@productbrain/cli 0.1.0-beta.72 → 0.1.0-beta.7204

package/dist/commands/handshake.js

@@ -1,24 +1,49 @@
 /**
  * pb handshake — generate context files for AI developer tools.
- * The fourth delivery surface: context export (GLO-63, DEC-161).
+ * Context export wiring (read-only filesystem bridge; GLO-63, DEC-161) — not a product surface.
  */
-import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, copyFileSync } from 'fs';
-import { join, dirname, resolve } from 'path';
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, copyFileSync, realpathSync } from 'fs';
+import { join, dirname, resolve, basename, relative, sep, isAbsolute } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
+import { createHash } from 'crypto';
+import { execSync } from 'child_process';
 import { getConfigOrGuide } from '../lib/config.js';
-import { select as promptSelect } from '../lib/prompts.js';
-import { kernelCall } from '../lib/client.js';
+import { select as promptSelect, confirm as promptConfirm } from '../lib/prompts.js';
+import { composeHooksFromIntents, getHookStatusForSurface } from '../lib/hook-intents.js';
+import { kernelCall, kernelCallWithSession } from '../lib/client.js';
+import { readSession } from '../lib/session.js';
 import { detectRepo, extractWorkspaceProfile } from '../lib/repo-detect.js';
 import { generateContextMd } from '../generators/context-md.js';
 import { generateBriefingMd } from '../generators/briefing-md.js';
-import { MARKER, generateAgentsMd, generateClaudeMd, generateCursorMdc, generateCopilotMd } from '../generators/adapters.js';
-import { readCanonicalSkills, readCanonicalRules, generateCursorSkill, generateCursorRule, generateCodexSkill, generateCodexSkillIndex, generateClaudeRule, generateClaudeSkillRouter, shouldEmitToTarget, filterByLevel, validateCodexSkills, evaluateConditions, STAGE_TO_MAX_LEVEL, LEVEL_ORDER, } from '../generators/portable-knowledge.js';
+import { MARKER, generateAgentsMd, generateClaudeMd, generateCursorMdc, generateCopilotMd, generateCopilotInstructionFiles } from '../generators/adapters.js';
+import { readCanonicalSkills, readCanonicalRules, readPersonalLayer, readPersonalSkillsLayer, generateCursorSkill, generateCursorRule, generateCodexSkill, generateCodexSkillIndex, shouldEmitToTarget, filterByLevel, validateCodexSkills, evaluateConditions, STAGE_TO_MAX_LEVEL, LEVEL_ORDER, } from '../generators/portable-knowledge.js';
 import { generateChainRules } from '../generators/chain-rules.js';
+import { findNoProjectionAssets } from '../generators/noProjectionAssets.js'; // WP-660 S2 combine
 import { saveHandshakeState, loadPreviousState, diffHandshakeState, formatDiff, buildCurrentState, } from '../generators/handshake-diff.js';
 import { resolveSurfaceProfile } from '../generators/surface-profiles.js';
 import { formatHandshakeReport } from '../formatters/handshake.js';
+import { classifyAdapterFile, detectEol, spliceAppend, spliceReplace } from '../generators/region.js';
+import { REGION_PROJECTIONS } from '../generators/region-projections.js';
+import { readManifest, readManifestStatus, filterByAdoptionState } from '../generators/manifest.js';
+import { generateBoundaryManifest, getBoundaryEnforcementMode } from '../generators/boundary-manifest.js';
+import { loadMethodRegistry } from '../lib/method-registry.js';
 import { CLIError, ErrorCode } from '../lib/errors.js';
+import { trackEvent } from '../lib/telemetry.js';
+import { isJsonMode } from '../lib/runner.js';
+import { stripConvexInternals } from '../lib/strip.js';
+import { replaceVocabTokens } from '../lib/canonicalRefs.js';
+// WP-436 S3: vocab projector — resolves {{vocab:...}} tokens before writing to disk.
+import { getOrFetchVocabCtx } from '../lib/workspaceVocabCache.js';
+import { normalizeMaterializedFilename } from '../lib/normalizeMaterializedFilename.js';
+import { findLeftoverCursorSkills, LEFTOVER_FILES_MAX } from './handshakeCursorSkillCleanup.js';
+import { classifyDriftBucket } from './handshakeDriftClassification.js';
+import { parseSetupFrontmatter } from '../lib/frontmatter.js';
+import { sanitizeStartupResolutionSignals } from '../lib/startup-resolution-signals.js';
+import { assertSetupWritePath } from '../setup/perimeter.js';
+// WP-421 S3: SurfaceAdapter reverse-map for tampered prompts (DEC-952, doneWhen #34).
+import { canonicalPathForAnySurface, SURFACE_GOVERN_NO_SURFACES, SURFACE_REGISTRY, validateSurfacesForMode, } from '../surfaces/registry.js';
+import { getReverseMapFallbackMessage, reportReverseMapMissing } from '../surfaces/telemetry.js';
 const LEVELS = {
     guide: {
         label: 'Guide me',
@@ -47,12 +72,8 @@ const LEVELS = {
 };
 // Explicit ordering — determines menu numbering in promptLevel(). Do not reorder.
 const LEVEL_KEYS = ['guide', 'work', 'silent', 'full-trust'];
-// Hook failure contract (TEN-712): all hook commands MUST end with '2>/dev/null || true'
-// so Claude Code always starts even if pb is unavailable. Never remove this suffix.
+// Hook failure contract (TEN-712): every hook command MUST end with '|| true' so Claude Code always starts even if pb is unavailable.
 const INIT_PERMISSION = 'Bash(pb:*)';
-const INIT_SESSION_START_CMD = 'pb session start 2>/dev/null || true';
-const INIT_SESSION_CLOSE_CMD = 'pb session close 2>/dev/null || true';
-const INIT_PRECOMPACT_CMD = 'pb session id > /dev/null 2>&1 && echo \'{"systemMessage": "pb session active — capture decisions/tensions before compacting: pb capture \\"DEC: ...\\""}\'  || true';
 function readSettings(filePath) {
     if (!existsSync(filePath))
         return {};
@@ -64,9 +85,6 @@ function readSettings(filePath) {
         return {};
     }
 }
-function hasCommand(groups, cmd) {
-    return (groups ?? []).some((g) => g.hooks?.some((h) => h.command === cmd));
-}
 // Team write: hooks + Bash(pb:*) → .claude/settings.json (safe to commit)
 function writeTeamSettings(cwd, dryRun) {
     const claudeDir = join(cwd, '.claude');
@@ -82,26 +100,10 @@ function writeTeamSettings(cwd, dryRun) {
     }
     settings.permissions = permissions;
     const hooks = (settings.hooks ?? {});
-    if (!hasCommand(hooks.SessionStart, INIT_SESSION_START_CMD)) {
-        hooks.SessionStart = [
-            ...(hooks.SessionStart ?? []),
-            { hooks: [{ type: 'command', command: INIT_SESSION_START_CMD, statusMessage: 'Opening pb session...' }] },
-        ];
-        added.push('SessionStart → pb session start');
-    }
-    if (!hasCommand(hooks.Stop, INIT_SESSION_CLOSE_CMD)) {
-        hooks.Stop = [
-            ...(hooks.Stop ?? []),
-            { hooks: [{ type: 'command', command: INIT_SESSION_CLOSE_CMD, statusMessage: 'Closing pb session...' }] },
-        ];
-        added.push('Stop → pb session close');
-    }
-    if (!hasCommand(hooks.PreCompact, INIT_PRECOMPACT_CMD)) {
-        hooks.PreCompact = [
-            ...(hooks.PreCompact ?? []),
-            { hooks: [{ type: 'command', command: INIT_PRECOMPACT_CMD }] },
-        ];
-        added.push('PreCompact → decision capture reminder');
+    const hookAdditions = composeHooksFromIntents(['session-start', 'session-close', 'pre-compact'], hooks);
+    for (const addition of hookAdditions) {
+        hooks[addition.event] = [...(hooks[addition.event] ?? []), addition.entry];
+        added.push(addition.label);
     }
     settings.hooks = hooks;
     if (!dryRun) {
@@ -171,8 +173,7 @@ export async function runHandshakeInit(options = {}) {
         for (const item of teamAdded)
             console.log(`    + ${item}`);
     }
-    // Step 2: Personal config — wizard or --level flag
-    // Cast is safe: LEVEL_KEYS.includes() validated above; invalid level already threw CLIError.
+    // Step 2: Personal config — wizard or --level flag. Cast is safe: LEVEL_KEYS.includes() validated above.
     const levelKey = options.level ? options.level : await promptLevel();
     const level = LEVELS[levelKey];
     const personalAdded = writePersonalSettings(levelKey, dryRun);
@@ -194,6 +195,27 @@ export async function runHandshakeInit(options = {}) {
     if (!dryRun)
         console.log('Reload /hooks in Claude Code (or restart) to activate.');
     console.log('Run `pb handshake --init --level <guide|work|silent|full-trust>` to change level.');
+    // Step 2b: Report multi-surface hook opt-in status (WP-310 E3b) — manifest.hooks.{cursor,copilot}, silence = no manifest/flags (DEC-536).
+    const pbDirForManifest = join(cwd, '.productbrain');
+    const initManifest = readManifest(pbDirForManifest);
+    const multiSurfaceOptIns = [];
+    if (initManifest?.hooks?.cursor)
+        multiSurfaceOptIns.push('cursor');
+    if (initManifest?.hooks?.copilot)
+        multiSurfaceOptIns.push('copilot');
+    if (multiSurfaceOptIns.length > 0) {
+        console.log('');
+        for (const surface of multiSurfaceOptIns) {
+            const status = getHookStatusForSurface(surface);
+            if (status.writable) {
+                // Future-proofing path: surface has hook events, would write files.
+                console.log(`ℹ ${surface} hooks: opted in — hooks will be written`);
+            }
+            else {
+                console.log(`ℹ ${surface} hooks: opted in — no auto-hooks (${surface} has no session events; run \`pb session start\` manually)`);
+            }
+        }
+    }
     // Step 3: Scaffold starter templates if .productbrain/rules/ is empty
     const rulesDir = join(cwd, '.productbrain', 'rules');
     const hasExistingRules = existsSync(rulesDir) && readdirSync(rulesDir).filter((f) => f.endsWith('.md')).length > 0;
@@ -242,24 +264,385 @@ export async function runHandshakeInit(options = {}) {
         }
     }
 }
-/**
- * Normalize volatile handshake-only timestamps before comparing generated files.
- * This keeps the visible timestamps in generated artifacts while avoiding
- * meaningless rewrites when semantic content is unchanged.
- */
+const LOCAL_REF_REGEX = /\b(?:WP|TEN|DEC|BET|FEAT|INS|STD|PRI|ARCH)[-\s#]*\d+\b|\bPR\s*#?\s*\d+\b/gi;
+const STARTUP_RESOLUTION_RESOLVER_VERSION = 'startup-resolution-v1';
+// Global cap on collected refs (spec "Contract: StartupResolutionSignals" — arrays are capped).
+const LOCAL_REF_GLOBAL_CAP = 25;
+// Per-source cap so a broad source (context.md) can't starve briefing.md's task-specific refs (Codex@677).
+const LOCAL_REF_PER_SOURCE_CAP = 18;
+// Time-boxed so an unauthed/slow `gh` can't stall session-start (F4).
+const PR_DIFF_TIMEOUT_MS = 4_000;
+// Bounds worst-case `gh` subprocess invocations per handshake.
