@productbrain/cli 0.1.0-beta.7395 → 0.1.0-beta.7409

package/dist/commands/handshake.js

@@ -3,16 +3,14 @@
  * Context export wiring (read-only filesystem bridge; GLO-63, DEC-161) — not a product surface.
  */
 import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, copyFileSync, realpathSync } from 'fs';
-import { join, dirname, resolve, basename, relative, sep, isAbsolute } from 'path';
+import { join, dirname, resolve, basename, relative, sep } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
-import { createHash } from 'crypto';
 import { execSync } from 'child_process';
 import { getConfigOrGuide } from '../lib/config.js';
 import { select as promptSelect, confirm as promptConfirm } from '../lib/prompts.js';
 import { composeHooksFromIntents, getHookStatusForSurface } from '../lib/hook-intents.js';
-import { kernelCall, kernelCallWithSession } from '../lib/client.js';
-import { readSession } from '../lib/session.js';
+import { kernelCall } from '../lib/client.js';
 import { detectRepo, extractWorkspaceProfile } from '../lib/repo-detect.js';
 import { generateContextMd } from '../generators/context-md.js';
 import { generateBriefingMd } from '../generators/briefing-md.js';
@@ -29,7 +27,6 @@ import { readManifest, readManifestStatus, filterByAdoptionState } from '../gene
 import { generateBoundaryManifest, getBoundaryEnforcementMode } from '../generators/boundary-manifest.js';
 import { loadMethodRegistry } from '../lib/method-registry.js';
 import { CLIError, ErrorCode } from '../lib/errors.js';
-import { trackEvent } from '../lib/telemetry.js';
 import { isJsonMode } from '../lib/runner.js';
 import { stripConvexInternals } from '../lib/strip.js';
 import { replaceVocabTokens } from '../lib/canonicalRefs.js';
@@ -38,12 +35,9 @@ import { getOrFetchVocabCtx } from '../lib/workspaceVocabCache.js';
 import { normalizeMaterializedFilename } from '../lib/normalizeMaterializedFilename.js';
 import { findLeftoverCursorSkills, LEFTOVER_FILES_MAX } from './handshakeCursorSkillCleanup.js';
 import { classifyDriftBucket } from './handshakeDriftClassification.js';
-import { parseSetupFrontmatter } from '../lib/frontmatter.js';
 import { sanitizeStartupResolutionSignals } from '../lib/startup-resolution-signals.js';
-import { assertSetupWritePath } from '../setup/perimeter.js';
-// WP-421 S3: SurfaceAdapter reverse-map for tampered prompts (DEC-952, doneWhen #34).
-import { canonicalPathForAnySurface, SURFACE_GOVERN_NO_SURFACES, SURFACE_REGISTRY, validateSurfacesForMode, } from '../surfaces/registry.js';
-import { getReverseMapFallbackMessage, reportReverseMapMissing } from '../surfaces/telemetry.js';
+import { assertSetupWritePath } from '../lib/writePerimeter.js';
+import { SURFACE_GOVERN_NO_SURFACES, SURFACE_REGISTRY, validateSurfacesForMode, } from '../surfaces/registry.js';
 const LEVELS = {
     guide: {
         label: 'Guide me',
@@ -492,154 +486,8 @@ function surfacePerimeterRoots(surface) {
         return ['.claude', 'CLAUDE.md'];
     return [`.${surface}`];
 }
-function modeRank(mode) {
-    return { off: 0, observe: 1, project: 2, govern: 3 }[mode];
-}
-function normalizeSetupAuthoringBody(body) {
-    return body.replace(/\r\n/g, '\n').replace(/\r/g, '\n').trimEnd();
-}
-function setupAuthoringAssetHash(asset) {
-    const canonical = {
-        entryId: asset.entryId,
-        name: asset.name,
-        description: asset.description ?? '',
-        assetKind: asset.assetKind,
-        triggers: asset.triggers ?? [],
-        semanticRefs: asset.semanticRefs ?? [],
-        body: normalizeSetupAuthoringBody(asset.body),
-    };
-    return `sha256:${createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
-}
-function parseSetupAuthoringFrontmatter(raw) {
-    // Shared parser (lib/frontmatter.ts): array-item quotes strip exactly as before, now canonical
-    // for migrate-setup/setup-ingest too. `assetKind` ignored (handshake derives kind from dir).
-    const parsed = parseSetupFrontmatter(raw);
-    return {
-        frontmatterId: parsed.frontmatterId,
-        name: parsed.name,
-        description: parsed.description,
-        body: parsed.body,
-        triggers: parsed.triggers,
-        semanticRefs: parsed.semanticRefs,
-    };
-}
-function deriveSetupAuthoringEntryId(filename, kind) {
-    const base = basename(filename, '.md');
-    const snakeCase = base.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
-    return `SETUP-${kind.toUpperCase()}-${snakeCase}`;
-}
-function scanSetupAuthoringFiles(productbrainDir) {
-    const dirs = [
-        { dir: 'skills', kind: 'skill' },
-        { dir: 'rules', kind: 'rule' },
-        { dir: 'hooks', kind: 'hook' },
-    ];
-    const items = [];
-    for (const { dir, kind } of dirs) {
-        const absDir = join(productbrainDir, dir);
-        if (!existsSync(absDir))
-            continue;
-        for (const file of readdirSync(absDir).filter((f) => f.endsWith('.md'))) {
-            const filePath = join(absDir, file);
-            const parsed = parseSetupAuthoringFrontmatter(readFileSync(filePath, 'utf8'));
-            const fallbackName = basename(file, '.md');
-            items.push({
-                filePath,
-                derivedEntryId: deriveSetupAuthoringEntryId(file, kind),
-                frontmatterId: parsed.frontmatterId,
-                name: parsed.name || fallbackName,
-                description: parsed.description,
-                body: parsed.body,
-                assetKind: kind,
-                triggers: parsed.triggers,
-                semanticRefs: parsed.semanticRefs,
-            });
-        }
-    }
-    return items.sort((a, b) => a.filePath.localeCompare(b.filePath));
-}
-function setupAuthoringDirForKind(kind) {
-    if (kind === 'skill')
-        return 'skills';
-    if (kind === 'rule')
-        return 'rules';
-    if (kind === 'hook')
-        return 'hooks';
-    return null;
-}
-function setupAuthoringFilename(name, entryId) {
-    const base = (name || entryId)
-        .replace(/[\/\\:*?"<>|]/g, '-')
-        .replace(/\s+/g, ' ')
-        .trim();
-    return `${base || entryId}.md`;
-}
-function setupAuthoringPath(cwd, asset) {
-    const dir = setupAuthoringDirForKind(asset.assetKind);
-    if (!dir)
-        return null;
-    // WP-426 E3: recorded authoring source path wins so reprojection lands where the
-    // user authored — no duplicate (TEN-1920). Stored relative to .productbrain/.
