPendingDrift(cwd, options).length;
+}
+
+// src/core/knowledge/doctor-checks.ts
+import { existsSync, readFileSync as readFileSync3 } from "fs";
+import { isIP } from "net";
+import path4 from "path";
+
+// src/core/knowledge/wrapper-visibility.ts
+import { lstatSync, readFileSync as readFileSync2 } from "fs";
+import path3 from "path";
+var WRAPPER_FILENAMES = ["CLAUDE.md", "GEMINI.md"];
+var MAX_WRAPPER_BYTES = 16e3;
+function isRegularFile(filePath) {
+  try {
+    return lstatSync(filePath).isFile();
+  } catch {
+    return false;
+  }
+}
+function readTextSafe(filePath, maxBytes = MAX_WRAPPER_BYTES) {
+  try {
+    return readFileSync2(filePath, "utf8").slice(0, maxBytes);
+  } catch {
+    return "";
+  }
+}
+var AGENTS_INCLUDE_PATTERN = /@\S*AGENTS\.md/;
+function checkWrapperVisibility(root) {
+  const resolved = path3.resolve(root);
+  if (!isRegularFile(path3.join(resolved, "AGENTS.md"))) {
+    return { applicable: false, wrappers: [] };
+  }
+  const wrappers = WRAPPER_FILENAMES.map((filename) => {
+    const wrapperPath = path3.join(resolved, filename);
+    if (!isRegularFile(wrapperPath)) {
+      return { filename, status: "missing" };
+    }
+    const content = readTextSafe(wrapperPath);
+    return {
+      filename,
+      status: AGENTS_INCLUDE_PATTERN.test(content) ? "visible" : "exists-no-reference"
+    };
+  });
+  return { applicable: true, wrappers };
+}
+
+// src/core/knowledge/doctor-checks.ts
+var DEFAULT_STALE_REF_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
+var BLOCKED_LINK_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "0.0.0.0",
+  "::",
+  "::1",
+  "metadata",
+  "metadata.google.internal",
+  "metadata.goog",
+  "kubernetes.default",
+  "kubernetes.default.svc"
+]);
+function isBlockedHostname(hostname) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (BLOCKED_LINK_HOSTNAMES.has(host)) return true;
+  if (host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) {
+    return true;
+  }
+  if (host.endsWith(".lan") || host.endsWith(".home") || host.endsWith(".corp")) {
+    return true;
+  }
+  return false;
+}
+function isBlockedIpv4(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+    return true;
+  }
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function ipv4FromHextets(high, low) {
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+function parseIpv4Hextets(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+    return void 0;
+  }
+  const [a, b, c, d] = parts;
+  return [a << 8 | b, c << 8 | d];
+}
+function parseIpv6Hextets(ip) {
+  if (!ip || ip.includes(":::")) return void 0;
+  const sides = ip.toLowerCase().split("::");
+  if (sides.length > 2) return void 0;
+  const parseSide = (side) => {
+    if (!side) return [];
+    const result = [];
+    for (const rawPart of side.split(":")) {
+      if (!rawPart) return void 0;
+      if (rawPart.includes(".")) {
+        const hextets = parseIpv4Hextets(rawPart);
+        if (!hextets) return void 0;
+        result.push(...hextets);
+        continue;
+      }
+      if (!/^[0-9a-f]{1,4}$/i.test(rawPart)) return void 0;
+      result.push(Number.parseInt(rawPart, 16));
+    }
+    return result;
+  };
+  const left = parseSide(sides[0] ?? "");
+  const right = parseSide(sides[1] ?? "");
+  if (!left || !right) return void 0;
+  if (sides.length === 1) {
+    return left.length === 8 ? left : void 0;
+  }
+  const zeroCount = 8 - left.length - right.length;
+  if (zeroCount < 1) return void 0;
+  return [...left, ...Array(zeroCount).fill(0), ...right];
+}
+function isBlockedIpv6(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "::" || normalized === "::1") return true;
+  const hextets = parseIpv6Hextets(normalized);
+  if (!hextets || hextets.length !== 8) return true;
+  const [first] = hextets;
+  if ((first & 65024) === 64512) return true;
+  if ((first & 65472) === 65152) return true;
+  const firstFiveZero = hextets.slice(0, 5).every((part) => part === 0);
+  const firstSixZero = firstFiveZero && hextets[5] === 0;
+  const embeddedIpv4 = ipv4FromHextets(hextets[6], hextets[7]);
+  if (firstFiveZero && hextets[5] === 65535 && isBlockedIpv4(embeddedIpv4)) {
+    return true;
+  }
+  if (firstSixZero && isBlockedIpv4(embeddedIpv4)) return true;
+  if (hextets[0] === 100 && hextets[1] === 65435 && hextets.slice(2, 6).every((p) => p === 0)) {
+    return isBlockedIpv4(embeddedIpv4);
+  }
+  return false;
+}
+function unsafeLinkProbeReason(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return "invalid URL";
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return `disallowed scheme ${url.protocol}`;
+  }
+  if (url.username || url.password) {
+    return "URL credentials not allowed";
+  }
+  let hostname = url.hostname.toLowerCase();
+  if (hostname.startsWith("[") && hostname.endsWith("]")) {
+    hostname = hostname.slice(1, -1);
+  }
+  if (!hostname) return "missing hostname";
+  if (isBlockedHostname(hostname)) return `blocked hostname ${hostname}`;
+  const ipVersion = isIP(hostname);
+  if (ipVersion === 4 && isBlockedIpv4(hostname)) {
+    return `blocked address ${hostname}`;
+  }
+  if (ipVersion === 6 && isBlockedIpv6(hostname)) {
+    return `blocked address ${hostname}`;
+  }
+  return void 0;
+}
+var MAX_LINK_PROBE_REDIRECTS = 5;
+var FOLLOWED_REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function redirectLocation(response) {
+  if (!FOLLOWED_REDIRECT_STATUSES.has(response.status)) return void 0;
+  const location = response.headers.get("location");
+  return location !== null && location.length > 0 ? location : void 0;
+}
+async function fetchWithScreenedRedirects(method, url, timeoutMs) {
+  const signal = AbortSignal.timeout(timeoutMs);
+  let current = url;
+  for (let hop = 0; hop <= MAX_LINK_PROBE_REDIRECTS; hop += 1) {
+    if (unsafeLinkProbeReason(current) !== void 0) return void 0;
+    const response = await fetch(current, { method, redirect: "manual", signal });
+    const location = redirectLocation(response);
+    if (location === void 0) return response;
+    try {
+      current = new URL(location, current).toString();
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+async function defaultProbeLink(url, timeoutMs) {
+  if (unsafeLinkProbeReason(url) !== void 0) return false;
+  try {
+    const response = await fetchWithScreenedRedirects("HEAD", url, timeoutMs);
+    if (response === void 0) return false;
+    if (response.status === 405 || response.status === 501) {
+      const getResponse = await fetchWithScreenedRedirects("GET", url, timeoutMs);
+      if (getResponse === void 0) return false;
+      return getResponse.status < 400;
+    }
+    return response.status < 400;
+  } catch {
+    return false;
+  }
+}
+function buildWrapperVisibilityFinding(root) {
+  const visibility = checkWrapperVisibility(root);
+  if (!visibility.applicable) return void 0;
+  const missing = visibility.wrappers.filter((w) => w.status === "missing");
+  const unreferenced = visibility.wrappers.filter(
+    (w) => w.status === "exists-no-reference"
+  );
+  if (missing.length === 0 && unreferenced.length === 0) return void 0;
+  const parts = [];
+  if (missing.length > 0) {
+    parts.push(
+      `${missing.map((w) => w.filename).join(" and ")} missing \u2014 agents will not load the kit. Create the wrapper(s) with: poetic generate-instructions --target claude --target gemini.`
+    );
+  }
+  if (unreferenced.length > 0) {
+    parts.push(
+      `${unreferenced.map((w) => w.filename).join(" and ")} exists but does not reference AGENTS.md \u2014 add \`@./AGENTS.md\` to the file manually (Poetic will not overwrite it).`
+    );
+  }
+  return {
+    id: "wrapper-not-visible",
+    severity: "info",
+    message: `AGENTS.md is present but not visible to all agents: ${parts.join(" ")}`
+  };
+}
+async function knowledgeDoctorChecks(cwd, options = {}) {
+  const root = path4.resolve(cwd);
+  const findings = [];
+  const manifestResult = readKnowledgeManifest(root);
+  if (manifestResult.status === "absent") {
+    return { manifestPresent: false, findings };
+  }
+  if (manifestResult.status === "invalid") {
+    findings.push({
+      id: "manifest-invalid",
+      severity: "error",
+      message: `.poetic/context/knowledge/manifest.json is invalid: ${manifestResult.error}`
+    });
+    return { manifestPresent: true, findings };
+  }
+  const manifest = manifestResult.manifest;
+  let detection = detectStack(root);
+  const intent = readIntentContract(root);
+  if (intent.status === "ok" && intent.contract.status !== "retired") {
+    const resolution = resolveIntent(detection, intent.contract);
+    detection = resolution.effective;
+    for (const conflict of resolution.conflicts) {
+      findings.push({
+        id: "stack-intent-conflict",
+        severity: "warn",
+        message: `Stack intent conflict: declared ${conflict.dimension.token} vs detected ${conflict.detectedToken}. Resolve at an interactive 'poetic init' (keep both / accept detected).`
+      });
+    }
+  }
+  if (detection.fingerprint !== manifest.stackFingerprint) {
+    findings.push({
+      id: "manifest-drift",
+      severity: "warn",
+      message: `The repo stack has changed since the knowledge kit was accepted (fingerprint ${manifest.stackFingerprint} -> ${detection.fingerprint}). Re-run 'poetic init' to review updated recommendations.`
+    });
+  }
+  const staleTtlMs = options.staleTtlMs ?? DEFAULT_STALE_REF_TTL_MS;
+  const nowMs = (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
+  for (const item of manifest.items) {
+    const itemDate = Date.parse(item.versionOrDate);
+    if (!Number.isFinite(itemDate)) continue;
+    if (nowMs - itemDate > staleTtlMs) {
+      const days = Math.floor((nowMs - itemDate) / (24 * 60 * 60 * 1e3));
+      findings.push({
+        id: "stale-ref",
+        severity: "info",
+        itemId: item.id,
+        message: `Knowledge item "${item.id}" was accepted ${days} days ago and may be stale.`
+      });
+    }
+  }
+  const agentsPath = path4.join(root, "AGENTS.md");
+  let agentsContent = "";
+  try {
+    agentsContent = existsSync(agentsPath) ? readFileSync3(agentsPath, "utf8") : "";
+  } catch {
+    agentsContent = "";
+  }
+  const hasBegin = agentsContent.includes(KNOWLEDGE_BLOCK_BEGIN);
+  const hasEnd = agentsContent.includes(KNOWLEDGE_BLOCK_END);
+  const blockValid = hasBegin && hasEnd && agentsContent.indexOf(KNOWLEDGE_BLOCK_END) >= agentsContent.indexOf(KNOWLEDGE_BLOCK_BEGIN);
+  if (!hasBegin && !hasEnd) {
+    findings.push({
+      id: "agents-block-missing",
+      severity: "warn",
+      message: "A knowledge manifest exists but AGENTS.md has no poetic-knowledge managed block. Re-run 'poetic init' to restore it."
+    });
+  } else if (hasBegin !== hasEnd || agentsContent.indexOf(KNOWLEDGE_BLOCK_END) < agentsContent.indexOf(KNOWLEDGE_BLOCK_BEGIN)) {
+    findings.push({
+      id: "agents-block-malformed",
+      severity: "error",
+      message: "AGENTS.md contains a malformed poetic-knowledge block (unpaired or out-of-order markers)."
+    });
+  }
+  if (blockValid) {
+    const wrapperFinding = buildWrapperVisibilityFinding(root);
+    if (wrapperFinding) findings.push(wrapperFinding);
+  }
+  if (options.checkLinks === true) {
+    const probe = options.probeLink ?? defaultProbeLink;
+    const timeoutMs = options.linkTimeoutMs ?? 1e4;
+    for (const item of manifest.items) {
+      const blocked = unsafeLinkProbeReason(item.sourceUrl);
+      if (blocked !== void 0) {
+        findings.push({
+          id: "dead-link",
+          severity: "warn",
+          itemId: item.id,
+          message: `Knowledge item "${item.id}" source URL was not probed (${blocked}): ${item.sourceUrl}`
+        });
+        continue;
+      }
+      const alive = await probe(item.sourceUrl, timeoutMs);
+      if (!alive) {
+        findings.push({
+          id: "dead-link",
+          severity: "warn",
+          itemId: item.id,
+          message: `Knowledge item "${item.id}" source URL appears unreachable: ${item.sourceUrl}`
+        });
+      }
+    }
+  }
+  return { manifestPresent: true, findings };
+}
+
+// src/core/knowledge/pending-notice.ts
+import { existsSync as existsSync2, readFileSync as readFileSync4, unlinkSync } from "fs";
+import path5 from "path";
+import { z } from "zod";
+var PENDING_OFFER_NOTICE_MESSAGE = "Knowledge kit: offer skipped (non-interactive session). Run poetic knowledge offer for a headless offer, or re-run poetic init in a terminal.";
+var PendingOfferNoticeSchema = z.object({
+  schemaVersion: z.literal(1),
+  skippedAt: z.string().min(1),
+  cause: z.union([z.literal("non-interactive"), z.literal("suppressed")]),
+  message: z.string().min(1)
+});
+function pendingOfferNoticePath(cwd) {
+  return path5.join(cwd, ".poetic", "state", "knowledge", "pending-offer-notice.json");
+}
+function writePendingOfferNotice(cwd, cause) {
+  const notice = {
+    schemaVersion: 1,
+    skippedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    cause,
+    message: PENDING_OFFER_NOTICE_MESSAGE
+  };
+  try {
+    atomicWriteJsonSync(pendingOfferNoticePath(cwd), notice);
+  } catch {
+  }
+}
+function readPendingOfferNotice(cwd) {
+  const filePath = pendingOfferNoticePath(cwd);
+  if (!existsSync2(filePath)) return void 0;
+  try {
+    const parsed = PendingOfferNoticeSchema.safeParse(JSON.parse(readFileSync4(filePath, "utf8")));
+    if (!parsed.success) return void 0;
+    return { ...parsed.data, message: PENDING_OFFER_NOTICE_MESSAGE };
+  } catch {
+    return void 0;
+  }
+}
+function clearPendingOfferNotice(cwd) {
+  try {
+    unlinkSync(pendingOfferNoticePath(cwd));
+  } catch {
+  }
+}
+
+// src/planning/archive-reconciliation.ts
+function hasArchivedMarker(item) {
+  const fm = item.frontMatter;
+  return typeof fm.archivedAt === "string" && fm.archivedAt.length > 0;
+}
+function indexById(items) {
+  const map = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    if (!map.has(item.id)) {
+      map.set(item.id, item);
+    }
+  }
+  return map;
+}
+function detectDuplicates(kind, active, archived) {
+  const archivedById = indexById(archived);
+  const issues = [];
+  for (const activeItem of active) {
+    const archivedMatch = archivedById.get(activeItem.id);
+    if (!archivedMatch) continue;
+    const preferred = hasArchivedMarker(archivedMatch) ? "archive" : hasArchivedMarker(activeItem) ? "active" : "archive";
+    issues.push({
+      kind,
+      id: activeItem.id,
+      activePath: activeItem.filePath,
+      archivePath: archivedMatch.filePath,
+      preferred
+    });
+  }
+  return issues;
+}
+function detectDanglingSprintMembership(sprints, activeTaskIds, archivedTaskIds) {
+  const issues = [];
+  for (const sprint of sprints) {
+    const taskIdsRaw = sprint.frontMatter.taskIds;
+    if (!Array.isArray(taskIdsRaw)) continue;
+    for (const taskId of taskIdsRaw) {
+      if (typeof taskId !== "string") continue;
+      if (activeTaskIds.has(taskId)) continue;
+      if (archivedTaskIds.has(taskId)) {
+        issues.push({ sprintId: sprint.id, taskId, reason: "archived-but-listed" });
+      } else {
+        issues.push({ sprintId: sprint.id, taskId, reason: "missing" });
+      }
+    }
+  }
+  return issues;
+}
+function detectOrphanedFollowups(backlogActive, backlogArchived) {
+  const knownBacklogIds = /* @__PURE__ */ new Set();
+  for (const item of [...backlogActive, ...backlogArchived]) {
+    knownBacklogIds.add(item.id);
+  }
+  const issues = [];
+  for (const item of backlogActive) {
+    const spawnedFrom = item.frontMatter.spawnedFrom;
+    if (typeof spawnedFrom !== "string" || spawnedFrom.length === 0) continue;
+    if (!knownBacklogIds.has(spawnedFrom)) {
+      issues.push({ followupId: item.id, parentId: spawnedFrom, followupPath: item.filePath });
+    }
+  }
+  return issues;
+}
+async function detectArchiveReconciliationIssues(planningRoot = getPlanningRoot()) {
+  const taskActiveDir = getBucketPathByKind("task", planningRoot);
+  const taskArchiveDir = getBucketArchivePathByKind("task", planningRoot);
+  const backlogActiveDir = getBucketPathByKind("backlog", planningRoot);
+  const backlogArchiveDir = getBucketArchivePathByKind("backlog", planningRoot);
+  const sprintActiveDir = getBucketPathByKind("sprint", planningRoot);
+  const [activeTasks, archivedTasks, activeBacklog, archivedBacklog, sprints] = await Promise.all([