+const PR_DIFF_MAX_REFS = 5;
+function runGitText(cwd, command) {
+    try {
+        const value = execSync(command, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return value.length > 0 ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Dereference a "PR #N" ref to its changed paths via `gh pr diff <N> --name-only` (F4: server
+ *  resolver has no git/gh access). Guarded/time-boxed; `run` is injectable for tests. */
+export function dereferencePrRefToPaths(cwd, prNumber, run = runGitTextTimeboxed) {
+    if (!Number.isInteger(prNumber) || prNumber <= 0)
+        return [];
+    const raw = run(cwd, `gh pr diff ${prNumber} --name-only`, PR_DIFF_TIMEOUT_MS);
+    if (!raw)
+        return [];
+    return raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+/** Time-boxed variant of runGitText for the PR-diff dereference (F4). */
+function runGitTextTimeboxed(cwd, command, timeoutMs) {
+    try {
+        const value = execSync(command, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: timeoutMs,
+        }).trim();
+        return value.length > 0 ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readOptionalLocalText(cwd, path) {
+    const fullPath = join(cwd, path);
+    if (!existsSync(fullPath))
+        return undefined;
+    try {
+        return readFileSync(fullPath, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function normalizeLocalRef(ref) {
+    const trimmed = ref.trim().replace(/\s+/g, ' ');
+    const pr = trimmed.match(/^PR\s*#?\s*(\d+)$/i);
+    if (pr)
+        return `PR #${pr[1]}`;
+    const entry = trimmed.match(/^([A-Z]+)[-\s#]*(\d+)$/i);
+    if (entry)
+        return `${entry[1].toUpperCase()}-${entry[2]}`;
+    return trimmed;
+}
+/** Collect normalized local refs across several text sources, deduped. Codex@677: a per-source
+ *  cap alongside the global one, so a broad source (context.md) can't starve a later,
+ *  task-specific source (briefing.md); already-collected refs dedupe without spending later quota. */
+function collectLocalRefs(texts) {
+    const refs = [];
+    const seen = new Set();
+    for (const text of texts) {
+        if (!text)
+            continue;
+        let fromThisSource = 0;
+        for (const match of text.matchAll(LOCAL_REF_REGEX)) {
+            const ref = normalizeLocalRef(match[0]);
+            const key = ref.toLowerCase();
+            if (seen.has(key))
+                continue;
+            if (fromThisSource >= LOCAL_REF_PER_SOURCE_CAP)
+                break;
+            seen.add(key);
+            refs.push(ref);
+            fromThisSource++;
+            if (refs.length >= LOCAL_REF_GLOBAL_CAP)
+                return refs;
+        }
+    }
+    return refs;
+}
+function deriveHandshakeStartupTask(refs, changedPaths, callerTask) {
+    if (callerTask && callerTask.trim())
+        return callerTask.trim();
+    const parts = [];
+    if (refs.length > 0)
+        parts.push(refs.join(' '));
+    if (changedPaths.length > 0)
+        parts.push(`changed paths ${changedPaths.slice(0, 5).join(' ')}`);
+    return parts.length > 0 ? parts.join(' ') : undefined;
+}
+const DEFAULT_HANDSHAKE_SIGNAL_DEPS = {
+    runGit: runGitText,
+    prDiff: (cwd, prNumber) => dereferencePrRefToPaths(cwd, prNumber),
+};
+/** Extract the PR number from a normalized "PR #N" ref, else null. */
+function prNumberFromRef(ref) {
+    const m = ref.match(/^PR\s*#?\s*(\d+)$/i);
+    if (!m)
+        return null;
+    const n = Number(m[1]);
+    return Number.isInteger(n) && n > 0 ? n : null;
+}
+export function deriveHandshakeStartupSignals(cwd, callerSignals = {}, deps = DEFAULT_HANDSHAKE_SIGNAL_DEPS) {
+    const { runGit, prDiff } = deps;
+    const branchName = runGit(cwd, 'git branch --show-current');
+    const commitSha = runGit(cwd, 'git rev-parse --short HEAD');
+    // Changed paths, unioned + deduped: (1) dirty worktree; (2) committed branch delta vs origin/main's
+    // merge-base (Codex@665, invisible once the tree is clean); (3) PR-ref dereference (F4), appended later.
+    const dirtyChangedPaths = runGit(cwd, 'git diff --name-only HEAD')?.split(/\r?\n/).filter(Boolean) ?? [];
+    const mergeBase = runGit(cwd, 'git merge-base HEAD origin/main');
+    const branchChangedPaths = mergeBase
+        ? (runGit(cwd, `git diff --name-only ${mergeBase} HEAD`)?.split(/\r?\n/).filter(Boolean) ?? [])
+        : [];
+    const worktreeName = basename(cwd);
+    const contextText = readOptionalLocalText(cwd, '.productbrain/context.md');
+    const briefingText = readOptionalLocalText(cwd, '.productbrain/briefing.md');
+    const callerRefs = Array.isArray(callerSignals.reviewedArtifactRefs) ? callerSignals.reviewedArtifactRefs.join('\n') : undefined;
+    // Codex@677: briefing.md (task-specific) reads BEFORE context.md (broad) so its refs collect first — with the per-source cap, context.md can't starve briefing.
+    const refs = collectLocalRefs([
+        callerSignals.taskText ?? undefined,
+        callerSignals.explicitScope ?? undefined,
+        callerRefs,
+        branchName,
+        worktreeName,
+        briefingText,
+        contextText,
+    ]);
+    // F4: dereference "PR #N" refs to diff paths, folded into changedPaths — the only place this can happen (server records dereferenced:false, no git access). Time-boxed; absent/unauthed gh no-ops.
+    const prDiffPaths = [];
+    if (callerSignals.changedPaths === undefined) {
+        let derefed = 0;
+        for (const ref of refs) {
+            const prNumber = prNumberFromRef(ref);
+            if (prNumber === null)
+                continue;
+            if (derefed >= PR_DIFF_MAX_REFS)
+                break;
+            derefed++;
+            try {
+                for (const p of prDiff(cwd, prNumber))
+                    prDiffPaths.push(p);
+            }
+            catch {
+                // gh absent / unauthed / PR missing — skip gracefully, leave existing behavior.
+            }
+        }
+    }
+    // Caller-supplied changedPaths win (backward compat); otherwise union the
+    // three local sources, deduped, order-stable.
+    const unionedChangedPaths = callerSignals.changedPaths ??
+        Array.from(new Set([...dirtyChangedPaths, ...branchChangedPaths, ...prDiffPaths]));
+    const baseSignals = sanitizeStartupResolutionSignals({
+        ...callerSignals,
+        sourceSurface: callerSignals.sourceSurface ?? 'cli',
+        resolverVersion: callerSignals.resolverVersion ?? STARTUP_RESOLUTION_RESOLVER_VERSION,
+        branchName: callerSignals.branchName ?? branchName,
+        worktreeName: callerSignals.worktreeName ?? worktreeName,
+        changedPaths: unionedChangedPaths,
+        reviewedArtifactRefs: callerSignals.reviewedArtifactRefs ?? refs,
+        commitSha: callerSignals.commitSha ?? commitSha,
+    });
+    const taskText = deriveHandshakeStartupTask(baseSignals.reviewedArtifactRefs ?? [], baseSignals.changedPaths ?? [], baseSignals.taskText);
+    const sanitized = sanitizeStartupResolutionSignals({
+        ...baseSignals,
+        taskText,
+    });
+    const hasMeaningfulEvidence = Boolean(sanitized.taskText) ||
+        (sanitized.changedPaths?.length ?? 0) > 0 ||
+        (sanitized.reviewedArtifactRefs?.length ?? 0) > 0 ||
+        Boolean(sanitized.explicitScope);
+    if (hasMeaningfulEvidence)
+        return sanitized;
+    // Codex@704: even with no evidence, emit a minimal envelope carrying attribution — {} would
+    // drop the whole startup block, losing the loud domain-unresolved signal (spec "Loud Unresolved State", AC #4).
+    return sanitizeStartupResolutionSignals({
+        sourceSurface: sanitized.sourceSurface ?? 'cli',
+        resolverVersion: sanitized.resolverVersion ?? STARTUP_RESOLUTION_RESOLVER_VERSION,
+        branchName: sanitized.branchName,
+        worktreeName: sanitized.worktreeName,
+        commitSha: sanitized.commitSha,
+        changeId: sanitized.changeId,
+    });
+}
+/** Normalize volatile handshake-only timestamps before comparing generated files — keeps visible
+ *  timestamps in artifacts while avoiding meaningless rewrites when content is unchanged. */
 export function normalizeHandshakeContentForComparison(content) {
     return content
         .replace(/<!-- auto-generated by pb handshake — [0-9]{4}-[0-9]{2}-[0-9]{2}T[^>]+ -->/g, '<!-- auto-generated by pb handshake — <TIMESTAMP> -->')
         .replace(/^_Generated: [0-9]{4}-[0-9]{2}-[0-9]{2}T.*_$/gm, '_Generated: <TIMESTAMP>_');
 }
 function shouldWriteAdapter(filePath, force) {
-    if (force)
-        return true;
+    // An absent file at an adapter path is a projection target → materialize it.
     if (!existsSync(filePath))
         return true;
     const content = readFileSync(filePath, 'utf8');
+    // No MARKER → user-owned/committed-static (CLAUDE.md, AGENTS.md, Copilot instructions) — never overwritten, not even under --force.
+    void force;
     return content.includes(MARKER);
 }
+function normalizeSurfaceName(surface) {
+    const stripped = surface.startsWith('.') ? surface.slice(1) : surface;
+    const normalized = stripped === 'github' ? 'copilot' : stripped;
+    return normalized in SURFACE_REGISTRY ? normalized : null;
+}
+function surfacePerimeterRoots(surface) {
+    if (surface === 'codex')
+        return ['.codex', SURFACE_REGISTRY.codex.hookFilePath];
+    if (surface === 'copilot')
+        return ['.github', SURFACE_REGISTRY.copilot.hookFilePath];
+    if (surface === 'claude')
+        return ['.claude', 'CLAUDE.md'];
+    return [`.${surface}`];
+}
+function modeRank(mode) {
+    return { off: 0, observe: 1, project: 2, govern: 3 }[mode];
+}
+function normalizeSetupAuthoringBody(body) {
+    return body.replace(/\r\n/g, '\n').replace(/\r/g, '\n').trimEnd();
+}
+function setupAuthoringAssetHash(asset) {
+    const canonical = {
+        entryId: asset.entryId,
+        name: asset.name,
+        description: asset.description ?? '',
+        assetKind: asset.assetKind,
+        triggers: asset.triggers ?? [],
+        semanticRefs: asset.semanticRefs ?? [],
+        body: normalizeSetupAuthoringBody(asset.body),
+    };
+    return `sha256:${createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
+}
+function parseSetupAuthoringFrontmatter(raw) {
+    // Shared parser (lib/frontmatter.ts): array-item quotes strip exactly as before, now canonical
+    // for migrate-setup/setup-ingest too. `assetKind` ignored (handshake derives kind from dir).
+    const parsed = parseSetupFrontmatter(raw);
+    return {
+        frontmatterId: parsed.frontmatterId,
+        name: parsed.name,
+        description: parsed.description,
+        body: parsed.body,
+        triggers: parsed.triggers,
+        semanticRefs: parsed.semanticRefs,
+    };
+}
+function deriveSetupAuthoringEntryId(filename, kind) {
+    const base = basename(filename, '.md');
+    const snakeCase = base.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
+    return `SETUP-${kind.toUpperCase()}-${snakeCase}`;
+}
+function scanSetupAuthoringFiles(productbrainDir) {
+    const dirs = [
+        { dir: 'skills', kind: 'skill' },
+        { dir: 'rules', kind: 'rule' },
+        { dir: 'hooks', kind: 'hook' },
+    ];
+    const items = [];
+    for (const { dir, kind } of dirs) {
+        const absDir = join(productbrainDir, dir);
+        if (!existsSync(absDir))
+            continue;
+        for (const file of readdirSync(absDir).filter((f) => f.endsWith('.md'))) {
+            const filePath = join(absDir, file);
+            const parsed = parseSetupAuthoringFrontmatter(readFileSync(filePath, 'utf8'));
+            const fallbackName = basename(file, '.md');
+            items.push({
+                filePath,
+                derivedEntryId: deriveSetupAuthoringEntryId(file, kind),
+                frontmatterId: parsed.frontmatterId,
+                name: parsed.name || fallbackName,
+                description: parsed.description,
+                body: parsed.body,
+                assetKind: kind,
+                triggers: parsed.triggers,
+                semanticRefs: parsed.semanticRefs,
+            });
+        }
+    }
+    return items.sort((a, b) => a.filePath.localeCompare(b.filePath));
+}
+function setupAuthoringDirForKind(kind) {
+    if (kind === 'skill')
+        return 'skills';
+    if (kind === 'rule')
+        return 'rules';
+    if (kind === 'hook')
+        return 'hooks';
+    return null;
+}
+function setupAuthoringFilename(name, entryId) {
+    const base = (name || entryId)
+        .replace(/[\/\\:*?"<>|]/g, '-')
+        .replace(/\s+/g, ' ')
+        .trim();
+    return `${base || entryId}.md`;
+}
+function setupAuthoringPath(cwd, asset) {
+    const dir = setupAuthoringDirForKind(asset.assetKind);
+    if (!dir)
+        return null;
+    // WP-426 E3: recorded authoring source path wins so reprojection lands where the
+    // user authored — no duplicate (TEN-1920). Stored relative to .productbrain/.
