@rungs/cli 0.1.0 → 0.1.2

package/dist/cli.js

@@ -0,0 +1,2270 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { dirname as dirname6, join as join11, resolve as resolve3 } from "node:path";
+
+// src/manifest.ts
+import { readdirSync as readdirSync2, readFileSync, statSync as statSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+import { parse } from "smol-toml";
+
+// src/glob.ts
+import { readdirSync, statSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+function globToRegExp(pattern) {
+  let out = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const c2 = pattern[i];
+    if (c2 === "*") {
+      if (pattern[i + 1] === "*") {
+        if (pattern[i + 2] === "/") {
+          out += "(?:[^/]+/)*";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else if (c2 === "?") {
+      out += "[^/]";
+    } else if (c2 === "{") {
+      const end = pattern.indexOf("}", i);
+      if (end === -1) {
+        out += "\\{";
+      } else {
+        const alts = pattern.slice(i + 1, end).split(",");
+        out += `(?:${alts.map((a) => a.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`;
+        i = end;
+      }
+    } else if (".+^$()|[]\\".includes(c2)) {
+      out += `\\${c2}`;
+    } else {
+      out += c2;
+    }
+  }
+  return new RegExp(`^${out}$`);
+}
+var SKIP = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "bin",
+  "obj",
+  ".vs",
+  ".angular",
+  ".next",
+  "coverage",
+  "TestResults",
+  "BenchmarkDotNet.Artifacts"
+]);
+function walk(root, maxEntries = 2e5) {
+  const files = [];
+  const stack = [root];
+  while (stack.length && files.length < maxEntries) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      if (SKIP.has(e.name)) continue;
+      const full = join(dir, e.name);
+      if (e.isDirectory()) {
+        stack.push(full);
+      } else if (e.isFile()) {
+        files.push(relative(root, full).split(sep).join("/"));
+      }
+    }
+  }
+  return files;
+}
+function matchAny(files, pattern) {
+  const re = globToRegExp(pattern);
+  return files.filter((f) => re.test(f));
+}
+
+// src/manifest.ts
+function loadManifest(dir) {
+  const raw = parse(readFileSync(join2(dir, "module.toml"), "utf8"));
+  const m = raw.module ?? {};
+  const name = m.name;
+  if (!name) throw new Error(`${dir}: [module].name is required`);
+  const manifest = {
+    name,
+    version: m.version ?? "0.0.0",
+    rung: m.rung ?? 0,
+    summary: m.summary ?? "",
+    requires: raw.requires?.modules ?? [],
+    conflicts: raw.conflicts?.modules ?? [],
+    params: raw.params ?? {},
+    gates: raw.gates ?? [],
+    detect: raw.detect ?? {},
+    provenance: raw.provenance,
+    threshold: raw.threshold,
+    dir
+  };
+  const p = manifest.provenance;
+  if (!p?.sources?.length) throw new Error(`${name}: [provenance].sources is required`);
+  if (!p?.patterns?.length) throw new Error(`${name}: [provenance].patterns is required`);
+  if (!p?.incident?.trim()) throw new Error(`${name}: [provenance].incident is required`);
+  return manifest;
+}
+function loadAllModules(modulesRoot) {
+  return readdirSync2(modulesRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && statSync2(join2(modulesRoot, e.name, "module.toml"), { throwIfNoEntry: false })).map((e) => loadManifest(join2(modulesRoot, e.name))).sort((a, b) => a.rung - b.rung || a.name.localeCompare(b.name));
+}
+function usedParams(dir) {
+  const used = /* @__PURE__ */ new Set();
+  const add = (text) => {
+    for (const match of text.matchAll(/(^|[^$])\{\{([a-z_.]+)\}\}/g)) used.add(match[2]);
+  };
+  for (const rel of walk(dir)) {
+    add(rel);
+    add(readFileSync(join2(dir, rel), "utf8"));
+  }
+  return used;
+}
+function auditModules(mods) {
+  const issues = [];
+  const names = new Set(mods.map((m) => m.name));
+  for (const mod of mods) {
+    for (const dep of mod.requires) {
+      if (!names.has(dep)) {
+        issues.push({ module: mod.name, kind: "dep-missing", detail: `requires unknown module '${dep}'` });
+      }
+    }
+    const used = usedParams(mod.dir);
+    for (const [param, spec] of Object.entries(mod.params)) {
+      if (used.has(param) || spec.consumed_by) continue;
+      issues.push({
+        module: mod.name,
+        kind: "dead-param",
+        detail: `'${param}' is declared, never substituted, and not marked consumed_by`
+      });
+    }
+    for (const u of used) {
+      if (u.includes(".")) continue;
+      if (!(u in mod.params)) {
+        issues.push({ module: mod.name, kind: "undeclared-param", detail: `uses {{${u}}} but does not declare it` });
+      }
+    }
+    for (const g of mod.gates) {
+      if (g.kind === "declared" && !g.table) {
+        issues.push({ module: mod.name, kind: "gate-no-table", detail: `gate '${g.id}' is declared with no table` });
+      }
+      if (!g.why?.trim()) {
+        issues.push({ module: mod.name, kind: "gate-no-why", detail: `gate '${g.id}' has no 'why'` });
+      }
+    }
+  }
+  return issues;
+}
+
+// src/detect.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+
+// src/add.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { dirname, join as join3 } from "node:path";
+import { createHash } from "node:crypto";
+
+// src/substitute.ts
+import { basename, resolve } from "node:path";
+function substitute(text, module, params) {
+  return text.replace(/(^|[^$])\{\{([a-z_.]+)\}\}/g, (whole, lead, ref) => {
+    const [a, b] = ref.includes(".") ? ref.split(".") : [module, ref];
+    const value = params[a]?.[b];
+    if (value === void 0) return whole;
+    return lead + format(value);
+  });
+}
+function format(v) {
+  if (Array.isArray(v)) return `[${v.map((x) => JSON.stringify(x)).join(", ")}]`;
+  if (typeof v === "boolean" || typeof v === "number") return String(v);
+  return String(v);
+}
+function repoFacts(repoRoot) {
+  return repoRoot ? { dirname: basename(resolve(repoRoot)) } : {};
+}
+function resolveParams(mods, overrides = {}, repoRoot) {
+  const out = { repo: repoFacts(repoRoot) };
+  for (const m of mods) {
+    out[m.name] = {};
+    for (const [k, spec] of Object.entries(m.params)) out[m.name][k] = spec.default;
+  }
+  for (const [mod, vals] of Object.entries(overrides)) {
+    out[mod] = { ...out[mod] ?? {}, ...vals };
+  }
+  for (const m of mods) {
+    for (const [k, v] of Object.entries(out[m.name])) {
+      if (typeof v === "string" && v.includes("{{")) out[m.name][k] = substitute(v, m.name, out);
+    }
+  }
+  return out;
+}
+function markers(targetPath, module, version) {
+  const hash = /\.(toml|ya?ml|gitignore|gitattributes|sh|ps1|conf|properties)$|(^|\/)\.(gitignore|gitattributes)$/.test(
+    targetPath
+  );
+  return hash ? { begin: `# rungs:begin ${module}@${version}`, end: `# rungs:end ${module}` } : { begin: `<!-- rungs:begin ${module}@${version} -->`, end: `<!-- rungs:end ${module} -->` };
+}
+function mergeBlock(existing, fragment, module) {
+  const beginRe = new RegExp(`^[ \\t]*(?:<!--|#)\\s*rungs:begin ${module}(?:@[\\w.\\-]+)?\\s*(?:-->)?[ \\t]*$`, "m");
+  const endRe = new RegExp(`^[ \\t]*(?:<!--|#)\\s*rungs:end ${module}\\s*(?:-->)?[ \\t]*$`, "m");
+  const b = existing.match(beginRe);
+  const e = existing.match(endRe);
+  if (b && e && b.index !== void 0 && e.index !== void 0 && e.index > b.index) {
+    const before = existing.slice(0, b.index);
+    const after = existing.slice(e.index + e[0].length);
+    return `${before}${fragment.trim()}${after}`;
+  }
+  const sep2 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  return `${existing}${sep2}${fragment.trim()}
+`;
+}
+
+// src/add.ts
+var FRAGMENT_TARGET = {
+  "AGENTS.md": "AGENTS.md",
+  gitignore: ".gitignore",
+  gitattributes: ".gitattributes"
+};
+function addModule(mod, repoRoot, params, opts = {}) {
+  const actions = [];
+  const write = (rel, content, disposition) => {
+    const full = join3(repoRoot, rel);
+    if (existsSync(full)) {
+      actions.push({ disposition: "skip-exists", target: rel, note: "already present \u2014 left alone" });
+      return;
+    }
+    actions.push({ disposition, target: rel });
+    if (opts.dryRun) return;
+    mkdirSync(dirname(full), { recursive: true });
+    writeFileSync(full, content);
+  };
+  const sub = (text) => substitute(text, mod.name, params);
+  const has = (d) => existsSync(join3(mod.dir, d));
+  if (has("files")) {
+    const base = join3(mod.dir, "files");
+    for (const rel of walk(base)) {
+      write(sub(rel), sub(readFileSync2(join3(base, rel), "utf8")), "create");
+    }
+  }
+  if (has("rules")) {
+    const base = join3(mod.dir, "rules");
+    for (const rel of walk(base)) {
+      write(join3(".ai", "rules", rel).split("\\").join("/"), sub(readFileSync2(join3(base, rel), "utf8")), "rule");
+    }
+  }
+  if (has("skills")) {
+    const base = join3(mod.dir, "skills");
+    const dir = opts.skillsDir ?? ".claude/skills";
+    for (const rel of walk(base)) {
+      write(`${dir}/${rel}`, sub(readFileSync2(join3(base, rel), "utf8")), "skill");
+    }
+  }
+  if (has("fragments")) {
+    const base = join3(mod.dir, "fragments");
+    for (const rel of walk(base)) {
+      const target = FRAGMENT_TARGET[rel];
+      if (!target) {
+        actions.push({ disposition: "merge", target: rel, note: "unknown fragment target \u2014 skipped" });
+        continue;
+      }
+      const full = join3(repoRoot, target);
+      const existing = existsSync(full) ? readFileSync2(full, "utf8") : "";
+      const fragment = sub(readFileSync2(join3(base, rel), "utf8"));
+      const merged = mergeBlock(existing, fragment, mod.name);
+      actions.push({
+        disposition: "merge",
+        target,
+        note: existing.includes(`rungs:begin ${mod.name}`) ? "block replaced" : "block appended"
+      });
+      if (!opts.dryRun) {
+        mkdirSync(dirname(full), { recursive: true });
+        writeFileSync(full, merged);
+      }
+    }
+  }
+  return actions;
+}
+function registerGates(mods, repoRoot, dryRun = false, adopted = []) {
+  const actions = [];
+  const registry = join3(repoRoot, ".ai", "gates.toml");
+  if (adopted.length) {
+    const existing = existsSync(registry) ? readFileSync2(registry, "utf8") : "";
+    const { begin, end } = markers("gates.toml", "adopted", "1.0.0");
+    const body = [
+      begin,
+      "# Registered from validators this repo already had. Their scripts are untouched and",
+      "# stay yours; rungs only runs them and records what it observes.",
+      ...adopted.map(
+        (a) => `
+[[gates]]
+id      = "${a.id}"
+kind    = "command"
+module  = "adopted"
+tier    = "${a.tier}"
+command = "${a.command}"
+why     = """Adopted from ${a.source}. Predates rungs and is owned by this repo."""`
+      ),
+      end
+    ].join("\n");
+    actions.push({ disposition: "gate", target: ".ai/gates.toml", note: `adopted: ${adopted.length} entries` });
+    if (!dryRun) {
+      mkdirSync(dirname(registry), { recursive: true });
+      writeFileSync(registry, mergeBlock(existing, body, "adopted"));
+    }
+  }
+  for (const mod of mods) {
+    if (!mod.gates.length) continue;
+    const existing = existsSync(registry) ? readFileSync2(registry, "utf8") : "";
+    const { begin, end } = markers("gates.toml", mod.name, mod.version);