-    if (asset.authoringPath && asset.authoringPath.trim()) {
-        // Codex P1/P2: authoringPath is untrusted DB data, probed before any assertSetupWritePath guard runs —
-        // constrain to a kind-appropriate markdown file, else fall back to the safe name-derived path.
-        const pbDir = join(cwd, '.productbrain');
-        const candidate = resolve(pbDir, asset.authoringPath);
-        const within = relative(pbDir, candidate);
-        const withinPosix = within.split(sep).join('/');
-        if (!within.startsWith('..') &&
-            !isAbsolute(within) &&
-            withinPosix.startsWith(`${dir}/`) &&
-            withinPosix.toLowerCase().endsWith('.md')) {
-            return candidate;
-        }
-    }
-    return join(cwd, '.productbrain', dir, setupAuthoringFilename(asset.name, asset.entryId));
-}
-function renderSetupAuthoringFile(asset) {
-    const lines = [
-        '---',
-        `id: ${asset.entryId}`,
-        `name: ${JSON.stringify(asset.name)}`,
-        `description: ${JSON.stringify(asset.description ?? '')}`,
-        `assetKind: ${asset.assetKind}`,
-    ];
-    const pushArray = (key, values) => {
-        if (!values || values.length === 0)
-            return;
-        lines.push(`${key}:`);
-        for (const value of values)
-            lines.push(`  - ${JSON.stringify(value)}`);
-    };
-    pushArray('triggers', asset.triggers);
-    pushArray('semanticRefs', asset.semanticRefs);
-    lines.push('---', normalizeSetupAuthoringBody(asset.body), '');
-    return lines.join('\n');
-}
-function loadAuthoringSyncState(productbrainDir) {
-    const statePath = join(productbrainDir, '.authoring-sync.json');
-    if (!existsSync(statePath))
-        return { version: 1, assets: {} };
-    try {
-        const parsed = JSON.parse(readFileSync(statePath, 'utf8'));
-        if (parsed.version !== 1 || !parsed.assets || typeof parsed.assets !== 'object') {
-            return { version: 1, assets: {} };
-        }
-        return {
-            version: 1,
-            assets: parsed.assets,
-        };
-    }
-    catch {
-        return { version: 1, assets: {} };
-    }
-}
-function saveAuthoringSyncState(productbrainDir, state) {
-    const statePath = join(productbrainDir, '.authoring-sync.json');
-    assertSetupWritePath(statePath, { surfaces: [] });
-    mkdirSync(productbrainDir, { recursive: true });
-    writeFileSync(statePath, JSON.stringify(state, null, 2) + '\n');
-}
+// WP-776 S3f: modeRank deleted — its only caller compared authority-mode transitions for the
+// now-deleted setup.recordTransition receipt.
 // ── WP-421 S3: Three-bucket drift classification (doneWhen #17) — now its own module (STD-2/DEC-1504
 // shrink-only offset). Re-exported so existing imports `from '../commands/handshake.js'` keep working.
 export { classifyDriftBucket };
@@ -887,280 +735,14 @@ export async function runHandshake(options = {}) {
     const authorityCanWrite = manifestStatus.mode === 'project' || manifestStatus.mode === 'govern';
     const authorityPreviewOnly = applyMode && !authorityCanWrite;
     const writeMode = applyMode && authorityCanWrite;
-    let dbSkills = [];
-    let dbRules = [];
-    let usedDbSource = false;
-    // Codex P2 (PR #912 round 3): distinct from usedDbSource — true whenever the query succeeded
-    // (even empty), gating cleanup regardless of a later body-fetch throw; usedDbSource stays the
-    // CONTENT-source flag, only true after full success (a throw falls back to the filesystem).
-    let dbQuerySucceeded = false;
-    let dbAssetRows = [];
-    // WP-428 S2 (Finding #5): entryIds whose body fetch failed — hoisted so both the
-    // skills/rules AND authoring-file projection loops can skip them.
-    const bodyFetchFailedEntryIds = new Set();
-    const dbProjectionHashes = new Map();
-    const syncDriftTensToFire = [];
-    const deferredAuthoringBaselineEntryIds = new Set();
-    if (writeMode) {
-        const authoringItems = scanSetupAuthoringFiles(pbDir);
-        if (authoringItems.length > 0) {
-            // WP-428 S2 (Critical #1): ingestSetupAssetWithBody runs per-asset (batch can't call ctx.storage.store()), losing intra-batch collision detection — checked client-side below (replaces server-side DEC-954).
-            const idToPaths = new Map();
-            for (const item of authoringItems) {
-                const canonicalId = item.frontmatterId?.trim() || item.derivedEntryId;
-                const paths = idToPaths.get(canonicalId) ?? [];
-                paths.push(item.filePath);
-                idToPaths.set(canonicalId, paths);
-            }
-            const conflictingPaths = new Set();
-            for (const [, paths] of idToPaths) {
-                if (paths.length > 1) {
-                    for (const p of paths)
-                        conflictingPaths.add(p);
-                }
-            }
-            if (conflictingPaths.size > 0) {
-                logErr(`Setup authoring import partial: ${conflictingPaths.size} file(s) refused for duplicate setup id. ` +
-                    [...conflictingPaths].join(', '));
-            }
-            const itemsToIngest = authoringItems.filter((item) => !conflictingPaths.has(item.filePath));
-            if (itemsToIngest.length > 0) {
-                try {
-                    // Parallel uploads — concurrency limit 10 to avoid overwhelming the gateway.