+    if (asset.authoringPath && asset.authoringPath.trim()) {
+        // Codex P1/P2: authoringPath is untrusted DB data, probed before any assertSetupWritePath guard runs —
+        // constrain to a kind-appropriate markdown file, else fall back to the safe name-derived path.
+        const pbDir = join(cwd, '.productbrain');
+        const candidate = resolve(pbDir, asset.authoringPath);
+        const within = relative(pbDir, candidate);
+        const withinPosix = within.split(sep).join('/');
+        if (!within.startsWith('..') &&
+            !isAbsolute(within) &&
+            withinPosix.startsWith(`${dir}/`) &&
+            withinPosix.toLowerCase().endsWith('.md')) {
+            return candidate;
+        }
+    }
+    return join(cwd, '.productbrain', dir, setupAuthoringFilename(asset.name, asset.entryId));
+}
+function renderSetupAuthoringFile(asset) {
+    const lines = [
+        '---',
+        `id: ${asset.entryId}`,
+        `name: ${JSON.stringify(asset.name)}`,
+        `description: ${JSON.stringify(asset.description ?? '')}`,
+        `assetKind: ${asset.assetKind}`,
+    ];
+    const pushArray = (key, values) => {
+        if (!values || values.length === 0)
+            return;
+        lines.push(`${key}:`);
+        for (const value of values)
+            lines.push(`  - ${JSON.stringify(value)}`);
+    };
+    pushArray('triggers', asset.triggers);
+    pushArray('semanticRefs', asset.semanticRefs);
+    lines.push('---', normalizeSetupAuthoringBody(asset.body), '');
+    return lines.join('\n');
+}
+function loadAuthoringSyncState(productbrainDir) {
+    const statePath = join(productbrainDir, '.authoring-sync.json');
+    if (!existsSync(statePath))
+        return { version: 1, assets: {} };
+    try {
+        const parsed = JSON.parse(readFileSync(statePath, 'utf8'));
+        if (parsed.version !== 1 || !parsed.assets || typeof parsed.assets !== 'object') {
+            return { version: 1, assets: {} };
+        }
+        return {
+            version: 1,
+            assets: parsed.assets,
+        };
+    }
+    catch {
+        return { version: 1, assets: {} };
+    }
+}
+function saveAuthoringSyncState(productbrainDir, state) {
+    const statePath = join(productbrainDir, '.authoring-sync.json');
+    assertSetupWritePath(statePath, { surfaces: [] });
+    mkdirSync(productbrainDir, { recursive: true });
+    writeFileSync(statePath, JSON.stringify(state, null, 2) + '\n');
+}
+// ── WP-421 S3: Three-bucket drift classification (doneWhen #17) — now its own module (STD-2/DEC-1504
+// shrink-only offset). Re-exported so existing imports `from '../commands/handshake.js'` keep working.
+export { classifyDriftBucket };
 function deduplicateEntries(entries) {
     const seen = new Set();
     const result = [];
@@ -272,19 +655,128 @@ function deduplicateEntries(entries) {
     }
     return result;
 }
+/**
+ * findLeftoverProjections — WP-379 S5b
+ *
+ * Lists marker-bearing files under .cursor/rules/, .claude/rules/, .claude/skills/, .codex/skills/
+ * (plus the nested .cursor/skills/<name>/SKILL.md layout) that look stale: orphan (no canonical
+ * asset), stale case/punctuation variant, or a leftover `.dormant` copy. User-owned (no MARKER)
+ * files and unselected `allowedTargets` are never reported.
+ *
+ * Round 12: stops once `LEFTOVER_FILES_MAX + 1` matches are found across the flat + merged
+ * nested-Cursor scan combined — bounds read/enumerate I/O, not just the reported list.
+ * `truncated` says more exist beyond the capped, returned `files`.
+ *
+ * @param cursorSkillNames Cursor-specific, SKILL-kind-only canon (falls back to `assetNames`).
+ * @param exactRelativePaths Round 11: exact write-plan paths (forward-slash), exempted from both
+ *   checks — covers asset-less generated files and a canonical raw name not already normalized.
+ */
+export function findLeftoverProjections(cwd, assetNames, allowedTargets, cursorSkillNames, exactRelativePaths) {
+    const TARGET_DIRS_BY_EXT = [
+        { dir: join(cwd, '.cursor', 'rules'), ext: '.mdc', surface: 'cursor' },
+        { dir: join(cwd, '.claude', 'rules'), ext: '.md', surface: 'claude' },
+        { dir: join(cwd, '.claude', 'skills'), ext: '.md', surface: 'claude' },
+        { dir: join(cwd, '.codex', 'skills'), ext: '.md', surface: 'codex' },
+    ];
+    const canonicalNormalizedStems = new Set(assetNames.map((n) => normalizeMaterializedFilename(n)));
+    const exactPaths = exactRelativePaths ?? new Set();
+    const leftovers = [];
+    let truncated = false;
+    scanLoop: for (const { dir, ext, surface } of TARGET_DIRS_BY_EXT) {
+        if (!allowedTargets.has(surface))
+            continue;
+        if (!existsSync(dir))
+            continue;
+        let files;
+        try {
+            files = readdirSync(dir);
+        }
+        catch {
+            continue; // unreadable dir — skip
+        }
+        for (const filename of files) {
+            if (!filename.endsWith(ext) && !filename.endsWith(`${ext}.dormant`))
+                continue;
+            const fullPath = join(dir, filename);
+            let content;
+            try {
+                content = readFileSync(fullPath, 'utf8');
+            }
+            catch {
+                continue; // unreadable file — skip
+            }
+            if (!content.includes(MARKER))
+                continue; // user-owned — never reported
+            const isDormant = filename.endsWith('.dormant');
+            // A live file the write plan targets by this exact path is canonical by construction.
+            if (!isDormant) {
+                const relativePath = relative(cwd, fullPath).split(sep).join('/');
+                if (exactPaths.has(relativePath))
+                    continue;
+            }
+            const stem = basename(isDormant ? filename.slice(0, -'.dormant'.length) : filename, ext);
+            const normalizedStem = normalizeMaterializedFilename(stem);
+            let entry = null;
+            if (!canonicalNormalizedStems.has(normalizedStem)) {
+                entry = { path: fullPath, reason: 'orphan — no canonical asset matches this name' };
+            }
+            else if (isDormant) {
+                entry = { path: fullPath, reason: 'leftover .dormant file from an older binary version' };
+            }
+            else if (stem !== normalizedStem) {
+                entry = { path: fullPath, reason: `stale case/punctuation variant — canonical form is "${normalizedStem}${ext}"` };
+            }
+            if (!entry)
+                continue;
+            leftovers.push(entry);
+            if (leftovers.length > LEFTOVER_FILES_MAX) {
+                truncated = true;
+                leftovers.pop();
+                break scanLoop;
+            }
+        }
+    }
+    // Nested Cursor skills — extracted to its own module (STD-2/DEC-1504 shrink-only offset).
+    // Skipped once the flat scan already hit the cap; the remaining budget keeps the combined
+    // total across both scans stopping at LEFTOVER_FILES_MAX + 1.
+    if (!truncated && allowedTargets.has('cursor')) {
+        const nested = findLeftoverCursorSkills(cwd, cursorSkillNames ?? assetNames, LEFTOVER_FILES_MAX - leftovers.length);
+        leftovers.push(...nested.files);
+        truncated = nested.truncated;
+    }
+    return { files: leftovers, truncated };
+}
+/** Round 13 (Codex P1, security): strips a `user:token@` userinfo segment from an https remote
+ *  so a credential never reaches JSON output. SSH remotes (`git@host:...`) are untouched — that
+ *  `git@` is a fixed public username, not a secret. */
+function redactGitRemote(remote) {
+    return remote ? remote.replace(/^(https?:\/\/)[^@/]+@/i, '$1') : remote;
+}
+/** Round 13 (Codex P1, security): `pb --json handshake` serialized the report directly — leaking
+ *  an HTTPS git-remote credential and raw Convex `_id`/`_creationTime` on `matchedEntries` (never
+ *  went through the shared runner's `stripConvexInternals`). One public shape, both JSON paths. */
+function toPublicJsonReport(report) {
+    return stripConvexInternals({ ...report, repo: { ...report.repo, gitRemote: redactGitRemote(report.repo.gitRemote) } });
+}
 export async function runHandshake(options = {}) {
-    const config = await getConfigOrGuide(() => runHandshake(options));
+    const config = await getConfigOrGuide(async () => { await runHandshake(options); });
     if (!config)
-        return;
+        return undefined;
     const cwd = process.cwd();
     const force = options.force ?? false;
     const dryRun = options.dryRun ?? false;
+    // Preview mode: default when neither --apply nor --dry-run is passed (--dry-run is a backward-compat alias).
+    const preview = !options.apply && !dryRun;
+    const applyMode = options.apply === true && !dryRun;
     const level = options.level;
+    // `quiet` gates the final report write (`--json` alone still prints). `suppressProgress`
+    // also silences stdout log() prose in JSON mode. logErr() stays on `quiet` alone (stderr).
     const quiet = options.quiet ?? false;
+    const suppressProgress = quiet || isJsonMode();
     const generate = options.generate ?? false;
     const timestamp = new Date().toISOString();
-    // Helper: emit progress line only when not quiet (used when handshake is a sub-step)
-    const log = (msg) => { if (!quiet)
+    // Helper: emit progress line only when not suppressed. logErr is gated on `quiet` alone.
+    const log = (msg) => { if (!suppressProgress)
         process.stdout.write(msg + '\n'); };
     const logErr = (msg) => { if (!quiet)
         process.stderr.write(msg + '\n'); };
@@ -303,6 +795,15 @@ export async function runHandshake(options = {}) {
     if (repo.detectedStack.length > 0) {
         log(`Stack: ${repo.detectedStack.join(', ')}`);
     }
+    const startupSignals = deriveHandshakeStartupSignals(cwd, options.startupSignals ?? {});
+    const orientArgs = { tier: 'standard' };
+    if (options.invocationPath)
+        orientArgs.invocationPath = options.invocationPath;
+    if (Object.keys(startupSignals).length > 0) {
+        orientArgs.startupSignals = startupSignals;
+        if (startupSignals.taskText)
+            orientArgs.task = startupSignals.taskText;
+    }
     // 2. Fetch orient view + workspace readiness in parallel (budget max +200ms added latency)
     log('Fetching workspace context...');
     let orientView = null;
@@ -310,7 +811,7 @@ export async function runHandshake(options = {}) {
     try {
         const workspaceReadinessPromise = kernelCall('chain.workspaceReadiness', {}).catch(() => null);
         const [orientResult, readinessRaw] = await Promise.all([
-            kernelCall('chain.getOrientView', {}).catch((err) => {
+            kernelCall('chain.getOrientView', orientArgs).catch((err) => {
                 logErr(`Warning: could not fetch workspace context — ${err instanceof Error ? err.message : err}`);
                 logErr('Continuing with limited context (Chain search + portable knowledge only).');
                 return null;
@@ -325,7 +826,7 @@ export async function runHandshake(options = {}) {
         logErr('Continuing with limited context (Chain search + portable knowledge only).');
     }
     if (workspaceProfile) {
-        log(`Workspace profile: stage=${workspaceProfile.stage}, entries=${workspaceProfile.totalEntries}, governance=${workspaceProfile.governanceMode}`);
+        log(`Workspace profile: stage=${workspaceProfile.stage}, entries=${workspaceProfile.totalEntries}`);
     }
     // 3. Build search queries from repo context
     const searchQueries = [];
@@ -347,10 +848,319 @@ export async function runHandshake(options = {}) {
         const searchResults = await Promise.all(uniqueQueries.map((q) => kernelCall('chain.searchEntries', { query: q }).catch(() => [])));
         matchedEntries = deduplicateEntries(searchResults.flat());
     }
-    // 5. Read canonical skills & rules from .productbrain/
+    // 5. Read canonical skills & rules — DB-first (WP-345 S0c, TEN-1459): query setup.listAssetsForUser, FS fallback.