+    loadAllItems(planningRoot, [taskActiveDir]),
+    loadAllItems(planningRoot, [taskArchiveDir]),
+    loadAllItems(planningRoot, [backlogActiveDir]),
+    loadAllItems(planningRoot, [backlogArchiveDir]),
+    loadAllItems(planningRoot, [sprintActiveDir])
+  ]);
+  const duplicateRecords = [
+    ...detectDuplicates("task", activeTasks, archivedTasks),
+    ...detectDuplicates("backlog", activeBacklog, archivedBacklog)
+  ];
+  const activeTaskIds = new Set(activeTasks.map((t) => t.id));
+  const archivedTaskIds = new Set(archivedTasks.map((t) => t.id));
+  const danglingSprintMembership = detectDanglingSprintMembership(
+    sprints,
+    activeTaskIds,
+    archivedTaskIds
+  );
+  const orphanedFollowups = detectOrphanedFollowups(activeBacklog, archivedBacklog);
+  return {
+    duplicateRecords,
+    danglingSprintMembership,
+    orphanedFollowups,
+    totalIssues: duplicateRecords.length + danglingSprintMembership.length + orphanedFollowups.length
+  };
+}
+function formatArchiveReconciliationReport(report) {
+  if (report.totalIssues === 0) return "";
+  const lines = [];
+  if (report.duplicateRecords.length > 0) {
+    lines.push(`Duplicate active+archive records: ${report.duplicateRecords.length}`);
+    for (const dup of report.duplicateRecords) {
+      lines.push(`  ${dup.kind} ${dup.id} (keep: ${dup.preferred})`);
+    }
+  }
+  if (report.danglingSprintMembership.length > 0) {
+    lines.push(`Dangling sprint membership: ${report.danglingSprintMembership.length}`);
+    for (const ref of report.danglingSprintMembership) {
+      lines.push(`  sprint ${ref.sprintId} -> ${ref.taskId} (${ref.reason})`);
+    }
+  }
+  if (report.orphanedFollowups.length > 0) {
+    lines.push(`Orphaned followups: ${report.orphanedFollowups.length}`);
+    for (const orphan of report.orphanedFollowups) {
+      lines.push(`  ${orphan.followupId} -> missing parent ${orphan.parentId}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/cli/commands/doctor-guard.ts
+import { promises as fs4 } from "fs";
+import * as path9 from "path";
+
+// src/core/guard-kit/kit-version.ts
+var GUARD_KIT_VERSION = "0.2.2";
+
+// src/core/guard-kit/state.ts
+import { createHash as createHash2 } from "crypto";
+import * as fs3 from "fs";
+import * as path8 from "path";
+
+// src/core/guard-kit/case-verify.ts
+import { execFileSync } from "child_process";
+import * as fs2 from "fs";
+import * as path7 from "path";
+
+// src/core/guard-kit/paths.ts
+import * as path6 from "path";
+var GUARD_DIR_REL = path6.join(".poetic", "guard");
+var CHECK_SCRIPT_REL = "check.mjs";
+var CONFIG_FILE_REL = "config.json";
+var LOCK_FILE_REL = "checks.lock";
+var SETUP_PLAYBOOK_REL = "GUARD_SETUP.md";
+var CI_WORKFLOW_TEMPLATE_FILE = "poetic-guard.yml.template";
+var BASELINES_DIR_REL = "baselines";
+var GENERATED_HASHED_FILES = [CHECK_SCRIPT_REL];
+function getGuardKitTemplatesDir() {
+  return path6.join(getPackageRoot(), "templates", "guard-kit");
+}
+
+// src/core/guard-kit/case-verify.ts
+var CANONICAL_GUARD_FILES = [
+  CHECK_SCRIPT_REL,
+  LOCK_FILE_REL,
+  CONFIG_FILE_REL,
+  BASELINES_DIR_REL
+];
+function toPosix(value) {
+  return value.replace(/\\/g, "/");
+}
+function findCaseVariantEntry(dir, expected) {
+  let entries;
+  try {
+    entries = fs2.readdirSync(dir);
+  } catch {
+    return null;
+  }
+  for (const entry of entries) {
+    if (entry !== expected && entry.toLowerCase() === expected.toLowerCase()) {
+      return entry;
+    }
+  }
+  return null;
+}
+function detectFilesystemCaseIssues(repoRoot) {
+  const issues = [];
+  const guardSegments = GUARD_DIR_REL.split(path7.sep);
+  let currentDir = repoRoot;
+  let relPrefix = "";
+  for (const segment of guardSegments) {
+    const variant = findCaseVariantEntry(currentDir, segment);
+    if (variant !== null) {
+      issues.push({
+        source: "filesystem",
+        actual: toPosix(path7.join(relPrefix, variant)),
+        expected: toPosix(path7.join(relPrefix, segment))
+      });
+    }
+    relPrefix = path7.join(relPrefix, segment);
+    currentDir = path7.join(currentDir, segment);
+  }
+  for (const name of CANONICAL_GUARD_FILES) {
+    const variant = findCaseVariantEntry(currentDir, name);
+    if (variant !== null) {
+      issues.push({
+        source: "filesystem",
+        actual: toPosix(path7.join(relPrefix, variant)),
+        expected: toPosix(path7.join(relPrefix, name))
+      });
+    }
+  }
+  return issues;
+}
+function detectGitCaseIssues(repoRoot) {
+  let stdout;
+  try {
+    stdout = execFileSync("git", ["ls-files", "-z"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024
+    });
+  } catch {
+    return [];
+  }
+  const guardPrefix = `${toPosix(GUARD_DIR_REL)}/`;
+  const guardPrefixLower = guardPrefix.toLowerCase();
+  const issues = [];
+  for (const raw of stdout.split("\0")) {
+    if (!raw) continue;
+    const tracked = toPosix(raw);
+    if (!tracked.toLowerCase().startsWith(guardPrefixLower)) continue;
+    if (tracked.startsWith(guardPrefix)) {
+      const rest = tracked.slice(guardPrefix.length);
+      const firstSegment = rest.split("/")[0] ?? "";
+      const canonical = CANONICAL_GUARD_FILES.find(
+        (name) => name !== firstSegment && name.toLowerCase() === firstSegment.toLowerCase()
+      );
+      if (canonical !== void 0) {
+        issues.push({
+          source: "git",
+          actual: tracked,
+          expected: `${guardPrefix}${canonical}${rest.slice(firstSegment.length)}`
+        });
+      }
+      continue;
+    }
+    issues.push({
+      source: "git",
+      actual: tracked,
+      expected: `${guardPrefix}${tracked.slice(guardPrefix.length)}`
+    });
+  }
+  return issues;
+}
+function detectGuardCaseIssues(repoRoot) {
+  const combined = [...detectFilesystemCaseIssues(repoRoot), ...detectGitCaseIssues(repoRoot)];
+  const seen = /* @__PURE__ */ new Set();
+  const issues = [];
+  for (const issue of combined) {
+    if (seen.has(issue.actual)) continue;
+    seen.add(issue.actual);
+    issues.push(issue);
+  }
+  return issues;
+}
+function repairGuardCaseIssues(repoRoot, issues) {
+  const repaired = [];
+  let remaining = [];
+  let pending = issues;
+  for (let round = 0; round < 5; round++) {
+    const result = repairPass(repoRoot, pending);
+    repaired.push(...result.repaired);
+    remaining = result.remaining;
+    if (result.repaired.length === 0) break;
+    const fresh = detectGuardCaseIssues(repoRoot);
+    if (fresh.length === 0) break;
+    const alreadyKnown = new Set(remaining.map((issue) => issue.actual));
+    pending = fresh.filter((issue) => !alreadyKnown.has(issue.actual));
+    if (pending.length === 0) break;
+  }
+  return { repaired, remaining };
+}
+function repairPass(repoRoot, issues) {
+  const repaired = [];
+  const remaining = [];
+  const ordered = [...issues].sort(
+    (a, b) => a.actual.split("/").length - b.actual.split("/").length
+  );
+  for (const issue of ordered) {
+    if (issue.source !== "filesystem") {
+      remaining.push(issue);
+      continue;
+    }
+    const actualAbs = path7.join(repoRoot, ...issue.actual.split("/"));
+    const expectedAbs = path7.join(repoRoot, ...issue.expected.split("/"));
+    const parent = path7.dirname(actualAbs);
+    const expectedName = path7.basename(expectedAbs);
+    let entries;
+    try {
+      entries = fs2.readdirSync(parent);
+    } catch {
+      remaining.push(issue);
+      continue;
+    }
+    if (entries.includes(expectedName)) {
+      remaining.push(issue);
+      continue;
+    }
+    try {
+      let tmp = `${actualAbs}.case-repair-tmp`;
+      let suffix = 0;
+      while (fs2.existsSync(tmp)) {
+        suffix += 1;
+        if (suffix > 100) throw new Error("no free temp name for case repair");
+        tmp = `${actualAbs}.case-repair-tmp${suffix}`;
+      }
+      fs2.renameSync(actualAbs, tmp);
+      fs2.renameSync(tmp, expectedAbs);
+      repaired.push(issue);
+    } catch {
+      remaining.push(issue);
+    }
+  }
+  return { repaired, remaining };
+}
+function formatGuardCaseIssues(issues) {
+  return issues.map(
+    (issue) => `Warning: guard path case mismatch (${issue.source}): ${issue.actual} should be ${issue.expected}. Rename to the exact casing (tracked paths need: git mv <actual> <expected>); case-insensitive filesystems silently merge these paths while CI sees them as distinct.`
+  );
+}
+
+// src/core/guard-kit/state.ts
+function sha256Hex(content) {
+  return createHash2("sha256").update(content).digest("hex");
+}
+function readLock(guardDir) {
+  const lockPath = path8.join(guardDir, LOCK_FILE_REL);
+  let raw;
+  try {
+    raw = fs3.readFileSync(lockPath, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.kitVersion !== "string" || typeof parsed.generatedAt !== "string" || typeof parsed.files !== "object" || parsed.files === null) {
+      return null;
+    }
+    const files = {};
+    const seenFolded = /* @__PURE__ */ new Set();
+    for (const [file, hash] of Object.entries(parsed.files)) {
+      if (typeof hash !== "string") return null;
+      const folded = file.toLowerCase();
+      if (seenFolded.has(folded)) return null;
+      seenFolded.add(folded);
+      files[file] = hash;
+    }
+    if (!(CHECK_SCRIPT_REL in files)) return null;
+    return { kitVersion: parsed.kitVersion, generatedAt: parsed.generatedAt, files };
+  } catch {
+    return null;
+  }
+}
+function compareKitVersions(a, b) {
+  const partsA = a.split(".").map((segment) => Number.parseInt(segment, 10) || 0);
+  const partsB = b.split(".").map((segment) => Number.parseInt(segment, 10) || 0);
+  const length = Math.max(partsA.length, partsB.length);
+  for (let index = 0; index < length; index++) {
+    const diff = (partsA[index] ?? 0) - (partsB[index] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function classifyGuardState(repoRoot) {
+  const bundledVersion = GUARD_KIT_VERSION;
+  const guardDir = path8.join(repoRoot, GUARD_DIR_REL);
+  const caseIssues = detectGuardCaseIssues(repoRoot);
+  const caseMessages = formatGuardCaseIssues(caseIssues);
+  const base = (state, extra = {}) => {
+    const report = {
+      state,
+      bundledVersion,
+      mismatchedFiles: [],
+      missingFiles: [],
+      messages: [],
+      caseIssues,
+      ...extra
+    };
+    report.messages = [...report.messages, ...caseMessages];
+    return report;
+  };
+  if (caseIssues.length > 0) {
+    return base("partial", {
+      messages: [
+        "Warning: guard kit path casing diverges from the canonical .poetic/guard layout; the trusted-base CI extraction will fail."
+      ]
+    });
+  }
+  if (!fs3.existsSync(guardDir)) {
+    return base("absent", {
+      messages: ["Info: guard kit not installed (.poetic/guard/ absent)."]
+    });
+  }
+  const lock = readLock(guardDir);
+  if (!lock) {
+    return base("partial", {
+      messages: ["Warning: guard kit lock (.poetic/guard/checks.lock) is missing or invalid."]
+    });
+  }
+  const mismatchedFiles = [];
+  const missingFiles = [];
+  const guardDirResolved = path8.resolve(guardDir);
+  for (const [file, expected] of Object.entries(lock.files)) {
+    const filePath = path8.resolve(guardDirResolved, file);
+    if (filePath !== guardDirResolved && !filePath.startsWith(guardDirResolved + path8.sep)) {
+      return base("partial", {
+        installedVersion: lock.kitVersion,
+        messages: [
+          `Warning: guard kit lock names a path outside .poetic/guard (${file}); the lock is invalid.`
+        ]
+      });
+    }
+    let content;
+    try {
+      content = fs3.readFileSync(filePath);
+    } catch {
+      missingFiles.push(file);
+      continue;
+    }
+    const actual = `sha256:${sha256Hex(content)}`;
+    if (actual !== expected) mismatchedFiles.push(file);
+  }
+  if (missingFiles.length > 0) {
+    return base("partial", {
+      installedVersion: lock.kitVersion,
+      missingFiles: missingFiles.sort(),
+      mismatchedFiles: mismatchedFiles.sort(),
+      messages: [
+        `Warning: guard kit is missing generated files: ${missingFiles.sort().join(", ")}.`
+      ]
+    });
+  }
+  if (mismatchedFiles.length > 0) {
+    return base("tampered", {
+      installedVersion: lock.kitVersion,
+      mismatchedFiles: mismatchedFiles.sort(),
+      messages: [
+        `Warning: guard kit generated files were hand-edited: ${mismatchedFiles.sort().join(", ")}.`
+      ]
+    });
+  }
+  const versionDelta = compareKitVersions(lock.kitVersion, bundledVersion);
+  if (versionDelta < 0) {
+    return base("upgradable", {
+      installedVersion: lock.kitVersion,
+      messages: [`Info: guard kit ${lock.kitVersion} installed; ${bundledVersion} available.`]
+    });
+  }
+  if (versionDelta > 0) {
+    return base("current", {
+      installedVersion: lock.kitVersion,
+      messages: [
+        `Info: guard kit ${lock.kitVersion} is newer than this Poetic's bundled ${bundledVersion}; leaving it untouched.`
+      ]
+    });
+  }
+  return base("current", {
+    installedVersion: lock.kitVersion,
+    messages: [`OK: guard kit ${lock.kitVersion} is current.`]
+  });
+}
+
+// src/cli/commands/doctor-guard.ts
+var GUARD_DIR_REL2 = path9.join(".poetic", "guard");
+var GUARD_LOCK_REL = path9.join(GUARD_DIR_REL2, "checks.lock");
+var GUARD_BASELINES_REL = path9.join(GUARD_DIR_REL2, "baselines");
+var INIT_INSTALL_CMD = "poetic init --guardrails";
+var INIT_REINSTALL_CMD = "poetic init --guardrails --reinstall-guard";
+async function readGuardLock(repoRoot) {
+  try {
+    const raw = await fs4.readFile(path9.join(repoRoot, GUARD_LOCK_REL), "utf8");
+    const parsed = JSON.parse(raw);
+    const version = typeof parsed.version === "string" ? parsed.version : typeof parsed.kitVersion === "string" ? parsed.kitVersion : typeof parsed.kit_version === "string" ? parsed.kit_version : void 0;
+    const container = parsed.files ?? parsed.hashes;
+    let files = [];
+    if (Array.isArray(container)) {
+      files = container.filter((f) => typeof f === "string");
+    } else if (container && typeof container === "object") {
+      files = Object.keys(container);
+    }
+    return { version, files };
+  } catch {
+    return null;
+  }
+}
+function collectZeroCountKeys(value, prefix, out) {
+  if (typeof value === "number") {
+    if (value === 0) out.push(prefix);
+    return;
+  }
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    for (const [key, child] of Object.entries(value)) {
+      const next = prefix ? `${prefix}.${key}` : key;
+      collectZeroCountKeys(child, next, out);
+    }
+  }
+}
+async function scanPromotableBaselineKeys(repoRoot) {
+  const baselinesDir = path9.join(repoRoot, GUARD_BASELINES_REL);
+  let entries;
+  try {
+    entries = await fs4.readdir(baselinesDir);
+  } catch {
+    return [];
+  }
+  const promotable = [];
+  for (const entry of entries) {
+    if (!entry.endsWith(".json")) continue;
+    try {
+      const raw = await fs4.readFile(path9.join(baselinesDir, entry), "utf8");
+      const parsed = JSON.parse(raw);
+      const keys = [];
+      collectZeroCountKeys(parsed, "", keys);
+      const baselineName = entry.replace(/\.json$/, "");
+      for (const key of keys) promotable.push(key ? `${baselineName}:${key}` : baselineName);
+    } catch {
+    }
+  }
+  return promotable;
+}
+var defaultGuardInspector = async (repoRoot) => {
+  const state = classifyGuardState(repoRoot).state;
+  const lock = await readGuardLock(repoRoot);
+  const promotableBaselineKeys = await scanPromotableBaselineKeys(repoRoot);
+  return {
+    state,
+    bundledVersion: GUARD_KIT_VERSION,
+    installedVersion: lock?.version,
+    generatedFiles: lock?.files,
+    promotableBaselineKeys
+  };
+};
+async function checkGuardrails(repoRoot, options = {}) {
+  const inspect = options.inspect ?? defaultGuardInspector;
+  let inspection;
+  try {
+    inspection = await inspect(repoRoot);
+  } catch (error) {
+    return [
+      {
+        name: "Guardrails",
+        category: "guardrails",
+        status: "info",
+        message: "guardrail kit status unavailable",
+        details: error instanceof Error ? error.message : String(error)
+      }
+    ];
+  }
+  if (!inspection) {
+    return [
+      {
+        name: "Guardrails",
+        category: "guardrails",
+        status: "info",
+        message: "guardrail kit module unavailable",
+        details: "Guard kit could not be loaded in this install; guardrails status is unknown."