-                    const CONCURRENCY = 10;
-                    const ingestResults = [];
-                    for (let i = 0; i < itemsToIngest.length; i += CONCURRENCY) {
-                        const batch = itemsToIngest.slice(i, i + CONCURRENCY);
-                        const settled = await Promise.allSettled(batch.map(async (item) => {
-                            const result = await kernelCall('setup.ingestSetupAssetWithBody', {
-                                entryId: item.derivedEntryId,
-                                frontmatterId: item.frontmatterId,
-                                name: item.name,
-                                description: item.description,
-                                body: item.body,
-                                assetKind: item.assetKind,
-                                triggers: item.triggers,
-                                semanticRefs: item.semanticRefs,
-                                authoringPath: relative(pbDir, item.filePath).split(sep).join('/'),
-                            });
-                            return { filePath: item.filePath, ...result };
-                        }));
-                        for (const r of settled) {
-                            if (r.status === 'fulfilled') {
-                                ingestResults.push(r.value);
-                                if (r.value.conflict === 'repo-wins') {
-                                    syncDriftTensToFire.push(`Repo authoring file won setup sync conflict for ${r.value.entryId} at ${r.value.filePath}.`);
-                                    logErr(`Warning: repo authoring file won sync conflict for ${r.value.entryId}; DB edit was overwritten.`);
-                                }
-                            }
-                            else {
-                                trackEvent('setup.authoring_import.item_failed', { error: r.reason instanceof Error ? r.reason.message : String(r.reason) });
-                                logErr(`Warning: setup authoring import failed for one asset — ${r.reason instanceof Error ? r.reason.message : String(r.reason)}`);
-                            }
-                        }
-                    }
-                    if (ingestResults.length > 0) {
-                        log(`Setup authoring import: ${ingestResults.length} file(s) checked (with bodyStorageId).`);
-                    }
-                }
-                catch (err) {
-                    trackEvent('setup.authoring_import.failed', { error: err instanceof Error ? err.message : String(err) });
-                    logErr(`Warning: setup authoring import failed — ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-    }
-    try {
-        // WP-379 S4: only activeAssets projects (DEC-1690); falls back to [] for the old flat-array server shape.
-        const rawResponse = await kernelCall('setup.listAssetsForUser', {}).catch(() => null);
-        let dbAssets = [];
-        if (rawResponse !== null) {
-            if (Array.isArray(rawResponse)) {
-                // Pre-S4 server — treat entire response as active assets with no dormant list.
-                dbAssets = rawResponse;
-            }
-            else {
-                dbAssets = rawResponse.activeAssets ?? [];
-            }
-            // Successful (even empty) is authoritative, distinct from "unavailable" (catch below) — an
-            // empty active set must still gate cleanup on, or a workspace whose last asset was deleted
-            // keeps stale projections forever.
-            dbQuerySucceeded = true;
-            dbAssetRows = dbAssets;
-        }
-        if (dbAssets.length > 0) {
-            // WP-428 S2: body is no longer inline — fetch from storage per non-disabled skill/rule/hook (bounded, parallel).
-            const projectableAssets = dbAssets.filter((a) => !a.disabledByOwner && (a.assetKind === 'skill' || a.assetKind === 'rule' || a.assetKind === 'hook'));
-            const assetsNeedingBodyFetch = projectableAssets.filter((a) => a.bodyStorageId);
-            const bodyFetchMap = new Map(); // entryId → body
-            // WP-428 S2 (Finding #5/#12): fetch-failed entryIds excluded from dbSkills/dbRules below (outer-scope bodyFetchFailedEntryIds).
-            if (assetsNeedingBodyFetch.length > 0) {
-                log(`Fetching ${assetsNeedingBodyFetch.length} asset body(s) from storage...`);
-                const bodyFetchResults = await Promise.allSettled(assetsNeedingBodyFetch.map(async (asset) => {
-                    const result = await kernelCall('setup.fetchAssetBody', { bodyStorageId: asset.bodyStorageId });
-                    return { entryId: asset.entryId, name: asset.name, body: result.body };
-                }));
-                for (let i = 0; i < bodyFetchResults.length; i++) {
-                    const result = bodyFetchResults[i];
-                    if (result.status === 'fulfilled') {
-                        bodyFetchMap.set(result.value.entryId, result.value.body);
-                    }
-                    else {
-                        // WP-428 S2 (Finding #12): include entryId and name in the warning (Finding #5: skip projection).
-                        const asset = assetsNeedingBodyFetch[i];
-                        logErr(`Warning: failed to fetch body for ${asset.entryId} (${asset.name}) — ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
-                        bodyFetchFailedEntryIds.add(asset.entryId);
-                    }
-                }
-                if (bodyFetchFailedEntryIds.size > 0) {
-                    // WP-439 S4: strict-by-default — a body-fetch failure is hard unless --lenient.
-                    const failedList = [...bodyFetchFailedEntryIds].join(', ');
-                    if (options.lenient) {
-                        logErr(`Warning: ${bodyFetchFailedEntryIds.size} asset(s) skipped due to body fetch failure (--lenient): ${failedList}`);
-                    }
-                    else {
-                        throw new CLIError(`${bodyFetchFailedEntryIds.size} asset(s) failed body fetch: ${failedList}. ` +
-                            `There is no CLI repair path for this release. ` +
-                            `Pass --lenient to suppress this and continue with affected entries skipped.`, { code: ErrorCode.INTERNAL, category: 'internal' });
-                    }
-                }
-            }
-            // Map DB assets to CanonicalSkill/CanonicalRule shapes
-            for (const asset of dbAssets) {
-                if (asset.disabledByOwner)
-                    continue;
-                // WP-428 S2 (Finding #5): skip fetch-failed assets — no empty body written, no lastProjectedHash update.
-                if (bodyFetchFailedEntryIds.has(asset.entryId))
-                    continue;
-                // WP-428 S2: prefer storage-fetched body, fall back to inline body (pre-S2 servers, deletable once all servers are S2+).
-                const resolvedBody = bodyFetchMap.get(asset.entryId) ?? asset.body ?? '';
-                if (asset.assetKind === 'skill') {
-                    dbSkills.push({
-                        name: asset.name,
-                        description: asset.description,
-                        triggers: asset.triggers ?? [],
-                        body: resolvedBody,
-                        sourcePath: `db:${asset.entryId}`,
-                    });
-                }
-                else if (asset.assetKind === 'rule' || asset.assetKind === 'hook') {
-                    dbRules.push({
-                        name: asset.name,
-                        description: asset.description,
-                        autoApply: false,
-                        body: resolvedBody,
-                        sourcePath: `db:${asset.entryId}`,
-                    });
-                }
-            }
-            log(`Setup assets: ${dbSkills.length} skills, ${dbRules.length} rules/hooks from DB (WP-345 DB-first path)`);
-            // Reaching here (no throw above) means it's safe to use as the CONTENT source (Codex P2, PR #912 round 3).
-            usedDbSource = true;
-        }
-        else if (dbQuerySucceeded && writeMode) {
-            // Empty DB in WRITE mode is authoritative (ingest already ran); preview never ingests, so FS still forecasts apply.
-            // Round 14: findLeftoverProjections only lists stale files, never removes them — say so.
-            // Round 15: it also skips surfaces outside allowedTargets — scope the claim to those.