     const pbDir = join(cwd, '.productbrain');
-    const allSkills = readCanonicalSkills(pbDir);
-    const manualRules = readCanonicalRules(pbDir);
+    const manifestStatus = readManifestStatus(pbDir);
+    const manifest = manifestStatus.manifest;
+    const surfaceValidation = validateSurfacesForMode(manifestStatus.mode, manifestStatus.surfaces);
+    if (applyMode && surfaceValidation.error === SURFACE_GOVERN_NO_SURFACES) {
+        throw new CLIError('materialize: govern requires at least one registered manifest surface.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Add surfaces such as `.cursor` or `.claude` to .productbrain/manifest.yaml.',
+        });
+    }
+    for (const surface of surfaceValidation.unregisteredSurfaces) {
+        logErr(`Warning: manifest surface "${surface}" is not registered; skipping it.`);
+    }
+    const manifestTargets = new Set(surfaceValidation.registeredSurfaces);
+    const cliTargets = new Set();
+    const ignoredCliSurfaces = [];
+    for (const surface of options.surfaces ?? []) {
+        const normalized = normalizeSurfaceName(surface);
+        if (normalized && manifestTargets.has(normalized)) {
+            cliTargets.add(normalized);
+        }
+        else {
+            ignoredCliSurfaces.push(surface);
+        }
+    }
+    if (ignoredCliSurfaces.length > 0) {
+        logErr(`Warning: --surfaces ignored outside manifest.surfaces: ${ignoredCliSurfaces.join(', ')}`);
+    }
+    const allowedTargets = options.surfaces && options.surfaces.length > 0
+        ? cliTargets
+        : manifestTargets;
+    const perimeterManifest = {
+        surfaces: [...manifestTargets].flatMap(surfacePerimeterRoots),
+    };
+    const authorityCanWrite = manifestStatus.mode === 'project' || manifestStatus.mode === 'govern';
+    const authorityPreviewOnly = applyMode && !authorityCanWrite;
+    const writeMode = applyMode && authorityCanWrite;
+    let dbSkills = [];
+    let dbRules = [];
+    let usedDbSource = false;
+    // Codex P2 (PR #912 round 3): distinct from usedDbSource — true whenever the query succeeded
+    // (even empty), gating cleanup regardless of a later body-fetch throw; usedDbSource stays the
+    // CONTENT-source flag, only true after full success (a throw falls back to the filesystem).
+    let dbQuerySucceeded = false;
+    let dbAssetRows = [];
+    // WP-428 S2 (Finding #5): entryIds whose body fetch failed — hoisted so both the
+    // skills/rules AND authoring-file projection loops can skip them.
+    const bodyFetchFailedEntryIds = new Set();
+    const dbProjectionHashes = new Map();
+    const syncDriftTensToFire = [];
+    const deferredAuthoringBaselineEntryIds = new Set();
+    if (writeMode) {
+        const authoringItems = scanSetupAuthoringFiles(pbDir);
+        if (authoringItems.length > 0) {
+            // WP-428 S2 (Critical #1): ingestSetupAssetWithBody runs per-asset (batch can't call ctx.storage.store()), losing intra-batch collision detection — checked client-side below (replaces server-side DEC-954).
+            const idToPaths = new Map();
+            for (const item of authoringItems) {
+                const canonicalId = item.frontmatterId?.trim() || item.derivedEntryId;
+                const paths = idToPaths.get(canonicalId) ?? [];
+                paths.push(item.filePath);
+                idToPaths.set(canonicalId, paths);
+            }
+            const conflictingPaths = new Set();
+            for (const [, paths] of idToPaths) {
+                if (paths.length > 1) {
+                    for (const p of paths)
+                        conflictingPaths.add(p);
+                }
+            }
+            if (conflictingPaths.size > 0) {
+                logErr(`Setup authoring import partial: ${conflictingPaths.size} file(s) refused for duplicate setup id. ` +
+                    [...conflictingPaths].join(', '));
+            }
+            const itemsToIngest = authoringItems.filter((item) => !conflictingPaths.has(item.filePath));
+            if (itemsToIngest.length > 0) {
+                try {
+                    // Parallel uploads — concurrency limit 10 to avoid overwhelming the gateway.
+                    const CONCURRENCY = 10;
+                    const ingestResults = [];
+                    for (let i = 0; i < itemsToIngest.length; i += CONCURRENCY) {
+                        const batch = itemsToIngest.slice(i, i + CONCURRENCY);
+                        const settled = await Promise.allSettled(batch.map(async (item) => {
+                            const result = await kernelCall('setup.ingestSetupAssetWithBody', {
+                                entryId: item.derivedEntryId,
+                                frontmatterId: item.frontmatterId,
+                                name: item.name,
+                                description: item.description,
+                                body: item.body,
+                                assetKind: item.assetKind,
+                                triggers: item.triggers,
+                                semanticRefs: item.semanticRefs,
+                                authoringPath: relative(pbDir, item.filePath).split(sep).join('/'),
+                            });
+                            return { filePath: item.filePath, ...result };
+                        }));
+                        for (const r of settled) {
+                            if (r.status === 'fulfilled') {
+                                ingestResults.push(r.value);
+                                if (r.value.conflict === 'repo-wins') {
+                                    syncDriftTensToFire.push(`Repo authoring file won setup sync conflict for ${r.value.entryId} at ${r.value.filePath}.`);
+                                    logErr(`Warning: repo authoring file won sync conflict for ${r.value.entryId}; DB edit was overwritten.`);
+                                }
+                            }
+                            else {
+                                trackEvent('setup.authoring_import.item_failed', { error: r.reason instanceof Error ? r.reason.message : String(r.reason) });
+                                logErr(`Warning: setup authoring import failed for one asset — ${r.reason instanceof Error ? r.reason.message : String(r.reason)}`);
+                            }
+                        }
+                    }
+                    if (ingestResults.length > 0) {
+                        log(`Setup authoring import: ${ingestResults.length} file(s) checked (with bodyStorageId).`);
+                    }
+                }
+                catch (err) {
+                    trackEvent('setup.authoring_import.failed', { error: err instanceof Error ? err.message : String(err) });
+                    logErr(`Warning: setup authoring import failed — ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+    try {
+        // WP-379 S4: only activeAssets projects (DEC-1690); falls back to [] for the old flat-array server shape.
+        const rawResponse = await kernelCall('setup.listAssetsForUser', {}).catch(() => null);
+        let dbAssets = [];
+        if (rawResponse !== null) {
+            if (Array.isArray(rawResponse)) {
+                // Pre-S4 server — treat entire response as active assets with no dormant list.
+                dbAssets = rawResponse;
+            }
+            else {
+                dbAssets = rawResponse.activeAssets ?? [];
+            }
+            // Successful (even empty) is authoritative, distinct from "unavailable" (catch below) — an
+            // empty active set must still gate cleanup on, or a workspace whose last asset was deleted
+            // keeps stale projections forever.
+            dbQuerySucceeded = true;
+            dbAssetRows = dbAssets;
+        }
+        if (dbAssets.length > 0) {
+            // WP-428 S2: body is no longer inline — fetch from storage per non-disabled skill/rule/hook (bounded, parallel).
+            const projectableAssets = dbAssets.filter((a) => !a.disabledByOwner && (a.assetKind === 'skill' || a.assetKind === 'rule' || a.assetKind === 'hook'));
+            const assetsNeedingBodyFetch = projectableAssets.filter((a) => a.bodyStorageId);
+            const bodyFetchMap = new Map(); // entryId → body
+            // WP-428 S2 (Finding #5/#12): fetch-failed entryIds excluded from dbSkills/dbRules below (outer-scope bodyFetchFailedEntryIds).
+            if (assetsNeedingBodyFetch.length > 0) {
+                log(`Fetching ${assetsNeedingBodyFetch.length} asset body(s) from storage...`);
+                const bodyFetchResults = await Promise.allSettled(assetsNeedingBodyFetch.map(async (asset) => {
+                    const result = await kernelCall('setup.fetchAssetBody', { bodyStorageId: asset.bodyStorageId });
+                    return { entryId: asset.entryId, name: asset.name, body: result.body };
+                }));
+                for (let i = 0; i < bodyFetchResults.length; i++) {
+                    const result = bodyFetchResults[i];
+                    if (result.status === 'fulfilled') {
+                        bodyFetchMap.set(result.value.entryId, result.value.body);
+                    }
+                    else {
+                        // WP-428 S2 (Finding #12): include entryId and name in the warning (Finding #5: skip projection).
+                        const asset = assetsNeedingBodyFetch[i];
+                        logErr(`Warning: failed to fetch body for ${asset.entryId} (${asset.name}) — ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
+                        bodyFetchFailedEntryIds.add(asset.entryId);
+                    }
+                }
+                if (bodyFetchFailedEntryIds.size > 0) {
+                    // WP-439 S4: strict-by-default — a body-fetch failure is hard unless --lenient.
+                    const failedList = [...bodyFetchFailedEntryIds].join(', ');
+                    if (options.lenient) {
+                        logErr(`Warning: ${bodyFetchFailedEntryIds.size} asset(s) skipped due to body fetch failure (--lenient): ${failedList}`);
+                    }
+                    else {
+                        throw new CLIError(`${bodyFetchFailedEntryIds.size} asset(s) failed body fetch: ${failedList}. ` +
+                            `Run \`pb setup-audit\` to diagnose, then \`pb setup-audit --repair\` to reseed. ` +
+                            `Pass --lenient to suppress this and continue with affected entries skipped (legacy behaviour).`, { code: ErrorCode.INTERNAL, category: 'internal' });
+                    }
+                }
+            }
+            // Map DB assets to CanonicalSkill/CanonicalRule shapes
+            for (const asset of dbAssets) {
+                if (asset.disabledByOwner)
+                    continue;
+                // WP-428 S2 (Finding #5): skip fetch-failed assets — no empty body written, no lastProjectedHash update.
+                if (bodyFetchFailedEntryIds.has(asset.entryId))
+                    continue;
+                // WP-428 S2: prefer storage-fetched body, fall back to inline body (pre-S2 servers, deletable once all servers are S2+).
+                const resolvedBody = bodyFetchMap.get(asset.entryId) ?? asset.body ?? '';
+                if (asset.assetKind === 'skill') {
+                    dbSkills.push({
+                        name: asset.name,
+                        description: asset.description,
+                        triggers: asset.triggers ?? [],
+                        body: resolvedBody,
+                        sourcePath: `db:${asset.entryId}`,
+                    });
+                }
+                else if (asset.assetKind === 'rule' || asset.assetKind === 'hook') {
+                    dbRules.push({
+                        name: asset.name,
+                        description: asset.description,
+                        autoApply: false,
+                        body: resolvedBody,
+                        sourcePath: `db:${asset.entryId}`,
+                    });
+                }
+            }
+            log(`Setup assets: ${dbSkills.length} skills, ${dbRules.length} rules/hooks from DB (WP-345 DB-first path)`);
+            // Reaching here (no throw above) means it's safe to use as the CONTENT source (Codex P2, PR #912 round 3).
+            usedDbSource = true;
+        }
+        else if (dbQuerySucceeded && writeMode) {
+            // Empty DB in WRITE mode is authoritative (ingest already ran); preview never ingests, so FS still forecasts apply.
+            // Round 14: findLeftoverProjections only lists stale files, never removes them — say so.
+            // Round 15: it also skips surfaces outside allowedTargets — scope the claim to those.
+            log('Setup assets: DB query succeeded with zero active assets — any existing projections on the selected surfaces will be listed as leftovers, not removed.');
+            usedDbSource = true;
+        }
+    }
+    catch {
+        // DB unavailable, or post-query processing failed hard — usedDbSource stays false either way.
+    }
+    const allSkills = usedDbSource ? dbSkills : readCanonicalSkills(pbDir);
+    const manualRules = usedDbSource ? dbRules : readCanonicalRules(pbDir);
+    if (!usedDbSource) {
+        log('Setup assets: reading from filesystem (DB source unavailable, or unauthoritative for this mode)');
+    }
+    // 5a-pre. E4: resolve semantic refs (WP-345, DEC-A/C/K) — replace {{ref:key}} via the Convex
+    // resolver, apply mode only. NG11: PostHog events fire from CLI side only.