+      }
+    ];
+  }
+  const checks = [checkForState(inspection)];
+  const promotable = inspection.promotableBaselineKeys ?? [];
+  if (promotable.length > 0) {
+    checks.push({
+      name: "Guard Baselines",
+      category: "guardrails",
+      status: "info",
+      message: `${promotable.length} baseline key(s) promotable`,
+      details: `Zero-count keys ready to promote: ${promotable.join(", ")}`
+    });
+  }
+  return checks;
+}
+function checkForState(inspection) {
+  const { state, bundledVersion, installedVersion, generatedFiles } = inspection;
+  switch (state) {
+    case "absent":
+      return {
+        name: "Guardrails",
+        category: "guardrails",
+        status: "info",
+        message: "guardrail kit not installed",
+        details: `Optional: install the read-only guardrail kit with "${INIT_INSTALL_CMD}".`
+      };
+    case "current":
+      return {
+        name: "Guardrails",
+        category: "guardrails",
+        status: "pass",
+        message: `guardrail kit current (version ${installedVersion ?? bundledVersion})`
+      };
+    case "upgradable":
+      return {
+        name: "Guardrails",
+        category: "guardrails",
+        status: "info",
+        message: `guardrail kit upgradable (installed ${installedVersion ?? "unknown"}, bundled ${bundledVersion})`,
+        details: `Run "${INIT_INSTALL_CMD}" to upgrade the generated guard files (config.json is preserved).`
+      };
+    case "tampered":
+      return {
+        name: "Guardrails",
+        category: "guardrails",
+        status: "warn",
+        message: "guardrail kit modified (hash mismatch)",
+        details: formatMismatchDetails(generatedFiles)
+      };
+    case "partial":
+      return {
+        name: "Guardrails",
+        category: "guardrails",
+        status: "warn",
+        message: "guardrail kit incomplete (missing lock or generated files)",
+        details: formatMismatchDetails(generatedFiles)
+      };
+  }
+}
+function formatMismatchDetails(generatedFiles) {
+  const suffix = `Run "${INIT_REINSTALL_CMD}" to restore the generated guard files.`;
+  if (generatedFiles && generatedFiles.length > 0) {
+    return `Generated guard files: ${generatedFiles.join(", ")}. ${suffix}`;
+  }
+  return suffix;
+}
+
+// src/cli/commands/doctor-metrics.ts
+import chalk from "chalk";
+import { Command } from "commander";
+import { z as z2 } from "zod";
+async function loadTelemetryHealthTracker() {
+  const mod = await import("./telemetry-health-tracker-DMSSGBZ2.js");
+  return mod.TelemetryHealthTracker;
+}
+var DoctorMetricsOptionsSchema = z2.object({
+  json: BooleanFlagSchema.optional(),
+  prometheus: BooleanFlagSchema.optional(),
+  verbose: BooleanFlagSchema.optional()
+}).strict();
+var DoctorMetricsMonitorOptionsSchema = z2.object({
+  interval: z2.number().optional(),
+  json: BooleanFlagSchema.optional(),
+  prometheus: BooleanFlagSchema.optional()
+}).strict();
+function buildUnavailableHealthMetrics() {
+  return {
+    queueDepth: 0,
+    fallbackMode: false,
+    errorRate: 0,
+    databaseHealthy: false,
+    lastErrorTimestamp: null,
+    errorsLastHour: 0,
+    unresolvedErrors: 0
+  };
+}
+function isHealthSchemaPresent(db) {
+  const row = db.prepare(
+    "SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'telemetry_errors' LIMIT 1"
+  ).get();
+  return row !== void 0;
+}
+async function openTelemetryDb() {
+  const { openConfiguredTelemetryDb } = await import("./storage-access-F6ALDN4S.js");
+  const TelemetryHealthTracker = await loadTelemetryHealthTracker();
+  const readonlyResult = openConfiguredTelemetryDb();
+  if (!readonlyResult.db) {
+    return readonlyResult;
+  }
+  const { dbPath } = readonlyResult;
+  if (isHealthSchemaPresent(readonlyResult.db)) {
+    return readonlyResult;
+  }
+  readonlyResult.db.close();
+  const writableResult = openConfiguredTelemetryDb({ writable: true });
+  if (!writableResult.db) {
+    return writableResult;
+  }
+  try {
+    new TelemetryHealthTracker(writableResult.db);
+  } catch (error) {
+    writableResult.db.close();
+    return {
+      db: null,
+      dbPath,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+  writableResult.db.close();
+  return openConfiguredTelemetryDb();
+}
+function readDoctorMetricsOptions(command) {
+  const globals = command.optsWithGlobals();
+  return validateCommandOptions(DoctorMetricsOptionsSchema, {
+    json: globals.json,
+    prometheus: globals.prometheus,
+    verbose: globals.verbose
+  });
+}
+async function collectHealthMetrics(db) {
+  const TelemetryHealthTracker = await loadTelemetryHealthTracker();
+  const tracker = new TelemetryHealthTracker(db);
+  const queueDepth = 0;
+  const fallbackMode = false;
+  const health = tracker.getHealthMetrics(queueDepth, fallbackMode);
+  const metrics = {
+    queueDepth: health.queue_depth,
+    fallbackMode: health.fallback_mode_active,
+    errorRate: health.error_rate,
+    databaseHealthy: health.database_healthy,
+    lastErrorTimestamp: health.last_error_timestamp || null,
+    errorsLastHour: health.errors_last_hour,
+    unresolvedErrors: health.unresolved_errors
+  };
+  try {
+    const mttr = tracker.calculateMTTR(24);
+    metrics.mttr = {
+      meanTimeToResolution: Math.round(mttr.mean_time_to_resolution),
+      p50: Math.round(mttr.p50_resolution_time),
+      p95: Math.round(mttr.p95_resolution_time),
+      p99: Math.round(mttr.p99_resolution_time),
+      resolutionRate: mttr.resolution_rate,
+      errorCount24h: mttr.error_count_last_24h
+    };
+  } catch (_error) {
+  }
+  return metrics;
+}
+function formatMetricsJson(metrics, extras = {}) {
+  const pathEnvWarnings = getRejectedPathEnvWarnings();
+  return JSON.stringify(
+    {
+      status: getHealthStatus(metrics),
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      uptime: Math.floor(process.uptime()),
+      metrics,
+      ...extras.telemetryDb ? { telemetryDb: extras.telemetryDb } : {},
+      ...extras.databaseError ? { databaseError: extras.databaseError } : {},
+      ...pathEnvWarnings.length > 0 ? { pathEnvWarnings } : {}
+    },
+    null,
+    2
+  );
+}
+function formatMetricsPrometheus(metrics) {
+  const lines = [];
+  lines.push("# HELP poetic_error_rate Error rate as decimal (0.0-1.0)");
+  lines.push("# TYPE poetic_error_rate gauge");
+  lines.push(`poetic_error_rate ${metrics.errorRate.toFixed(4)}`);
+  lines.push("# HELP poetic_database_healthy Database health status (1=healthy, 0=unhealthy)");
+  lines.push("# TYPE poetic_database_healthy gauge");
+  lines.push(`poetic_database_healthy ${metrics.databaseHealthy ? 1 : 0}`);
+  lines.push("# HELP poetic_errors_last_hour Number of errors in last hour");
+  lines.push("# TYPE poetic_errors_last_hour gauge");
+  lines.push(`poetic_errors_last_hour ${metrics.errorsLastHour}`);
+  lines.push("# HELP poetic_unresolved_errors Number of unresolved errors");
+  lines.push("# TYPE poetic_unresolved_errors gauge");
+  lines.push(`poetic_unresolved_errors ${metrics.unresolvedErrors}`);
+  if (metrics.mttr) {
+    lines.push("# HELP poetic_mttr_ms Mean time to resolution in milliseconds");
+    lines.push("# TYPE poetic_mttr_ms gauge");
+    lines.push(`poetic_mttr_ms ${metrics.mttr.meanTimeToResolution}`);
+    lines.push("# HELP poetic_mttr_p50_ms 50th percentile time to resolution (ms)");
+    lines.push("# TYPE poetic_mttr_p50_ms gauge");
+    lines.push(`poetic_mttr_p50_ms ${metrics.mttr.p50}`);
+    lines.push("# HELP poetic_mttr_p95_ms 95th percentile time to resolution (ms)");
+    lines.push("# TYPE poetic_mttr_p95_ms gauge");
+    lines.push(`poetic_mttr_p95_ms ${metrics.mttr.p95}`);
+    lines.push("# HELP poetic_mttr_p99_ms 99th percentile time to resolution (ms)");
+    lines.push("# TYPE poetic_mttr_p99_ms gauge");
+    lines.push(`poetic_mttr_p99_ms ${metrics.mttr.p99}`);
+    lines.push("# HELP poetic_resolution_rate Error resolution rate (0.0-1.0)");
+    lines.push("# TYPE poetic_resolution_rate gauge");
+    lines.push(`poetic_resolution_rate ${metrics.mttr.resolutionRate.toFixed(4)}`);
+    lines.push("# HELP poetic_error_count_24h Error count in last 24 hours");
+    lines.push("# TYPE poetic_error_count_24h gauge");
+    lines.push(`poetic_error_count_24h ${metrics.mttr.errorCount24h}`);
+  }
+  lines.push(`# Generated at ${(/* @__PURE__ */ new Date()).toISOString()}`);
+  return `${lines.join("\n")}
+`;
+}
+function formatMetricsTable(metrics, verbose = false) {
+  const lines = [];
+  lines.push(chalk.bold.cyan("\nPoetic Telemetry Metrics\n"));
+  const status = getHealthStatus(metrics);
+  const statusColor = status === "healthy" ? chalk.green : status === "degraded" ? chalk.yellow : chalk.red;
+  const statusIcon = status === "healthy" ? "OK" : status === "degraded" ? "Warning: " : "Error";
+  lines.push(
+    `${statusColor(statusIcon)} Status:                ${statusColor(status.toUpperCase())}`
+  );
+  lines.push(`Error Rate:           ${(metrics.errorRate * 100).toFixed(2)}%`);
+  lines.push(
+    `${metrics.databaseHealthy ? "OK" : "Error"} Database:             ${metrics.databaseHealthy ? chalk.green("Healthy") : chalk.red("Unhealthy")}`
+  );
+  if (metrics.errorsLastHour > 0) {
+    lines.push(chalk.yellow(`Warning: Errors (last hour):   ${metrics.errorsLastHour}`));
+  } else {
+    lines.push("OK Errors (last hour):    0");
+  }
+  if (metrics.unresolvedErrors > 0) {
+    lines.push(chalk.yellow(`Warning: Unresolved:           ${metrics.unresolvedErrors}`));
+  } else {
+    lines.push("OK Unresolved:            0");
+  }
+  if (verbose && metrics.lastErrorTimestamp) {
+    const lastErrorTime = new Date(metrics.lastErrorTimestamp);
+    const minutesAgo = Math.floor((Date.now() - lastErrorTime.getTime()) / 6e4);
+    lines.push(`Last Error:           ${minutesAgo} minutes ago`);
+  }
+  if (verbose && metrics.mttr) {
+    lines.push(chalk.bold.cyan("\nResolution Metrics (24h)\n"));
+    lines.push(
+      `Time: MTTR (mean):          ${formatDurationMs(metrics.mttr.meanTimeToResolution)}`
+    );
+    lines.push(`MTTR (P50):           ${formatDurationMs(metrics.mttr.p50)}`);
+    lines.push(`MTTR (P95):           ${formatDurationMs(metrics.mttr.p95)}`);
+    lines.push(`MTTR (P99):           ${formatDurationMs(metrics.mttr.p99)}`);
+    lines.push(`OK Resolution Rate:      ${(metrics.mttr.resolutionRate * 100).toFixed(1)}%`);
+    lines.push(`Error Count (24h):    ${metrics.mttr.errorCount24h}`);
+  }
+  if (verbose && metrics.lastErrorTimestamp) {
+    lines.push(chalk.bold.cyan("\nDetails\n"));
+    lines.push(`Last Error: ${metrics.lastErrorTimestamp}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function getHealthStatus(metrics) {
+  if (!metrics.databaseHealthy) {
+    return "unhealthy";
+  }
+  if (metrics.errorRate > 0.1 || metrics.unresolvedErrors > 0) {
+    return "degraded";
+  }
+  return "healthy";
+}
+async function displayDatabaseStatus(options = {}) {
+  const { db, dbPath, error } = await openTelemetryDb();
+  if (!db) {
+    const metrics = buildUnavailableHealthMetrics();
+    if (options.json) {
+      console.log(
+        formatMetricsJson(metrics, {
+          telemetryDb: dbPath,
+          databaseError: error ?? "Telemetry database unavailable"
+        })
+      );
+      process.exit(1);
+    }
+    console.log(chalk.yellow(`Warning: ${error ?? "Telemetry database not found"}`));
+    console.log(`  Path: ${dbPath}`);
+    console.log("  Run: poetic init");
+    process.exit(1);
+  }
+  try {
+    const metrics = await collectHealthMetrics(db);
+    if (options.json) {
+      console.log(formatMetricsJson(metrics, { telemetryDb: dbPath }));
+    } else if (options.prometheus) {
+      console.log(formatMetricsPrometheus(metrics));
+    } else {
+      console.log(formatMetricsTable(metrics, options.verbose ?? false));
+    }
+  } catch (error2) {
+    if (options.json) {
+      const metrics = buildUnavailableHealthMetrics();
+      console.log(
+        formatMetricsJson(metrics, {
+          telemetryDb: dbPath,
+          databaseError: error2 instanceof Error ? error2.message : String(error2)
+        })
+      );
+      process.exit(1);
+    }
+    console.error(
+      chalk.red("Failed to collect health metrics:"),
+      error2 instanceof Error ? error2.message : String(error2)
+    );
+    process.exit(1);
+  } finally {
+    db.close();
+  }
+}
+async function monitorHealth(options) {
+  const { db, dbPath, error } = await openTelemetryDb();
+  if (!db) {
+    if (options.json) {
+      const metrics = buildUnavailableHealthMetrics();
+      console.log(
+        formatMetricsJson(metrics, {
+          telemetryDb: dbPath,
+          databaseError: error ?? "Telemetry database unavailable"
+        })
+      );
+      process.exit(1);
+    }
+    console.log(chalk.yellow(`Warning: ${error ?? "Telemetry database not found"}`));
+    console.log(`  Path: ${dbPath}`);
+    console.log("  Run: poetic init");
+    return;
+  }
+  const interval = (options.interval || 2) * 1e3;
+  const isJson = options.json || false;
+  const isPrometheus = options.prometheus || false;
+  try {
+    while (true) {
+      const metrics = await collectHealthMetrics(db);
+      if (isJson) {
+        console.log(formatMetricsJson(metrics));
+      } else if (isPrometheus) {
+        console.log(formatMetricsPrometheus(metrics));
+      } else {
+        console.clear?.();
+        console.log(formatMetricsTable(metrics, false));
+      }
+      await new Promise((resolve2) => setTimeout(resolve2, interval));
+    }
+  } catch (error2) {
+    console.error(
+      chalk.red("Error Monitoring error:"),
+      error2 instanceof Error ? error2.message : String(error2)
+    );
+    process.exit(1);
+  } finally {
+    db.close();
+  }
+}
+function createDoctorMetricsCommand() {
+  const metricsCmd = new Command("metrics");
+  metricsCmd.description(
+    "Monitor telemetry-derived operational metrics (not the install doctor)\n\nNote: For install / provider auth diagnostics use `poetic doctor`.\n`poetic doctor metrics` reports runtime telemetry from the local SQLite store.\n\nExamples:\n  poetic doctor metrics                    # Show metrics status\n  poetic doctor metrics --json             # Output as JSON\n  poetic doctor metrics --prometheus       # Prometheus format\n  poetic doctor metrics monitor            # Real-time monitoring\n  poetic doctor metrics monitor --interval 5  # Update every 5 seconds"
+  );
+  const checkCmd = new Command("check");
+  checkCmd.description("Run telemetry metrics check and display results");
+  checkCmd.option("--json", "Output as JSON");
+  checkCmd.option("--prometheus", "Output in Prometheus text format");
+  checkCmd.option("-v, --verbose", "Show detailed information");
+  checkCmd.action(async function() {
+    const validatedOptions = readDoctorMetricsOptions(this);
+    const { db, dbPath, error } = await openTelemetryDb();
+    if (!db) {
+      const metrics = buildUnavailableHealthMetrics();
+      if (validatedOptions.json) {
+        console.log(
+          formatMetricsJson(metrics, {
+            telemetryDb: dbPath,
+            databaseError: error ?? "Telemetry database unavailable"
+          })
+        );
+        process.exit(1);
+      }
+      console.log(chalk.yellow(`Warning: ${error ?? "Telemetry database not found"}`));
+      console.log(`  Path: ${dbPath}`);
+      console.log("  Run: poetic init");
+      process.exit(1);
+    }
+    let degraded = false;
+    try {
+      const metrics = await collectHealthMetrics(db);
+      const status = getHealthStatus(metrics);
+      degraded = status !== "healthy";
+      if (validatedOptions.json) {
+        console.log(formatMetricsJson(metrics, { telemetryDb: dbPath }));
+      } else if (validatedOptions.prometheus) {
+        console.log(formatMetricsPrometheus(metrics));
+      } else {
+        console.log(formatMetricsTable(metrics, validatedOptions.verbose));
+      }
+    } finally {
+      db.close();
+    }
+    if (degraded) process.exit(1);
+  });
+  const monitorCmd = new Command("monitor");
+  monitorCmd.description("Watch telemetry metrics in real-time");
+  monitorCmd.option("--interval <seconds>", "Update interval in seconds", "2");
+  monitorCmd.option("--json", "Output as JSON");
+  monitorCmd.option("--prometheus", "Output in Prometheus text format");
+  monitorCmd.action(async (options) => {
+    const monitorOptions = {
+      interval: options.interval ? Number.parseInt(String(options.interval), 10) : 2,
+      json: Boolean(options.json),
+      prometheus: Boolean(options.prometheus)
+    };
+    const validatedOptions = validateCommandOptions(
+      DoctorMetricsMonitorOptionsSchema,
+      monitorOptions
+    );
+    await monitorHealth(validatedOptions);
+  });
+  metricsCmd.addCommand(checkCmd);
+  metricsCmd.addCommand(monitorCmd);
+  metricsCmd.option("--json", "Output as JSON");
+  metricsCmd.option("--prometheus", "Output in Prometheus text format");
+  metricsCmd.option("-v, --verbose", "Show detailed information");
+  metricsCmd.action(async function() {
+    const validatedOptions = readDoctorMetricsOptions(this);