-            log('Setup assets: DB query succeeded with zero active assets — any existing projections on the selected surfaces will be listed as leftovers, not removed.');
-            usedDbSource = true;
-        }
-    }
-    catch {
-        // DB unavailable, or post-query processing failed hard — usedDbSource stays false either way.
-    }
-    const allSkills = usedDbSource ? dbSkills : readCanonicalSkills(pbDir);
-    const manualRules = usedDbSource ? dbRules : readCanonicalRules(pbDir);
-    if (!usedDbSource) {
-        log('Setup assets: reading from filesystem (DB source unavailable, or unauthoritative for this mode)');
-    }
-    // 5a-pre. E4: resolve semantic refs (WP-345, DEC-A/C/K) — replace {{ref:key}} via the Convex
-    // resolver, apply mode only. NG11: PostHog events fire from CLI side only.
-    if (usedDbSource && writeMode) {
-        const projectableDbAssets = dbAssetRows.filter((a) => !a.disabledByOwner && (a.assetKind === 'skill' || a.assetKind === 'rule' || a.assetKind === 'hook'));
-        const assetsWithRefs = projectableDbAssets.filter((a) => a.semanticRefs && a.semanticRefs.length > 0);
-        if (assetsWithRefs.length > 0) {
-            log(`Resolving semantic refs for ${assetsWithRefs.length} asset(s)...`);
-            // Collect unique ref keys across all assets
-            const allRefKeys = [...new Set(assetsWithRefs.flatMap((a) => a.semanticRefs))];
-            // Resolve all refs in a single batch call (DEC-767 / WP-354 Build-Order #6 — kind + status discriminator).
-            let resolvedRefs = [];
-            try {
-                resolvedRefs = await kernelCall('setup.resolveSemanticRefs', { semanticRefs: allRefKeys });
-            }
-            catch (err) {
-                trackEvent('setup.refs.resolve_failed', { error: err instanceof Error ? err.message : String(err) });
-                logErr(`Warning: could not resolve semantic refs — ${err instanceof Error ? err.message : String(err)}`);
-            }
-            // Build resolved map: canonicalKey → display name. Only required refs count as unresolved warnings.
-            const resolvedMap = new Map();
-            let unresolvedCount = 0;
-            for (const result of resolvedRefs) {
-                if (result.status === 'resolved' && result.localEntryId) {
-                    resolvedMap.set(result.ref, result.localEntryId);
-                    trackEvent('skill.ref.resolved', { ref: result.ref, kind: result.kind });
-                }
-                else if (result.status === 'unsupported-future') {
-                    // seed: refs are explicitly future scope per WP-354 Build-Order #6 — not a warning.
-                    trackEvent('skill.ref.future', { ref: result.ref, kind: result.kind });
-                }
-                else if (result.required) {
-                    unresolvedCount++;
-                    trackEvent('skill.ref.unresolved', { ref: result.ref, kind: result.kind, status: result.status });
-                }
-            }
-            if (unresolvedCount > 0) {
-                logErr(`Warning: ${unresolvedCount} required semantic ref(s) could not be resolved.`);
-            }
-            // Projection preserves ref tokens as portable refs — resolvedMap is validation/telemetry only.
-        }
-        // Compute projection hash per projected DB asset (DEC-K): sha256 of the normalized resolved body.
-        const HASH_TRAILER_REGEX = /^<!--\s*pb-hash:.*-->\s*$/gm;
-        const TIMESTAMP_REGEX = /^<!--\s*pb-generated-at:.*-->\s*$/gm;
-        for (const rawAsset of projectableDbAssets) {
-            const resolvedAsset = [...dbSkills, ...dbRules].find((a) => a.sourcePath === `db:${rawAsset.entryId}`);
-            if (!resolvedAsset)
-                continue;
-            try {
-                // Build the projected body (what will be written to disk)
-                const projectedBody = resolvedAsset.body;
-                // Normalize: strip existing hash/timestamp trailers, convert to LF
-                const normalized = projectedBody
-                    .replace(HASH_TRAILER_REGEX, '')
-                    .replace(TIMESTAMP_REGEX, '')
-                    .replace(/\r\n/g, '\n')
-                    .replace(/\r/g, '\n')
-                    .trimEnd();
-                // Compute sha256 hash
-                const hash = createHash('sha256').update(normalized, 'utf8').digest('hex');
-                const hashTrailer = `<!-- pb-hash: sha256:${hash} -->`;
-                // Append hash trailer to the projected body
-                resolvedAsset.body = `${normalized}\n${hashTrailer}`;
-                dbProjectionHashes.set(rawAsset.entryId, {
-                    hash: `sha256:${hash}`,
-                    assetKind: rawAsset.assetKind,
-                });
-                // Drift detection: compare against last known hash
-                if (rawAsset.lastProjectedHash && rawAsset.lastProjectedHash !== `sha256:${hash}`) {
-                    trackEvent('skill.drift.detected', {
-                        entryId: rawAsset.entryId,
-                        assetKind: rawAsset.assetKind,
-                    });
-                    log(`Drift detected for asset ${rawAsset.entryId} — projecting updated version.`);
-                }
-                trackEvent('skill.projection.succeeded', {
-                    entryId: rawAsset.entryId,
-                    assetKind: rawAsset.assetKind,
-                });
-            }
-            catch (err) {
-                trackEvent('skill.projection.failed', {
-                    entryId: rawAsset.entryId,
-                    assetKind: rawAsset.assetKind,
-                });
-                logErr(`Warning: projection failed for ${rawAsset.entryId} — ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-    }
+    // WP-776 S3f: the DB-first setup-asset sourcing pipeline (setup.listAssetsForUser +
+    // setup.fetchAssetBody + setup.resolveSemanticRefs + setup.ingestSetupAssetWithBody, plus the
+    // personal-asset dormancy sync and per-asset projection-hash/drift-detection bookkeeping around
+    // it) is deleted along with the rest of the setup-assets system — DEC-1771 (delete, never hide).
+    // The filesystem read path below (readCanonicalSkills/readCanonicalRules) was always the
+    // fallback when the DB source was unavailable; it is now the only source.
+    const allSkills = readCanonicalSkills(pbDir);
+    const manualRules = readCanonicalRules(pbDir);
     // 5a. Optionally fetch and merge Chain-derived rules (--generate flag)
     let chainRulesStats = null;
     let chainGaps = [];
@@ -1215,7 +797,8 @@ export async function runHandshake(options = {}) {
         }
         allSkills.push(...personalSkills);
     }
-    // 5d. Load method registry (WP-310 E4) — only when manifest is present.