+    const body = [begin, ...mod.gates.map(gateEntry(mod)), end].join("\n");
+    actions.push({ disposition: "gate", target: ".ai/gates.toml", note: `${mod.name}: ${mod.gates.length} entries` });
+    if (dryRun) continue;
+    mkdirSync(dirname(registry), { recursive: true });
+    writeFileSync(registry, mergeBlock(existing, body, mod.name));
+  }
+  return actions;
+}
+var gateEntry = (mod) => (g) => {
+  const lines = ["", "[[gates]]", `id     = "${g.id}"`, `kind   = "${g.kind}"`, `module = "${mod.name}"`];
+  if (g.engine) lines.push(`engine = "${g.engine}"`);
+  if (g.table) lines.push(`table  = "${mod.name}/${g.table.replace(/^gates\//, "")}"`);
+  if (g.command) lines.push(`command = "${g.command}"`);
+  if (g.tier) lines.push(`tier   = "${g.tier}"`);
+  if (g.trigger) lines.push(`trigger = "${g.trigger}"`);
+  if (g.matcher) lines.push(`matcher = "${g.matcher}"`);
+  if (g.why) lines.push(`why    = """${g.why.trim()}"""`);
+  return lines.join("\n");
+};
+function resolveInstallOrder(requested, all) {
+  const byName = new Map(all.map((m) => [m.name, m]));
+  const order = [];
+  const missing = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (name) => {
+    if (seen.has(name)) return;
+    const mod = byName.get(name);
+    if (!mod) {
+      missing.push(name);
+      return;
+    }
+    seen.add(name);
+    for (const dep of mod.requires) visit(dep);
+    order.push(mod);
+  };
+  const closure = /* @__PURE__ */ new Set();
+  const collect = (n) => {
+    if (closure.has(n)) return;
+    const m = byName.get(n);
+    if (!m) return;
+    closure.add(n);
+    m.requires.forEach(collect);
+  };
+  requested.forEach(collect);
+  if ([...closure].some((n) => byName.get(n).gates.length) && byName.has("gates")) {
+    visit("gates");
+  }
+  for (const r of requested) visit(r);
+  return { order, missing };
+}
+var contentHash = (s) => createHash("sha256").update(s.replace(/\r\n/g, "\n")).digest("hex").slice(0, 12);
+var SHARED = /* @__PURE__ */ new Set(["AGENTS.md", "CLAUDE.md", ".gitignore", ".gitattributes", ".ai/gates.toml"]);
+function emittedFiles(mod, params, skillsDir = ".claude/skills") {
+  const out = /* @__PURE__ */ new Map();
+  const sub = (t) => substitute(t, mod.name, params);
+  for (const [dir, prefix] of [
+    ["files", ""],
+    ["rules", ".ai/rules/"],
+    ["skills", `${skillsDir}/`]
+  ]) {
+    const base = join3(mod.dir, dir);
+    if (!existsSync(base)) continue;
+    for (const rel of walk(base)) {
+      const target = sub(prefix + rel).split("\\").join("/");
+      if (SHARED.has(target)) continue;
+      out.set(target, sub(readFileSync2(join3(base, rel), "utf8")));
+    }
+  }
+  return out;
+}
+function writeInstallRecord(repoRoot, mods, params, harnesses, stamp, skillsDir = ".claude/skills", wroteByModule) {
+  const lines = [
+    "# Installed by `rungs`. This is a record of what was written, not a control panel:",
+    "# editing a parameter here does not rewrite a file that already exists. `rungs render`",
+    "# re-emits path-scoped rules from `.ai/rules/`, and `rungs upgrade --apply` replaces",
+    "# module files you have not edited \u2014 neither re-substitutes parameters. AGENTS.md,",
+    "# CLAUDE.md, .gitignore, .gitattributes and .ai/gates.toml are shared between modules,",
+    "# so only their `rungs:begin`/`rungs:end` blocks are ever updated; anything outside a",
+    "# block, including the entry document's title, is yours to edit directly.",
+    "#",
+    "# Hashes are what rungs emitted; a file whose hash no longer matches is a",
+    "# divergence rungs reports and never overwrites.",
+    "",
+    "[repo]",
+    `harnesses = ${JSON.stringify(harnesses)}`,
+    `installed = "${stamp}"`,
+    ""
+  ];
+  for (const m of mods) {
+    lines.push(`[modules.${m.name}]`, `version = "${m.version}"`, 'state   = "managed"');
+    const p = params[m.name] ?? {};
+    if (Object.keys(p).length) {
+      lines.push(`params  = { ${Object.entries(p).map(([k, v]) => `${k} = ${JSON.stringify(v ?? "")}`).join(", ")} }`);
+    }
+    const emitted = emittedFiles(m, params, skillsDir);
+    const created = [...emitted].filter(([rel]) => wroteByModule?.get(m.name)?.has(rel) ?? existsSync(join3(repoRoot, rel)));
+    const kept = [...emitted].filter(([rel]) => !created.some(([c2]) => c2 === rel) && existsSync(join3(repoRoot, rel)));
+    if (created.length) {
+      lines.push(`[modules.${m.name}.hashes]`);
+      for (const [rel, content] of created) lines.push(`"${rel}" = "${contentHash(content)}"`);
+    }
+    if (kept.length) {
+      lines.push("", `[modules.${m.name}]`.replace("]", ".kept]"));
+      lines.push(`files = ${JSON.stringify(kept.map(([rel]) => rel))}`);
+    }
+    lines.push("");
+  }
+  writeFileSync(join3(repoRoot, ".ai", "rungs.toml"), lines.join("\n"));
+}
+function adoptableGates(files, patterns, repoRoot) {
+  const runner = { ".mjs": "node", ".js": "node", ".ps1": "pwsh -File", ".sh": "bash" };
+  const out = [];
+  for (const pattern of patterns) {
+    for (const rel of matchAny(files, pattern)) {
+      const ext = rel.slice(rel.lastIndexOf("."));
+      const exec = runner[ext];
+      if (!exec) continue;
+      out.push({
+        id: `adopted-${rel.split("/").pop().replace(/\.[^.]+$/, "")}`,
+        command: `${exec} ${rel}`,
+        tier: "fast",
+        source: rel
+      });
+    }
+  }
+  return out;
+}
+
+// src/detect.ts
+var SAMPLE = 3;
+function detect(mod, repoRoot, files, installed) {
+  const result = {
+    module: mod.name,
+    state: "absent",
+    matchedPaths: [],
+    matchedMarkers: [],
+    proposals: [],
+    adoptable: []
+  };
+  if (installed) {
+    result.ours = ownedState(mod, repoRoot, installed);
+    result.state = result.ours.diverged.length ? "ours-diverged" : "ours-current";
+    return result;
+  }
+  for (const pattern of mod.detect.paths ?? []) {
+    const hits = matchAny(files, pattern);
+    if (hits.length) {
+      result.matchedPaths.push({ pattern, count: hits.length, sample: hits.slice(0, SAMPLE) });
+    }
+  }
+  const markers2 = mod.detect.markers ?? [];
+  if (markers2.length) {
+    const scanPatterns = mod.detect.marker_paths ?? result.matchedPaths.map((m) => m.pattern);
+    const candidates = new Set(scanPatterns.flatMap((p) => matchAny(files, p)));
+    for (const rel of candidates) {
+      let text;
+      try {
+        text = readFileSync3(join4(repoRoot, rel), "utf8");
+      } catch {
+        continue;
+      }
+      for (const marker of markers2) {
+        if (text.includes(marker) && !result.matchedMarkers.includes(marker)) {
+          result.matchedMarkers.push(marker);
+        }
+      }
+    }
+  }
+  for (const adopt of mod.detect.adopt_as ?? []) {
+    const hits = (adopt.paths ?? []).flatMap((p) => matchAny(files, p));
+    if (hits.length) {
+      result.adoptable.push({ kind: adopt.kind, count: hits.length, sample: hits.slice(0, SAMPLE), note: adopt.note });
+    }
+  }
+  if (result.matchedPaths.length === 0 && result.adoptable.length === 0) {
+    for (const para of mod.detect.paradigm ?? []) {
+      const matched = (para.paths ?? []).flatMap((p) => matchAny(files, p));
+      if (matched.length) {
+        result.paradigm = { id: para.id, note: para.note, compare: para.compare, matched: matched.slice(0, SAMPLE) };
+        break;
+      }
+    }
+  }
+  if (result.matchedPaths.length > 0 || result.adoptable.length > 0 || result.matchedMarkers.length > 0) {
+    result.state = "theirs";
+  } else if (result.paradigm) {
+    result.state = "paradigm";
+  } else {
+    result.state = "absent";
+  }
+  if (result.state === "theirs") {
+    result.proposals = infer(mod, repoRoot, files);
+  }
+  return result;
+}
+function infer(mod, repoRoot, files) {
+  const proposals = [];
+  for (const rule of mod.detect.infer ?? []) {
+    if (rule.paths) {
+      const present = Object.entries(rule.paths).filter(([, p]) => files.some((f) => f.startsWith(p.replace(/\/$/, "/")))).map(([key]) => key);
+      if (present.length) {
+        proposals.push({ param: rule.param, value: present.join(", "), evidence: "directory present" });
+      }
+      continue;
+    }
+    if (!rule.pattern) continue;
+    const scope = (rule.scope ?? ["**/*.md"]).flatMap((p) => matchAny(files, p));
+    const excluded = new Set((rule.exclude ?? []).flatMap((p) => matchAny(files, p)));
+    const counts = /* @__PURE__ */ new Map();
+    for (const rel of scope) {
+      if (excluded.has(rel)) continue;
+      let text;
+      try {
+        text = readFileSync3(join4(repoRoot, rel), "utf8");
+      } catch {
+        continue;
+      }
+      for (const m of text.matchAll(new RegExp(rule.pattern, "gm"))) {
+        const key = m[1];
+        if (key) counts.set(key, (counts.get(key) ?? 0) + 1);
+      }
+    }
+    if (rule.anchor) {
+      const anchored = /* @__PURE__ */ new Map();
+      for (const rel of scope) {
+        if (excluded.has(rel)) continue;
+        let text;
+        try {
+          text = readFileSync3(join4(repoRoot, rel), "utf8");
+        } catch {
+          continue;
+        }
+        for (const m of text.matchAll(new RegExp(rule.anchor, "gm"))) {
+          if (m[1]) anchored.set(m[1], (anchored.get(m[1]) ?? 0) + 1);
+        }
+      }
+      const [best] = [...anchored].sort((a, b) => b[1] - a[1]);
+      if (best) {
+        proposals.push({ param: rule.param, value: best[0], evidence: `anchored on ${rule.anchor_name ?? "marker"}` });
+        continue;
+      }
+    }
+    const banned = new Set(rule.exclude_values ?? []);
+    const ranked = [...counts].filter(([k]) => !banned.has(k)).sort((a, b) => b[1] - a[1]);
+    const [top] = ranked;
+    if (top && top[1] >= (rule.min ?? 1)) {
+      proposals.push({
+        param: rule.param,
+        value: top[0],
+        evidence: `${top[1]} matches${ranked.length > 1 ? ` (next: ${ranked[1][0]} at ${ranked[1][1]})` : ""}`
+      });
+    }
+  }
+  return proposals;
+}
+function scanRepo(repoRoot) {
+  return walk(repoRoot);
+}
+function ownedState(mod, repoRoot, installed) {
+  const params = installed.params_all ?? {};
+  const emitted = emittedFiles(mod, params, installed.skillsDir ?? ".claude/skills");
+  const kept = new Set(installed.kept?.files ?? []);
+  const out = {
+    version: installed.version,
+    current: [],
+    stale: [],
+    diverged: [],
+    missing: [],
+    kept: []
+  };
+  for (const [rel, wouldEmit] of emitted) {
+    if (kept.has(rel)) {
+      out.kept.push(rel);
+      continue;
+    }
+    const full = join4(repoRoot, rel);
+    if (!existsSync2(full)) {
+      out.missing.push(rel);
+      continue;
+    }
+    const onDisk = contentHash(readFileSync3(full, "utf8"));
+    if (onDisk === contentHash(wouldEmit)) out.current.push(rel);
+    else if (installed.hashes?.[rel] && onDisk === installed.hashes[rel]) out.stale.push(rel);
+    else out.diverged.push(rel);
+  }
+  return out;
+}
+
+// src/render.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join5 } from "node:path";
+var DO_NOT_EDIT = (source) => `Generated by \`rungs render\` from ${source}. Do not edit \u2014 your changes are overwritten.`;
+function readRules(repoRoot) {