+    await displayDatabaseStatus(validatedOptions);
+  });
+  return metricsCmd;
+}
+
+// src/cli/commands/doctor.ts
+var BetterSqlite3Ctor = null;
+async function getBetterSqlite3() {
+  if (!BetterSqlite3Ctor) {
+    const mod = await import("better-sqlite3");
+    BetterSqlite3Ctor = mod.default;
+  }
+  return BetterSqlite3Ctor;
+}
+var REQUIRED_NODE_MAJOR = 24;
+var HOMEBREW_NODE_24_PATH = "/opt/homebrew/opt/node@24/bin/node";
+async function preferredNode24Path() {
+  try {
+    await fs5.access(HOMEBREW_NODE_24_PATH);
+    return HOMEBREW_NODE_24_PATH;
+  } catch {
+    return null;
+  }
+}
+function formatNode24Remediation(preferredPath) {
+  if (preferredPath) {
+    return `Poetic requires Node.js v${REQUIRED_NODE_MAJOR}.x; use ${preferredPath} or put /opt/homebrew/opt/node@24/bin first in PATH.`;
+  }
+  return `Poetic requires Node.js v${REQUIRED_NODE_MAJOR}.x; install/select Node ${REQUIRED_NODE_MAJOR}, for example: nvm install ${REQUIRED_NODE_MAJOR} && nvm use ${REQUIRED_NODE_MAJOR}.`;
+}
+function isLikelyBetterSqlite3NativeLoadMismatch(error) {
+  const code = error?.code;
+  const message = error instanceof Error ? error.message : String(error);
+  return code === "ERR_DLOPEN_FAILED" || message.includes("NODE_MODULE_VERSION") || /compiled against a different Node\.js version/i.test(message) || /was compiled for a different Node\.js version/i.test(message) || /module did not self-register/i.test(message) || /invalid ELF header/i.test(message) || /incompatible architecture/i.test(message) || /better[-_]sqlite3/i.test(message) && /\.node\b/i.test(message);
+}
+function formatDatabaseNativeErrorDetails(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (!isLikelyBetterSqlite3NativeLoadMismatch(error)) {
+    return message;
+  }
+  return `${message}
+Remediation: npm rebuild better-sqlite3 (then rerun poetic doctor). If it still fails, reinstall dependencies under Node ${REQUIRED_NODE_MAJOR}: rm -rf node_modules && npm ci.`;
+}
+var HealthCommandOptionsSchema = z3.object({
+  json: BooleanFlagSchema.optional(),
+  verbose: BooleanFlagSchema.optional(),
+  fix: BooleanFlagSchema.optional(),
+  all: BooleanFlagSchema.optional(),
+  provider: z3.string().optional(),
+  providersOnly: BooleanFlagSchema.optional(),
+  matrix: BooleanFlagSchema.optional(),
+  strict: BooleanFlagSchema.optional(),
+  requireReady: BooleanFlagSchema.optional(),
+  probe: BooleanFlagSchema.optional(),
+  refresh: BooleanFlagSchema.optional(),
+  checkLinks: BooleanFlagSchema.optional()
+}).strict();
+function isStrictBlockingWarning(check) {
+  if (check.name === "Linux write boundary") {
+    return false;
+  }
+  if (check.category === "providers" && check.name === "Provider CLIs") {
+    return false;
+  }
+  if (check.category === "providers" && (check.name === "OpenCode discovery" || /auth not observed/i.test(check.message))) {
+    return false;
+  }
+  return true;
+}
+function isRequireReadyFailure(check) {
+  return check.category === "providers" && check.name === "Provider CLIs" && (check.readinessGateLabel === "zero-ready" || check.readinessReadyCount === 0);
+}
+function exitForHealthFailures(checks, options) {
+  const failedChecks = checks.filter((c) => c.status === "fail");
+  const warnChecks = checks.filter((c) => c.status === "warn" && isStrictBlockingWarning(c));
+  if (failedChecks.length > 0) {
+    process.exit(1);
+  }
+  if (options.requireReady && checks.some((check) => isRequireReadyFailure(check))) {
+    process.exit(1);
+  }
+  if (options.strict && warnChecks.length > 0) {
+    process.exit(1);
+  }
+}
+async function checkGit() {
+  try {
+    const result = await execa("git", ["--version"]);
+    const version = result.stdout.trim();
+    let details = version;
+    try {
+      const whichCmd = process.platform === "win32" ? "where" : "which";
+      const whichResult = await execa(whichCmd, ["git"]);
+      details = `${version} \u2014 ${whichResult.stdout.trim()}`;
+    } catch (_whichError) {
+    }
+    return {
+      name: "Git",
+      category: "git",
+      status: "pass",
+      message: version,
+      details
+    };
+  } catch (error) {
+    return {
+      name: "Git",
+      category: "git",
+      status: "fail",
+      message: "Git not found or not accessible",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+var PROVIDER_CLI_SPECS = [
+  { id: "claude", versionArgs: ["--version"] },
+  { id: "codex", versionArgs: ["--version"] },
+  { id: "copilot", versionArgs: ["--version"] },
+  { id: "cursor", versionArgs: ["--version"] },
+  { id: "gemini", versionArgs: ["--version"] },
+  { id: "grok", versionArgs: ["--version"] },
+  { id: "kiro", versionArgs: ["--version"] },
+  { id: "pi", versionArgs: ["--version"] },
+  { id: "antigravity", versionArgs: ["--version"] },
+  { id: "opencode", versionArgs: ["--version"] }
+];
+var PROVIDER_CLI_SPEC_IDS = PROVIDER_CLI_SPECS.map((s) => s.id);
+var AUTH_PROBE_HINT_PROVIDERS = /* @__PURE__ */ new Set(["grok"]);
+var PROVIDER_EXTRA_HEALTH_CHECKS = [
+  { providerId: "opencode", runWithoutProviderFilter: false, check: checkOpencodeDiscovery },
+  { providerId: "claude", runWithoutProviderFilter: true, check: checkClaudeStrictMcpConfig },
+  { providerId: "claude", runWithoutProviderFilter: true, check: checkLegacyClaudePlugin }
+];
+async function collectProviderExtraHealthChecks(options) {
+  const checks = [];
+  for (const entry of PROVIDER_EXTRA_HEALTH_CHECKS) {
+    const requested = options.all === true || options.provider === entry.providerId || entry.runWithoutProviderFilter && !options.provider;
+    if (requested) {
+      checks.push(await entry.check());
+    }
+  }
+  return checks;
+}
+function providerHealthReadinessOptions(providerId) {
+  const activeAuthProviders = /* @__PURE__ */ new Set(["cursor", "grok"]);
+  return {
+    mode: "execute",
+    authProbeMode: activeAuthProviders.has(providerId) ? "active" : "passive"
+  };
+}
+async function formatLastSeenAuth(providerId) {
+  const lookup = await lookupAuthOutcome(providerId);
+  if (!lookup || lookup.stale || !lookup.contextMatches) {
+    return "none";
+  }
+  return `${lookup.entry.result}, ${lookup.entry.observedAt}`;
+}
+async function recordHealthAuthOutcome(providerId, result, message) {
+  await recordAuthOutcome(providerId, result, {
+    source: "health-probe",
+    message
+  }).catch(() => {
+  });
+}
+function normalizeProviderId(value) {
+  return normalizeEngineId(value.trim());
+}
+async function checkOpencodeDiscovery() {
+  let command;
+  let prefixArgs;
+  try {
+    ({ command, prefixArgs } = resolveProviderCliCommand("opencode"));
+  } catch {
+    return {
+      name: "OpenCode discovery",
+      category: "providers",
+      status: "fail",
+      message: "OpenCode CLI not resolved",
+      details: "Install OpenCode or set POETIC_OPENCODE_CLI_COMMAND. Run: poetic doctor --provider opencode"
+    };
+  }
+  const cliProbe = await probeProviderCli(command, ["--version"], prefixArgs);
+  const cliInstalled = cliProbe.present;
+  const discovery = await discoverOpencode({
+    cliCommand: command,
+    prefixArgs,
+    cliInstalled,
+    refreshModels: false,
+    includeModelsDev: true,
+    modelsDevCacheDir: path10.join(
+      getRuntimeEnv("POETIC_TELEMETRY_DIR") ?? path10.join(process.cwd(), ".poetic"),
+      "cache",
+      "opencode"
+    )
+  });
+  const parts = [];
+  parts.push(`CLI installed: ${cliInstalled ? "yes" : "no"}`);
+  if (discovery.authList.rawOk) {
+    const credentialNames = discovery.authList.credentialProviders ?? [];
+    const environmentNames = discovery.authList.environmentProviders ?? [];
+    parts.push(`Auth: ${credentialNames.length > 0 ? credentialNames.join(", ") : "not observed"}`);
+    if (environmentNames.length > 0) {
+      parts.push(`Capability (parent-env): ${environmentNames.join(", ")}`);
+    }
+  } else {
+    parts.push(
+      `Providers (auth list): unsupported or failed${discovery.authList.unsupportedMessage ? ` (${discovery.authList.unsupportedMessage.slice(0, 80)})` : ""}`
+    );
+  }
+  if (discovery.models.rawOk) {
+    parts.push(
+      `Models: ${discovery.models.modelIds.length > 0 ? discovery.models.modelIds.slice(0, 15).join(", ") + (discovery.models.modelIds.length > 15 ? ` (+${discovery.models.modelIds.length - 15} more)` : "") : "none"}`
+    );
+  } else {
+    parts.push(
+      `Models: unsupported or failed${discovery.models.unsupportedMessage ? ` (${discovery.models.unsupportedMessage.slice(0, 80)})` : ""}`
+    );
+  }
+  if (discovery.modelsDev) {
+    const source = discovery.modelsDev.source === "network" ? "fresh" : "cache";
+    parts.push(
+      `models.dev: ${source}${discovery.modelsDev.fetchedAt ? ` @ ${new Date(discovery.modelsDev.fetchedAt).toISOString()}` : ""}`
+    );
+  }
+  const credentialProviders = discovery.authList.credentialProviders ?? [];
+  const environmentProviders = discovery.authList.environmentProviders ?? [];
+  const hasCredentialAuth = credentialProviders.length > 0;
+  const envOnlyCapability = cliInstalled && discovery.authList.rawOk && !hasCredentialAuth && (environmentProviders.length > 0 || discovery.models.modelIds.length > 0);
+  const status = cliInstalled && discovery.authList.rawOk && discovery.models.rawOk && hasCredentialAuth ? "pass" : cliInstalled ? "warn" : "fail";
+  const message = status === "pass" ? `CLI installed; ${credentialProviders.length} credential provider(s); ${discovery.models.modelIds.length} model(s)` : envOnlyCapability ? "CLI present; auth not observed (parent-env vendors are capability only)" : cliInstalled ? discovery.authList.rawOk && discovery.models.rawOk ? "CLI present; no OpenCode providers or models discovered" : "CLI present; auth list or models unavailable" : "OpenCode CLI not installed";
+  return {
+    name: "OpenCode discovery",
+    category: "providers",
+    status,
+    message,
+    details: parts.join(" | ")
+  };
+}
+async function getProvidersToCheck(options) {
+  const validIds = PROVIDER_CLI_SPECS.map((s) => s.id);
+  if (options.provider) {
+    const requested = normalizeProviderId(options.provider);
+    if (!validIds.includes(requested)) {
+      throw new Error(
+        `Unknown provider: ${options.provider}. Valid providers: ${validIds.join(", ")}`
+      );
+    }
+    return {
+      providers: [requested],
+      isDiscoveryMode: false,
+      selectionScope: "provider"
+    };
+  }
+  if (options.all) {
+    return {
+      providers: PROVIDER_CLI_SPECS.map((s) => s.id),
+      isDiscoveryMode: false,
+      selectionScope: "all"
+    };
+  }
+  const configured = /* @__PURE__ */ new Set();
+  const defaultProvider = process.env.POETIC_DEFAULT_PROVIDER;
+  if (defaultProvider) {
+    const normalized = normalizeProviderId(defaultProvider);
+    if (validIds.includes(normalized)) {
+      configured.add(normalized);
+    }
+  }
+  try {
+    const { ConfigManager: ConfigManager2 } = await import("./config-manager-L3VRNTSG.js");
+    const manager = new ConfigManager2({
+      enableCache: false,
+      cwd: process.cwd()
+    });
+    const resolved = await manager.loadConfig({}, true);
+    const config = resolved.config;
+    const hasExplicitConfig = resolved.sources.some(
+      (source) => (source.type === "project" || source.type === "user") && source.exists
+    );
+    if (hasExplicitConfig) {
+      if (config?.providers) {
+        const providerEntries = Object.entries(config.providers);
+        for (const [providerId, providerConfig] of providerEntries) {
+          if (providerConfig?.enabled) {
+            configured.add(normalizeProviderId(providerId));
+          }
+        }
+      }
+      const configuredDefault = config?.defaults?.provider ?? config?.defaultProvider;
+      if (configuredDefault) {
+        configured.add(normalizeProviderId(String(configuredDefault)));
+      }
+    }
+  } catch (error) {
+    if (isConfigValidityError(error)) {
+      throw error;
+    }
+  }
+  if (configured.size > 0) {
+    const validIds2 = new Set(PROVIDER_CLI_SPECS.map((s) => s.id));
+    const filteredProviders = [...configured].filter((id) => validIds2.has(id));
+    if (filteredProviders.length > 0) {
+      return {
+        providers: filteredProviders,
+        isDiscoveryMode: false,
+        selectionScope: "configured"
+      };
+    }
+  }
+  return {
+    providers: PROVIDER_CLI_SPECS.map((s) => s.id),
+    isDiscoveryMode: true,
+    selectionScope: "discovery"
+  };
+}
+async function checkProviderCLIs(optionsOrVerbose = false) {
+  const options = typeof optionsOrVerbose === "boolean" ? { includeVerboseDetails: optionsOrVerbose } : optionsOrVerbose;
+  const includeVerboseDetails = options.includeVerboseDetails ?? false;
+  const {
+    providers: providersToCheck,
+    isDiscoveryMode,
+    selectionScope
+  } = await getProvidersToCheck(options);
+  const specsToCheck = PROVIDER_CLI_SPECS.filter((spec) => providersToCheck.includes(spec.id));
+  const uncheckedProviderIds = selectionScope === "configured" ? PROVIDER_CLI_SPECS.map((spec) => spec.id).filter((id) => !providersToCheck.includes(id)) : [];
+  const available = [];
+  const degraded = [];
+  const authUnobserved = [];
+  const sandboxBlocked = [];
+  const missing = [];
+  const providerBreakdown = [];
+  const providerReadiness = [];
+  const gateReadyProviders = /* @__PURE__ */ new Set();
+  const authMissing = [];
+  const authReady = [];
+  const lastSeenAuthMap = /* @__PURE__ */ new Map();
+  for (const spec of specsToCheck) {
+    lastSeenAuthMap.set(spec.id, await formatLastSeenAuth(spec.id));
+  }
+  const repoRoot = resolveRepoRootForPoeticDir(process.cwd());
+  for (const spec of specsToCheck) {
+    let config;
+    try {
+      config = getProviderConfig(spec.id);
+    } catch {
+      missing.push({ id: spec.id });
+      if (includeVerboseDetails) {
+        providerBreakdown.push({ id: spec.id, status: "missing" });
+      }
+      continue;
+    }
+    if (!config?.cli) {
+      missing.push({ id: spec.id });
+      if (includeVerboseDetails) {
+        providerBreakdown.push({ id: spec.id, status: "missing" });
+      }
+      continue;
+    }
+    const readinessOptions = options.probe ? {
+      ...providerHealthReadinessOptions(spec.id)
+    } : {
+      ...SETUP_CHECK_READINESS_OPTIONS,
+      cliProbeMode: "execute",
+      sandboxProbeMode: "execute",
+      probeAuth: async () => "unknown"
+    };
+    const probeContext = readinessProbeContextForOptions(readinessOptions);
+    const readiness = await getProviderReadiness(spec.id, readinessOptions);
+    if (isGateReadyProvider(readiness)) gateReadyProviders.add(readiness.provider);
+    if (options.probe) {
+      void recordReadinessDiagnostic(readiness, {
+        phase: "health",
+        cliProbeMode: "execute",
+        ...readinessOptions.authProbeMode ? { authProbeMode: readinessOptions.authProbeMode } : {}
+      });
+    }
+    const dryRun = readProviderDryRunFreshness(spec.id, repoRoot);
+    const resolved = resolveNamedReadiness(readiness, dryRun);
+    const scope = resolveReadinessScope(readiness, resolved);
+    const parityLabel = resolveProviderParityLabel(readiness, resolved);
+    providerReadiness.push({
+      provider: spec.id,
+      known: readiness.known,
+      configured: readiness.configured,
+      installed: readiness.installed,
+      cliHealthy: readiness.cliHealthy,
+      authenticated: readiness.authenticated,
+      ready: readiness.ready,
+      scope: scope.label,
+      ...scope.detail ? { scopeDetail: scope.detail } : {},
+      ...readiness.readinessNote ? { readinessNote: readiness.readinessNote } : {},
+      ...readiness.reasonCode ? { reasonCode: readiness.reasonCode } : {},
+      parityLabel,
+      resolved,
+      probe: probeContext
+    });
+    const lastSeenAuth = lastSeenAuthMap.get(spec.id) ?? "";
+    if (!readiness.command && !readiness.installed) {
+      missing.push({
+        id: spec.id,
+        installCommand: config.cli?.install_command
+      });
+      if (includeVerboseDetails) {
+        providerBreakdown.push({
+          id: spec.id,
+          status: "missing",
+          installCommand: config.cli?.install_command,
+          lastSeenAuth
+        });
+      }
+      continue;
+    }
+    if (!readiness.installed) {
+      missing.push({
+        id: spec.id,
+        installCommand: config.cli?.install_command
+      });
+      if (includeVerboseDetails) {
+        providerBreakdown.push({
+          id: spec.id,
+          status: "missing",
+          resolvedCommand: readiness.command,
+          installCommand: config.cli?.install_command,
+          lastSeenAuth
+        });
+      }
+    } else if (!readiness.cliHealthy) {
+      degraded.push({
+        id: spec.id,
+        reason: readiness.reason ?? "Unknown issue"
+      });
+      if (includeVerboseDetails) {
+        providerBreakdown.push({
+          id: spec.id,
+          status: "degraded",
+          resolvedCommand: readiness.command,
+          degradedReason: readiness.reason,
+          lastSeenAuth
+        });
+      }
+    } else {
+      if (readiness.sandboxCapable === false) {