+    // 5d. Load method registry (WP-310 E4) — only when manifest is present. Unrelated to the
+    // setup-assets system (WP-329's own "methods" Chain collection, no setup.* coupling) — kept.
     let registrySource;
     let registryStale;
     if (manifest) {
@@ -1337,117 +920,9 @@ export async function runHandshake(options = {}) {
     const filesWritten = [];
     const filesSkipped = [];
     const previewPlan = [];
-    if (writeMode && usedDbSource) {
-        const authoringSyncState = loadAuthoringSyncState(pbDir);
-        let authoringSyncStateChanged = false;
-        const personalAssets = dbAssetRows.filter((asset) => asset.scope === 'personal' &&
-            !asset.disabledByOwner &&
-            (asset.assetKind === 'skill' || asset.assetKind === 'rule' || asset.assetKind === 'hook'));
-        for (const asset of personalAssets) {
-            // WP-428 S2 (Finding #5): skip fetch-failed assets — no empty-body authoring file, no lastProjectedHash update.
-            if (bodyFetchFailedEntryIds.has(asset.entryId))
-                continue;
-            const authoringPath = setupAuthoringPath(cwd, asset);
-            if (!authoringPath)
-                continue;
-            // relative() for correct cross-platform path computation (string-replace mis-fires on non-'/' cwd separators).
-            const relativeAuthoringPath = relative(cwd, authoringPath);
-            const bodyHash = setupAuthoringAssetHash(asset);
-            const authoringExists = existsSync(authoringPath);
-            const tracked = authoringSyncState.assets[asset.entryId];
-            const trackedHere = tracked?.path === relativeAuthoringPath;
-            const trackedMatchesServer = Boolean(trackedHere && asset.lastProjectedHash && tracked?.hash === asset.lastProjectedHash);
-            if (!authoringExists && asset.lastProjectedHash && trackedHere && trackedMatchesServer) {
-                try {
-                    const dormantResult = await kernelCall('setup.markPersonalSetupAssetDormantFromSync', { entryId: asset.entryId, expectedLastProjectedHash: tracked.hash });
-                    if (dormantResult.action === 'conflict') {
-                        syncDriftTensToFire.push(`Repo authoring deletion skipped for ${asset.entryId}; server baseline changed during sync, so writeback was deferred until the next DB read.`);
-                        logErr(`Warning: authoring deletion for ${asset.entryId} was not applied because the DB baseline changed during sync.`);
-                        deferredAuthoringBaselineEntryIds.add(asset.entryId);
-                        continue;
-                    }
-                    else {
-                        syncDriftTensToFire.push(`Repo authoring file was deleted for ${asset.entryId}; caller-owned personal setup asset marked dormant.`);
-                        log(`Setup authoring deletion: ${asset.entryId} marked dormant.`);
-                        delete authoringSyncState.assets[asset.entryId];
-                        authoringSyncStateChanged = true;
-                        continue;
-                    }
-                }
-                catch (err) {
-                    logErr(`Warning: could not mark ${asset.entryId} dormant after authoring deletion — ${err instanceof Error ? err.message : String(err)}`);
-                    continue;
-                }
-            }
-            else if (!authoringExists && asset.lastProjectedHash && trackedHere) {
-                syncDriftTensToFire.push(`Repo authoring deletion skipped for ${asset.entryId}; local sync baseline is stale, so DB writeback wins.`);
-                logErr(`Warning: authoring deletion for ${asset.entryId} was not applied because the DB baseline changed.`);
-            }
-            const nextAuthoringContent = renderSetupAuthoringFile(asset);
-            if (authoringExists) {
-                const parsed = parseSetupAuthoringFrontmatter(readFileSync(authoringPath, 'utf8'));
-                const fileHash = setupAuthoringAssetHash({
-                    entryId: parsed.frontmatterId?.trim() || asset.entryId,
-                    name: parsed.name || asset.name,
-                    description: parsed.description,
-                    body: parsed.body,
-                    assetKind: asset.assetKind,
-                    triggers: parsed.triggers,
-                    semanticRefs: parsed.semanticRefs,
-                });
-                if (fileHash === bodyHash) {
-                    if (asset.lastProjectedHash !== bodyHash) {
-                        await kernelCall('setup.updateLastProjectedHash', {
-                            entryId: asset.entryId,
-                            hash: bodyHash,
-                        }).catch(() => null);
-                    }
-                    authoringSyncState.assets[asset.entryId] = { path: relativeAuthoringPath, hash: bodyHash };
-                    authoringSyncStateChanged = true;
-                    continue;
-                }
-                if (!asset.lastProjectedHash) {
-                    syncDriftTensToFire.push(`Repo authoring file differs from DB for ${asset.entryId} at ${authoringPath} with no shared baseline; DB writeback skipped.`);
-                    logErr(`Warning: setup authoring drift for ${asset.entryId}; DB writeback skipped because no shared baseline exists.`);
-                    continue;
-                }
-                if (fileHash !== asset.lastProjectedHash &&
-                    bodyHash !== asset.lastProjectedHash) {
-                    syncDriftTensToFire.push(`Repo authoring file won setup sync conflict for ${asset.entryId} at ${authoringPath}.`);
-                    logErr(`Warning: repo authoring file won sync conflict for ${asset.entryId}; DB writeback skipped.`);
-                    continue;
-                }
-                if (fileHash !== asset.lastProjectedHash) {
-                    syncDriftTensToFire.push(`Repo authoring file differs from DB baseline for ${asset.entryId} at ${authoringPath}; DB writeback skipped.`);
-                    logErr(`Warning: setup authoring drift for ${asset.entryId}; DB writeback skipped.`);
-                    continue;
-                }
-            }
-            try {
-                assertSetupWritePath(authoringPath, perimeterManifest);
-                mkdirSync(dirname(authoringPath), { recursive: true });
-                writeFileSync(authoringPath, nextAuthoringContent);
-                filesWritten.push(relativeAuthoringPath);
-                await kernelCall('setup.updateLastProjectedHash', {
-                    entryId: asset.entryId,
-                    hash: bodyHash,
-                }).catch(() => null);
-                authoringSyncState.assets[asset.entryId] = { path: relativeAuthoringPath, hash: bodyHash };
-                authoringSyncStateChanged = true;
-            }
-            catch (err) {
-                logErr(`Warning: could not write setup authoring file for ${asset.entryId} — ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        if (authoringSyncStateChanged) {
-            try {
-                saveAuthoringSyncState(pbDir, authoringSyncState);
-            }
-            catch (err) {
-                logErr(`Warning: could not persist setup authoring sync state — ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-    }
+    // WP-776 S3f: the personal-setup-asset authoring sync block (setup.markPersonalSetupAssetDormantFromSync
+    // + setup.updateLastProjectedHash) is deleted along with the DB-asset sourcing pipeline above —
+    // there is no DB-sourced personal asset any more to reconcile against .productbrain authoring files.