+  const dir = join5(repoRoot, ".ai", "rules");
+  const rules = [];
+  let files;
+  try {
+    files = walk(dir).filter((f) => f.endsWith(".md") && f !== "README.md");
+  } catch {
+    return rules;
+  }
+  for (const rel of files) {
+    const raw = readFileSync4(join5(dir, rel), "utf8");
+    const m = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+    if (!m) continue;
+    const [, fm, body] = m;
+    rules.push({
+      file: rel,
+      description: scalar(fm, "description"),
+      paths: list(fm, "paths"),
+      enforcement: scalar(fm, "enforcement"),
+      body: body.trim()
+    });
+  }
+  return rules;
+}
+function scalar(fm, key) {
+  const folded = fm.match(new RegExp(`^${key}:\\s*>-?\\s*\\n([\\s\\S]*?)(?=\\n\\S|$)`, "m"));
+  if (folded) return folded[1].split("\n").map((l) => l.trim()).filter(Boolean).join(" ");
+  const plain = fm.match(new RegExp(`^${key}:\\s*(.+)$`, "m"));
+  return plain?.[1].trim().replace(/^["']|["']$/g, "");
+}
+function list(fm, key) {
+  const block = fm.match(new RegExp(`^${key}:\\s*\\n((?:\\s*-\\s*.+\\n?)+)`, "m"));
+  if (!block) return [];
+  return [...block[1].matchAll(/^\s*-\s*(.+)$/gm)].map((m) => m[1].trim().replace(/^["']|["']$/g, ""));
+}
+function renderRule(rule, harness) {
+  const stem = rule.file.replace(/\.md$/, "");
+  const source = `.ai/rules/${rule.file}`;
+  const dropped = [];
+  if (harness === "claude") {
+    if (rule.description) dropped.push("description");
+    const fm = rule.paths.length ? `paths:
+${rule.paths.map((p) => `  - "${p}"`).join("\n")}
+` : "";
+    return {
+      target: `.claude/rules/${stem}.md`,
+      content: `---
+${fm}---
+
+<!-- ${DO_NOT_EDIT(source)} -->
+
+${rule.body}
+`,
+      dropped
+    };
+  }
+  if (harness === "copilot") {
+    const applyTo = rule.paths.length ? rule.paths.join(", ") : "**/*";
+    const desc = rule.description ? `description: '${rule.description.replace(/'/g, "''")}'
+` : "";
+    return {
+      target: `.github/instructions/${stem}.instructions.md`,
+      content: `---
+${desc}applyTo: '${applyTo}'
+---
+
+<!-- ${DO_NOT_EDIT(source)} -->
+
+${rule.body}
+`,
+      dropped
+    };
+  }
+  if (harness === "cursor") {
+    const desc = rule.description ? `description: ${rule.description}
+` : "";
+    const globs = rule.paths.length ? `globs: ${rule.paths.join(",")}
+` : "";
+    return {
+      target: `.cursor/rules/${stem}.mdc`,
+      content: `---
+${desc}${globs}alwaysApply: ${rule.paths.length === 0}
+---
+
+<!-- ${DO_NOT_EDIT(source)} -->
+
+${rule.body}
+`,
+      dropped
+    };
+  }
+  const prefix = commonDirPrefix(rule.paths);
+  if (prefix) {
+    return {
+      target: `${prefix}/AGENTS.md`,
+      content: `<!-- ${DO_NOT_EDIT(source)} -->
+
+${rule.body}
+`,
+      dropped: ["description", "paths (directory-scoped instead of glob)"]
+    };
+  }
+  return {
+    degraded: `routing-only: globs do not share a directory prefix, so root AGENTS.md gets a pointer to ${source}`
+  };
+}
+function commonDirPrefix(paths) {
+  if (!paths.length) return null;
+  const dirs = paths.map((p) => p.split("/").filter((s) => !s.includes("*")).join("/")).filter(Boolean);
+  if (dirs.length !== paths.length) return null;
+  const first = dirs[0];
+  return dirs.every((d) => d === first) && first.includes("/") ? first : null;
+}
+function render(repoRoot, harnesses) {
+  const rules = readRules(repoRoot);
+  const entries = [];
+  const routingOnly = [];
+  for (const rule of rules) {
+    for (const harness of harnesses) {
+      const out = renderRule(rule, harness);
+      if ("degraded" in out) {
+        entries.push({ rule: rule.file, harness, degraded: out.degraded });
+        if (harness === "agents-md") routingOnly.push(rule);
+        continue;
+      }
+      const full = join5(repoRoot, out.target);
+      mkdirSync2(dirname2(full), { recursive: true });
+      writeFileSync2(full, out.content);
+      entries.push({ rule: rule.file, harness, target: out.target, dropped: out.dropped });
+    }
+  }
+  writeRoutingBlock(repoRoot, routingOnly, harnesses);
+  return entries;
+}
+function writeRoutingBlock(repoRoot, rules, harnesses) {
+  if (!harnesses.includes("agents-md")) return;
+  const target = join5(repoRoot, "AGENTS.md");
+  if (!existsSync3(target)) return;
+  const begin = "<!-- rungs:begin rules-routing -->";
+  const end = "<!-- rungs:end rules-routing -->";
+  const body = rules.length ? [
+    begin,
+    "## Rules for specific paths",
+    "",
+    "This harness has no glob scoping, so these load only if you open them. **Read the one that",
+    "matches what you are editing before editing broadly.**",
+    "",
+    ...rules.map((r) => `- \`${r.paths.join("`, `")}\` \u2192 [\`.ai/rules/${r.file}\`](.ai/rules/${r.file})`),
+    end
+  ].join("\n") : "";
+  const existing = readFileSync4(target, "utf8");
+  const beginRe = /^[ \t]*<!--\s*rungs:begin rules-routing\s*-->[ \t]*$/m;
+  const endRe = /^[ \t]*<!--\s*rungs:end rules-routing\s*-->[ \t]*$/m;
+  const b = existing.match(beginRe);
+  const e = existing.match(endRe);
+  if (b && e && b.index !== void 0 && e.index !== void 0) {
+    const next = existing.slice(0, b.index) + body.trim() + existing.slice(e.index + e[0].length);
+    writeFileSync2(target, body ? next : next.replace(/\n{3,}/g, "\n\n"));
+    return;
+  }
+  if (body) writeFileSync2(target, `${existing.replace(/\n+$/, "\n")}
+${body}
+`);
+}
+function writeReport(repoRoot, entries, harnesses, stamp) {
+  const lines = [
+    "# Render report",
+    "",
+    `> Generated by \`rungs render\` on ${stamp}. Do not edit.`,
+    "",
+    `Harnesses: ${harnesses.join(", ")}`,
+    "",
+    "| Rule | Harness | Emitted | Dropped / degraded |",
+    "| --- | --- | --- | --- |"
+  ];
+  for (const e of entries) {
+    const lost = e.degraded ?? (e.dropped?.length ? e.dropped.join(", ") : "\u2014");
+    lines.push(`| \`${e.rule}\` | ${e.harness} | ${e.target ? `\`${e.target}\`` : "**not emitted**"} | ${lost} |`);
+  }
+  const degraded = entries.filter((e) => e.degraded).length;
+  const lossy = entries.filter((e) => e.dropped?.length).length;
+  lines.push(
+    "",
+    `${entries.length} renderings \xB7 ${lossy} lost a field \xB7 ${degraded} degraded.`,
+    "",
+    "A field listed as dropped is one the target harness has no way to express. It is recorded",
+    "here rather than silently discarded, so a repo can see what its harness choice costs it.",
+    ""
+  );
+  const content = lines.join("\n");
+  writeFileSync2(join5(repoRoot, ".ai", "render-report.md"), content);
+  return content;
+}
+
+// src/check.ts
+import { appendFileSync, existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
+import { execSync as execSync3 } from "node:child_process";
+import { dirname as dirname4, join as join9 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as parse2 } from "smol-toml";
+
+// src/engines.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { join as join8, dirname as dirname3, resolve as resolve2 } from "node:path";
+
+// src/engines2.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+import { execSync } from "node:child_process";
+import { join as join6 } from "node:path";
+var read = (root, rel) => {
+  try {
+    return readFileSync5(join6(root, rel), "utf8");
+  } catch {
+    return "";
+  }
+};
+var expand = (files, p, f = []) => [...new Set((p ?? f).flatMap((x) => matchAny(files, x)))];
+var exempted = (text, marker) => !!marker && new RegExp(`${marker.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\S`).test(text);
+var idIntegrity = (t, root, files) => {
+  const findings = [];
+  let examined = 0;
+  const known = /* @__PURE__ */ new Set();
+  for (const [, kind] of Object.entries(t.kinds ?? {})) {
+    const re = new RegExp(`^\\s*id:\\s*(${kind.format})`, "m");
+    const seen = /* @__PURE__ */ new Map();
+    for (const rel of expand(files, kind.sources)) {
+      examined++;
+      const text = read(root, rel);
+      const id = text.match(re)?.[1] ?? rel.match(new RegExp(kind.format))?.[0];
+      if (!id) continue;
+      known.add(id);
+      const prior = seen.get(id);
+      if (prior) findings.push({ file: rel, message: `id ${id} also claimed by ${prior}` });
+      else seen.set(id, rel);
+    }
+    if (kind.marker?.file) {
+      const m = read(root, kind.marker.file).match(new RegExp(kind.marker.pattern));
+      if (m?.[1] && seen.has(m[1])) {
+        findings.push({ file: kind.marker.file, message: `NEXT marker points at ${m[1]}, already taken` });
+      }
+    }
+  }
+  const sb = t.stale_blocker;
+  if (sb?.phrases?.length && known.size) {
+    const scope = expand(files, ["docs/**/*.md", "AGENTS.md", "CLAUDE.md"]).filter(
+      (f) => !expand(files, sb.scope_exclude, []).includes(f)
+    );
+    const past = (sb.past_tense_ok ?? []).map((p) => p.toLowerCase());
+    for (const rel of scope) {
+      const text = read(root, rel);
+      if (exempted(text, sb.exempt_marker)) continue;
+      for (const phrase of sb.phrases) {
+        const re = new RegExp(`(.{0,${sb.negation_window ?? 60}})\\b${phrase}\\b\\s+([A-Z]{1,6}-\\d{1,4})`, "gi");
+        for (const m of text.matchAll(re)) {
+          const lead = m[1].toLowerCase();
+          if (past.some((p) => lead.includes(p.split(" ")[0]) && lead.includes("was"))) continue;
+          if (/\bnot\b|\bnever\b|\bno longer\b/.test(lead.slice(-30))) continue;
+          if (isDone(root, m[2], files)) {
+            findings.push({ file: rel, message: `claims to be ${phrase} ${m[2]}, which is done` });
+          }
+        }
+      }
+    }
+  }
+  return { findings, examined };
+};
+function isDone(root, id, files) {
+  const hit = files.find((f) => f.includes(id) && f.endsWith(".md"));
+  if (!hit) return false;
+  const s = read(root, hit).match(/^status:\s*(\S+)/m)?.[1];
+  return s === "done" || hit.includes("/archive/");
+}
+var renderFreshness = (t, root, files) => {
+  const specs = Array.isArray(t) ? t : [t];
+  const findings = [];
+  let examined = 0;
+  for (const spec of specs) {
+    if (spec.block?.file) {
+      examined++;
+      const text = read(root, spec.block.file);
+      const re = new RegExp(`rungs:begin ${spec.block.marker}[\\s\\S]*?rungs:end ${spec.block.marker}`);
+      if (!re.test(text)) {
+        findings.push({ file: spec.block.file, message: `no '${spec.block.marker}' block \u2014 run \`${spec.command}\`` });
+      }
+      continue;
+    }
+    const excluded = new Set(expand(files, spec.exclude, []));
+    const sources = expand(files, spec.sources).filter((s) => !excluded.has(s));
+    const targets = expand(files, spec.targets);
+    const live = new Set(targets.map((x) => x.split("/")[0]));
+    for (const src of sources) {
+      examined++;
+      const stem = src.split("/").pop().replace(/\.md$/, "");
+      for (const dir of live) {
+        if (!targets.some((x) => x.startsWith(dir) && x.includes(stem))) {
+          findings.push({ file: src, message: `no rendering under ${dir}/ \u2014 run \`${spec.command}\`` });
+        }
+      }
+    }
+  }
+  return { findings, examined };
+};
+var registerSchema = (t, root, files) => {
+  const findings = [];
+  let examined = 0;