+        const deniedPaths = readiness.sandboxDeniedPaths?.join(", ") ?? "";
+        const summary = deniedPaths ? `${spec.id}: sandbox blocked (${deniedPaths})` : formatSandboxDegradedSummary({
+          providerId: spec.id,
+          capable: false,
+          probed: [],
+          missing: []
+        });
+        const verboseReason = readiness.sandboxReason ?? "CLI present, sandbox capability denied";
+        sandboxBlocked.push({ id: spec.id, paths: deniedPaths });
+        degraded.push({ id: spec.id, reason: summary });
+        if (includeVerboseDetails) {
+          providerBreakdown.push({
+            id: spec.id,
+            status: "degraded",
+            resolvedCommand: readiness.command,
+            degradedReason: verboseReason,
+            lastSeenAuth
+          });
+        }
+        continue;
+      }
+      const authState = readiness.authenticated;
+      if (authState === "no") {
+        if (options.probe) {
+          await recordHealthAuthOutcome(
+            spec.id,
+            "failed",
+            readiness.reason ?? "Health probe reported authentication missing"
+          );
+        }
+        authMissing.push(spec.id);
+        const authMissingReason = spec.id === "codex" && readEnv(POETIC_CODEX_BACKEND).value?.trim().toLowerCase() === "bedrock" ? 'CLI present, auth missing; Bedrock runs need an AWS credential chain, not "codex login"' : spec.id === "codex" && Boolean(
+          process.env.AWS_ACCESS_KEY_ID?.trim() && process.env.AWS_SECRET_ACCESS_KEY?.trim()
+        ) ? "CLI present, auth missing; AWS keys are present but Codex is not attested for Bedrock. Set POETIC_CODEX_BACKEND=bedrock" : "CLI present, auth missing";
+        degraded.push({ id: spec.id, reason: authMissingReason });
+        if (includeVerboseDetails) {
+          providerBreakdown.push({
+            id: spec.id,
+            status: "degraded",
+            resolvedCommand: readiness.command,
+            degradedReason: authMissingReason,
+            lastSeenAuth: lastSeenAuthMap.get(spec.id) ?? ""
+          });
+        }
+        continue;
+      }
+      if (authState === "unknown") {
+        const activeProbeUnknown = options.probe === true && readiness.reason?.includes("active auth probe could not verify headless execution");
+        const defaultProbeHintUnknown = AUTH_PROBE_HINT_PROVIDERS.has(spec.id) && options.provider === spec.id && options.probe !== true;
+        if (activeProbeUnknown || defaultProbeHintUnknown) {
+          const reason2 = defaultProbeHintUnknown ? `CLI present, auth unknown; run \`poetic doctor --probe --provider ${spec.id}\` to verify headless execution` : readiness.reason ?? "CLI present, active auth probe inconclusive";
+          degraded.push({
+            id: spec.id,
+            reason: reason2
+          });
+          if (includeVerboseDetails) {
+            providerBreakdown.push({
+              id: spec.id,
+              status: "degraded",
+              resolvedCommand: readiness.command,
+              degradedReason: reason2,
+              lastSeenAuth
+            });
+          }
+          continue;
+        }
+        const cached = await lookupAuthOutcome(spec.id);
+        const freshFailure = cached?.entry.result === "failed" && !cached.stale && cached.contextMatches;
+        if (!freshFailure) {
+          authUnobserved.push(spec.id);
+          available.push(spec.id);
+          if (includeVerboseDetails) {
+            providerBreakdown.push({
+              id: spec.id,
+              status: "available",
+              resolvedCommand: readiness.command,
+              lastSeenAuth
+            });
+          }
+          continue;
+        }
+        const reason = "CLI present, cached auth failure";
+        degraded.push({
+          id: spec.id,
+          reason
+        });
+        if (includeVerboseDetails) {
+          providerBreakdown.push({
+            id: spec.id,
+            status: "degraded",
+            resolvedCommand: readiness.command,
+            degradedReason: reason,
+            lastSeenAuth
+          });
+        }
+        continue;
+      }
+      if (authState === "yes") {
+        if (options.probe) {
+          await recordHealthAuthOutcome(spec.id, "ok", "Health probe succeeded");
+        }
+        authReady.push(spec.id);
+      }
+      available.push(spec.id);
+      if (includeVerboseDetails) {
+        providerBreakdown.push({
+          id: spec.id,
+          status: "available",
+          resolvedCommand: readiness.command,
+          degradedReason: readiness.warning,
+          lastSeenAuth: lastSeenAuthMap.get(spec.id) ?? ""
+        });
+      }
+    }
+  }
+  const missingDetails = missing.map(
+    (entry) => entry.installCommand ? `${entry.id} (install: ${entry.installCommand})` : entry.id
+  ).join(", ");
+  const degradedDetails = degraded.map((entry) => `${entry.id} (${entry.reason})`).join(", ");
+  const lastSeenParts = specsToCheck.map(
+    (spec) => `${spec.id}: ${lastSeenAuthMap.get(spec.id) ?? ""}`
+  );
+  const baseDetails = (() => {
+    const parts = [];
+    if (available.length > 0) {
+      parts.push(`CLI present: ${available.join(", ")}`);
+    }
+    if (degraded.length > 0) {
+      parts.push(`Degraded: ${degradedDetails}`);
+    }
+    if (authUnobserved.length > 0) {
+      parts.push(
+        `No current auth observation: ${authUnobserved.join(", ")} (expected; provider execution is the probe)`
+      );
+    }
+    if (authMissing.length > 0) {
+      parts.push(`Auth missing: ${authMissing.join(", ")}`);
+    }
+    if (authReady.length > 0) {
+      parts.push(`Auth ready: ${authReady.join(", ")}`);
+    }
+    const assumedReady = providerReadiness.filter((entry) => entry.readinessNote === "env-var-auth-assumed").map((entry) => entry.provider);
+    if (assumedReady.length > 0) {
+      parts.push(`Readiness assumed: ${assumedReady.join(", ")}`);
+    }
+    if (lastSeenParts.length > 0) {
+      parts.push(`Last seen auth: ${lastSeenParts.join(", ")}`);
+    }
+    if (missing.length > 0) {
+      parts.push(`Missing: ${missingDetails}`);
+    }
+    if (uncheckedProviderIds.length > 0) {
+      parts.push(`Not checked: ${uncheckedProviderIds.join(", ")} (use --all to include)`);
+    }
+    if (parts.length === 0) {
+      return "No provider CLIs checked";
+    }
+    return parts.join(" | ");
+  })();
+  const discoveryModeNote = isDiscoveryMode ? "\n\n     Info: Discovery mode: No configured providers found, checking all known providers.\n     Tip: Set POETIC_DEFAULT_PROVIDER or configure providers in poetic.config.jsonc / ~/.config/poetic/poetic.config.jsonc" : "";
+  const details = (() => {
+    if (!includeVerboseDetails) return baseDetails + discoveryModeNote;
+    if (providerBreakdown.length === 0) return baseDetails + discoveryModeNote;
+    const breakdown = providerBreakdown.map((provider) => {
+      let statusMark;
+      switch (provider.status) {
+        case "available":
+          statusMark = "OK";
+          break;
+        case "degraded":
+          statusMark = "Warning:";
+          break;
+        default:
+          statusMark = "Error";
+      }
+      const commandPart = provider.resolvedCommand ? `: ${provider.resolvedCommand}` : ": missing";
+      const statusSuffix = (() => {
+        if (provider.status === "missing" && provider.installCommand) {
+          return ` (install: ${provider.installCommand})`;
+        }
+        if (provider.status === "degraded" && provider.degradedReason) {
+          const lastSeen = provider.lastSeenAuth ? `; lastSeenAuth: ${provider.lastSeenAuth}` : "";
+          return ` (${provider.degradedReason}${lastSeen})`;
+        }
+        if (provider.lastSeenAuth) {
+          return ` (lastSeenAuth: ${provider.lastSeenAuth})`;
+        }
+        return "";
+      })();
+      return `${statusMark} ${provider.id}${commandPart}${statusSuffix}`;
+    }).join("\n     ");
+    return `${baseDetails}${discoveryModeNote}
+
+     ${breakdown}`;
+  })();
+  const totalChecked = specsToCheck.length;
+  const healthyCount = available.length;
+  const degradedCount = degraded.length;
+  const missingCount = missing.length;
+  const gateReadyCount = gateReadyProviders.size;
+  const readinessGateLabel = gateReadyCount === 0 ? "zero-ready" : gateReadyCount === 1 ? "one-ready" : "multi-ready";
+  const gateMeta = {
+    readinessGateLabel,
+    readinessReadyCount: gateReadyCount
+  };
+  if (options.requireReady && gateReadyCount === 0) {
+    return {
+      name: "Provider CLIs",
+      category: "providers",
+      status: "fail",
+      message: isDiscoveryMode ? "No ready providers (--require-ready, discovery mode)" : "No ready providers (--require-ready)",
+      details,
+      ...providerReadiness.length > 0 ? { providerReadiness } : {},
+      ...gateMeta
+    };
+  }
+  if (healthyCount === 0 && degradedCount === 0) {
+    return {
+      name: "Provider CLIs",
+      category: "providers",
+      status: "fail",
+      message: isDiscoveryMode ? "No provider CLIs present (discovery mode)" : "No provider CLIs present",
+      details,
+      ...providerReadiness.length > 0 ? { providerReadiness } : {},
+      ...gateMeta
+    };
+  }
+  if (missingCount > 0 || degradedCount > 0) {
+    const statusParts = [];
+    if (healthyCount > 0) statusParts.push(`${healthyCount} healthy`);
+    if (degradedCount > 0) statusParts.push(`${degradedCount} degraded`);
+    if (missingCount > 0) statusParts.push(`${missingCount} missing`);
+    if ((options.strict || options.requireReady) && gateReadyCount > 0) {
+      statusParts.push(`${gateReadyCount} ready`);
+    }
+    return {
+      name: "Provider CLIs",
+      category: "providers",
+      status: degradedCount > 0 || missingCount > 0 ? "warn" : "pass",
+      message: (() => {
+        if (options.provider) {
+          const sandboxEntry = sandboxBlocked.find((entry) => entry.id === options.provider);
+          if (sandboxEntry) {
+            return sandboxEntry.paths ? `${options.provider} sandbox blocked (${sandboxEntry.paths})` : `${options.provider} sandbox/policy blocked`;
+          }
+          if (authMissing.includes(options.provider)) {
+            return `${options.provider} CLI present, auth missing`;
+          }
+        }
+        return `${statusParts.join(", ")} of ${totalChecked} ${selectionScope === "configured" ? "configured " : ""}checked${isDiscoveryMode ? " (discovery mode)" : ""}${uncheckedProviderIds.length > 0 ? `; ${uncheckedProviderIds.length} known provider(s) not checked` : ""}`;
+      })(),
+      details,
+      ...providerReadiness.length > 0 ? { providerReadiness } : {},
+      ...gateMeta
+    };
+  }
+  const scopedPassMessage = selectionScope === "configured" && uncheckedProviderIds.length > 0 ? `${healthyCount} of ${totalChecked} configured provider CLIs present; ${uncheckedProviderIds.length} known provider(s) not checked` : void 0;
+  return {
+    name: "Provider CLIs",
+    category: "providers",
+    status: "pass",
+    message: options.provider && authReady.includes(options.provider) ? `${options.provider} CLI present and authenticated` : scopedPassMessage ?? (totalChecked === PROVIDER_CLI_SPECS.length ? `All ${healthyCount} provider CLIs present${isDiscoveryMode ? " (discovery mode)" : ""}` : `${healthyCount} of ${totalChecked} checked provider CLIs present${isDiscoveryMode ? " (discovery mode)" : ""}`),
+    details,
+    ...providerReadiness.length > 0 ? { providerReadiness } : {},
+    ...gateMeta
+  };
+}
+async function checkPoeticDirectory() {
+  const cwd = process.cwd();
+  const poeticDir = path10.join(cwd, ".poetic");
+  try {
+    await fs5.stat(poeticDir);
+    try {
+      await fs5.access(poeticDir, fs5.constants.W_OK);
+      return {
+        name: ".poetic Directory",
+        category: "poetic",
+        status: "pass",
+        message: "Directory exists and is writable",
+        details: poeticDir
+      };
+    } catch (_error) {
+      return {
+        name: ".poetic Directory",
+        category: "poetic",
+        status: "fail",
+        message: "Directory not writable",
+        details: poeticDir,
+        fixable: false
+      };
+    }
+  } catch (_error) {
+    return {
+      name: ".poetic Directory",
+      category: "poetic",
+      status: "warn",
+      message: "Directory not found",
+      details: 'Run "poetic init" or "poetic doctor --fix" to initialize',
+      fixable: true
+    };
+  }
+}
+async function checkNestedPoeticDirectory() {
+  const cwd = process.cwd();
+  const nestedDir = path10.join(cwd, ".poetic", ".poetic");
+  try {
+    const stats = await fs5.stat(nestedDir);
+    if (stats.isDirectory()) {
+      return {
+        name: "Nested .poetic Directory",
+        category: "poetic",
+        status: "warn",
+        message: "Found nested .poetic/.poetic/ directory (bug artifact)",
+        details: `This directory was created by a bug and should be removed: ${nestedDir}`,
+        fixable: true
+      };
+    }
+  } catch (_error) {
+  }
+  return null;
+}
+async function checkRequiredDirectories() {
+  const cwd = process.cwd();
+  const missing = [];
+  const present = [];
+  for (const dir of RuntimeRequirements.directories) {
+    const fullPath = path10.join(cwd, ".poetic", dir);
+    try {
+      await fs5.stat(fullPath);
+      present.push(dir);
+    } catch (_error) {
+      missing.push(dir);
+    }
+  }
+  if (missing.length === 0) {
+    return {
+      name: "Required Directories",
+      category: "poetic",
+      status: "pass",
+      message: `All ${RuntimeRequirements.directories.length} directories present`,
+      details: `All present: ${present.join(", ")}`
+    };
+  }
+  if (missing.length === RuntimeRequirements.directories.length) {
+    return {
+      name: "Required Directories",
+      category: "poetic",
+      status: "fail",
+      message: "No directories found",
+      details: `Present: ${present.join(", ")} | Missing: ${missing.join(", ")}`,
+      fixable: true
+    };
+  }
+  return {
+    name: "Required Directories",
+    category: "poetic",
+    status: "warn",
+    message: `${missing.length} directories missing`,
+    details: `Present: ${present.join(", ")} | Missing: ${missing.join(", ")}`,
+    fixable: true
+  };
+}
+async function checkArchiveReconciliation() {
+  let report;
+  try {
+    report = await detectArchiveReconciliationIssues();
+  } catch (error) {
+    return {
+      name: "Archive Reconciliation",
+      category: "poetic",
+      status: "warn",
+      message: "Could not scan for archive reconciliation issues",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+  if (report.totalIssues === 0) {
+    return {
+      name: "Archive Reconciliation",
+      category: "poetic",
+      status: "pass",
+      message: "No archive/restore reconciliation issues"
+    };
+  }
+  return {
+    name: "Archive Reconciliation",
+    category: "poetic",
+    status: "warn",
+    message: `${report.totalIssues} archive reconciliation issue(s) detected`,
+    details: formatArchiveReconciliationReport(report)
+  };
+}
+async function checkProviderConfig() {
+  const cwd = process.cwd();
+  const providersConfigPath = resolveProvidersConfigPath({ cwd });
+  try {
+    ProviderRegistry.load(void 0, cwd);
+    const projectPolicyPresent = await fs5.stat(providersConfigPath).then(() => true).catch((error) => {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    });
+    return {
+      name: "Provider Config",
+      category: "poetic",
+      status: "pass",
+      message: "Provider catalog loaded",
+      details: projectPolicyPresent ? `Release catalog with project policy: ${providersConfigPath}` : `Release catalog: ${ProviderRegistry.getLoadedConfigPath()}`
+    };
+  } catch (error) {
+    return {
+      name: "Provider Config",
+      category: "poetic",
+      status: "warn",
+      message: "Cannot load provider catalog",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkExecutionRoles() {
+  try {
+    const outcome = await runExecutionRolesPreflight(process.cwd());
+    if (!outcome.result || !outcome.roles) {
+      return null;
+    }
+    const { errors, warnings } = outcome.result;
+    const detailLines = [
+      ...errors.map((issue) => `Error: ${formatPreflightIssue(issue)}`),
+      ...warnings.map((issue) => `Warning: ${formatPreflightIssue(issue)}`)
+    ];
+    const details = detailLines.length > 0 ? detailLines.join("\n") : void 0;
+    const reviewer = outcome.roles.reviewer;
+    if (errors.length > 0) {
+      return {
+        name: "Execution Roles",
+        category: "poetic",
+        status: "fail",
+        message: `Reviewer not ready for gate "${reviewer.gate}"`,
+        details
+      };
+    }
+    if (warnings.length > 0) {
+      return {
+        name: "Execution Roles",
+        category: "poetic",
+        status: "warn",
+        message: `Reviewer degraded (gate "${reviewer.gate}")`,
+        details
+      };
+    }
+    return {
+      name: "Execution Roles",
+      category: "poetic",
+      status: "pass",