     const writes = [
         ...(contextContent ? [{ path: join(cwd, '.productbrain', 'context.md'), relative: '.productbrain/context.md', content: contextContent, dirs: join(cwd, '.productbrain'), isAdapter: false }] : []),
         { path: join(cwd, '.productbrain', 'briefing.md'), relative: '.productbrain/briefing.md', content: briefingContent, isAdapter: false },
@@ -1529,17 +1004,16 @@ export async function runHandshake(options = {}) {
         });
     }
     // 7a. WP-379 S5b: find leftover projections (apply mode) — REPORT-ONLY (coordinator ruling, PR
-    // #912 round 10), see findLeftoverProjections's own header. Gated on dbQuerySucceeded, not
-    // usedDbSource — the report only needs dbAssetRows' names, not the write-content source.
+    // #912 round 10), see findLeftoverProjections's own header. WP-776 S3f: gated on writeMode
+    // alone now — the DB source (dbQuerySucceeded) is gone, so activeAssetNames comes from the
+    // filesystem-sourced allSkills/allRules (which already include the personal layer, merged in
+    // above) instead of dbAssetRows.
     let leftoverFiles = [];
     let leftoverFilesTruncated = false;
-    if (writeMode && dbQuerySucceeded) {
-        // Personal-layer names: merged into allSkills/allRules below but absent from dbAssetRows —
-        // without this an already-projected personal asset reads as a false-positive leftover.
+    if (writeMode) {
         const activeAssetNames = [
-            ...dbAssetRows.filter((a) => !a.disabledByOwner).map((a) => a.name),
-            ...personalSkills.map((s) => s.name),
-            ...personalRules.map((r) => r.name),
+            ...allSkills.map((s) => s.name),
+            ...allRules.map((r) => r.name),
         ];
         // Nested .cursor/skills scan gets its OWN canon: canonicalSkills is SKILL-kind only and
         // shouldEmitToTarget(_, 'cursor') respects per-skill target routing.
@@ -1568,18 +1042,8 @@ export async function runHandshake(options = {}) {
         }
     });
     const userOwnedSkipped = [];
-    const projectedHashUpdates = new Map();
     const cleanBucketPaths = [];
     const tamperedBucket = [];
-    const recordProjectedHash = (entryId) => {
-        if (!applyMode || !entryId)
-            return;
-        if (deferredAuthoringBaselineEntryIds.has(entryId))
-            return;
-        const projection = dbProjectionHashes.get(entryId);
-        if (projection)
-            projectedHashUpdates.set(entryId, projection.hash);
-    };
     // TEN-2155: region augmentation context + symlink dedupe — codexActive gates the AGENTS.md skills-index pointer.
     const regionCtx = { codexActive: allowedTargets.has('codex') };
     const malformedRegionPaths = [];
@@ -1723,7 +1187,6 @@ export async function runHandshake(options = {}) {
                     expectedHash: drift.expectedHash,
                     actualHash: drift.actualHash,
                     dirs: w.dirs,
-                    dbAssetEntryId: w.dbAssetEntryId,
                 });
                 // Do NOT write — defer until prompt/refusal resolves the file.
                 continue;
@@ -1746,27 +1209,16 @@ export async function runHandshake(options = {}) {
             const currentNormalized = normalizeHandshakeContentForComparison(current);
             if (nextNormalized === currentNormalized) {
                 filesSkipped.push({ path: w.relative, reason: 'unchanged' });
-                recordProjectedHash(w.dbAssetEntryId);
                 continue;
             }
         }
         writeFileSync(w.path, resolvedContent);
         filesWritten.push(w.relative);
-        recordProjectedHash(w.dbAssetEntryId);
-    }
-    if (projectedHashUpdates.size > 0) {
-        const updates = [...projectedHashUpdates];
-        const results = await Promise.allSettled(updates.map(([entryId, hash]) => kernelCall('setup.updateLastProjectedHash', { entryId, hash })));
-        results.forEach((result, index) => {
-            if (result.status === 'rejected') {
-                const [entryId] = updates[index];
-                trackEvent('skill.projection.failed', {
-                    entryId,
-                    reason: result.reason instanceof Error ? result.reason.message : String(result.reason),
-                });
-            }
-        });
     }
+    // WP-776 S3f: the projected-hash flush back to the DB (setup.updateLastProjectedHash) is
+    // deleted along with the rest of the setup-assets gateway routes — there is no DB-sourced
+    // asset any more whose lastProjectedHash needs updating (dbAssetEntryId is always undefined
+    // now that allSkills/allRules are filesystem-sourced).
     // Runs AFTER the hash flush (malformed files were never written, nothing to record). TEN-2155:
     // non-interactive apply refuses on a malformed region — gated on applyMode per STD-263 vi.
     if (applyMode && malformedRegionPaths.length > 0 && (options.noPrompt || !process.stdout.isTTY)) {
@@ -1777,9 +1229,15 @@ export async function runHandshake(options = {}) {
         });
     }
     // ── WP-421 S3: tampered-bucket resolution (doneWhen #17), apply mode only — headless (--no-prompt
-    // / non-TTY) refuses (setup_receipt kind='transition', DEC-962, exit non-zero); interactive adopts
-    // (personal draft from tampered content) or reverts (re-project canonical content).