+  const targets = t.file ? [t.file] : expand(files, t.scan);
+  for (const rel of targets) {
+    const text = read(root, rel);
+    if (!text) continue;
+    for (const table of parseTables(text)) {
+      if (t.table && !sectionOf(text, table.headerLine).toLowerCase().includes(String(t.table).toLowerCase())) continue;
+      const cols = t.required_cols ?? t.table_columns ?? [];
+      const present = cols.filter(
+        (c2) => table.headers.some((h) => h.toLowerCase() === String(c2).toLowerCase())
+      );
+      if (cols.length && present.length < Math.max(2, Math.ceil(cols.length / 2))) continue;
+      for (const c2 of cols) {
+        if (!present.includes(c2)) findings.push({ file: rel, message: `register table missing column '${c2}'` });
+      }
+      for (const row of table.rows) {
+        if (Object.values(row).every((v) => !v || v === "\u2014")) continue;
+        examined++;
+        for (const [key, values] of Object.entries(t.enum ?? {})) {
+          const v = strip(row[key]);
+          if (v && !values.map(String).includes(v)) {
+            findings.push({ file: rel, message: `${key}='${v}' not one of ${values.join(", ")}` });
+          }
+        }
+        for (const c2 of t.non_empty ?? []) {
+          if (!strip(row[c2])) findings.push({ file: rel, message: `row ${firstCell(row)}: '${c2}' is empty` });
+        }
+        for (const cond of t.conditional ?? []) {
+          const matches = Object.entries(cond.when ?? {}).every(([k, v]) => strip(row[k]) === String(v));
+          if (!matches) continue;
+          for (const c2 of cond.non_empty ?? []) {
+            const v = strip(row[c2]);
+            if (!v) findings.push({ file: rel, message: `row ${firstCell(row)}: '${c2}' required when ${JSON.stringify(cond.when)}` });
+            else if (cond.min_words?.[c2] && v.split(/\s+/).length < cond.min_words[c2]) {
+              findings.push({ file: rel, message: `row ${firstCell(row)}: '${c2}' is too thin to be a reason` });
+            }
+          }
+        }
+      }
+    }
+  }
+  return { findings, examined };
+};
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var selfDeclaredClosure = (t, root, files) => {
+  const findings = [];
+  let examined = 0;
+  const targets = t.file ? [t.file] : expand(files, t.scan ?? ["docs/**/FINDINGS.md"]);
+  const idPattern = t.id_pattern ?? "[A-Z]{1,6}-\\d{1,4}";
+  const openRow = new RegExp(t.open_row_pattern ?? `^\\|\\s*\\[?(${idPattern})\\]`, "gmu");
+  const detailHeading = new RegExp(t.detail_heading_pattern ?? `^###\\s+(${idPattern})\\s+\u2014\\s+`, "gmu");
+  const verdicts = (t.declares_fixed ?? [
+    "\\*\\*Fixed[.,)*]",
+    "\\*\\*Fixed\\s+(?:in|by|the\\s+same\\s+day|\\d{4}-\\d{2}-\\d{2})",
+    "\\*\\*Implemented in this change\\.?\\*\\*",
+    "\\*\\*fixed in the pass that found it\\*\\*"
+  ]).map((p) => new RegExp(p, "iu"));
+  for (const rel of targets) {
+    const text = read(root, rel);
+    if (!text) continue;
+    const openStart = headingIndex(text, t.open_heading ?? "Open");
+    const closedStart = headingIndex(text, t.closed_heading ?? "Closed");
+    const detailStart = headingIndex(text, t.detail_heading ?? "Detail");
+    if (openStart < 0 || closedStart < 0 || detailStart < 0 || closedStart <= openStart || detailStart < closedStart) continue;
+    const open = /* @__PURE__ */ new Set();
+    for (const match of text.slice(openStart, closedStart).matchAll(openRow)) open.add(match[1]);
+    if (!open.size) continue;
+    const detail = text.slice(detailStart);
+    const headings = [...detail.matchAll(detailHeading)];
+    for (let i = 0; i < headings.length; i++) {
+      const id = headings[i][1];
+      if (!open.has(id)) continue;
+      examined++;
+      const start = headings[i].index ?? 0;
+      const end = headings[i + 1]?.index ?? detail.length;
+      const section = detail.slice(start, end);
+      const marker = t.exempt_marker ?? "closure-ok:";
+      if (new RegExp(`<!--\\s*${escapeRe(marker)}\\s*\\S`, "u").test(section)) continue;
+      const body = section.slice(section.indexOf("\n") + 1);
+      for (const verdict of verdicts) {
+        const match = verdict.exec(body);
+        if (!match) continue;
+        const before = body.slice(Math.max(0, match.index - (t.citation_window ?? 120)), match.index);
+        const cited = [...before.matchAll(new RegExp(`(${idPattern})[^.]{0,${t.citation_window ?? 120}}$`, "gu"))].at(-1)?.[1];
+        if (cited && cited !== id) continue;
+        findings.push({ file: rel, message: `${id} is open but its detail declares it fixed: ${body.slice(match.index, match.index + 60).split("\n")[0].trim()}` });
+        break;
+      }
+    }
+  }
+  return { findings, examined };
+};
+function headingIndex(text, heading) {
+  const re = new RegExp(`^#{1,6}\\s+${escapeRe(heading)}\\s*$`, "imu");
+  return text.search(re);
+}
+var strip = (v) => (v ?? "").replace(/[`*\[\]]/g, "").split("(")[0].trim();
+var firstCell = (row) => strip(Object.values(row)[0]) || "?";
+function parseTables(text) {
+  const out = [];
+  const lines = text.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^\s*\|/.test(lines[i]) || !/^\s*\|[\s:|-]+\|/.test(lines[i + 1] ?? "")) continue;
+    const headers = cells(lines[i]);
+    const rows = [];
+    let j = i + 2;
+    for (; j < lines.length && /^\s*\|/.test(lines[j]); j++) {
+      const c2 = cells(lines[j]);
+      rows.push(Object.fromEntries(headers.map((h, k) => [h, c2[k] ?? ""])));
+    }
+    out.push({ headers, rows, headerLine: i });
+    i = j;
+  }
+  return out;
+}
+var cells = (line) => line.trim().replace(/^\||\|$/g, "").split("|").map((s) => s.trim());
+var sectionOf = (text, line) => {
+  const before = text.split("\n").slice(0, line);
+  for (let i = before.length - 1; i >= 0; i--) if (/^#{1,6}\s/.test(before[i])) return before[i];
+  return "";
+};
+var filenameSchema = (t, root, files) => {
+  const re = new RegExp(t.pattern);
+  const excluded = new Set(expand(files, t.exclude, []));
+  const findings = [];
+  let examined = 0;
+  for (const rel of expand(files, t.scan)) {
+    if (excluded.has(rel)) continue;
+    examined++;
+    const base = rel.split("/").pop();
+    if (!re.test(base)) findings.push({ file: rel, message: "filename does not say what closed and what came next" });
+  }
+  return { findings, examined };
+};
+var crossReference = (t, root, files) => {
+  const skills = expand(files, t.scan);
+  if (skills.length < (t.min_skills ?? 6)) return { findings: [], examined: skills.length };
+  const names = skills.map((s) => s.split("/").slice(-2)[0]);
+  const findings = [];
+  for (const rel of skills) {
+    const text = read(root, rel);
+    if (exempted(text, t.exempt_marker)) continue;
+    const desc = text.match(/^---\n([\s\S]*?)\n---/)?.[1] ?? "";
+    const self = rel.split("/").slice(-2)[0];
+    if (!names.some((n) => n !== self && desc.includes(n))) {
+      findings.push({ file: rel, message: `names no neighbouring skill (${skills.length} in this repo)` });
+    }
+  }
+  return { findings, examined: skills.length };
+};
+var gitStatusReconcile = (t, root, files) => {
+  const findings = [];
+  let merged;
+  try {
+    merged = new Set(
+      execSync(`git branch --merged ${t.integration_branch ?? "main"} --format=%(refname:short)`, {
+        cwd: root,
+        stdio: "pipe"
+      }).toString().split("\n").map((s) => s.trim()).filter(Boolean)
+    );
+  } catch {
+    return { findings: [{ message: "cannot read git branches; status not reconciled" }], examined: 0 };
+  }
+  let examined = 0;
+  for (const rel of expand(files, ["docs/**/items/**/*.md"])) {
+    const text = read(root, rel);
+    if (exempted(text, t.exempt_marker)) continue;
+    const branch = text.match(new RegExp(`^${t.branch_field ?? "branch"}:\\s*(\\S+)`, "m"))?.[1];
+    const status = text.match(new RegExp(`^${t.status_field ?? "status"}:\\s*(\\S+)`, "m"))?.[1];
+    if (!branch || !status) continue;
+    examined++;
+    if (merged.has(branch) && (t.pre_review_statuses ?? []).includes(status)) {
+      findings.push({ file: rel, message: `branch ${branch} is merged but status is '${status}'` });
+    }
+  }
+  return { findings, examined };
+};
+var computedClaim = (t, root, files) => {
+  const specs = Array.isArray(t) ? t : [t];
+  const findings = [];
+  let examined = 0;
+  for (const spec of specs) {
+    const values = /* @__PURE__ */ new Map();
+    for (const src of spec.sources ?? []) {
+      for (const rel of matchAny(files, src.file)) {
+        const text = read(root, rel);
+        let v;
+        if (src.path && rel.endsWith(".json")) {
+          try {
+            v = src.path.split(".").reduce((o, k) => o?.[k], JSON.parse(text));
+          } catch {
+          }
+        } else if (src.xpath) {
+          v = text.match(new RegExp(`<${src.xpath.split("//")[1]}>(.*?)<`))?.[1];
+        }
+        if (v) {
+          examined++;
+          values.set(rel, String(v));
+        }
+      }
+    }
+    const distinct = new Set(values.values());
+    if (spec.rule === "all-agree" && distinct.size > 1) {
+      findings.push({
+        message: `${spec.id} disagrees across ${values.size} locations: ${[...distinct].join(", ")} \u2014 run \`${spec.autofix}\``
+      });
+    }
+  }
+  return { findings, examined };
+};
+
+// src/engines3.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+import { execSync as execSync2 } from "node:child_process";
+import { join as join7 } from "node:path";
+var read2 = (root, rel) => {
+  try {
+    return readFileSync6(join7(root, rel), "utf8");
+  } catch {
+    return "";
+  }
+};
+var expand2 = (files, p, f = []) => [...new Set((p ?? f).flatMap((x) => matchAny(files, x)))];
+var escapeRe2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var exempted2 = (text, marker) => !!marker && new RegExp(`${escapeRe2(marker)}\\s*\\S`).test(text);
+function tableRows(text, near) {
+  const lines = text.split("\n");
+  const rows = [];
+  let heading = "";
+  for (let i = 0; i < lines.length; i++) {
+    if (/^#{1,6}\s/.test(lines[i])) heading = lines[i];
+    if (!/^\s*\|/.test(lines[i]) || !/^\s*\|[\s:|-]+\|/.test(lines[i + 1] ?? "")) continue;
+    if (near && !heading.toLowerCase().includes(near.toLowerCase())) continue;
+    const cells2 = (l) => l.trim().replace(/^\||\|$/g, "").split("|").map((s) => s.trim());
+    const headers = cells2(lines[i]);
+    for (let j = i + 2; j < lines.length && /^\s*\|/.test(lines[j]); j++) {
+      const c2 = cells2(lines[j]);
+      rows.push(Object.fromEntries(headers.map((h, k) => [h, c2[k] ?? ""])));
+    }
+    i = lines.length;
+  }
+  return rows;
+}
+var clean = (v = "") => v.replace(/[`*\[\]]/g, "").trim();
+function terms(topic) {
+  const stop = /* @__PURE__ */ new Set(["the", "and", "for", "with", "per", "its", "a", "an", "of", "to", "in", "on", "is", "are"]);
+  return clean(topic).toLowerCase().split(/[^a-z0-9_-]+/).filter((w) => w.length > 3 && !stop.has(w));
+}
+var termOwnership = (t, root, files) => {
+  const registry = read2(root, t.registry ?? "docs/doc-ownership.md");
+  if (!registry) return { findings: [{ message: `ownership registry '${t.registry}' not found` }], examined: 0 };