+      message: `Reviewer ready (gate "${reviewer.gate}")`
+    };
+  } catch (error) {
+    return {
+      name: "Execution Roles",
+      category: "poetic",
+      status: "fail",
+      message: "Invalid execution-role configuration",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkSteeringInstructions() {
+  const { loadUserGlobalAgentsFile, getUserAgentsPath } = await import("./user-agents-GHUGCSKN.js");
+  const agentsPath = getUserAgentsPath();
+  const loaded = loadUserGlobalAgentsFile();
+  if (!loaded) {
+    return {
+      name: "Global Instructions",
+      category: "poetic",
+      status: "info",
+      message: "No machine-wide AGENTS.md; using built-in steering defaults",
+      details: `Optional: customize provider runs with "poetic config instructions edit" (${agentsPath}). It is injected into steering-capable provider runs.`
+    };
+  }
+  if (!loaded.source.editedByUser) {
+    return {
+      name: "Global Instructions",
+      category: "poetic",
+      status: "info",
+      message: "Machine-wide AGENTS.md present (unedited default)",
+      details: `Tip: tailor it with "poetic config instructions edit" (${agentsPath}). It is injected into steering-capable provider runs.`
+    };
+  }
+  return {
+    name: "Global Instructions",
+    category: "poetic",
+    status: "pass",
+    message: "Machine-wide AGENTS.md present (customized)",
+    details: agentsPath
+  };
+}
+async function checkLinuxWriteBoundary() {
+  try {
+    const { resolveLinuxHostClass, formatLinuxHostClassNote } = await import("./linux-host-class-UY4KVLFD.js");
+    const resolution = resolveLinuxHostClass();
+    if (resolution.hostClass === "desktop-unacked") {
+      return {
+        name: "Linux write boundary",
+        category: "system",
+        status: "warn",
+        message: "Linux desktop write consent is not recorded",
+        details: "This is not a sandbox-blocked provider. Write-capable runs need `poetic sandbox trust linux --ack-desktop` or, for a VM/container/cloud instance, `poetic sandbox trust linux --host isolated`."
+      };
+    }
+    if (resolution.hostClass === "not-applicable") {
+      return {
+        name: "Linux write boundary",
+        category: "system",
+        status: "pass",
+        message: "Host class not applicable on this platform",
+        details: `source=${resolution.source}`
+      };
+    }
+    const note = resolution.note ?? formatLinuxHostClassNote(resolution);
+    return {
+      name: "Linux write boundary",
+      category: "system",
+      status: "pass",
+      message: `Host class ${resolution.hostClass} (source=${resolution.source}); writes allowed`,
+      details: note ?? "Provider CLIs can write anywhere $USER can. This is not Seatbelt-sandboxed."
+    };
+  } catch (error) {
+    return {
+      name: "Linux write boundary",
+      category: "system",
+      status: "info",
+      message: "Linux host-class posture could not be resolved",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkVerificationPrivilegeBoundary() {
+  let verificationLabel = "unavailable";
+  try {
+    const { PROJECT_VERIFICATION_SANDBOX_ID, resolveSandboxLabel } = await import("./safety-stanza-BSVE6OJU.js");
+    verificationLabel = resolveSandboxLabel(
+      PROJECT_VERIFICATION_SANDBOX_ID,
+      PROJECT_VERIFICATION_SANDBOX_ID
+    );
+  } catch {
+    verificationLabel = "unavailable";
+  }
+  return {
+    name: "Verification Privileges",
+    category: "system",
+    status: "info",
+    message: "Project verification wraps when a boundary is available; otherwise it is an ordinary child",
+    details: `Test, build, lint, and typecheck commands from the target repository wrap when a generated macOS seatbelt or accepted container boundary is available. On unsupported platforms or when the sandbox is disabled, they run as ordinary child processes. Live verification posture: ${verificationLabel}. The command allowlist constrains the command string, not what the invoked script does. Treat running Poetic against an unfamiliar repository as running that repository's code. See docs/reference/SECURITY.md (Project Verification Executes Target-Repository Code).`
+  };
+}
+async function checkClaudeStrictMcpConfig() {
+  let command;
+  let prefixArgs;
+  try {
+    const resolved = resolveProviderCliCommand("claude");
+    command = resolved.command;
+    prefixArgs = resolved.prefixArgs ?? [];
+  } catch {
+    return {
+      name: "Claude strict-mcp-config",
+      category: "providers",
+      status: "info",
+      message: "Claude CLI not configured; skipping strict-mcp-config check"
+    };
+  }
+  const probe = await probeProviderCli(command, ["--version"], prefixArgs);
+  if (!probe.present) {
+    return {
+      name: "Claude strict-mcp-config",
+      category: "providers",
+      status: "info",
+      message: "Claude CLI not installed; skipping strict-mcp-config check"
+    };
+  }
+  if (!hasStrictMcpConfigBeenProbed()) {
+    const { wrapWithSandbox } = await import("./sandbox-3AG2WJLM.js");
+    const { metadata } = await import("./metadata-HQ43NDEK.js");
+    const sandboxed = wrapWithSandbox({
+      workingDir: process.cwd(),
+      command,
+      args: [...prefixArgs, "--help"],
+      providerName: metadata.name,
+      env: process.env
+    });
+    await probeStrictMcpConfig(
+      sandboxed?.command ?? command,
+      sandboxed?.args ?? [...prefixArgs, "--help"]
+    );
+  }
+  const supported = isStrictMcpConfigSupported();
+  if (supported) {
+    return {
+      name: "Claude strict-mcp-config",
+      category: "providers",
+      status: "pass",
+      message: "Claude CLI supports --strict-mcp-config; judge MCP isolation active"
+    };
+  }
+  return {
+    name: "Claude strict-mcp-config",
+    category: "providers",
+    status: "warn",
+    message: "Claude CLI does not support --strict-mcp-config; judge MCP isolation unavailable",
+    details: "Judge runs may inherit project MCP servers, reducing determinism. Upgrade the Claude CLI to enable strict MCP isolation."
+  };
+}
+async function checkLegacyClaudePlugin() {
+  const { checkClaudeCode } = await import("./setup-claude-code-P7BTTSPO.js");
+  const { resolvePoeticRoot } = await import("./poetic-root-V5DNXEAE.js");
+  const result = await checkClaudeCode(resolvePoeticRoot(), { scope: "user" });
+  const cleanupCommand = "poetic provider disconnect claude";
+  if (result.settingsError) {
+    return {
+      name: "Legacy Claude plugin",
+      category: "providers",
+      status: "info",
+      message: "Claude settings unreadable; legacy residue not checked",
+      details: result.settingsError
+    };
+  }
+  if (!result.hasLegacyResidue && result.pluginState.hasClaudeCli && !result.pluginState.listAvailable) {
+    return {
+      name: "Legacy Claude plugin",
+      category: "providers",
+      status: "info",
+      message: "legacy plugin residue could not be checked",
+      details: `Claude plugin enumeration was unavailable. Optional cleanup: ${cleanupCommand}. Does not affect native Claude CLI provider readiness.`
+    };
+  }
+  if (!result.hasLegacyResidue) {
+    return {
+      name: "Legacy Claude plugin",
+      category: "providers",
+      status: "pass",
+      message: "no legacy Poetic Claude Code plugin residue"
+    };
+  }
+  const bits = [];
+  if (result.pluginState.installedIds.length > 0) {
+    bits.push(`plugin ids: ${result.pluginState.installedIds.join(", ")}`);
+  }
+  if (result.legacyState.hasLegacyMcpServer || result.legacyState.hasLegacyPermissions) {
+    bits.push("legacy MCP settings");
+  }
+  return {
+    name: "Legacy Claude plugin",
+    category: "providers",
+    status: "info",
+    message: `legacy residue present (${bits.join("; ")})`,
+    details: `Optional cleanup: ${cleanupCommand}. Does not affect native Claude CLI provider readiness.`
+  };
+}
+async function checkDatabases() {
+  const cwd = process.cwd();
+  const poeticDir = path10.join(cwd, ".poetic");
+  const dbDir = path10.join(poeticDir, "telemetry", "db");
+  const variantsDbPath = path10.join(dbDir, "variants.db");
+  const validationsDbPath = path10.join(dbDir, "validations.db");
+  const checks = [];
+  let variantsDbExists = false;
+  try {
+    await fs5.stat(variantsDbPath);
+    variantsDbExists = true;
+  } catch {
+  }
+  if (!variantsDbExists) {
+    checks.push({
+      name: "variants.db",
+      category: "poetic",
+      status: "info",
+      message: "Not initialized yet",
+      details: 'Telemetry database is created automatically on first execution. Run "poetic init --db" to pre-create, or "poetic doctor --fix" to initialize now.',
+      fixable: true
+    });
+  } else {
+    try {
+      const SqliteDB = await getBetterSqlite3();
+      const db = new SqliteDB(variantsDbPath, { readonly: true });
+      try {
+        const result = db.prepare("SELECT 1 as test").get();
+        if (result?.test !== 1) {
+          checks.push({
+            name: "variants.db",
+            category: "poetic",
+            status: "fail",
+            message: "Database query failed",
+            details: variantsDbPath,
+            fixable: true
+          });
+          db.close();
+          return checks;
+        }
+        const integrityResult = db.prepare("PRAGMA quick_check").get();
+        if (integrityResult?.quick_check !== "ok") {
+          checks.push({
+            name: "variants.db",
+            category: "poetic",
+            status: "fail",
+            message: "Database integrity check failed",
+            details: `${variantsDbPath} - Run "poetic doctor --fix"; if corruption remains, follow the database quarantine procedure in docs/TROUBLESHOOTING.md`,
+            fixable: true
+          });
+          db.close();
+          return checks;
+        }
+        const schemaVersion = checkSchemaVersion(db);
+        if (schemaVersion !== SCHEMA_VERSION) {
+          checks.push({
+            name: "variants.db",
+            category: "poetic",
+            status: "warn",
+            message: `Schema version mismatch (expected ${SCHEMA_VERSION}, found ${schemaVersion})`,
+            details: variantsDbPath,
+            fixable: true
+          });
+        } else {
+          checks.push({
+            name: "variants.db",
+            category: "poetic",
+            status: "pass",
+            message: `Healthy (schema v${schemaVersion})`,
+            details: variantsDbPath
+          });
+        }
+        db.close();
+      } catch (error) {
+        db.close();
+        checks.push({
+          name: "variants.db",
+          category: "poetic",
+          status: "fail",
+          message: "Database error",
+          details: error instanceof Error ? error.message : String(error),
+          fixable: true
+        });
+      }
+    } catch (error) {
+      const likelyNativeMismatch = isLikelyBetterSqlite3NativeLoadMismatch(error);
+      checks.push({
+        name: "variants.db",
+        category: "poetic",
+        status: "fail",
+        message: likelyNativeMismatch ? "better-sqlite3 native module load mismatch" : "Database could not be opened",
+        details: formatDatabaseNativeErrorDetails(error),
+        fixable: true
+      });
+    }
+  }
+  let validationsDbExists = false;
+  try {
+    await fs5.stat(validationsDbPath);
+    validationsDbExists = true;
+  } catch {
+  }
+  if (!validationsDbExists) {
+    checks.push({
+      name: "validations.db",
+      category: "poetic",
+      status: "info",
+      message: "Not present (optional)"
+    });
+  } else {
+    try {
+      const SqliteDB = await getBetterSqlite3();
+      const db = new SqliteDB(validationsDbPath, { readonly: true });
+      try {
+        const result = db.prepare("SELECT 1 as test").get();
+        if (result?.test === 1) {
+          checks.push({
+            name: "validations.db",
+            category: "poetic",
+            status: "pass",
+            message: "Accessible",
+            details: validationsDbPath
+          });
+        }
+        db.close();
+      } catch (error) {
+        db.close();
+        checks.push({
+          name: "validations.db",
+          category: "poetic",
+          status: "warn",
+          message: "Database error",
+          details: error instanceof Error ? error.message : String(error)
+        });
+      }
+    } catch (error) {
+      const likelyNativeMismatch = isLikelyBetterSqlite3NativeLoadMismatch(error);
+      checks.push({
+        name: "validations.db",
+        category: "poetic",
+        status: "warn",
+        message: likelyNativeMismatch ? "better-sqlite3 native module load mismatch" : "Database could not be opened",
+        details: formatDatabaseNativeErrorDetails(error)
+      });
+    }
+  }
+  return checks;
+}
+async function checkStateMarker() {
+  const cwd = process.cwd();
+  const stateFile = path10.join(cwd, ".poetic", "state", "init.json");
+  try {
+    const content = await fs5.readFile(stateFile, "utf-8");
+    const state = JSON.parse(content);
+    const issues = [];
+    if (state.schemaVersion !== SCHEMA_VERSION) {
+      issues.push(`Schema v${state.schemaVersion} (expected v${SCHEMA_VERSION})`);
+    }
+    if (state.tier !== "runtime" && state.tier !== "full") {
+      issues.push(`Invalid tier: ${state.tier}`);
+    }
+    if (issues.length > 0) {
+      return {
+        name: "State Marker",
+        category: "poetic",
+        status: "warn",
+        message: "State file has issues",
+        details: issues.join(", "),
+        fixable: true
+      };
+    }
+    return {
+      name: "State Marker",
+      category: "poetic",
+      status: "pass",
+      message: `Initialized (v${state.version}, tier: ${state.tier})`,
+      details: state.lastCheckedAt ? `Last checked: ${new Date(state.lastCheckedAt).toLocaleString()}` : "Last checked: unknown"
+    };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return {
+        name: "State Marker",
+        category: "poetic",
+        status: "warn",
+        message: "State file not found",
+        details: 'Run "poetic doctor --fix" to initialize',
+        fixable: true
+      };
+    }
+    return {
+      name: "State Marker",
+      category: "poetic",
+      status: "warn",
+      message: "Cannot read state file",
+      details: error instanceof Error ? error.message : String(error),
+      fixable: true
+    };
+  }
+}
+async function checkTelemetryMode() {
+  const poeticDir = getRuntimeEnv("POETIC_TELEMETRY_DIR") ?? path10.join(process.cwd(), ".poetic");
+  const dbDir = path10.join(poeticDir, "telemetry", "db");
+  const variantsDbPath = path10.join(dbDir, "variants.db");
+  try {
+    await fs5.stat(variantsDbPath);
+    const SqliteDB = await getBetterSqlite3();
+    const db = new SqliteDB(variantsDbPath, { readonly: true });
+    try {
+      db.prepare("SELECT 1").get();
+      db.close();
+      return {
+        name: "Telemetry Mode",
+        category: "poetic",
+        status: "pass",
+        message: "Database mode (full features)",
+        details: variantsDbPath
+      };
+    } catch (_error) {
+      db.close();
+      return {
+        name: "Telemetry Mode",
+        category: "poetic",
+        status: "warn",
+        message: "Degraded mode (JSONL-only)",
+        details: variantsDbPath
+      };
+    }
+  } catch (_error) {
+    return {
+      name: "Telemetry Mode",
+      category: "poetic",
+      status: "warn",
+      message: "Degraded mode (JSONL-only)",
+      details: variantsDbPath
+    };
+  }
+}
+async function resolvePoeticPackageRoot() {
+  let current = path10.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    try {
+      const packageJsonPath = path10.join(current, "package.json");
+      const packageJson = JSON.parse(await fs5.readFile(packageJsonPath, "utf8"));
+      if (packageJson.name === "@poetic-ai/poetic") {
+        return current;
+      }
+    } catch {
+    }
+    const parent = path10.dirname(current);
+    if (parent === current) {
+      return process.cwd();
+    }
+    current = parent;
+  }
+}
+async function checkDistArtifacts() {
+  try {
+    const { checkBuildFreshness } = await import("./flywheel-preflight-6E33DJDK.js");
+    const result = await checkBuildFreshness(await resolvePoeticPackageRoot());
+    if (result.passed) {
+      return {
+        name: "Build Artifacts",
+        category: "poetic",
+        status: "pass",
+        message: result.metadata?.packageMode ? "packaged dist artifacts are present" : "dist/entry.js is present and fresh",
+        details: result.warning
+      };
+    }
+    return {
+      name: "Build Artifacts",
+      category: "poetic",
+      status: "warn",
+      message: "Build artifacts need refresh",
+      details: result.error ? `${result.error} This is expected after source changes in a development checkout. Most source tests do not require fresh dist output; run npm run build when testing the bundled poetic binary against the latest source.` : "Most source tests do not require fresh dist output; run npm run build when testing the bundled poetic binary against the latest source."