+    if (usedDbSource && writeMode) {
+        const projectableDbAssets = dbAssetRows.filter((a) => !a.disabledByOwner && (a.assetKind === 'skill' || a.assetKind === 'rule' || a.assetKind === 'hook'));
+        const assetsWithRefs = projectableDbAssets.filter((a) => a.semanticRefs && a.semanticRefs.length > 0);
+        if (assetsWithRefs.length > 0) {
+            log(`Resolving semantic refs for ${assetsWithRefs.length} asset(s)...`);
+            // Collect unique ref keys across all assets
+            const allRefKeys = [...new Set(assetsWithRefs.flatMap((a) => a.semanticRefs))];
+            // Resolve all refs in a single batch call (DEC-767 / WP-354 Build-Order #6 — kind + status discriminator).
+            let resolvedRefs = [];
+            try {
+                resolvedRefs = await kernelCall('setup.resolveSemanticRefs', { semanticRefs: allRefKeys });
+            }
+            catch (err) {
+                trackEvent('setup.refs.resolve_failed', { error: err instanceof Error ? err.message : String(err) });
+                logErr(`Warning: could not resolve semantic refs — ${err instanceof Error ? err.message : String(err)}`);
+            }
+            // Build resolved map: canonicalKey → display name. Only required refs count as unresolved warnings.
+            const resolvedMap = new Map();
+            let unresolvedCount = 0;
+            for (const result of resolvedRefs) {
+                if (result.status === 'resolved' && result.localEntryId) {
+                    resolvedMap.set(result.ref, result.localEntryId);
+                    trackEvent('skill.ref.resolved', { ref: result.ref, kind: result.kind });
+                }
+                else if (result.status === 'unsupported-future') {
+                    // seed: refs are explicitly future scope per WP-354 Build-Order #6 — not a warning.
+                    trackEvent('skill.ref.future', { ref: result.ref, kind: result.kind });
+                }
+                else if (result.required) {
+                    unresolvedCount++;
+                    trackEvent('skill.ref.unresolved', { ref: result.ref, kind: result.kind, status: result.status });
+                }
+            }
+            if (unresolvedCount > 0) {
+                logErr(`Warning: ${unresolvedCount} required semantic ref(s) could not be resolved.`);
+            }
+            // Projection preserves ref tokens as portable refs — resolvedMap is validation/telemetry only.
+        }
+        // Compute projection hash per projected DB asset (DEC-K): sha256 of the normalized resolved body.
+        const HASH_TRAILER_REGEX = /^<!--\s*pb-hash:.*-->\s*$/gm;
+        const TIMESTAMP_REGEX = /^<!--\s*pb-generated-at:.*-->\s*$/gm;
+        for (const rawAsset of projectableDbAssets) {
+            const resolvedAsset = [...dbSkills, ...dbRules].find((a) => a.sourcePath === `db:${rawAsset.entryId}`);
+            if (!resolvedAsset)
+                continue;
+            try {
+                // Build the projected body (what will be written to disk)
+                const projectedBody = resolvedAsset.body;
+                // Normalize: strip existing hash/timestamp trailers, convert to LF
+                const normalized = projectedBody
+                    .replace(HASH_TRAILER_REGEX, '')
+                    .replace(TIMESTAMP_REGEX, '')
+                    .replace(/\r\n/g, '\n')
+                    .replace(/\r/g, '\n')
+                    .trimEnd();
+                // Compute sha256 hash
+                const hash = createHash('sha256').update(normalized, 'utf8').digest('hex');
+                const hashTrailer = `<!-- pb-hash: sha256:${hash} -->`;
+                // Append hash trailer to the projected body
+                resolvedAsset.body = `${normalized}\n${hashTrailer}`;
+                dbProjectionHashes.set(rawAsset.entryId, {
+                    hash: `sha256:${hash}`,
+                    assetKind: rawAsset.assetKind,
+                });
+                // Drift detection: compare against last known hash
+                if (rawAsset.lastProjectedHash && rawAsset.lastProjectedHash !== `sha256:${hash}`) {
+                    trackEvent('skill.drift.detected', {
+                        entryId: rawAsset.entryId,
+                        assetKind: rawAsset.assetKind,
+                    });
+                    log(`Drift detected for asset ${rawAsset.entryId} — projecting updated version.`);
+                }
+                trackEvent('skill.projection.succeeded', {
+                    entryId: rawAsset.entryId,
+                    assetKind: rawAsset.assetKind,
+                });
+            }
+            catch (err) {
+                trackEvent('skill.projection.failed', {
+                    entryId: rawAsset.entryId,
+                    assetKind: rawAsset.assetKind,
+                });
+                logErr(`Warning: projection failed for ${rawAsset.entryId} — ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
     // 5a. Optionally fetch and merge Chain-derived rules (--generate flag)
     let chainRulesStats = null;
     let chainGaps = [];
@@ -382,12 +1192,48 @@ export async function runHandshake(options = {}) {
             log(diffText);
         }
     }
-    // Apply level filtering with stage-gating (after read, before target filtering in write loop)
-    // Stage caps the effective level: blank→beginner, seed→intermediate, grounded+→expert.
-    // If stage caps below the requested level, log it so the user knows why items were dropped.
+    // 5b. Read personal layer (WP-310 E2) — machine-local rules/skills from .productbrain/.local/, [] if absent, all persist: 'local'.
+    const personalRules = readPersonalLayer(pbDir);
+    if (personalRules.length > 0) {
+        // Name collision detection — warn when a personal rule overrides a team rule
+        const teamRuleNames = new Set(allRules.map((r) => r.name));
+        for (const pr of personalRules) {
+            if (teamRuleNames.has(pr.name)) {
+                logErr(`Personal rule "${pr.name}" overrides team rule (local takes precedence).`);
+            }
+        }
+        // Merge: team rules first, personal rules appended (personal takes precedence via name collision above)
+        allRules = [...allRules, ...personalRules];
+    }
+    const personalSkills = readPersonalSkillsLayer(pbDir);
+    if (personalSkills.length > 0) {
+        const teamSkillNames = new Set(allSkills.map((s) => s.name));
+        for (const ps of personalSkills) {
+            if (teamSkillNames.has(ps.name)) {
+                logErr(`Personal skill "${ps.name}" overrides team skill (local takes precedence).`);
+            }
+        }
+        allSkills.push(...personalSkills);
+    }
+    // 5d. Load method registry (WP-310 E4) — only when manifest is present.
+    let registrySource;
+    let registryStale;
+    if (manifest) {
+        const registryResult = await loadMethodRegistry().catch(() => null);
+        if (registryResult) {
+            registrySource = registryResult.source;
+            registryStale = registryResult.stale;
+        }
+    }
+    const adoptionFilteredSkills = filterByAdoptionState(allSkills, manifest);
+    const adoptionFilteredRules = filterByAdoptionState(allRules, manifest);
+    // Compute adoption counts for report (only meaningful when manifest is present)
+    const adoptedRulesCount = manifest ? adoptionFilteredRules.length : undefined;
+    const rejectedRulesCount = manifest ? allRules.length - adoptionFilteredRules.length : undefined;
+    // Level filtering with stage-gating: stage caps the effective level (blank→beginner, seed→intermediate, grounded+→expert).
     const profileStage = workspaceProfile?.stage;
-    const levelFilteredSkills = filterByLevel(allSkills, level, profileStage);
-    const levelFilteredRules = filterByLevel(allRules, level, profileStage);
+    const levelFilteredSkills = filterByLevel(adoptionFilteredSkills, level, profileStage);
+    const levelFilteredRules = filterByLevel(adoptionFilteredRules, level, profileStage);
     // Log when stage gating changes the effective level
     if (profileStage) {
         const stageCap = STAGE_TO_MAX_LEVEL[profileStage];
@@ -420,6 +1266,7 @@ export async function runHandshake(options = {}) {
     if (dryRun && canonicalRules.length > 0) {
         log(`  INCLUDED rules: ${canonicalRules.map((r) => r.name).join(', ')}`);
     }
+    const noProjectionAssets = findNoProjectionAssets(canonicalSkills, canonicalRules);
     if (canonicalSkills.length > 0 || canonicalRules.length > 0) {
         const levelSuffix = level ? ` (level: ${level})` : '';
         const stageSuffix = profileStage ? `, stage: ${profileStage}` : '';
@@ -429,16 +1276,15 @@ export async function runHandshake(options = {}) {
         log(`Portable knowledge: ${canonicalSkills.length}/${totalSkills} skills, ${canonicalRules.length}/${totalRules} rules${levelSuffix}${stageSuffix}${stackSuffix}`);
     }
     // 6. Generate file contents
-    // Build workspace context for AGENTS.md enrichment (stage, focus, governance, entry count)
+    // Build workspace context for AGENTS.md enrichment (stage, focus, entry count)
     const agentsWorkspaceContext = workspaceProfile
         ? {
             stage: workspaceProfile.stage,
-            focus: orientView?.strategicContext?.currentBet ?? undefined,
-            governanceMode: workspaceProfile.governanceMode,
+            focus: orientView?.strategicContext?.currentWorkPackage ?? undefined,
             totalEntries: workspaceProfile.totalEntries,
         }
         : undefined;
-    // Collect codex-targeted skills for AGENTS.md skill directory
+    // Collect codex-targeted skills for AGENTS.md skill directory — persist: 'local' entries included (all projections are local-only now).
     const agentsCodexSkills = canonicalSkills
         .filter((s) => shouldEmitToTarget(s, 'codex'))
         .map((s) => ({
@@ -477,26 +1323,160 @@ export async function runHandshake(options = {}) {
     const claudeContent = generateClaudeMd(timestamp);
     const cursorContent = generateCursorMdc(timestamp);
     const copilotContent = generateCopilotMd(timestamp, copilotOptions);
+    // DEC-1343: one committed .github/instructions/<slug>.instructions.md per copilot rule with applyTo; repo-wide rules stay above.
+    const copilotInstructionFiles = generateCopilotInstructionFiles(canonicalRules
+        .filter((r) => shouldEmitToTarget(r, 'copilot'))
+        // `.github/instructions/` is COMMITTED — never project a machine-local (persist: 'local') rule into it.
+        .filter((r) => r.persist !== 'local')
+        .map((r) => ({ name: r.name, body: r.body, applyTo: r.applyTo, sourcePath: r.sourcePath })), timestamp);
+    const boundaryEnforcementMode = getBoundaryEnforcementMode(manifest);
+    const boundaryManifestContent = boundaryEnforcementMode === 'advisory'
+        ? null
+        : generateBoundaryManifest(pbDir);
     // 7. Write files
     const filesWritten = [];
     const filesSkipped = [];
-    // Surface filtering: skip adapter writes for targets not in the allowed set
-    const allowedTargets = options.surfaces && options.surfaces.length > 0
-        ? new Set(options.surfaces)
-        : null; // null = write all
+    const previewPlan = [];
+    if (writeMode && usedDbSource) {
+        const authoringSyncState = loadAuthoringSyncState(pbDir);
+        let authoringSyncStateChanged = false;
+        const personalAssets = dbAssetRows.filter((asset) => asset.scope === 'personal' &&
+            !asset.disabledByOwner &&
+            (asset.assetKind === 'skill' || asset.assetKind === 'rule' || asset.assetKind === 'hook'));
+        for (const asset of personalAssets) {
+            // WP-428 S2 (Finding #5): skip fetch-failed assets — no empty-body authoring file, no lastProjectedHash update.
+            if (bodyFetchFailedEntryIds.has(asset.entryId))
+                continue;
+            const authoringPath = setupAuthoringPath(cwd, asset);
+            if (!authoringPath)
+                continue;
+            // relative() for correct cross-platform path computation (string-replace mis-fires on non-'/' cwd separators).