+  const cols = t.columns ?? {};
+  const findings = [];
+  let examined = 0;
+  for (const row of tableRows(registry)) {
+    const topic = clean(row[cols.topic ?? "Topic"]);
+    const owner = clean(row[cols.owner ?? "Owner"]);
+    const forbidden = clean(row[cols.forbidden ?? "Must NOT appear in"]);
+    if (!topic || !forbidden || forbidden === "\u2014" || topic.startsWith("(example)")) continue;
+    const want = terms(topic);
+    if (want.length < 2) continue;
+    const patterns = forbidden.split(/[,·]/).map((s) => s.trim()).filter(Boolean);
+    for (const rel of expand2(files, patterns)) {
+      if (rel === owner) continue;
+      const text = read2(root, rel);
+      if (exempted2(text, t.exempt_marker)) continue;
+      examined++;
+      for (const section of text.split(/^#{1,6}\s+/m)) {
+        const lower = section.toLowerCase();
+        const hits = want.filter((w) => lower.includes(w));
+        if (hits.length >= (t.engage_min_terms ?? 3)) {
+          findings.push({ file: rel, message: `restates "${topic}", owned by ${owner} (${hits.length} terms)` });
+          break;
+        }
+      }
+    }
+  }
+  return { findings, examined };
+};
+var rulePropagation = (t, root, files) => {
+  const registry = read2(root, t.registry ?? "docs/working-rules.md");
+  if (!registry) return { findings: [{ message: `rules registry '${t.registry}' not found` }], examined: 0 };
+  const cols = t.columns ?? {};
+  const findings = [];
+  let examined = 0;
+  const window = t.negation_window ?? 60;
+  for (const row of tableRows(registry)) {
+    const rule = clean(row[cols.rule ?? "Rule"]);
+    const retired = clean(row[cols.retired ?? "Retired wording"]);
+    const surfaces = clean(row[cols.surfaces ?? "Surfaces that restate it"]);
+    if (!rule || !retired || retired === "\u2014" || rule.startsWith("(example)")) continue;
+    for (const rel of expand2(files, surfaces.split(/[,·]/).map((s) => s.trim()).filter(Boolean))) {
+      const text = read2(root, rel);
+      if (exempted2(text, t.exempt_marker)) continue;
+      examined++;
+      const re = new RegExp(`(.{0,${window}})${escapeRe2(retired)}`, "gis");
+      for (const m of text.matchAll(re)) {
+        const lead = m[1].toLowerCase();
+        if (/\bnot\b|\bnever\b|\bno longer\b|\bused to\b|\bformerly\b|\bretired\b/.test(lead)) continue;
+        findings.push({ file: rel, message: `carries the retired wording for "${rule}"` });
+        break;
+      }
+    }
+  }
+  return { findings, examined };
+};
+var gitState = (t, root) => {
+  let out;
+  try {
+    out = execSync2("git worktree list --porcelain", { cwd: root, stdio: "pipe" }).toString();
+  } catch {
+    return { findings: [{ message: "cannot read git worktrees; checkout state unknown" }], examined: 0 };
+  }
+  const findings = [];
+  const blocks = out.split("\n\n").filter(Boolean);
+  for (const b of blocks) {
+    const dir = b.match(/^worktree (.+)$/m)?.[1];
+    const branch = b.match(/^branch refs\/heads\/(.+)$/m)?.[1];
+    if (branch && (t.refuse_checked_out ?? []).includes(branch)) {
+      findings.push({ message: `'${branch}' is checked out in ${dir} \u2014 nothing should hold it` });
+    }
+  }
+  return { findings, examined: blocks.length };
+};
+var mergeDriverCheck = (t, root) => {
+  const attrs = read2(root, t.attributes_file ?? ".gitattributes");
+  if (!attrs) return { findings: [], examined: 0 };
+  const declared = [...new Set([...attrs.matchAll(/merge=([\w-]+)/g)].map((m) => m[1]))];
+  const required = (t.required_drivers ?? []).filter((d) => declared.includes(d));
+  if (!required.length) return { findings: [], examined: declared.length };
+  const findings = [];
+  for (const driver of required) {
+    let configured = "";
+    try {
+      configured = execSync2(`git config --get merge.${driver}.driver`, { cwd: root, stdio: "pipe" }).toString().trim();
+    } catch {
+    }
+    if (!configured) {
+      findings.push({ message: `driver '${driver}' is declared but not installed \u2014 run \`${t.install_command}\`` });
+    }
+  }
+  return { findings, examined: declared.length };
+};
+
+// src/engines.ts
+var read3 = (root, rel) => {
+  try {
+    return readFileSync7(join8(root, rel), "utf8");
+  } catch {
+    return "";
+  }
+};
+var GENERATED = "Generated by `rungs";
+var expand3 = (files, patterns, fallback = []) => [...new Set((patterns ?? fallback).flatMap((p) => matchAny(files, p)))];
+function dropGenerated(root, rels) {
+  return rels.filter((rel) => !read3(root, rel).slice(0, 600).includes(GENERATED));
+}
+function loadedLines(text) {
+  return text.replace(/^---\n[\s\S]*?\n---\n/, "").replace(/<!--[\s\S]*?-->/g, "").split("\n").filter((l) => l.trim()).length;
+}
+var fileBudget = (t, root, files) => {
+  const targets = dropGenerated(root, t.file ? [t.file] : expand3(files, t.scan));
+  const excluded = new Set(expand3(files, t.exclude, []));
+  const findings = [];
+  let examined = 0;
+  for (const rel of targets) {
+    if (excluded.has(rel) || !existsSync6(join8(root, rel))) continue;
+    examined++;
+    const n = loadedLines(read3(root, rel));
+    if (n > t.max_lines) findings.push({ file: rel, message: `${n} lines, budget ${t.max_lines}` });
+  }
+  return { findings, examined };
+};
+var sections = (t, root, files) => {
+  const specs = Array.isArray(t) ? t : [t];
+  const findings = [];
+  let examined = 0;
+  for (const spec of specs) {
+    const targets = dropGenerated(root, spec.file ? [spec.file] : expand3(files, spec.scan));
+    const excluded = new Set(expand3(files, spec.exclude, []));
+    for (const rel of targets) {
+      if (excluded.has(rel) || !existsSync6(join8(root, rel))) continue;
+      examined++;
+      const text = read3(root, rel);
+      const heads = [...text.matchAll(/^#{1,6}\s+(.+?)\s*$/gm)].map((m) => m[1]);
+      for (const want of spec.required ?? []) {
+        const idx = heads.findIndex((h) => h.toLowerCase().startsWith(String(want).toLowerCase()));
+        if (idx === -1) {
+          findings.push({ file: rel, message: `missing section '${want}'` });
+          continue;
+        }
+        if (spec.non_empty) {
+          const after = text.split(new RegExp(`^#{1,6}\\s+${escapeRe3(heads[idx])}\\s*$`, "m"))[1] ?? "";
+          const body = after.split(/^#{1,6}\s+/m)[0].replace(/<!--[\s\S]*?-->/g, "").trim();
+          if (!body) findings.push({ file: rel, message: `section '${want}' is empty` });
+        }
+      }
+      for (const open of spec.requires_opening ?? []) {
+        if (!text.slice(0, 400).includes(open)) findings.push({ file: rel, message: `does not open with ${open}` });
+      }
+    }
+  }
+  return { findings, examined };
+};
+var frontmatterSchema = (t, root, files) => {
+  const specs = Array.isArray(t) ? t : [t];
+  const findings = [];
+  let examined = 0;
+  for (const spec of specs) {
+    for (const rel of dropGenerated(root, expand3(files, spec.scan))) {
+      if (new Set(expand3(files, spec.exclude, [])).has(rel)) continue;
+      const text = read3(root, rel);
+      const m = text.match(/^---\n([\s\S]*?)\n---/);
+      if (!m) {
+        findings.push({ file: rel, message: "no frontmatter" });
+        continue;
+      }
+      examined++;
+      const keys = [...m[1].matchAll(/^([a-zA-Z0-9_-]+):/gm)].map((k) => k[1]);
+      for (const req of spec.required ?? []) {
+        if (!keys.includes(req)) findings.push({ file: rel, message: `missing '${req}'` });
+      }
+      if (spec.allowed) {
+        for (const k of keys) {
+          if (!spec.allowed.includes(k)) findings.push({ file: rel, message: `non-spec key '${k}'` });
+        }
+      }
+      for (const [key, values] of Object.entries(spec.enum ?? {})) {
+        const v = m[1].match(new RegExp(`^${key}:\\s*(.+)$`, "m"))?.[1].trim().replace(/^["']|["']$/g, "");
+        if (v && !values.map(String).includes(v)) {
+          findings.push({ file: rel, message: `${key}='${v}' not one of ${values.join(", ")}` });
+        }
+      }
+    }
+  }
+  return { findings, examined };
+};
+var linkIntegrity = (t, root, files) => {
+  const scan = expand3(files, t.scan, ["**/*.md"]);
+  const excluded = new Set(expand3(files, t.exclude, []));
+  const findings = [];
+  let examined = 0;
+  for (const rel of scan) {
+    if (excluded.has(rel)) continue;
+    const text = read3(root, rel);
+    examined++;
+    if (/path-ok:\s*\S/.test(text)) continue;
+    const scannable = text.replace(/`+[^`\n]*`+/g, (s) => " ".repeat(s.length));
+    for (const m of scannable.matchAll(/\]\((?!https?:|#|mailto:)([^)\s#]+)/g)) {
+      if (/\{\{[a-z_.]+\}\}/.test(m[1])) continue;
+      const target = resolve2(root, dirname3(rel), decodeURIComponent(m[1]));
+      if (!existsSync6(target)) findings.push({ file: rel, message: `broken link \u2192 ${m[1]}` });
+    }
+  }
+  return { findings, examined };
+};
+var filePopulation = (t, root, files) => {
+  let hits = dropGenerated(root, expand3(files, t.scan)).filter((f) => !new Set(expand3(files, t.exclude, [])).has(f));
+  if (t.detect === "body_is_only_a_pointer") {
+    hits = hits.filter((rel) => {
+      const body = read3(root, rel).replace(/^---\n[\s\S]*?\n---\n/, "").replace(/<!--[\s\S]*?-->/g, "").replace(/^#.*$/gm, "").trim();
+      const words = body.split(/\s+/).filter(Boolean).length;
+      const links = (body.match(/\]\(/g) ?? []).length;
+      return words > 0 && words <= (t.max_body_words ?? 40) && links >= 1;
+    });
+  }
+  const findings = [];
+  const failAt = t.fail_at ?? Infinity;
+  if (hits.length >= failAt) {
+    findings.push({ message: `${hits.length} matching file(s), threshold ${failAt} (e.g. ${hits[0]})` });
+  }
+  return { findings, examined: hits.length };
+};
+var gateMeta = (_t, root) => {
+  const findings = [];
+  const registry = join8(root, ".ai", "gates.toml");
+  if (!existsSync6(registry)) return { findings, examined: 0 };
+  const text = readFileSync7(registry, "utf8");
+  const entries = [...text.matchAll(/\[\[gates\]\][\s\S]*?(?=\n\[\[gates\]\]|\n# rungs:end|$)/g)].map((m) => m[0]);
+  let examined = 0;
+  for (const entry of entries) {
+    const id = entry.match(/^id\s*=\s*"(.+)"/m)?.[1];
+    const kind = entry.match(/^kind\s*=\s*"(.+)"/m)?.[1];
+    const table = entry.match(/^table\s*=\s*"(.+)"/m)?.[1];
+    if (!id || kind !== "declared" || !table) continue;
+    examined++;
+    const tablePath = join8(dirname3(new URL(import.meta.url).pathname.slice(1)), "..", "modules", dirname3(table), "gates", table.split("/").pop());
+    const src = existsSync6(tablePath) ? readFileSync7(tablePath, "utf8") : "";
+    const forGate = [...src.matchAll(/\[\[self_test\]\][\s\S]*?(?=\n\[\[|\n\[|$)/g)].map((m) => m[0]).filter((b) => b.includes(`gate   = "${id}"`) || b.includes(`gate    = "${id}"`) || b.includes(`gate = "${id}"`));
+    for (const direction of ["pass", "fail"]) {
+      if (!forGate.some((b) => new RegExp(`expect\\s*=\\s*"${direction}"`).test(b))) {
+        findings.push({ message: `gate '${id}' has no self-test expecting '${direction}'` });
+      }
+    }
+  }
+  return { findings, examined };
+};
+var escapeRe3 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var ENGINES = {