-    const adoptedTamperedPaths = [];
+    // / non-TTY) refuses, exit non-zero. WP-776 S3d/S3f: the setup-assets system this resolution used
+    // to offer as an "adopt" alternative (capture tampered edits as a personal-scoped draft via
+    // setup.ingestSetupAsset) is deleted, and with it the only OTHER option besides overwriting —
+    // per DEC-1771 (delete, never hide) there is no shim standing in for that capability. Revert
+    // (re-project canonical content) is the only resolution left; this is a real capability loss
+    // for anyone who was relying on "adopt" to preserve hand-edits, named here rather than silently
+    // dropped. The refusal receipt (`setup.recordTamperRefusal`) is deleted along with the rest of
+    // the setup-assets gateway routes — headless mode still refuses and reports, it just no longer
+    // writes an audit row for the refusal.
     const revertedTamperedPaths = [];
     if (writeMode && tamperedBucket.length > 0) {
         const headless = options.noPrompt === true || !process.stdout.isTTY;
@@ -1787,7 +1245,7 @@ export async function runHandshake(options = {}) {
             // ── Headless refusal path (doneWhen #17) ────────────────────────────────
             logErr('');
             logErr(`pb handshake: ${tamperedBucket.length} PB-managed projection file(s) were edited downstream of the auto-gen marker.`);
-            logErr('Headless mode (--no-prompt or no TTY) cannot resolve adopt-or-revert — refusing.');
+            logErr('Headless mode (--no-prompt or no TTY) cannot confirm an overwrite — refusing.');
             logErr('');
             const refusedTamperedFiles = tamperedBucket.map((t) => ({
                 path: t.relative,
@@ -1801,26 +1259,6 @@ export async function runHandshake(options = {}) {
             }
             logErr('');
             logErr('Re-run interactively to resolve, or use --force to overwrite (data loss).');
-            // Write the kind='transition' setup_receipt row. Fail-open on the
-            // network/auth side: if the row cannot be written, we still exit non-zero
-            // (the audit trail is best-effort; refusal is mandatory).
-            try {
-                const manifestStatus = readManifestStatus(pbDir);
-                await kernelCall('setup.recordTamperRefusal', {
-                    mode: manifestStatus.mode,
-                    refusedTamperedFiles,
-                });
-                trackEvent('setup.transition.refused', {
-                    fileCount: refusedTamperedFiles.length,
-                    mode: manifestStatus.mode,
-                });
-            }
-            catch (err) {
-                trackEvent('setup.transition.refused.write_failed', {
-                    error: err instanceof Error ? err.message : String(err),
-                });
-                logErr(`Warning: could not record transition receipt — ${err instanceof Error ? err.message : String(err)}`);
-            }
             // Surface the report counts before exit (visibility for CI logs).
             if (!quiet) {
                 const refusalReport = {
@@ -1850,59 +1288,20 @@ export async function runHandshake(options = {}) {
             // Exit non-zero per #17.
             process.exit(1);
         }
-        // ── Interactive path: prompt adopt-or-revert per file ──────────────────────
+        // ── Interactive path: confirm, then revert every tampered file ─────────────
         log('');
         log(`pb handshake: ${tamperedBucket.length} PB-managed projection file(s) were edited downstream of the auto-gen marker.`);
-        log('You can ADOPT (capture your edits as a personal-scoped draft) or REVERT (overwrite with canonical content).');
-        // Batch yes-to-all / no-to-all when the user has many tampered files.
-        // Threshold: 5 (arbitrary; mirrors the typical handshake projection set).
-        let batchChoice = null;
-        if (tamperedBucket.length >= 5) {
-            const useBatch = await promptConfirm({
-                message: `Apply the same choice to all ${tamperedBucket.length} tampered files?`,
-                initialValue: false,
-            });
-            if (useBatch) {
-                const choice = await promptSelect({
-                    message: 'Apply to all:',
-                    options: [
-                        { value: 'adopt', label: 'Adopt all — capture each as a personal-scoped draft' },
-                        { value: 'revert', label: 'Revert all — overwrite with canonical content' },
-                    ],
-                });
-                batchChoice = choice === 'adopt' ? 'adopt-all' : 'revert-all';
-            }
-        }
-        for (const tamper of tamperedBucket) {
-            // Reverse-map the projection path back to the canonical authoring path.
-            const reverse = canonicalPathForAnySurface(tamper.relative);
-            const canonicalHint = reverse
-                ? `Canonical authoring path: ${reverse.canonicalPath}`
-                : (() => {
-                    // Telemetry + fallback message per surfaces/telemetry.ts.
-                    reportReverseMapMissing({ surface: 'unknown', projectionPath: tamper.relative }, logErr);
-                    return `Canonical authoring path: ${getReverseMapFallbackMessage()}`;
-                })();
-            log('');
-            log(`Tampered: ${tamper.relative}`);
-            log(`  expected: ${tamper.expectedHash}`);
-            log(`  actual:   ${tamper.actualHash}`);
-            log(`  ${canonicalHint}`);
-            let action;
-            if (batchChoice === 'adopt-all')
-                action = 'adopt';
-            else if (batchChoice === 'revert-all')
-                action = 'revert';
-            else {
-                action = await promptSelect({
-                    message: 'Adopt or revert?',
-                    options: [
-                        { value: 'adopt', label: 'Adopt — capture this as a personal-scoped setup_asset draft' },
-                        { value: 'revert', label: 'Revert — overwrite with canonical content' },
-                    ],
-                });
-            }
-            if (action === 'revert') {
+        log('These will be REVERTED (overwritten with canonical content) — there is no adopt/draft path any more.');
+        const proceed = await promptConfirm({
+            message: `Overwrite ${tamperedBucket.length} tampered file(s) with canonical content?`,
+            initialValue: false,
+        });
+        if (proceed) {
+            for (const tamper of tamperedBucket) {
+                log('');
+                log(`Reverting: ${tamper.relative}`);
+                log(`  expected: ${tamper.expectedHash}`);
+                log(`  actual:   ${tamper.actualHash}`);
                 // Re-project canonical content over the tampered file.
                 // WP-436 S3: resolve vocab tokens before writing (all tampered files are adapters).
                 if (tamper.dirs)
@@ -1910,106 +1309,26 @@ export async function runHandshake(options = {}) {
                 assertSetupWritePath(tamper.path, perimeterManifest);
                 writeFileSync(tamper.path, replaceVocabTokens(tamper.content, handshakeVocabCtx));
                 revertedTamperedPaths.push(tamper.relative);
-                recordProjectedHash(tamper.dbAssetEntryId);
-                trackEvent('setup.tampered.reverted', { path: tamper.relative });
-            }
-            else {
-                // Adopt: capture the tampered content as a personal-scoped draft (DEC-953: personal
-                // scope = push, no fork required). Best-effort — on failure the file stays untouched and
-                // a warning is logged. Does NOT revert; preserves the edits AND records them as a draft.