+            const relativeAuthoringPath = relative(cwd, authoringPath);
+            const bodyHash = setupAuthoringAssetHash(asset);
+            const authoringExists = existsSync(authoringPath);
+            const tracked = authoringSyncState.assets[asset.entryId];
+            const trackedHere = tracked?.path === relativeAuthoringPath;
+            const trackedMatchesServer = Boolean(trackedHere && asset.lastProjectedHash && tracked?.hash === asset.lastProjectedHash);
+            if (!authoringExists && asset.lastProjectedHash && trackedHere && trackedMatchesServer) {
+                try {
+                    const dormantResult = await kernelCall('setup.markPersonalSetupAssetDormantFromSync', { entryId: asset.entryId, expectedLastProjectedHash: tracked.hash });
+                    if (dormantResult.action === 'conflict') {
+                        syncDriftTensToFire.push(`Repo authoring deletion skipped for ${asset.entryId}; server baseline changed during sync, so writeback was deferred until the next DB read.`);
+                        logErr(`Warning: authoring deletion for ${asset.entryId} was not applied because the DB baseline changed during sync.`);
+                        deferredAuthoringBaselineEntryIds.add(asset.entryId);
+                        continue;
+                    }
+                    else {
+                        syncDriftTensToFire.push(`Repo authoring file was deleted for ${asset.entryId}; caller-owned personal setup asset marked dormant.`);
+                        log(`Setup authoring deletion: ${asset.entryId} marked dormant.`);
+                        delete authoringSyncState.assets[asset.entryId];
+                        authoringSyncStateChanged = true;
+                        continue;
+                    }
+                }
+                catch (err) {
+                    logErr(`Warning: could not mark ${asset.entryId} dormant after authoring deletion — ${err instanceof Error ? err.message : String(err)}`);
+                    continue;
+                }
+            }
+            else if (!authoringExists && asset.lastProjectedHash && trackedHere) {
+                syncDriftTensToFire.push(`Repo authoring deletion skipped for ${asset.entryId}; local sync baseline is stale, so DB writeback wins.`);
+                logErr(`Warning: authoring deletion for ${asset.entryId} was not applied because the DB baseline changed.`);
+            }
+            const nextAuthoringContent = renderSetupAuthoringFile(asset);
+            if (authoringExists) {
+                const parsed = parseSetupAuthoringFrontmatter(readFileSync(authoringPath, 'utf8'));
+                const fileHash = setupAuthoringAssetHash({
+                    entryId: parsed.frontmatterId?.trim() || asset.entryId,
+                    name: parsed.name || asset.name,
+                    description: parsed.description,
+                    body: parsed.body,
+                    assetKind: asset.assetKind,
+                    triggers: parsed.triggers,
+                    semanticRefs: parsed.semanticRefs,
+                });
+                if (fileHash === bodyHash) {
+                    if (asset.lastProjectedHash !== bodyHash) {
+                        await kernelCall('setup.updateLastProjectedHash', {
+                            entryId: asset.entryId,
+                            hash: bodyHash,
+                        }).catch(() => null);
+                    }
+                    authoringSyncState.assets[asset.entryId] = { path: relativeAuthoringPath, hash: bodyHash };
+                    authoringSyncStateChanged = true;
+                    continue;
+                }
+                if (!asset.lastProjectedHash) {
+                    syncDriftTensToFire.push(`Repo authoring file differs from DB for ${asset.entryId} at ${authoringPath} with no shared baseline; DB writeback skipped.`);
+                    logErr(`Warning: setup authoring drift for ${asset.entryId}; DB writeback skipped because no shared baseline exists.`);
+                    continue;
+                }
+                if (fileHash !== asset.lastProjectedHash &&
+                    bodyHash !== asset.lastProjectedHash) {
+                    syncDriftTensToFire.push(`Repo authoring file won setup sync conflict for ${asset.entryId} at ${authoringPath}.`);
+                    logErr(`Warning: repo authoring file won sync conflict for ${asset.entryId}; DB writeback skipped.`);
+                    continue;
+                }
+                if (fileHash !== asset.lastProjectedHash) {
+                    syncDriftTensToFire.push(`Repo authoring file differs from DB baseline for ${asset.entryId} at ${authoringPath}; DB writeback skipped.`);
+                    logErr(`Warning: setup authoring drift for ${asset.entryId}; DB writeback skipped.`);
+                    continue;
+                }
+            }
+            try {
+                assertSetupWritePath(authoringPath, perimeterManifest);
+                mkdirSync(dirname(authoringPath), { recursive: true });
+                writeFileSync(authoringPath, nextAuthoringContent);
+                filesWritten.push(relativeAuthoringPath);
+                await kernelCall('setup.updateLastProjectedHash', {
+                    entryId: asset.entryId,
+                    hash: bodyHash,
+                }).catch(() => null);
+                authoringSyncState.assets[asset.entryId] = { path: relativeAuthoringPath, hash: bodyHash };
+                authoringSyncStateChanged = true;
+            }
+            catch (err) {
+                logErr(`Warning: could not write setup authoring file for ${asset.entryId} — ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        if (authoringSyncStateChanged) {
+            try {
+                saveAuthoringSyncState(pbDir, authoringSyncState);
+            }
+            catch (err) {
+                logErr(`Warning: could not persist setup authoring sync state — ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
     const writes = [
         ...(contextContent ? [{ path: join(cwd, '.productbrain', 'context.md'), relative: '.productbrain/context.md', content: contextContent, dirs: join(cwd, '.productbrain'), isAdapter: false }] : []),
         { path: join(cwd, '.productbrain', 'briefing.md'), relative: '.productbrain/briefing.md', content: briefingContent, isAdapter: false },
-        { path: join(cwd, 'AGENTS.md'), relative: 'AGENTS.md', content: agentsContent, isAdapter: true, target: 'codex' },
-        { path: join(cwd, 'CLAUDE.md'), relative: 'CLAUDE.md', content: claudeContent, isAdapter: true, target: 'claude' },
+        { path: join(cwd, 'AGENTS.md'), relative: 'AGENTS.md', content: agentsContent, isAdapter: true, target: 'codex', augmentTarget: true },
+        { path: join(cwd, 'CLAUDE.md'), relative: 'CLAUDE.md', content: claudeContent, isAdapter: true, target: 'claude', augmentTarget: true },
         { path: join(cwd, '.cursor', 'rules', 'chain.mdc'), relative: '.cursor/rules/chain.mdc', content: cursorContent, dirs: join(cwd, '.cursor', 'rules'), isAdapter: true, target: 'cursor' },
         { path: join(cwd, '.github', 'copilot-instructions.md'), relative: '.github/copilot-instructions.md', content: copilotContent, dirs: join(cwd, '.github'), isAdapter: true, target: 'copilot' },
+        ...copilotInstructionFiles.map((f) => ({
+            path: join(cwd, f.relativePath),
+            relative: f.relativePath,
+            content: f.content,
+            dirs: join(cwd, '.github', 'instructions'),
+            isAdapter: true,
+            target: 'copilot',
+        })),
+        ...(boundaryManifestContent ? [{
+                path: join(cwd, '.productbrain', 'generated', 'boundaries.json'),
+                relative: '.productbrain/generated/boundaries.json',
+                content: boundaryManifestContent,
+                dirs: join(cwd, '.productbrain', 'generated'),
+                isAdapter: false,
+            }] : []),
     ];
     // Add Cursor skill copies (filtered by target)
     const cursorProfile = resolveSurfaceProfile('cursor');
     for (const skill of canonicalSkills) {
         if (!shouldEmitToTarget(skill, 'cursor'))
             continue;
+        const dbAssetEntryId = skill.sourcePath.startsWith('db:') ? skill.sourcePath.slice(3) : undefined;
         const skillDir = join(cwd, '.cursor', 'skills', skill.name);
         writes.push({
             path: join(skillDir, 'SKILL.md'),
@@ -505,12 +1485,14 @@ export async function runHandshake(options = {}) {
             dirs: skillDir,
             isAdapter: true,
             target: 'cursor',
+            dbAssetEntryId,
         });
     }
     // Add Codex skill copies (projected markdown + index)
     const codexProfile = resolveSurfaceProfile('codex');
     const codexSkills = canonicalSkills.filter((s) => shouldEmitToTarget(s, 'codex'));
     for (const skill of codexSkills) {
+        const dbAssetEntryId = skill.sourcePath.startsWith('db:') ? skill.sourcePath.slice(3) : undefined;
         writes.push({
             path: join(cwd, '.codex', 'skills', `${skill.name}.md`),
             relative: `.codex/skills/${skill.name}.md`,
@@ -518,6 +1500,7 @@ export async function runHandshake(options = {}) {
             dirs: join(cwd, '.codex', 'skills'),
             isAdapter: true,
             target: 'codex',
+            dbAssetEntryId,
         });
     }
     writes.push({
@@ -534,6 +1517,7 @@ export async function runHandshake(options = {}) {
     for (const rule of canonicalRules) {
         if (!shouldEmitToTarget(rule, 'cursor'))
             continue;
+        const dbAssetEntryId = rule.sourcePath.startsWith('db:') ? rule.sourcePath.slice(3) : undefined;
         writes.push({
             path: join(cwd, '.cursor', 'rules', `${rule.name}.mdc`),
             relative: `.cursor/rules/${rule.name}.mdc`,
@@ -541,64 +1525,492 @@ export async function runHandshake(options = {}) {
             dirs: join(cwd, '.cursor', 'rules'),
             isAdapter: true,
             target: 'cursor',
+            dbAssetEntryId,
         });
     }
-    // Add Claude Code rule copies (filtered by target)
-    const claudeProfile = resolveSurfaceProfile('claude');
-    for (const rule of canonicalRules) {
-        if (!shouldEmitToTarget(rule, 'claude'))
-            continue;
-        writes.push({
-            path: join(cwd, '.claude', 'rules', `${rule.name}.md`),
-            relative: `.claude/rules/${rule.name}.md`,
-            content: generateClaudeRule(rule, claudeProfile),
-            dirs: join(cwd, '.claude', 'rules'),
-            isAdapter: true,
-            target: 'claude',
-        });
+    // 7a. WP-379 S5b: find leftover projections (apply mode) — REPORT-ONLY (coordinator ruling, PR
+    // #912 round 10), see findLeftoverProjections's own header. Gated on dbQuerySucceeded, not
+    // usedDbSource — the report only needs dbAssetRows' names, not the write-content source.
+    let leftoverFiles = [];
+    let leftoverFilesTruncated = false;
+    if (writeMode && dbQuerySucceeded) {
+        // Personal-layer names: merged into allSkills/allRules below but absent from dbAssetRows —
+        // without this an already-projected personal asset reads as a false-positive leftover.
+        const activeAssetNames = [
+            ...dbAssetRows.filter((a) => !a.disabledByOwner).map((a) => a.name),
+            ...personalSkills.map((s) => s.name),
+            ...personalRules.map((r) => r.name),
+        ];
+        // Nested .cursor/skills scan gets its OWN canon: canonicalSkills is SKILL-kind only and
+        // shouldEmitToTarget(_, 'cursor') respects per-skill target routing.
+        const cursorSkillNames = canonicalSkills.filter((s) => shouldEmitToTarget(s, 'cursor')).map((s) => s.name);
+        // Round 11: exempt exact write-plan paths from the leftover scan (see findLeftoverProjections's own doc).
+        const exactRelativePaths = new Set(writes.map((w) => w.relative));
+        const scanResult = findLeftoverProjections(cwd, activeAssetNames, allowedTargets, cursorSkillNames, exactRelativePaths);
+        leftoverFiles = scanResult.files;
+        leftoverFilesTruncated = scanResult.truncated;
     }
-    // Add Claude Code skill router (filtered by target)
-    const claudeSkills = canonicalSkills.filter((s) => shouldEmitToTarget(s, 'claude'));
-    const skillRouterContent = generateClaudeSkillRouter(claudeSkills, claudeProfile);
-    if (skillRouterContent) {
-        writes.push({
-            path: join(cwd, '.claude', 'rules', 'skill-router.md'),
-            relative: '.claude/rules/skill-router.md',
-            content: skillRouterContent,
-            dirs: join(cwd, '.claude', 'rules'),
-            isAdapter: true,
-            target: 'claude',
-        });
+    // ── WP-436 S3: Vocab projector — fetch workspace vocab context once per handshake. Source-side
+    // stays tokenized; resolves {{vocab:...}} before writing. Fail-open: a failed fetch writes the raw token.