+    };
+  } catch (error) {
+    return {
+      name: "Build Artifacts",
+      category: "poetic",
+      status: "warn",
+      message: "Could not verify dist artifacts",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function calculateDirectorySize(dirPath) {
+  let totalSize = 0;
+  const entries = await fs5.readdir(dirPath, { withFileTypes: true });
+  for (const entry of entries) {
+    const entryPath = path10.join(dirPath, entry.name);
+    if (entry.isDirectory()) {
+      totalSize += await calculateDirectorySize(entryPath);
+    } else if (entry.isFile()) {
+      const stat2 = await fs5.stat(entryPath);
+      totalSize += stat2.size;
+    }
+  }
+  return totalSize;
+}
+var FOREIGN_COORDINATION_LOCK_REMEDIATION = "Local process liveness cannot be verified for foreign locks. Verify the owning machine is not running Poetic against this repo, then delete the lock file:";
+var UNREADABLE_COORDINATION_LOCK_REMEDIATION = "Poetic cannot safely verify unreadable coordination locks. Verify no Poetic process owns the lock, then delete the lock file:";
+function formatCoordinationLockAge(ageMs) {
+  const ageSec = Math.round(ageMs / 1e3);
+  if (ageSec < 60) {
+    return `${ageSec}s`;
+  }
+  const ageMin = Math.round(ageSec / 60);
+  if (ageMin < 60) {
+    return `${ageMin}m`;
+  }
+  const ageHours = Math.round(ageMin / 60);
+  return `${ageHours}h`;
+}
+function formatCoordinationLockLine(diagnostic) {
+  const machinePart = diagnostic.machineIdShort ?? "unknown";
+  const pidPart = diagnostic.pid ?? "n/a";
+  const agePart = formatCoordinationLockAge(diagnostic.ageMs);
+  return `${diagnostic.name}: ${diagnostic.classification} (pid=${pidPart}, machine=${machinePart}, age=${agePart})`;
+}
+function isForeignStaleCoordinationLock(diagnostic, staleMs) {
+  if (diagnostic.classification !== "foreign-machine") {
+    return false;
+  }
+  return diagnostic.ageMs >= staleMs;
+}
+async function checkCoordinationLocks() {
+  const { DEFAULT_STALE_LOCK_MS, diagnoseCoordinationLocks } = await import("./backend-P3DAYRP7.js");
+  const cwd = process.cwd();
+  const locksDir = path10.join(cwd, ".poetic", "planning", "coordination", "locks");
+  const diagnostics = diagnoseCoordinationLocks(locksDir);
+  if (diagnostics.length === 0) {
+    return null;
+  }
+  const foreignStaleLocks = diagnostics.filter(
+    (diagnostic) => isForeignStaleCoordinationLock(diagnostic, DEFAULT_STALE_LOCK_MS)
+  );
+  const unreadableLocks = diagnostics.filter((d) => d.classification === "unreadable");
+  const liveCount = diagnostics.filter((d) => d.classification === "live").length;
+  const staleSameMachineCount = diagnostics.filter(
+    (d) => d.classification === "stale-same-machine"
+  ).length;
+  const foreignCount = diagnostics.filter((d) => d.classification === "foreign-machine").length;
+  const detailLines = diagnostics.map(formatCoordinationLockLine);
+  const remediationLines = foreignStaleLocks.map(
+    (diagnostic) => `${FOREIGN_COORDINATION_LOCK_REMEDIATION} ${diagnostic.lockPath}`
+  );
+  remediationLines.push(
+    ...unreadableLocks.map(
+      (diagnostic) => `${UNREADABLE_COORDINATION_LOCK_REMEDIATION} ${diagnostic.lockPath}`
+    )
+  );
+  const manualRemediationCount = foreignStaleLocks.length + unreadableLocks.length;
+  let status = "pass";
+  if (foreignStaleLocks.length > 0 || unreadableLocks.length > 0) {
+    status = "warn";
+  } else if (staleSameMachineCount > 0) {
+    status = "info";
+  }
+  const messageParts = [`${diagnostics.length} coordination lock(s)`];
+  if (liveCount > 0) {
+    messageParts.push(`${liveCount} live`);
+  }
+  if (staleSameMachineCount > 0) {
+    messageParts.push(`${staleSameMachineCount} stale-same-machine`);
+  }
+  if (foreignCount > 0) {
+    messageParts.push(`${foreignCount} foreign-machine`);
+  }
+  if (unreadableLocks.length > 0) {
+    messageParts.push(`${unreadableLocks.length} unreadable`);
+  }
+  if (manualRemediationCount > 0) {
+    messageParts.push(`${manualRemediationCount} require manual remediation`);
+  }
+  const detailsParts = [...detailLines];
+  if (remediationLines.length > 0) {
+    detailsParts.push("", ...remediationLines);
+  }
+  return {
+    name: "Coordination Locks",
+    category: "poetic",
+    status,
+    message: messageParts.join("; "),
+    details: detailsParts.join("\n     ")
+  };
+}
+async function checkDiskSpace() {
+  const poeticDir = getRuntimeEnv("POETIC_TELEMETRY_DIR") ?? path10.join(process.cwd(), ".poetic");
+  const telemetryDir = path10.join(poeticDir, "telemetry");
+  try {
+    try {
+      await fs5.stat(telemetryDir);
+    } catch (_error) {
+      return {
+        name: "Disk Space",
+        category: "resources",
+        status: "info",
+        message: "Telemetry directory not found",
+        details: 'Run "poetic init" to initialize'
+      };
+    }
+    const totalSize = await calculateDirectorySize(telemetryDir);
+    const sizeMB = totalSize / (1024 * 1024);
+    const sizeGB = sizeMB / 1024;
+    if (sizeGB > 2) {
+      return {
+        name: "Disk Space",
+        category: "resources",
+        status: "fail",
+        message: `Telemetry directory very large: ${sizeGB.toFixed(2)} GB`,
+        details: 'Consider running "poetic cleanup" to remove old data'
+      };
+    }
+    if (sizeMB > 500) {
+      return {
+        name: "Disk Space",
+        category: "resources",
+        status: "warn",
+        message: `Telemetry directory: ${sizeMB.toFixed(1)} MB`,
+        details: "Consider periodic cleanup"
+      };
+    }
+    return {
+      name: "Disk Space",
+      category: "resources",
+      status: "pass",
+      message: `Telemetry directory: ${sizeMB.toFixed(1)} MB`,
+      details: telemetryDir
+    };
+  } catch (error) {
+    return {
+      name: "Disk Space",
+      category: "resources",
+      status: "fail",
+      message: "Cannot check disk space",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkMemory() {
+  try {
+    const totalGB = os.totalmem() / (1024 * 1024 * 1024);
+    const freeGB = getAvailableMemoryGB();
+    const usedPercent = Math.max(0, (totalGB - freeGB) / totalGB * 100);
+    if (freeGB < 0.5) {
+      return {
+        name: "Memory",
+        category: "resources",
+        status: "fail",
+        message: `Critical: only ${freeGB.toFixed(2)} GB available`,
+        details: `${usedPercent.toFixed(1)}% used of ${totalGB.toFixed(1)} GB total`
+      };
+    }
+    if (freeGB < 1) {
+      return {
+        name: "Memory",
+        category: "resources",
+        status: "warn",
+        message: `Low memory: ${freeGB.toFixed(2)} GB available`,
+        details: `${usedPercent.toFixed(1)}% used of ${totalGB.toFixed(1)} GB total`
+      };
+    }
+    return {
+      name: "Memory",
+      category: "resources",
+      status: "pass",
+      message: `${freeGB.toFixed(2)} GB available of ${totalGB.toFixed(1)} GB`,
+      details: `${usedPercent.toFixed(1)}% used`
+    };
+  } catch (error) {
+    return {
+      name: "Memory",
+      category: "resources",
+      status: "fail",
+      message: "Cannot check system memory",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkNodeVersion() {
+  const currentVersion = process.version;
+  const versionPart = currentVersion.slice(1).split(".")[0];
+  const major = versionPart ? Number.parseInt(versionPart, 10) : 0;
+  const preferredPath = await preferredNode24Path();
+  if (major !== REQUIRED_NODE_MAJOR) {
+    return {
+      name: "Node.js",
+      category: "system",
+      status: "fail",
+      message: `Node.js ${currentVersion} is not supported`,
+      details: formatNode24Remediation(preferredPath)
+    };
+  }
+  const homebrewDetail = preferredPath ? ` | Homebrew Node 24: ${preferredPath}` : "";
+  return {
+    name: "Node.js",
+    category: "system",
+    status: "pass",
+    message: `Node.js ${currentVersion}`,
+    details: `${process.platform}/${process.arch} \u2014 ${process.execPath}${homebrewDetail}`
+  };
+}
+async function checkGitRepository() {
+  try {
+    const result = await execa("git", ["rev-parse", "--is-inside-work-tree"]);
+    if (result.stdout.trim() === "true") {
+      let branchName = "unknown";
+      const branch = await execa("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+        reject: false
+      });
+      if (branch.exitCode === 0 && branch.stdout.trim() && branch.stdout.trim() !== "HEAD") {
+        branchName = branch.stdout.trim();
+      } else {
+        const symbolicBranch = await execa("git", ["symbolic-ref", "--short", "HEAD"], {
+          reject: false
+        });
+        if (symbolicBranch.exitCode === 0 && symbolicBranch.stdout.trim()) {
+          branchName = symbolicBranch.stdout.trim();
+        }
+      }
+      let details;
+      try {
+        const remoteResult = await execa("git", ["remote", "get-url", "origin"], { reject: false });
+        const remoteUrl = remoteResult.stdout.trim();
+        details = remoteUrl ? `branch: ${branchName}, remote: ${remoteUrl}` : `branch: ${branchName}, no remote`;
+      } catch (_remoteError) {
+        details = `branch: ${branchName}, no remote`;
+      }
+      return {
+        name: "Git Repository",
+        category: "git",
+        status: "pass",
+        message: `Inside git repository (branch: ${branchName})`,
+        details
+      };
+    }
+    return {
+      name: "Git Repository",
+      category: "git",
+      status: "warn",
+      message: "Not inside a git repository",
+      details: "Some features may not work correctly"
+    };
+  } catch (_error) {
+    return {
+      name: "Git Repository",
+      category: "git",
+      status: "warn",
+      message: "Not inside a git repository",
+      details: "Some features may not work correctly"
+    };
+  }
+}
+var DOCTOR_LINK_CHECK_TIMEOUT_MS = 5e3;
+async function checkKnowledgeKit(cwd, options = {}) {
+  const checkLinks = options.checkLinks === true;
+  try {
+    const result = await knowledgeDoctorChecks(cwd, {
+      checkLinks,
+      linkTimeoutMs: DOCTOR_LINK_CHECK_TIMEOUT_MS,
+      ...options.probeLink ? { probeLink: options.probeLink } : {}
+    });
+    if (!result.manifestPresent) {
+      const intent = readIntentContract(cwd);
+      if (intent.status === "ok" && intent.contract.status !== "retired") {
+        const resolved = resolveIntent(detectStack(cwd), intent.contract).contract;
+        const lines = resolved.dimensions.map((d) => describeDimension(d));
+        const hasConflict = resolved.status === "conflict";
+        return {
+          name: "Knowledge Kit",
+          category: "knowledge",
+          status: "warn",
+          message: hasConflict ? `No kit accepted; stack intent "${intent.contract.spec}" has unresolved conflicts \u2014 run poetic knowledge offer (headless) or poetic init in a terminal to receive the kit` : `No knowledge kit accepted yet (stack intent "${intent.contract.spec}" pending) \u2014 run poetic knowledge offer (headless) or poetic init in a terminal to receive the kit`,
+          details: `Declared ${intent.contract.declaredAt.slice(0, 10)}${intent.contract.rationale ? ` \u2014 ${intent.contract.rationale}` : ""}
+     ${lines.join("\n     ")}
+     Run 'poetic knowledge offer' (headless) or 'poetic init' in a terminal to review recommendations${hasConflict ? " and resolve the conflict" : ""}.`
+        };
+      }
+      return {
+        name: "Knowledge Kit",
+        category: "knowledge",
+        status: "info",
+        message: "No knowledge kit accepted yet",
+        details: "Run 'poetic init' in an interactive session to review stack recommendations. Greenfield repo (no code yet)? Declare the intended stack: poetic init --stack <spec>."