+  "file-budget": fileBudget,
+  sections,
+  "frontmatter-schema": frontmatterSchema,
+  "link-integrity": linkIntegrity,
+  "file-population": filePopulation,
+  "gate-meta": gateMeta,
+  "id-integrity": idIntegrity,
+  "render-freshness": renderFreshness,
+  "register-schema": registerSchema,
+  "self-declared-closure": selfDeclaredClosure,
+  "filename-schema": filenameSchema,
+  "cross-reference": crossReference,
+  "git-status-reconcile": gitStatusReconcile,
+  "computed-claim": computedClaim,
+  "term-ownership": termOwnership,
+  "rule-propagation": rulePropagation,
+  "git-state": gitState,
+  "merge-driver-check": mergeDriverCheck
+};
+function isImplemented(engine) {
+  return engine in ENGINES;
+}
+
+// src/check.ts
+var MODULES = join9(dirname4(fileURLToPath(import.meta.url)), "..", "modules");
+function loadRegistry(repoRoot) {
+  const path = join9(repoRoot, ".ai", "gates.toml");
+  if (!existsSync7(path)) return { runner: {}, gates: [] };
+  const raw = parse2(readFileSync8(path, "utf8"));
+  return { runner: raw.runner ?? {}, gates: raw.gates ?? [] };
+}
+function runGates(repoRoot, tier, now = () => Date.now()) {
+  const { gates } = loadRegistry(repoRoot);
+  const files = walk(repoRoot);
+  const runs = [];
+  for (const g of gates) {
+    if (g.trigger) continue;
+    if (tier && g.tier && g.tier !== tier) continue;
+    const started = now();
+    let status = "pass";
+    let findings = [];
+    let examined = 0;
+    if (g.kind === "command" && g.command) {
+      try {
+        execSync3(g.command, { cwd: repoRoot, stdio: "pipe" });
+      } catch (e) {
+        status = "fail";
+        findings = [{ message: String(e.stderr ?? e.stdout ?? e.message).trim().split("\n").slice(-3).join(" ") }];
+      }
+    } else if (!g.engine || !isImplemented(g.engine)) {
+      status = "unimplemented";
+      findings = [{ message: `engine '${g.engine ?? "(none)"}' is not implemented` }];
+    } else {
+      const table = loadTable(g.table, repoRoot);
+      if (!table) {
+        status = "error";
+        findings = [{ message: `table '${g.table}' not found` }];
+      } else {
+        try {
+          const key = tableKey(g.engine);
+          let section = table[key] ?? table;
+          if (Array.isArray(section) && section.some((s) => s?.id)) {
+            const mine = section.filter((s) => !s.id || g.id.includes(s.id));
+            if (mine.length) section = mine;
+          }
+          const r = ENGINES[g.engine](section, repoRoot, files);
+          findings = r.findings;
+          examined = r.examined;
+          status = r.findings.length ? "fail" : "pass";
+        } catch (e) {
+          status = "error";
+          findings = [{ message: e.message }];
+        }
+      }
+    }
+    runs.push({
+      id: g.id,
+      module: g.module,
+      kind: g.kind,
+      engine: g.engine,
+      tier: g.tier ?? "fast",
+      status,
+      ms: now() - started,
+      examined,
+      findings,
+      why: g.why
+    });
+  }
+  return runs;
+}
+function loadTable(ref, repoRoot) {
+  if (!ref) return null;
+  const [mod, file] = ref.split("/");
+  const path = join9(MODULES, mod, "gates", file);
+  if (!existsSync7(path)) return null;
+  try {
+    return parse2(substitute(readFileSync8(path, "utf8"), mod, installedParams(repoRoot)));
+  } catch {
+    return null;
+  }
+}
+var paramCache = null;
+function installedParams(repoRoot) {
+  if (paramCache?.root === repoRoot) return paramCache.params;
+  const defaults = resolveParams(loadAllModules(MODULES), {}, repoRoot);
+  const recordPath = join9(repoRoot, ".ai", "rungs.toml");
+  if (existsSync7(recordPath)) {
+    try {
+      const rec = parse2(readFileSync8(recordPath, "utf8"));
+      for (const [name, entry] of Object.entries(rec.modules ?? {})) {
+        if (entry?.params) defaults[name] = { ...defaults[name] ?? {}, ...entry.params };
+      }
+    } catch {
+    }
+  }
+  paramCache = { root: repoRoot, params: defaults };
+  return defaults;
+}
+var tableKey = (engine) => ({
+  "file-budget": "file_budget",
+  sections: "sections",
+  "frontmatter-schema": "frontmatter_schema",
+  "link-integrity": "link_integrity",
+  "file-population": "file_population",
+  "gate-meta": "gate_meta",
+  "id-integrity": "__whole__",
+  "render-freshness": "render_freshness",
+  "register-schema": "register_schema",
+  "self-declared-closure": "self_declared_closure",
+  "filename-schema": "filename_schema",
+  "cross-reference": "cross_reference",
+  "git-status-reconcile": "merged_status",
+  "computed-claim": "computed_claim",
+  "term-ownership": "term_ownership",
+  "rule-propagation": "rule_propagation",
+  "git-state": "git_state",
+  "merge-driver-check": "merge_driver_check"
+})[engine] ?? engine;
+function appendLedger(repoRoot, runs, stamp) {
+  const { runner } = loadRegistry(repoRoot);
+  if (runner.ledger === false) return;
+  const path = join9(repoRoot, ".ai", ".gate-ledger.jsonl");
+  const lines = runs.map((r) => JSON.stringify({ at: stamp, id: r.id, status: r.status, ms: r.ms, examined: r.examined })).join("\n");
+  appendFileSync(path, lines + "\n");
+}
+function ledgerQuestions(repoRoot, gates) {
+  const path = join9(repoRoot, ".ai", ".gate-ledger.jsonl");
+  if (!existsSync7(path)) return { neverFired: [], alwaysFires: [], runs: 0 };
+  const rows = readFileSync8(path, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
+  const by = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const e = by.get(r.id) ?? { total: 0, failed: 0 };
+    e.total++;
+    if (r.status === "fail") e.failed++;
+    by.set(r.id, e);
+  }
+  const whyOf = (id) => gates.find((g) => g.id === id)?.why;
+  const neverFired = [...by].filter(([, e]) => e.total >= 3 && e.failed === 0).map(([id]) => ({ id, why: whyOf(id) }));
+  const alwaysFires = [...by].filter(([, e]) => e.total >= 3 && e.failed / e.total > 0.9).map(([id, e]) => ({ id, why: whyOf(id), rate: `${e.failed}/${e.total}` }));
+  return { neverFired, alwaysFires, runs: rows.length };
+}
+
+// src/lifecycle.ts
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname5, join as join10 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { execSync as execSync4 } from "node:child_process";
+import { parse as parse3 } from "smol-toml";
+var SRC = dirname5(fileURLToPath2(import.meta.url));
+var PROFILES = {
+  minimal: ["instructions"],
+  tracked: ["instructions", "gates", "backlog", "findings", "adr", "session"],
+  disciplined: ["instructions", "gates", "backlog", "findings", "adr", "session", "ci", "specs", "workflows", "skills", "audit"],
+  hardened: ["instructions", "gates", "backlog", "findings", "adr", "session", "ci", "specs", "workflows", "skills", "audit", "release", "doc-authority"],
+  fleet: ["instructions", "gates", "backlog", "findings", "adr", "session", "ci", "specs", "workflows", "skills", "audit", "release", "doc-authority", "concurrency", "design-sync"]
+};
+function readRecord(repoRoot) {
+  const p = join10(repoRoot, ".ai", "rungs.toml");
+  if (!existsSync8(p)) return null;
+  try {
+    const raw = parse3(readFileSync9(p, "utf8"));
+    return { harnesses: raw.repo?.harnesses ?? [], modules: raw.modules ?? {} };
+  } catch {
+    return null;
+  }
+}
+function planUpgrade(repoRoot, mods, record) {
+  const params = resolveParams(mods, paramsFrom(record), repoRoot);
+  const skillsDir = record.harnesses.includes("claude") ? ".claude/skills" : ".agents/skills";
+  const items = [];
+  for (const mod of mods) {
+    const installed = record.modules[mod.name];
+    if (!installed) continue;
+    const emitted = emittedFiles(mod, params, skillsDir);
+    const files = [];
+    const kept = new Set(installed.kept?.files ?? []);
+    for (const [rel, wouldEmit] of emitted) {
+      if (kept.has(rel)) continue;
+      const full = join10(repoRoot, rel);
+      if (!existsSync8(full)) {
+        files.push({ rel, state: "missing" });
+        continue;
+      }
+      const onDisk = contentHash(readFileSync9(full, "utf8"));
+      const recorded = installed.hashes?.[rel];
+      if (onDisk === contentHash(wouldEmit)) files.push({ rel, state: "current" });
+      else if (recorded && onDisk === recorded) files.push({ rel, state: "stale" });
+      else files.push({ rel, state: "diverged" });
+    }
+    items.push({ module: mod.name, from: installed.version, to: mod.version, files });
+  }
+  return items;
+}
+function applyUpgrade(repoRoot, mods, record, plan) {
+  const params = resolveParams(mods, paramsFrom(record), repoRoot);
+  const skillsDir = record.harnesses.includes("claude") ? ".claude/skills" : ".agents/skills";
+  let written = 0;
+  for (const item of plan) {
+    const mod = mods.find((m) => m.name === item.module);
+    const emitted = emittedFiles(mod, params, skillsDir);
+    for (const f of item.files) {
+      if (f.state !== "stale" && f.state !== "missing") continue;
+      const full = join10(repoRoot, f.rel);
+      mkdirSync3(dirname5(full), { recursive: true });
+      writeFileSync3(full, emitted.get(f.rel));
+      written++;
+    }
+  }
+  return written;
+}
+function paramsFrom(record) {
+  const out = {};
+  for (const [name, entry] of Object.entries(record.modules)) {
+    if (entry.params) out[name] = { ...entry.params };
+  }
+  return out;
+}
+function eject(repoRoot, mods, dryRun = false) {
+  const dest = join10(repoRoot, ".rungs");
+  const engines = ["glob.ts", "engines.ts", "engines2.ts"];
+  const { gates } = loadRegistry(repoRoot);
+  const declared = gates.filter((g) => g.kind === "declared" && g.table);
+  const tables = [...new Set(declared.map((g) => g.table))];
+  const actions = [];
+  for (const f of engines) actions.push(`.rungs/${f}`);
+  for (const t of tables) actions.push(`.rungs/tables/${t.replace("/", "-").replace(/.toml$/, ".json")}`);
+  actions.push(".rungs/run-gate.mjs", ".ai/gates.toml (rewritten to command gates)");
+  if (dryRun) return { actions, gates: declared.length };
+  mkdirSync3(join10(dest, "tables"), { recursive: true });
+  for (const f of engines) copyFileSync(join10(SRC, f), join10(dest, f));
+  const record = readRecord(repoRoot);
+  const params = resolveParams(mods, record ? paramsFrom(record) : {}, repoRoot);
+  for (const t of tables) {
+    const [mod, file] = t.split("/");
+    const src = join10(SRC, "..", "modules", mod, "gates", file);
+    if (!existsSync8(src)) continue;
+    try {
+      const parsed = parse3(substitute(readFileSync9(src, "utf8"), mod, params));
+      writeFileSync3(join10(dest, "tables", `${mod}-${file.replace(/\.toml$/, ".json")}`), JSON.stringify(parsed, null, 2));
+    } catch {
+    }
+  }
+  writeFileSync3(join10(dest, "run-gate.mjs"), RUNNER);
+  writeFileSync3(join10(dest, "README.md"), EJECT_README);
+  const registry = join10(repoRoot, ".ai", "gates.toml");
+  let text = readFileSync9(registry, "utf8");
+  for (const g of declared) {
+    text = text.replace(
+      new RegExp(`(id\\s*=\\s*"${g.id}"[\\s\\S]*?)kind\\s*=\\s*"declared"`),
+      `$1kind   = "command"
+command = "node .rungs/run-gate.mjs ${g.id}"`
+    );
+  }
+  writeFileSync3(registry, `${text}
+# Ejected: gates above run from .rungs/ and no longer need rungs installed.