+    const handshakeVocabCtx = await getOrFetchVocabCtx(config.apiKey, async () => {
+        try {
+            const vocab = await kernelCall('chain.getVocabulary', {});
+            if (vocab?.collectionLabels || vocab?.collectionDefaults) {
+                return {
+                    ...(vocab.collectionLabels ? { collectionLabels: vocab.collectionLabels } : {}),
+                    ...(vocab.collectionDefaults ? { collectionDefaults: vocab.collectionDefaults } : {}),
+                };
+            }
+            return null;
+        }
+        catch {
+            return null; // fail-open
+        }
+    });
+    const userOwnedSkipped = [];
+    const projectedHashUpdates = new Map();
+    const cleanBucketPaths = [];
+    const tamperedBucket = [];
+    const recordProjectedHash = (entryId) => {
+        if (!applyMode || !entryId)
+            return;
+        if (deferredAuthoringBaselineEntryIds.has(entryId))
+            return;
+        const projection = dbProjectionHashes.get(entryId);
+        if (projection)
+            projectedHashUpdates.set(entryId, projection.hash);
+    };
+    // TEN-2155: region augmentation context + symlink dedupe — codexActive gates the AGENTS.md skills-index pointer.
+    const regionCtx = { codexActive: allowedTargets.has('codex') };
+    const malformedRegionPaths = [];
+    // Same inode for two augment targets (e.g. CLAUDE.md symlinked to AGENTS.md): augment only first-seen.
+    const seenAugmentRealpaths = new Set();
+    const augmentTargetSkip = new Set();
+    for (const w of writes) {
+        if (!w.augmentTarget || !w.target || !allowedTargets.has(w.target) || !existsSync(w.path))
+            continue;
+        let real;
+        try {
+            real = realpathSync(w.path);
+        }
+        catch {
+            real = w.path;
+        }
+        if (seenAugmentRealpaths.has(real))
+            augmentTargetSkip.add(w.path);
+        else
+            seenAugmentRealpaths.add(real);
     }
     for (const w of writes) {
         // Surface filtering: skip adapter writes for targets not in the allowed set
-        if (allowedTargets && w.target && !allowedTargets.has(w.target)) {
+        if (w.target && !allowedTargets.has(w.target)) {
             filesSkipped.push({ path: w.relative, reason: `filtered (surface: ${w.target})` });
+            if (preview)
+                previewPlan.push({ path: w.relative, status: 'filtered' });
             continue;
         }
+        // ── TEN-2155: augment user-owned CLAUDE.md / AGENTS.md with a marked PB region — runs ahead
+        // of the legacy MARKER gates; absent/legacy-pb-managed fall through to the legacy path.
+        if (w.augmentTarget) {
+            const projection = REGION_PROJECTIONS[w.target];
+            if (projection && existsSync(w.path)) {
+                if (augmentTargetSkip.has(w.path)) {
+                    filesSkipped.push({ path: w.relative, reason: 'symlinked to another augment target — augmented once' });
+                    continue;
+                }
+                const disk = readFileSync(w.path, 'utf8');
+                const cls = classifyAdapterFile(disk);
+                if (cls === 'augmentable' || cls === 'region-present') {
+                    const eol = detectEol(disk);
+                    const region = replaceVocabTokens(projection.build(regionCtx, eol), handshakeVocabCtx);
+                    // Defense-in-depth: the composed region (post vocab-token resolution) must itself be a
+                    // single well-formed region. v1 content has no vocab tokens so this is a no-op, but it
+                    // guards the documented future override/vocab seam from injecting a stray sentinel/MARKER.
+                    if (classifyAdapterFile(region) !== 'region-present') {
+                        filesSkipped.push({ path: w.relative, reason: 'internal: composed PB region malformed — skipped to protect your file' });
+                        if (preview)
+                            previewPlan.push({ path: w.relative, status: 'needs-attention' });
+                        continue;
+                    }
+                    const candidate = cls === 'augmentable' ? spliceAppend(disk, region, eol) : spliceReplace(disk, region);
+                    if (candidate === disk) {
+                        filesSkipped.push({ path: w.relative, reason: 'unchanged' });
+                        if (preview)
+                            previewPlan.push({ path: w.relative, status: 'unchanged' });
+                        continue;
+                    }
+                    if (preview || dryRun) {
+                        filesWritten.push(w.relative + (dryRun ? ' (dry run)' : ''));
+                        if (preview)
+                            previewPlan.push({ path: w.relative, status: 'would-augment' });
+                        continue;
+                    }
+                    if (authorityPreviewOnly) {
+                        // apply + materialize observe/off: honor authority — do NOT write; mirror the legacy
+                        // preview-only skip so the report does not falsely list it as written.
+                        filesSkipped.push({ path: w.relative, reason: `preview-only (materialize: ${manifestStatus.mode})` });
+                        continue;
+                    }
+                    assertSetupWritePath(w.path, perimeterManifest);
+                    writeFileSync(w.path, candidate);
+                    filesWritten.push(w.relative);
+                    continue;
+                }
+                if (cls === 'malformed') {
+                    filesSkipped.push({ path: w.relative, reason: 'malformed PB region — left untouched; fix the pb:region sentinels' });
+                    if (preview)
+                        previewPlan.push({ path: w.relative, status: 'needs-attention' });
+                    malformedRegionPaths.push(w.relative);
+                    continue;
+                }
+                // cls 'pb-managed' falls through to legacy re-projection; 'opt-out' (pb:no-augment) falls through to the user-owned skip.
+            }
+            // absent file → fall through to legacy whole-file CREATE.
+        }
         if (w.isAdapter && !shouldWriteAdapter(w.path, force)) {
-            filesSkipped.push({ path: w.relative, reason: 'exists without auto-generated marker (use --force to overwrite)' });
+            // User-owned: a file at an adapter path without our auto-gen MARKER is the
+            // user's own file. Leave it untouched — never overwrite, never treat as drift
+            // or log a TEN (TEN-2150). Relayed to the connect screen via userOwnedSkipped.
+            filesSkipped.push({ path: w.relative, reason: 'user-owned — left untouched (pb won\'t overwrite your file)' });
+            if (preview) {
+                previewPlan.push({ path: w.relative, status: 'user-owned' });
+            }
+            else {
+                userOwnedSkipped.push(w.relative);
+            }
+            continue;
+        }
+        if (authorityPreviewOnly) {
+            filesSkipped.push({
+                path: w.relative,
+                reason: `preview-only (materialize: ${manifestStatus.mode})`,
+            });
             continue;
         }
-        if (dryRun) {
-            filesWritten.push(w.relative + ' (dry run)');
+        if (preview || dryRun) {
+            // In preview/dry-run mode: check content to distinguish new/update/unchanged
+            if (existsSync(w.path)) {
+                const current = readFileSync(w.path, 'utf8');
+                const nextNormalized = normalizeHandshakeContentForComparison(w.content);
+                const currentNormalized = normalizeHandshakeContentForComparison(current);
+                if (nextNormalized === currentNormalized) {
+                    filesSkipped.push({ path: w.relative, reason: 'unchanged' });
+                    if (preview)
+                        previewPlan.push({ path: w.relative, status: 'unchanged' });
+                }
+                else {
+                    filesWritten.push(w.relative + (dryRun ? ' (dry run)' : ''));
+                    if (preview)
+                        previewPlan.push({ path: w.relative, status: 'would-update' });
+                }
+            }
+            else {
+                filesWritten.push(w.relative + (dryRun ? ' (dry run)' : ''));
+                if (preview)
+                    previewPlan.push({ path: w.relative, status: 'would-write' });
+            }
             continue;
         }
+        // ── WP-421 S3: defer tampered adapter writes (doneWhen #17) — classify pb-managed-clean vs
+        // pb-managed-tampered, deferred not overwritten; post-loop resolves. --force bypasses the defer.
+        if (w.isAdapter && !force) {
+            const drift = classifyDriftBucket(w.path);
+            if (drift && drift.bucket === 'pb-managed-tampered') {
+                tamperedBucket.push({
+                    path: w.path,
+                    relative: w.relative,
+                    content: w.content,
+                    expectedHash: drift.expectedHash,
+                    actualHash: drift.actualHash,
+                    dirs: w.dirs,
+                    dbAssetEntryId: w.dbAssetEntryId,
+                });
+                // Do NOT write — defer until prompt/refusal resolves the file.
+                continue;
+            }
+            if (drift && drift.bucket === 'pb-managed-clean') {
+                cleanBucketPaths.push(w.relative);
+            }
+        }
+        assertSetupWritePath(w.path, perimeterManifest);
         if (w.dirs)
             mkdirSync(w.dirs, { recursive: true });
+        // WP-436 S3: resolve {{vocab:...}} tokens before writing projected adapter files only
+        // (source-side stays tokenized). Fail-open: undefined vocabCtx falls back to canonicalKey literals.
+        const resolvedContent = w.isAdapter
+            ? replaceVocabTokens(w.content, handshakeVocabCtx)
+            : w.content;
         if (existsSync(w.path)) {
             const current = readFileSync(w.path, 'utf8');
-            const nextNormalized = normalizeHandshakeContentForComparison(w.content);
+            const nextNormalized = normalizeHandshakeContentForComparison(resolvedContent);
             const currentNormalized = normalizeHandshakeContentForComparison(current);
             if (nextNormalized === currentNormalized) {
                 filesSkipped.push({ path: w.relative, reason: 'unchanged' });
+                recordProjectedHash(w.dbAssetEntryId);
                 continue;
             }
         }
-        writeFileSync(w.path, w.content);
+        writeFileSync(w.path, resolvedContent);
         filesWritten.push(w.relative);
+        recordProjectedHash(w.dbAssetEntryId);
+    }
+    if (projectedHashUpdates.size > 0) {
+        const updates = [...projectedHashUpdates];
+        const results = await Promise.allSettled(updates.map(([entryId, hash]) => kernelCall('setup.updateLastProjectedHash', { entryId, hash })));
+        results.forEach((result, index) => {
+            if (result.status === 'rejected') {
+                const [entryId] = updates[index];
+                trackEvent('skill.projection.failed', {
+                    entryId,
+                    reason: result.reason instanceof Error ? result.reason.message : String(result.reason),
+                });
+            }
+        });
+    }
+    // Runs AFTER the hash flush (malformed files were never written, nothing to record). TEN-2155:
+    // non-interactive apply refuses on a malformed region — gated on applyMode per STD-263 vi.
+    if (applyMode && malformedRegionPaths.length > 0 && (options.noPrompt || !process.stdout.isTTY)) {
+        throw new CLIError(`Malformed PB region in: ${malformedRegionPaths.join(', ')}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Fix the `<!-- pb:region:start -->` / `<!-- pb:region:end -->` sentinels (one balanced pair), then re-run `pb handshake`.',
+        });
+    }
+    // ── WP-421 S3: tampered-bucket resolution (doneWhen #17), apply mode only — headless (--no-prompt
+    // / non-TTY) refuses (setup_receipt kind='transition', DEC-962, exit non-zero); interactive adopts
+    // (personal draft from tampered content) or reverts (re-project canonical content).
+    const adoptedTamperedPaths = [];
+    const revertedTamperedPaths = [];
+    if (writeMode && tamperedBucket.length > 0) {
+        const headless = options.noPrompt === true || !process.stdout.isTTY;
+        if (headless) {
+            // ── Headless refusal path (doneWhen #17) ────────────────────────────────
+            logErr('');
+            logErr(`pb handshake: ${tamperedBucket.length} PB-managed projection file(s) were edited downstream of the auto-gen marker.`);
+            logErr('Headless mode (--no-prompt or no TTY) cannot resolve adopt-or-revert — refusing.');
+            logErr('');
+            const refusedTamperedFiles = tamperedBucket.map((t) => ({
+                path: t.relative,
+                expectedHash: t.expectedHash,
+                actualHash: t.actualHash,
+            }));
+            for (const refused of refusedTamperedFiles) {
+                // Per #17: stderr enumerates each tampered file as
+                // {path, expectedHash, actualHash, bucket}.
+                logErr(`  ${JSON.stringify({ ...refused, bucket: 'pb-managed-tampered' })}`);
+            }
+            logErr('');
+            logErr('Re-run interactively to resolve, or use --force to overwrite (data loss).');
+            // Write the kind='transition' setup_receipt row. Fail-open on the
+            // network/auth side: if the row cannot be written, we still exit non-zero
+            // (the audit trail is best-effort; refusal is mandatory).
+            try {
+                const manifestStatus = readManifestStatus(pbDir);
+                await kernelCall('setup.recordTamperRefusal', {
+                    mode: manifestStatus.mode,
+                    refusedTamperedFiles,
+                });
+                trackEvent('setup.transition.refused', {
+                    fileCount: refusedTamperedFiles.length,
+                    mode: manifestStatus.mode,
+                });
+            }
+            catch (err) {
+                trackEvent('setup.transition.refused.write_failed', {
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                logErr(`Warning: could not record transition receipt — ${err instanceof Error ? err.message : String(err)}`);
+            }
+            // Surface the report counts before exit (visibility for CI logs).