+      };
+    }
+    if (result.findings.length === 0) {
+      return {
+        name: "Knowledge Kit",
+        category: "knowledge",
+        status: "pass",
+        message: checkLinks ? "Knowledge manifest present; no issues found (links checked)" : "Knowledge manifest present; no issues found"
+      };
+    }
+    const severityToStatus = (severity) => severity === "error" ? "fail" : severity === "warn" ? "warn" : "info";
+    const worst = result.findings.some((f) => f.severity === "error") ? "fail" : result.findings.some((f) => f.severity === "warn") ? "warn" : "info";
+    const details = result.findings.map((finding) => `[${severityToStatus(finding.severity)}] ${finding.message}`).join("\n     ");
+    return {
+      name: "Knowledge Kit",
+      category: "knowledge",
+      status: worst,
+      message: `${result.findings.length} knowledge finding(s)`,
+      details
+    };
+  } catch (error) {
+    return {
+      name: "Knowledge Kit",
+      category: "knowledge",
+      status: "warn",
+      message: "Could not run knowledge checks",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function checkPendingInitNotices(cwd) {
+  let count = 0;
+  try {
+    count = pendingNoticesCount(cwd);
+  } catch {
+  }
+  if (count === 0) {
+    return {
+      name: "Pending Init Notices",
+      category: "knowledge",
+      status: "pass",
+      message: "No pending init notices",
+      notices_pending: 0
+    };
+  }
+  return {
+    name: "Pending Init Notices",
+    category: "knowledge",
+    status: "info",
+    message: `${count} init notice(s) pending review`,
+    details: "Notices are shown below (human output) or after the summary.",
+    notices_pending: count
+  };
+}
+function checkPendingOfferNotice(cwd) {
+  let notice;
+  try {
+    notice = readPendingOfferNotice(cwd);
+  } catch {
+    notice = void 0;
+  }
+  if (!notice) {
+    return {
+      name: "Knowledge Offer",
+      category: "knowledge",
+      status: "pass",
+      message: "No pending knowledge-kit offer"
+    };
+  }
+  return {
+    name: "Knowledge Offer",
+    category: "knowledge",
+    status: "warn",
+    message: notice.message,
+    details: `Offer skipped ${notice.skippedAt.slice(0, 10)} (${notice.cause}); it clears when an offer runs.`
+  };
+}
+function renderDoctorPendingNudges(cwd, options, renderOptions = {}) {
+  const policy = {
+    json: options.json === true,
+    quiet: false,
+    verbose: options.verbose === true,
+    debug: false,
+    noColor: false,
+    level: "normal"
+  };
+  try {
+    return renderPendingNudges(cwd, policy, { ...renderOptions, includeAge: true });
+  } catch {
+    return { rendered: false, deliveredKeys: [], pendingCount: 0 };
+  }
+}
+async function runAllHealthChecks(options) {
+  const allChecks = [];
+  if (options.providersOnly) {
+    const includeVerboseProviderDetails2 = Boolean(options.verbose) && !options.json;
+    allChecks.push(
+      await checkProviderCLIs({
+        includeVerboseDetails: includeVerboseProviderDetails2,
+        all: options.all,
+        provider: options.provider,
+        probe: options.probe,
+        strict: options.strict,
+        requireReady: options.requireReady
+      })
+    );
+    allChecks.push(...await collectProviderExtraHealthChecks(options));
+    return allChecks;
+  }
+  allChecks.push(await checkNodeVersion());
+  allChecks.push(await checkMemory());
+  allChecks.push(await checkGit());
+  allChecks.push(await checkGitRepository());
+  const includeVerboseProviderDetails = Boolean(options.verbose) && !options.json;
+  allChecks.push(
+    await checkProviderCLIs({
+      includeVerboseDetails: includeVerboseProviderDetails,
+      all: options.all,
+      provider: options.provider,
+      probe: options.probe,
+      strict: options.strict,
+      requireReady: options.requireReady
+    })
+  );
+  allChecks.push(...await collectProviderExtraHealthChecks(options));
+  allChecks.push(await checkVerificationPrivilegeBoundary());
+  allChecks.push(await checkLinuxWriteBoundary());
+  allChecks.push(await checkPoeticDirectory());
+  const nestedCheck = await checkNestedPoeticDirectory();
+  if (nestedCheck) allChecks.push(nestedCheck);
+  allChecks.push(await checkRequiredDirectories());
+  allChecks.push(await checkArchiveReconciliation());
+  allChecks.push(await checkProviderConfig());
+  const executionRolesCheck = await checkExecutionRoles();
+  if (executionRolesCheck) allChecks.push(executionRolesCheck);
+  allChecks.push(await checkSteeringInstructions());
+  allChecks.push(...await checkDatabases());
+  allChecks.push(await checkStateMarker());
+  allChecks.push(await checkTelemetryMode());
+  allChecks.push(await checkDistArtifacts());
+  const coordinationLockCheck = await checkCoordinationLocks();
+  if (coordinationLockCheck) allChecks.push(coordinationLockCheck);
+  const knowledgeCwd = resolveRepoRootForPoeticDir(process.cwd());
+  allChecks.push(await checkKnowledgeKit(knowledgeCwd, { checkLinks: options.checkLinks }));
+  allChecks.push(checkPendingInitNotices(knowledgeCwd));
+  allChecks.push(checkPendingOfferNotice(knowledgeCwd));
+  allChecks.push(...await checkGuardrails(knowledgeCwd));
+  allChecks.push(await checkDiskSpace());
+  allChecks.push(await checkConcurrencyBudget());
+  return allChecks;
+}
+async function checkConcurrencyBudget() {
+  try {
+    const budget = detectHostConcurrencyBudget();
+    const basis = `${budget.totalMemoryGB.toFixed(0)} GB RAM, ${budget.performanceCores} performance cores`;
+    const recommendation = `up to ${budget.legSlots} concurrent legs, ${budget.validationSlots} concurrent validations (${basis})`;
+    let effectiveValue;
+    try {
+      const merged = await new ConfigManager().loadConfig();
+      const asValidConcurrency = (value) => typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+      effectiveValue = asValidConcurrency(merged.config.variants?.maxConcurrent) ?? asValidConcurrency(merged.config.worktree?.maxConcurrent);
+    } catch {
+    }
+    if (effectiveValue !== void 0 && effectiveValue > budget.legSlots) {
+      return {
+        name: "Concurrency budget",
+        category: "resources",
+        status: "warn",
+        message: `Effective max concurrent (${effectiveValue}) exceeds this host's recommendation`,
+        details: `This host recommends ${recommendation}. The configured value still runs as asked; validation pacing and memory pressure shedding are the safety net.`
+      };
+    }
+    return {
+      name: "Concurrency budget",
+      category: "resources",
+      status: "info",
+      message: `Recommended: ${recommendation}`,
+      details: `Effective max concurrent (config or default): ${effectiveValue ?? 4}. Recommendations are advisory; Poetic runs what you ask for.`
+    };
+  } catch (error) {
+    return {
+      name: "Concurrency budget",
+      category: "resources",
+      status: "info",
+      message: "Could not compute a host concurrency recommendation",
+      details: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function displayHealthResults(checks, options) {
+  if (options.json) {
+    console.log(JSON.stringify(checks, null, 2));
+    return;
+  }
+  console.log(chalk2.bold.cyan("\nPoetic Health Check\n"));
+  const categories = {
+    system: [],
+    git: [],
+    providers: [],
+    poetic: [],
+    knowledge: [],
+    guardrails: [],
+    resources: []
+  };
+  for (const check of checks) {
+    categories[check.category]?.push(check);
+  }
+  const categoryNames = {
+    system: "System Environment",
+    git: "Git Configuration",
+    providers: "AI Providers",
+    poetic: "Poetic Installation",
+    knowledge: "Knowledge & Init Drift",
+    guardrails: "Guardrails",
+    resources: "System Resources"
+  };
+  for (const [category, categoryChecks] of Object.entries(categories)) {
+    if (categoryChecks.length === 0) continue;
+    console.log(chalk2.bold(categoryNames[category]));
+    for (const check of categoryChecks) {
+      let statusIcon = "";
+      let statusColor;
+      switch (check.status) {
+        case "pass":
+          statusIcon = "OK";
+          statusColor = chalk2.green;
+          break;
+        case "warn":
+          statusIcon = "Warning: ";
+          statusColor = chalk2.yellow;
+          break;
+        case "fail":
+          statusIcon = "Error";
+          statusColor = chalk2.red;
+          break;
+        case "info":
+          statusIcon = "Info:";
+          statusColor = chalk2.blue;
+          break;
+      }
+      const checkName = check.name.padEnd(25);
+      console.log(`  ${statusColor(statusIcon)} ${chalk2.bold(checkName)} ${check.message}`);
+      if (options.verbose && check.details) {
+        console.log(chalk2.gray(`     ${check.details}`));
+      }
+    }
+    console.log();
+  }
+  const passCount = checks.filter((c) => c.status === "pass").length;
+  const warnCount = checks.filter((c) => c.status === "warn").length;
+  const failCount = checks.filter((c) => c.status === "fail").length;
+  const infoCount = checks.filter((c) => c.status === "info").length;
+  const fixableCount = checks.filter((c) => c.fixable && c.status !== "pass").length;
+  console.log(chalk2.bold.cyan("Summary\n"));
+  console.log(`  ${chalk2.green("Passed")}: ${passCount}`);
+  if (warnCount > 0) console.log(`  ${chalk2.yellow("Warnings")}: ${warnCount}`);
+  if (failCount > 0) console.log(`  ${chalk2.red("Failed")}: ${failCount}`);
+  if (infoCount > 0) console.log(`  ${chalk2.blue("Info")}: ${infoCount}`);
+  console.log();
+  if (failCount > 0) {
+    console.log(chalk2.bold.red("Error: Checks Failed\n"));
+    console.log(chalk2.gray("   Some checks failed. Review the issues above."));
+    if (fixableCount > 0) {
+      console.log(chalk2.gray(`   ${fixableCount} issue(s) can be fixed automatically.`));
+      console.log(chalk2.gray("   Run: poetic doctor --fix"));
+    }
+  } else if (warnCount > 0) {
+    console.log(chalk2.bold.yellow("Warning: Warnings Detected\n"));
+    console.log(chalk2.gray("   System is operational but some issues were found."));
+    if (fixableCount > 0) {
+      console.log(chalk2.gray(`   ${fixableCount} issue(s) can be fixed automatically.`));
+      console.log(chalk2.gray("   Run: poetic doctor --fix"));
+    }
+  } else {
+    console.log(chalk2.bold.green("OK: All Systems Healthy\n"));
+    console.log(chalk2.gray("   Poetic is ready to use!"));
+  }
+  if (!options.verbose && (warnCount > 0 || failCount > 0)) {
+    console.log(chalk2.gray("\nTip: Run with --verbose flag for more details"));
+  }
+  console.log();
+}
+function createDoctorCommand() {
+  const health = new Command2("doctor");
+  health.description(
+    "Check system health and diagnose issues\n\nExamples:\n  poetic doctor                    # Check configured providers only\n  poetic doctor --all              # Check all known providers\n  poetic doctor --provider claude  # Check specific provider\n  poetic doctor --providers-only --provider claude  # Check provider CLI and cached auth evidence\n  poetic doctor --probe --provider claude  # Probe provider auth and update cached evidence\n  poetic doctor --verbose          # Show detailed information\n  poetic doctor --fix              # Automatically repair issues\n  poetic doctor --json             # Output as JSON\n  poetic doctor --matrix           # Show provider support matrix"
+  );
+  health.aliases(["d"]);
+  health.addCommand(createDoctorMetricsCommand());
+  health.option("--json", "(OPTIONAL) Output results as JSON");
+  health.option("-v, --verbose", "(OPTIONAL) Show detailed information");
+  health.option("--fix", "(OPTIONAL) Attempt to repair issues automatically");
+  health.option("-a, --all", "(OPTIONAL) Check all known providers");
+  health.option("-p, --provider <id>", "(OPTIONAL) Check specific provider only");
+  health.option("--providers-only", "(OPTIONAL) Check provider CLI and cached auth evidence only");
+  health.option("--matrix", "(OPTIONAL) Show provider support matrix with tier and health status");
+  health.option(
+    "--strict",
+    "(OPTIONAL) Exit non-zero on identity failures (CLI missing, config invalid). Unobserved auth and zero ready providers do not fail"
+  );
+  health.option(
+    "--require-ready",
+    "(OPTIONAL) Exit non-zero when no checked provider can run (opt-in readiness gate)"
+  );
+  health.option("--probe", "(OPTIONAL) Run provider auth probes and update auth liveness cache");
+  health.option("--refresh", "(OPTIONAL) Clear cached auth liveness before checking");
+  health.option(
+    "--check-links",
+    "(OPTIONAL) Probe knowledge-kit source URLs for dead links (network; 5s/link; default off)"
+  );
+  health.action(async (options) => {
+    const validatedOptions = validateCommandOptions(HealthCommandOptionsSchema, options);
+    if (validatedOptions.refresh) {
+      await invalidateAuthOutcome(validatedOptions.provider);
+    }
+    if (validatedOptions.matrix) {
+      const { collectProviderMatrix } = await import("./provider-matrix-KWTYA5QV.js");
+      const { renderProviderMatrix } = await import("./provider-matrix-renderer-MZDWKKID.js");
+      const rows = await collectProviderMatrix({
+        probeAuth: true,
+        providerFilter: validatedOptions.provider
+      });
+      if (validatedOptions.json) {
+        const checks2 = await runAllHealthChecks(validatedOptions);
+        console.log(JSON.stringify({ checks: checks2, providerMatrix: rows }, null, 2));
+        exitForHealthFailures(checks2, validatedOptions);
+        return;
+      }
+      console.log(renderProviderMatrix(rows));
+      const skipNormalChecks = !validatedOptions.all && !validatedOptions.providersOnly && !validatedOptions.fix;
+      if (skipNormalChecks) {
+        if (rows.some((row) => row.status !== "available")) {
+          process.exit(1);
+        }
+        return;
+      }
+    }
+    if (validatedOptions.fix) {
+      console.log(chalk2.bold.cyan("\nRepairing Poetic Installation\n"));
+      const cwd = resolveRepoRootForPoeticDir(process.cwd());
+      const nestedDir = path10.join(cwd, ".poetic", ".poetic");
+      try {
+        const stats = await fs5.stat(nestedDir);
+        if (stats.isDirectory()) {
+          console.log(chalk2.gray("Removing nested .poetic/.poetic/ directory (bug artifact)..."));
+          await fs5.rm(nestedDir, { recursive: true, force: true });
+          console.log(chalk2.green("  OK Removed nested directory"));
+        }
+      } catch (_error) {
+      }
+      try {
+        const result = await ensurePoeticInitialized({
+          cwd,
+          tier: "runtime",
+          repair: true,
+          verbose: validatedOptions.verbose,
+          allowDegraded: true
+        });
+        if (result.status === "ok") {
+          console.log(chalk2.green("OK: Repair completed successfully"));
+        } else if (result.status === "degraded") {
+          console.log(chalk2.yellow("Warning: Repair completed with warnings (degraded mode)"));
+        } else {
+          console.log(chalk2.red("Error: Repair failed"));
+        }
+        if (result.actions.created.length > 0) {
+          console.log(chalk2.gray(`
+Created ${result.actions.created.length} item(s):`));
+          for (const item of result.actions.created) {
+            console.log(chalk2.gray(`  - ${item}`));
+          }
+        }
+        if (result.actions.repaired.length > 0) {
+          console.log(chalk2.gray(`
+Repaired ${result.actions.repaired.length} item(s):`));
+          for (const item of result.actions.repaired) {
+            console.log(chalk2.gray(`  - ${item}`));
+          }
+        }
+        if (result.warnings.length > 0) {
+          console.log(chalk2.yellow(`
+Warnings (${result.warnings.length}):`));
+          for (const warning of result.warnings) {
+            console.log(chalk2.yellow(`  Warning: ${warning}`));
+          }
+        }
+        if (result.errors.length > 0) {
+          console.log(chalk2.red(`
+Errors (${result.errors.length}):`));
+          for (const error of result.errors) {
+            console.log(chalk2.red(`  Error ${error.message}`));
+            if (error.path) {
+              console.log(chalk2.gray(`    Path: ${error.path}`));
+            }
+          }
+        }
+        if (result.nextSteps.length > 0) {
+          console.log(chalk2.bold("\nNext Steps:"));
+          for (const step of result.nextSteps) {
+            console.log(chalk2.gray(`  \u2022 ${step}`));
+          }
+        }
+        console.log(chalk2.gray(`
+Completed in ${result.initDurationMs}ms`));
+        console.log(chalk2.gray(`Telemetry mode: ${result.telemetryMode}`));
+        if (result.schemaVersion) {
+          console.log(chalk2.gray(`Schema version: ${result.schemaVersion}`));
+        }
+        console.log();
+        console.log(chalk2.bold.cyan("Re-running Health Checks\n"));
+      } catch (error) {
+        console.error(
+          chalk2.red("Error: Repair failed:"),
+          error instanceof Error ? error.message : String(error)
+        );
+        process.exit(1);
+      }
+    }
+    const checks = await runAllHealthChecks(validatedOptions);
+    displayHealthResults(checks, validatedOptions);
+    renderDoctorPendingNudges(resolveRepoRootForPoeticDir(process.cwd()), validatedOptions);
+    exitForHealthFailures(checks, validatedOptions);
+  });
+  return health;
+}
+
+export {
+  recordDelivery,
+  checkDrift,
+  shouldSuppressNudges,
+  renderPendingNudges,
+  checkWrapperVisibility,
+  PENDING_OFFER_NOTICE_MESSAGE,
+  writePendingOfferNotice,
+  readPendingOfferNotice,
+  clearPendingOfferNotice,
+  GUARD_KIT_VERSION,
+  GUARD_DIR_REL,
+  CHECK_SCRIPT_REL,
+  CONFIG_FILE_REL,
+  LOCK_FILE_REL,
+  SETUP_PLAYBOOK_REL,
+  CI_WORKFLOW_TEMPLATE_FILE,
+  BASELINES_DIR_REL,
+  GENERATED_HASHED_FILES,
+  getGuardKitTemplatesDir,
+  repairGuardCaseIssues,
+  formatGuardCaseIssues,
+  compareKitVersions,
+  classifyGuardState,
+  PROVIDER_CLI_SPEC_IDS,
+  checkProviderCLIs,
+  checkLinuxWriteBoundary,
+  checkCoordinationLocks,
+  checkKnowledgeKit,
+  checkPendingInitNotices,
+  checkPendingOfferNotice,
+  renderDoctorPendingNudges,
+  runAllHealthChecks,
+  createDoctorCommand
+};
+//# sourceMappingURL=chunk-SSB5UQHA.js.map