+`);
+  return { actions, gates: declared.length };
+}
+var RUNNER = `#!/usr/bin/env node
+// Ejected gate runner. Runs one declared gate from the tables in ./tables/.
+// Self-contained: this repo no longer needs rungs installed to run its gates.
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ENGINES } from './engines.ts';
+import { walk } from './glob.ts';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = join(here, '..');
+const id = process.argv[2];
+const registry = readFileSync(join(root, '.ai', 'gates.toml'), 'utf8');
+const entry = registry.split('[[gates]]').find((b) => b.includes(\`id      = "\${id}"\`) || b.includes(\`id     = "\${id}"\`));
+if (!entry) { console.error(\`unknown gate \${id}\`); process.exit(2); }
+
+const engine = entry.match(/^engine\\s*=\\s*"(.+)"/m)?.[1];
+const table = entry.match(/^table\\s*=\\s*"(.+)"/m)?.[1];
+if (!engine || !ENGINES[engine]) { console.error(\`gate \${id}: engine '\${engine}' unavailable\`); process.exit(2); }
+
+// Tables were converted to JSON when this was ejected, so nothing here needs a
+// TOML parser \u2014 or any dependency at all beyond Node itself.
+const raw = JSON.parse(readFileSync(join(here, 'tables', table.replace('/', '-').replace(/\\.toml$/, '.json')), 'utf8'));
+const KEYS = { 'file-budget': 'file_budget', 'frontmatter-schema': 'frontmatter_schema', 'link-integrity': 'link_integrity', 'file-population': 'file_population', 'gate-meta': 'gate_meta', 'render-freshness': 'render_freshness', 'register-schema': 'register_schema', 'self-declared-closure': 'self_declared_closure', 'filename-schema': 'filename_schema', 'cross-reference': 'cross_reference', 'git-status-reconcile': 'merged_status', 'computed-claim': 'computed_claim' };
+let section = raw[KEYS[engine] ?? engine] ?? raw;
+if (Array.isArray(section) && section.some((s) => s?.id)) {
+  const mine = section.filter((s) => !s.id || id.includes(s.id));
+  if (mine.length) section = mine;
+}
+const r = ENGINES[engine](section, root, walk(root));
+for (const f of r.findings) console.error(\`  \${f.file ? f.file + ': ' : ''}\${f.message}\`);
+process.exit(r.findings.length ? 1 : 0);
+`;
+var EJECT_README = `# .rungs \u2014 ejected
+
+The gate engines and tables, materialised into this repo. Every gate in
+\`.ai/gates.toml\` now runs as a \`command\` gate pointing here, so **this repo no
+longer needs rungs installed** to run its checks.
+
+What you gave up: engine fixes no longer arrive with a CLI version bump. These
+files are yours now, including their bugs.
+
+What you kept: every gate, every table, and the reason each one exists \u2014 the
+\`why\` field travelled with the registry entry, so a gate can still explain
+itself to whoever finds it.
+
+To go back, delete this directory and re-run \`rungs add\`.
+`;
+function setupGit(repoRoot, dryRun = false) {
+  const attrs = join10(repoRoot, ".gitattributes");
+  if (!existsSync8(attrs)) return { drivers: [], rerere: false };
+  const drivers = [...new Set([...readFileSync9(attrs, "utf8").matchAll(/merge=(rungs-[\w-]+)/g)].map((m) => m[1]))];
+  const done = [];
+  for (const d of drivers) {
+    const cmd2 = d === "rungs-generated" ? `node -e "process.stderr.write('refusing to text-merge a generated artifact; regenerate it instead
+');process.exit(1)"` : "git merge-file -L ours -L base -L theirs %A %O %B";
+    if (!dryRun) {
+      try {
+        execSync4(`git config merge.${d}.name "rungs ${d.replace("rungs-", "")} driver"`, { cwd: repoRoot, stdio: "pipe" });
+        execSync4(`git config merge.${d}.driver ${JSON.stringify(cmd2)}`, { cwd: repoRoot, stdio: "pipe" });
+      } catch {
+        continue;
+      }
+    }
+    done.push(d);
+  }
+  let rerere = false;
+  if (!dryRun) {
+    try {
+      execSync4("git config rerere.enabled true", { cwd: repoRoot, stdio: "pipe" });
+      rerere = true;
+    } catch {
+    }
+  }
+  return { drivers: done, rerere };
+}
+
+// src/cli.ts
+var HERE = dirname6(fileURLToPath3(import.meta.url));
+var MODULES2 = join11(HERE, "..", "modules");
+var c = {
+  dim: (s) => `\x1B[2m${s}\x1B[0m`,
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  cyan: (s) => `\x1B[36m${s}\x1B[0m`
+};
+var STATE_LABEL = {
+  absent: c.dim("absent"),
+  "ours-current": c.green("ours"),
+  "ours-diverged": c.yellow("diverged"),
+  theirs: c.cyan("theirs"),
+  paradigm: c.yellow("paradigm"),
+  unknown: c.red("unknown")
+};
+function cmdModules(showParams = false) {
+  const mods = loadAllModules(MODULES2);
+  console.log(c.bold(`
+${mods.length} modules
+`));
+  for (const m of mods) {
+    const deps = m.requires.length ? c.dim(` \u2190 ${m.requires.join(", ")}`) : "";
+    console.log(`  ${c.bold(m.name.padEnd(14))} rung ${m.rung}${deps}`);
+    console.log(`  ${" ".repeat(14)} ${c.dim(m.summary)}`);
+    if (!showParams) continue;
+    for (const [name, spec] of Object.entries(m.params)) {
+      const shown = spec.default === void 0 ? c.dim("(none)") : JSON.stringify(spec.default);
+      const notes = [
+        spec.allowed ? `one of ${spec.allowed.map(String).join(" \xB7 ")}` : "",
+        // Behavioural parameters never appear as {{token}}, so a reader hunting for one in a
+        // template would conclude the parameter was dead. Say so where they meet it.
+        spec.consumed_by ? `behavioural \u2014 changes what \`${spec.consumed_by}\` does, not a template` : "",
+        spec.required ? "required" : ""
+      ].filter(Boolean);
+      console.log(`  ${" ".repeat(14)} ${c.cyan(`${m.name}.${name}`.padEnd(30))} ${c.dim("=")} ${shown}`);
+      if (spec.description) console.log(`  ${" ".repeat(16)} ${c.dim(firstSentence(spec.description))}`);
+      for (const n of notes) console.log(`  ${" ".repeat(16)} ${c.dim(n)}`);
+    }
+    if (Object.keys(m.params).length) console.log();
+  }
+  if (showParams) {
+    console.log(c.dim("  Set one with `--set module.param=value` on `add` or `init`; either spelling works."));
+    console.log(c.dim("  Resolved values are recorded in `.ai/rungs.toml`. See docs/design/parameters.md.\n"));
+  }
+  const issues = auditModules(mods);
+  console.log();
+  if (issues.length === 0) {
+    console.log(c.green("  audit clean") + c.dim(" \u2014 every parameter accounted for, every gate has a table and a why"));
+  } else {
+    console.log(c.red(`  ${issues.length} issue(s):`));
+    for (const i of issues) console.log(`    ${c.yellow(i.module)} ${c.dim(i.kind)} \u2014 ${i.detail}`);
+  }
+  console.log();
+  return issues.length === 0 ? 0 : 1;
+}
+function cmdDoctor(target) {
+  const root = resolve3(target);
+  const mods = loadAllModules(MODULES2);
+  console.log(c.bold(`
+rungs doctor \u2014 ${root}
+`));
+  const files = scanRepo(root);
+  const record = readRecord(root);
+  console.log(
+    c.dim(`  scanned ${files.length} files`) + (record ? c.dim(` \xB7 installed ${Object.keys(record.modules).length} module(s)`) : c.dim(" \xB7 not a rungs repo")) + "\n"
+  );
+  const params = resolveParams(mods, Object.fromEntries(
+    Object.entries(record?.modules ?? {}).flatMap(([n, e]) => e.params ? [[n, e.params]] : [])
+  ), root);
+  const skillsDir = record?.harnesses.includes("claude") === false ? ".agents/skills" : ".claude/skills";
+  const results = mods.map((m) => {
+    const installed = record?.modules[m.name];
+    return detect(m, root, files, installed ? { ...installed, skillsDir, params_all: params } : void 0);
+  });
+  const byState = (s) => results.filter((r) => r.state === s);
+  for (const r of results) {
+    const mod = mods.find((m) => m.name === r.module);
+    const line = `  ${r.module.padEnd(14)} ${STATE_LABEL[r.state]}`;
+    if (r.state === "absent") {
+      console.log(c.dim(line));
+      continue;
+    }
+    console.log(line);
+    if (r.ours) {
+      const parts = [`v${r.ours.version}`, `${r.ours.current.length} current`];
+      if (r.ours.stale.length) parts.push(c.cyan(`${r.ours.stale.length} stale`));
+      if (r.ours.missing.length) parts.push(c.yellow(`${r.ours.missing.length} missing`));
+      if (r.ours.kept.length) parts.push(c.dim(`${r.ours.kept.length} kept (yours from the start)`));
+      console.log(c.dim(`      ${parts.join(" \xB7 ")}`));
+      for (const f of r.ours.diverged.slice(0, 3)) {
+        console.log(`      ${c.yellow("diverged")} ${f} ${c.dim("\u2014 yours, never overwritten")}`);
+      }
+      if (r.ours.diverged.length > 3) console.log(c.dim(`      \u2026and ${r.ours.diverged.length - 3} more`));
+      if (r.ours.stale.length || r.ours.missing.length) {
+        console.log(c.dim("      run `rungs upgrade --apply`"));
+      }
+      continue;
+    }
+    for (const p of r.matchedPaths.slice(0, 2)) {
+      console.log(c.dim(`      ${p.count}\xD7 ${p.pattern}  e.g. ${p.sample[0]}`));
+    }
+    if (r.matchedMarkers.length) console.log(c.dim(`      markers: ${r.matchedMarkers.join(", ")}`));
+    for (const prop of r.proposals) {
+      console.log(`      ${c.cyan("proposes")} ${prop.param} = ${c.bold(prop.value)} ${c.dim(`(${prop.evidence})`)}`);
+    }
+    for (const a of r.adoptable) {
+      console.log(`      ${c.cyan("adoptable")} ${a.count} as ${a.kind} ${c.dim(`e.g. ${a.sample[0]}`)}`);
+    }
+    if (r.paradigm) {
+      console.log(`      ${c.yellow("different paradigm")}: ${r.paradigm.id} ${c.dim(`(${r.paradigm.matched[0]})`)}`);
+      if (r.paradigm.note) console.log(c.dim(`      ${firstSentence(r.paradigm.note)}`));
+    }
+    if (mod.threshold?.confirm) {
+      console.log(c.yellow(`      threshold: ${mod.threshold.minimum}+ ${mod.threshold.metric} \u2014 add requires confirmation`));
+    }
+  }
+  const ours = byState("ours-current").length + byState("ours-diverged").length;
+  console.log(
+    `
+  ${ours ? `${ours} installed (${byState("ours-diverged").length} diverged) \xB7 ` : ""}${byState("theirs").length} present \xB7 ${byState("paradigm").length} different paradigm \xB7 ${byState("absent").length} absent
+`
+  );
+  console.log(c.dim("  This reports presence, never quality. It cannot tell whether an adopted"));
+  console.log(c.dim("  system is good, complete, or working \u2014 only that files are where a"));
+  console.log(c.dim("  module's files would be. Signatures under-detect on purpose.\n"));
+  const theirs = byState("theirs");
+  console.log(c.bold("  Next\n"));
+  if (ours) {
+    const behind = results.some((r) => r.ours?.stale.length || r.ours?.missing.length);
+    console.log(
+      behind ? `  ${c.cyan("rungs upgrade --apply")}  ${c.dim("\u2014 bring the stale and missing files up to date")}` : `  ${c.cyan("rungs check")}           ${c.dim("\u2014 run the gates this repo already registered")}`
+    );
+    console.log(c.dim(`  Add more with \`rungs add <module>\`; \`rungs modules\` lists the set.