-                const draftName = basename(tamper.relative).replace(/\.(md|mdc)$/, '') + ' (adopted)';
-                try {
-                    const tamperedContent = readFileSync(tamper.path, 'utf8');
-                    const session = readSession();
-                    const caller = session ? kernelCallWithSession : kernelCall;
-                    await caller('setup.ingestSetupAsset', {
-                        entryId: `SETUP-ADOPTED-${Date.now()}-${draftName.replace(/\s+/g, '-')}`,
-                        name: draftName,
-                        // WP-421 S3
-                        description: `Adopted from tampered projection at ${tamper.relative}.`,
-                        body: tamperedContent,
-                        assetKind: tamper.relative.includes('/skills/') ? 'skill' : 'rule',
-                        triggers: [],
-                        semanticRefs: [],
-                    });
-                    adoptedTamperedPaths.push(tamper.relative);
-                    trackEvent('setup.tampered.adopted', { path: tamper.relative });
-                }
-                catch (err) {
-                    logErr(`Warning: could not adopt ${tamper.relative} as draft — ${err instanceof Error ? err.message : String(err)}`);
-                    trackEvent('setup.tampered.adopt_failed', {
-                        path: tamper.relative,
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                }
             }
         }
+        else {
+            logErr('Skipped — tampered files left as-is; re-run to resolve.');
+            process.exit(1); // doneWhen #17: never exit 0 with a tampered file unresolved (codex review round 3)
+        }
     }
     // DEC-1690: a dormant (gate-failed) asset is simply not projected — dbAssets already comes
     // from the server's activeAssets list. The WP-379 S4 / WP-426 E4 on-disk marker/rename/restore
     // machinery (and its .authoring-sync.json registries) is retired: nothing to reconcile.
     // 8. User-owned files left untouched are NOT drift (TEN-2150) — a marker-less adapter-path
     // file is the user's own; handshake never wrote it, so no "sync", no draft TEN, just a benign
-    // "Skipped:" surfaced via report.userOwnedSkipped (the tampered/authoring-sync drift below is unaffected).
-    if (syncDriftTensToFire.length > 0) {
-        const session = readSession();
-        if (session) {
-            for (const driftDescription of syncDriftTensToFire) {
-                kernelCallWithSession('chain.createEntry', {
-                    collectionSlug: 'tensions',
-                    name: 'TEN: setup authoring sync drift — repo wins',
-                    status: 'draft',
-                    data: { kind: 'drift', description: driftDescription },
-                    sessionId: session.sessionId,
-                    createdBy: `agent:${session.sessionId}`,
-                }, { retryOnRateLimit: false }).catch((err) => {
-                    // WP-513 round 3 (P2): still fail-open, but surfaced — an unowned rung-2 refusal must not silently drop the drift evidence.
-                    logErr(`Warning: could not persist drift TEN (${driftDescription.slice(0, 60)}…) — ${err instanceof Error ? err.message : String(err)}`);
-                });
-            }
-        }
-    }
+    // "Skipped:" surfaced via report.userOwnedSkipped.
     // 8. Case-collision and dormant-drift TENs are gone (coordinator ruling, PR #912 round 10) —
     // they existed only to audit automated deletions that no longer happen; `report.leftoverFiles`
     // below is the single reporting surface now.
-    // 8b. Setup receipt — record which assets were materialized (apply mode only)
-    // Fail-open: receipt write is advisory, never blocks the handshake.
-    if (applyMode) {
-        const session = readSession();
-        const caller = session ? kernelCallWithSession : kernelCall;
-        try {
-            const currentState = await caller('setup.getCurrentSetupState', {});
-            const fromMode = currentState?.effectiveMode ?? 'observe';
-            if (fromMode !== manifestStatus.mode) {
-                await caller('setup.recordTransition', {
-                    fromMode, toMode: manifestStatus.mode, parseStatus: manifestStatus.parseStatus,
-                    surfaces: manifestStatus.surfaces,
-                    lock: manifestStatus.lock,
-                });
-                if (modeRank(manifestStatus.mode) < modeRank(fromMode)) {
-                    trackEvent('setup.transition.lowered', { fromMode, toMode: manifestStatus.mode });
-                }
-            }
-        }
-        catch (err) {
-            trackEvent('setup.transition.write_failed', { error: err instanceof Error ? err.message : String(err) });
-            logErr(`Warning: could not record setup transition — ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    if (writeMode) {
-        const session = readSession();
-        const caller = session ? kernelCallWithSession : kernelCall;
-        try {
-            const receiptResult = await caller('setup.materializeSetup', {});
-            if (receiptResult?.assetCount > 0) {
-                log(`Setup receipt: ${receiptResult.assetCount} asset(s) recorded.`);
-            }
-        }
-        catch (err) {
-            trackEvent('setup.receipt.write_failed', { error: err instanceof Error ? err.message : String(err) });
-            logErr(`Warning: could not write setup receipt — ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
+    // WP-776 S3f: the setup-transition receipt (setup.getCurrentSetupState / setup.recordTransition)
+    // and the setup materialization receipt (setup.materializeSetup) are deleted along with the
+    // rest of the setup-assets gateway routes — both were fail-open advisory writes recording
+    // authority-mode transitions and materialized-asset counts for a system that no longer exists.
     // 9. Report
     const report = {
         filesWritten,
@@ -2031,9 +1350,10 @@ export async function runHandshake(options = {}) {
         userOwnedSkipped: userOwnedSkipped.length > 0 ? userOwnedSkipped : undefined,
         // WP-421 S3: three-bucket drift report (doneWhen #17). PB-managed-clean is
         // the count of files whose marker + hash matched. Tampered files were
-        // resolved (adopted/reverted) above and are reported separately.
+        // resolved (reverted) above and are reported separately. WP-776 S3d/S3f:
+        // adoptedTamperedPaths is gone — "adopt" is no longer an option (see the
+        // tampered-bucket resolution comment above).
         managedCleanCount: cleanBucketPaths.length > 0 ? cleanBucketPaths.length : undefined,
-        adoptedTamperedPaths: adoptedTamperedPaths.length > 0 ? adoptedTamperedPaths : undefined,
         revertedTamperedPaths: revertedTamperedPaths.length > 0 ? revertedTamperedPaths : undefined,
         // REPORT-ONLY leftover-file listing (coordinator ruling, PR #912 round 10) — the human removes these.
         leftoverFiles: leftoverFiles.length > 0 ? leftoverFiles : undefined,
@@ -2047,6 +1367,7 @@ export async function runHandshake(options = {}) {
     // skipped/user-owned files without re-deriving the skip logic (TEN-2107).
     return report;
 }
-// WP-426 E3/E4: exported test-only surface (not part of the public CLI API).
-export const __test = { setupAuthoringPath, loadAuthoringSyncState, MARKER };
+// WP-426 E3/E4: exported test-only surface (not part of the public CLI API). setupAuthoringPath
+// and loadAuthoringSyncState are gone with the setup-authoring sync machinery (WP-776 S3d/S3f).
+export const __test = { MARKER };
 //# sourceMappingURL=handshake.js.map