+            if (!quiet) {
+                const refusalReport = {
+                    filesWritten,
+                    filesSkipped,
+                    matchedEntries,
+                    searchQueries: uniqueQueries,
+                    repo,
+                    codexWarnings: codexWarnings.length > 0 ? codexWarnings : undefined,
+                    chainRulesStats: chainRulesStats ?? undefined,
+                    chainGaps: chainGaps.length > 0 ? chainGaps : undefined,
+                    adoptedCount: adoptedRulesCount,
+                    rejectedCount: rejectedRulesCount,
+                    personalRuleCount: personalRules.length > 0 ? personalRules.length : undefined,
+                    personalSkillCount: personalSkills.length > 0 ? personalSkills.length : undefined,
+                    registrySource,
+                    registryStale,
+                    userOwnedSkipped: userOwnedSkipped.length > 0 ? userOwnedSkipped : undefined,
+                    managedCleanCount: cleanBucketPaths.length || undefined,
+                    tamperedFiles: refusedTamperedFiles,
+                    leftoverFiles: leftoverFiles.length > 0 ? leftoverFiles : undefined,
+                    leftoverFilesTruncated: leftoverFilesTruncated || undefined, noProjectionAssets: noProjectionAssets.length > 0 ? noProjectionAssets : undefined, // same-line combine, shrink-only budget
+                };
+                process.stdout.write('\n');
+                process.stdout.write(isJsonMode() ? JSON.stringify(toPublicJsonReport(refusalReport)) + '\n' : formatHandshakeReport(refusalReport) + '\n');
+            }
+            // Exit non-zero per #17.
+            process.exit(1);
+        }
+        // ── Interactive path: prompt adopt-or-revert per file ──────────────────────
+        log('');
+        log(`pb handshake: ${tamperedBucket.length} PB-managed projection file(s) were edited downstream of the auto-gen marker.`);
+        log('You can ADOPT (capture your edits as a personal-scoped draft) or REVERT (overwrite with canonical content).');
+        // Batch yes-to-all / no-to-all when the user has many tampered files.
+        // Threshold: 5 (arbitrary; mirrors the typical handshake projection set).
+        let batchChoice = null;
+        if (tamperedBucket.length >= 5) {
+            const useBatch = await promptConfirm({
+                message: `Apply the same choice to all ${tamperedBucket.length} tampered files?`,
+                initialValue: false,
+            });
+            if (useBatch) {
+                const choice = await promptSelect({
+                    message: 'Apply to all:',
+                    options: [
+                        { value: 'adopt', label: 'Adopt all — capture each as a personal-scoped draft' },
+                        { value: 'revert', label: 'Revert all — overwrite with canonical content' },
+                    ],
+                });
+                batchChoice = choice === 'adopt' ? 'adopt-all' : 'revert-all';
+            }
+        }
+        for (const tamper of tamperedBucket) {
+            // Reverse-map the projection path back to the canonical authoring path.
+            const reverse = canonicalPathForAnySurface(tamper.relative);
+            const canonicalHint = reverse
+                ? `Canonical authoring path: ${reverse.canonicalPath}`
+                : (() => {
+                    // Telemetry + fallback message per surfaces/telemetry.ts.
+                    reportReverseMapMissing({ surface: 'unknown', projectionPath: tamper.relative }, logErr);
+                    return `Canonical authoring path: ${getReverseMapFallbackMessage()}`;
+                })();
+            log('');
+            log(`Tampered: ${tamper.relative}`);
+            log(`  expected: ${tamper.expectedHash}`);
+            log(`  actual:   ${tamper.actualHash}`);
+            log(`  ${canonicalHint}`);
+            let action;
+            if (batchChoice === 'adopt-all')
+                action = 'adopt';
+            else if (batchChoice === 'revert-all')
+                action = 'revert';
+            else {
+                action = await promptSelect({
+                    message: 'Adopt or revert?',
+                    options: [
+                        { value: 'adopt', label: 'Adopt — capture this as a personal-scoped setup_asset draft' },
+                        { value: 'revert', label: 'Revert — overwrite with canonical content' },
+                    ],
+                });
+            }
+            if (action === 'revert') {
+                // Re-project canonical content over the tampered file.
+                // WP-436 S3: resolve vocab tokens before writing (all tampered files are adapters).
+                if (tamper.dirs)
+                    mkdirSync(tamper.dirs, { recursive: true });
+                assertSetupWritePath(tamper.path, perimeterManifest);
+                writeFileSync(tamper.path, replaceVocabTokens(tamper.content, handshakeVocabCtx));
+                revertedTamperedPaths.push(tamper.relative);
+                recordProjectedHash(tamper.dbAssetEntryId);
+                trackEvent('setup.tampered.reverted', { path: tamper.relative });
+            }
+            else {
+                // Adopt: capture the tampered content as a personal-scoped draft (DEC-953: personal
+                // scope = push, no fork required). Best-effort — on failure the file stays untouched and
+                // a warning is logged. Does NOT revert; preserves the edits AND records them as a draft.
+                const draftName = basename(tamper.relative).replace(/\.(md|mdc)$/, '') + ' (adopted)';
+                try {
+                    const tamperedContent = readFileSync(tamper.path, 'utf8');
+                    const session = readSession();
+                    const caller = session ? kernelCallWithSession : kernelCall;
+                    await caller('setup.ingestSetupAsset', {
+                        entryId: `SETUP-ADOPTED-${Date.now()}-${draftName.replace(/\s+/g, '-')}`,
+                        name: draftName,
+                        // WP-421 S3
+                        description: `Adopted from tampered projection at ${tamper.relative}.`,
+                        body: tamperedContent,
+                        assetKind: tamper.relative.includes('/skills/') ? 'skill' : 'rule',
+                        triggers: [],
+                        semanticRefs: [],
+                    });
+                    adoptedTamperedPaths.push(tamper.relative);
+                    trackEvent('setup.tampered.adopted', { path: tamper.relative });
+                }
+                catch (err) {
+                    logErr(`Warning: could not adopt ${tamper.relative} as draft — ${err instanceof Error ? err.message : String(err)}`);
+                    trackEvent('setup.tampered.adopt_failed', {
+                        path: tamper.relative,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+        }
+    }
+    // DEC-1690: a dormant (gate-failed) asset is simply not projected — dbAssets already comes
+    // from the server's activeAssets list. The WP-379 S4 / WP-426 E4 on-disk marker/rename/restore
+    // machinery (and its .authoring-sync.json registries) is retired: nothing to reconcile.
+    // 8. User-owned files left untouched are NOT drift (TEN-2150) — a marker-less adapter-path
+    // file is the user's own; handshake never wrote it, so no "sync", no draft TEN, just a benign
+    // "Skipped:" surfaced via report.userOwnedSkipped (the tampered/authoring-sync drift below is unaffected).
+    if (syncDriftTensToFire.length > 0) {
+        const session = readSession();
+        if (session) {
+            for (const driftDescription of syncDriftTensToFire) {
+                kernelCallWithSession('chain.createEntry', {
+                    collectionSlug: 'tensions',
+                    name: 'TEN: setup authoring sync drift — repo wins',
+                    status: 'draft',
+                    data: { kind: 'drift', description: driftDescription },
+                    sessionId: session.sessionId,
+                    createdBy: `agent:${session.sessionId}`,
+                }, { retryOnRateLimit: false }).catch((err) => {
+                    // WP-513 round 3 (P2): still fail-open, but surfaced — an unowned rung-2 refusal must not silently drop the drift evidence.
+                    logErr(`Warning: could not persist drift TEN (${driftDescription.slice(0, 60)}…) — ${err instanceof Error ? err.message : String(err)}`);
+                });
+            }
+        }
+    }
+    // 8. Case-collision and dormant-drift TENs are gone (coordinator ruling, PR #912 round 10) —
+    // they existed only to audit automated deletions that no longer happen; `report.leftoverFiles`
+    // below is the single reporting surface now.
+    // 8b. Setup receipt — record which assets were materialized (apply mode only)
+    // Fail-open: receipt write is advisory, never blocks the handshake.
+    if (applyMode) {
+        const session = readSession();
+        const caller = session ? kernelCallWithSession : kernelCall;
+        try {
+            const currentState = await caller('setup.getCurrentSetupState', {});
+            const fromMode = currentState?.effectiveMode ?? 'observe';
+            if (fromMode !== manifestStatus.mode) {
+                await caller('setup.recordTransition', {
+                    fromMode, toMode: manifestStatus.mode, parseStatus: manifestStatus.parseStatus,
+                    surfaces: manifestStatus.surfaces,
+                    lock: manifestStatus.lock,
+                });
+                if (modeRank(manifestStatus.mode) < modeRank(fromMode)) {
+                    trackEvent('setup.transition.lowered', { fromMode, toMode: manifestStatus.mode });
+                }
+            }
+        }
+        catch (err) {
+            trackEvent('setup.transition.write_failed', { error: err instanceof Error ? err.message : String(err) });
+            logErr(`Warning: could not record setup transition — ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (writeMode) {
+        const session = readSession();
+        const caller = session ? kernelCallWithSession : kernelCall;
+        try {
+            const receiptResult = await caller('setup.materializeSetup', {});
+            if (receiptResult?.assetCount > 0) {
+                log(`Setup receipt: ${receiptResult.assetCount} asset(s) recorded.`);
+            }
+        }
+        catch (err) {
+            trackEvent('setup.receipt.write_failed', { error: err instanceof Error ? err.message : String(err) });
+            logErr(`Warning: could not write setup receipt — ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
-    // 8. Report
+    // 9. Report
     const report = {
         filesWritten,
         filesSkipped,
@@ -608,10 +2020,33 @@ export async function runHandshake(options = {}) {
         codexWarnings: codexWarnings.length > 0 ? codexWarnings : undefined,
         chainRulesStats: chainRulesStats ?? undefined,
         chainGaps: chainGaps.length > 0 ? chainGaps : undefined,
+        adoptedCount: adoptedRulesCount,
+        rejectedCount: rejectedRulesCount,
+        personalRuleCount: personalRules.length > 0 ? personalRules.length : undefined,
+        personalSkillCount: personalSkills.length > 0 ? personalSkills.length : undefined,
+        registrySource,
+        registryStale,
+        preview: preview ? true : undefined,
+        previewPlan: preview && previewPlan.length > 0 ? previewPlan : undefined,
+        userOwnedSkipped: userOwnedSkipped.length > 0 ? userOwnedSkipped : undefined,
+        // WP-421 S3: three-bucket drift report (doneWhen #17). PB-managed-clean is
+        // the count of files whose marker + hash matched. Tampered files were
+        // resolved (adopted/reverted) above and are reported separately.
+        managedCleanCount: cleanBucketPaths.length > 0 ? cleanBucketPaths.length : undefined,
+        adoptedTamperedPaths: adoptedTamperedPaths.length > 0 ? adoptedTamperedPaths : undefined,
+        revertedTamperedPaths: revertedTamperedPaths.length > 0 ? revertedTamperedPaths : undefined,
+        // REPORT-ONLY leftover-file listing (coordinator ruling, PR #912 round 10) — the human removes these.
+        leftoverFiles: leftoverFiles.length > 0 ? leftoverFiles : undefined,
+        leftoverFilesTruncated: leftoverFilesTruncated || undefined, noProjectionAssets: noProjectionAssets.length > 0 ? noProjectionAssets : undefined, // WP-660 S2 combine
     };
     if (!quiet) {
         process.stdout.write('\n');
-        process.stdout.write(formatHandshakeReport(report) + '\n');
+        process.stdout.write(isJsonMode() ? JSON.stringify(toPublicJsonReport(report)) + '\n' : formatHandshakeReport(report) + '\n');
     }
+    // Return the report so non-UI callers (e.g. prepareConnectContext) can surface
+    // skipped/user-owned files without re-deriving the skip logic (TEN-2107).
+    return report;
 }
+// WP-426 E3/E4: exported test-only surface (not part of the public CLI API).
+export const __test = { setupAuthoringPath, loadAuthoringSyncState, MARKER };
 //# sourceMappingURL=handshake.js.map