+`));
+  } else if (theirs.length) {
+    const names = theirs.map((r) => r.module).slice(0, 3).join(" ");
+    console.log(`  ${c.cyan(`rungs add ${names}`)}  ${c.dim("\u2014 adopt what you already built, in place")}`);
+    console.log(c.dim("  Nothing is overwritten. Files you already have are kept and reported as"));
+    console.log(c.dim("  yours; only what is missing gets written.\n"));
+  } else {
+    console.log(`  ${c.cyan("rungs init . tracked")}   ${c.dim("\u2014 instructions \xB7 gates \xB7 backlog \xB7 findings \xB7 adr \xB7 session")}`);
+    console.log(c.dim("  `tracked` is the rung for more than one thing in flight. `minimal` is just"));
+    console.log(c.dim("  the entry document; higher profiles cost more than they return until the"));
+    console.log(c.dim("  problem they answer actually exists. `rungs modules` lists all fifteen.\n"));
+  }
+  return 0;
+}
+function firstSentence(s) {
+  return s.trim().replace(/\s+/g, " ").split(/(?<=\.)\s/)[0];
+}
+function cmdAdd(names, root, dryRun, harnesses, stamp) {
+  const mods = loadAllModules(MODULES2);
+  const { order, missing } = resolveInstallOrder(names, mods);
+  if (missing.length) {
+    console.log(c.red(`
+  unknown module(s): ${missing.join(", ")}
+`));
+    return 1;
+  }
+  const pulled = order.filter((m) => !names.includes(m.name));
+  const overrides = {};
+  for (const raw of flagValues["--set"] ?? []) {
+    const [key, ...rhs] = raw.split("=");
+    const [modName, param] = key.split(".");
+    if (!modName || !param || !rhs.length) {
+      console.log(c.red(`
+  --set expects module.param=value, got: ${raw}
+`));
+      return 1;
+    }
+    (overrides[modName] ??= {})[param] = rhs.join("=");
+  }
+  const params = resolveParams(mods, overrides, root);
+  for (const [m, vals] of Object.entries(overrides)) {
+    for (const [k, v] of Object.entries(vals)) console.log(c.dim(`  set ${m}.${k} = ${v}`));
+  }
+  const skillsDir = harnesses.includes("claude") ? ".claude/skills" : ".agents/skills";
+  console.log(c.bold(`
+rungs add ${names.join(" ")} \u2192 ${root}${dryRun ? c.yellow("  (dry run)") : ""}
+`));
+  if (pulled.length) console.log(c.dim(`  pulled in by dependency: ${pulled.map((m) => m.name).join(", ")}
+`));
+  const installed = [];
+  const wrote = /* @__PURE__ */ new Map();
+  for (const mod of order) {
+    if (mod.threshold?.confirm && !dryRun && !flags.has("--confirm-threshold")) {
+      console.log(
+        c.yellow(`  ${mod.name}: requires ${mod.threshold.minimum}+ ${mod.threshold.metric}.`) + c.dim(" Skipped \u2014 pass --confirm-threshold to install it.\n")
+      );
+      continue;
+    }
+    const actions = addModule(mod, root, params, { dryRun, skillsDir });
+    installed.push(mod);
+    wrote.set(mod.name, new Set(actions.filter((a) => a.disposition !== "skip-exists" && a.disposition !== "merge" && a.disposition !== "gate").map((a) => a.target)));
+    const counts = /* @__PURE__ */ new Map();
+    for (const a of actions) counts.set(a.disposition, (counts.get(a.disposition) ?? 0) + 1);
+    console.log(`  ${c.bold(mod.name.padEnd(14))} ${[...counts].map(([k, v]) => `${v} ${k}`).join(" \xB7 ")}`);
+    for (const a of actions.filter((x) => x.disposition === "skip-exists")) {
+      console.log(c.dim(`      kept ${a.target}`));
+    }
+  }
+  const repoFiles = scanRepo(root);
+  const adopted = installed.flatMap(
+    (m) => (m.detect.adopt_as ?? []).filter((a) => a.kind === "command").flatMap((a) => adoptableGates(repoFiles, a.paths ?? [], root))
+  );
+  if (adopted.length) {
+    console.log(
+      "\n  " + c.cyan(`adopting ${adopted.length} existing validator(s)`) + " as command gates" + c.dim(" \u2014 their scripts are untouched")
+    );
+    for (const a of adopted.slice(0, 3)) console.log(c.dim(`      ${a.command}`));
+    if (adopted.length > 3) console.log(c.dim(`      \u2026and ${adopted.length - 3} more`));
+  }
+  const gateActions = registerGates(installed, root, dryRun, adopted);
+  if (gateActions.length) {
+    console.log(c.dim(`
+  registered ${gateActions.reduce((n, a) => n + Number(a.note.split(": ")[1].split(" ")[0]), 0)} gates from ${gateActions.length} module(s)`));
+  }
+  if (!dryRun) {
+    writeInstallRecord(root, order, params, harnesses, stamp, skillsDir, wrote);
+    const entries = render(root, harnesses);
+    writeReport(root, entries, harnesses, stamp);
+    console.log(
+      `
+  rendered ${entries.filter((e) => e.target).length} file(s) \xB7 ${entries.filter((e) => e.degraded).length} degraded ` + c.dim("\u2192 .ai/render-report.md")
+    );
+  }
+  console.log();
+  return 0;
+}
+function cmdRender(root, harnesses, stamp) {
+  const entries = render(root, harnesses);
+  writeReport(root, entries, harnesses, stamp);
+  console.log(c.bold(`
+rungs render \u2014 ${root}
+`));
+  for (const e of entries) {
+    const lost = e.degraded ?? (e.dropped?.length ? c.dim(` (dropped ${e.dropped.join(", ")})`) : "");
+    console.log(`  ${e.rule.padEnd(24)} ${e.harness.padEnd(10)} ${e.target ?? c.yellow("not emitted")}${lost}`);
+  }
+  console.log(c.dim(`
+  ${entries.length} rendering(s) \u2192 .ai/render-report.md
+`));
+  if (entries.length === 0) {
+    console.log(c.yellow("  Nothing to render.") + c.dim(" This command re-emits path-scoped rules from `.ai/rules/`."));
+    console.log(c.dim("  It does not re-substitute parameters \u2014 a changed value in `.ai/rungs.toml`"));
+    console.log(c.dim("  does not rewrite a file that already exists.\n"));
+  }
+  return 0;
+}
+function cmdCheck(root, tier, stamp) {
+  const runs = runGates(root, tier);
+  if (!runs.length) {
+    console.log(c.yellow("\n  no gates registered \u2014 is this a rungs repo?\n"));
+    return 1;
+  }
+  appendLedger(root, runs, stamp);
+  console.log(c.bold(`
+rungs check \u2014 ${root}${tier ? ` (${tier} tier)` : ""}
+`));
+  const mark = { pass: c.green("pass"), fail: c.red("FAIL"), unimplemented: c.yellow("unimpl"), error: c.red("error") };
+  for (const r of runs) {
+    console.log(
+      `  ${mark[r.status]} ${r.id.padEnd(34)} ${c.dim(`${r.ms}ms`)}` + (r.examined ? c.dim(`  ${r.examined} examined`) : "")
+    );
+    for (const f of r.findings.slice(0, 4)) {
+      console.log(`         ${c.dim(f.file ? `${f.file}: ` : "")}${f.message}`);
+    }
+    if (r.findings.length > 4) console.log(c.dim(`         \u2026and ${r.findings.length - 4} more`));
+  }
+  const n = (s) => runs.filter((r) => r.status === s).length;
+  console.log(
+    `
+  ${c.green(`${n("pass")} pass`)} \xB7 ${c.red(`${n("fail")} fail`)} \xB7 ${c.yellow(`${n("unimplemented")} unimplemented`)} \xB7 ${n("error")} error` + c.dim(`  (${runs.reduce((t, r) => t + r.ms, 0)}ms total)`)
+  );
+  if (n("unimplemented")) {
+    console.log(
+      c.yellow("\n  Unimplemented gates are not passes.") + c.dim(" A registry reporting green because most of its\n  gates do nothing is the worst failure this tool could have, so they block.")
+    );
+  }
+  const { gates } = loadRegistry(root);
+  const q = ledgerQuestions(root, gates);
+  if (q.neverFired.length || q.alwaysFires.length) {
+    console.log(c.bold(`
+  Ledger questions ${c.dim(`(${q.runs} recorded runs)`)}`));
+    for (const g of q.neverFired.slice(0, 3)) {
+      console.log(`    ${c.cyan(g.id)} has never fired. ${c.dim(firstSentence(g.why ?? ""))}`);
+      console.log(c.dim("      Is that still a risk here, or is the gate scoped too narrowly?"));
+    }
+    for (const g of q.alwaysFires.slice(0, 3)) {
+      console.log(`    ${c.cyan(g.id)} fails ${g.rate}. ${c.dim("Red by default is a gate people learn to bypass.")}`);
+    }
+    console.log(
+      c.dim("\n    These are questions, not verdicts. The ledger records whether a gate ran")
+    );
+    console.log(c.dim("    and whether it fired \u2014 never whether it is valuable. Gates invoked"));
+    console.log(c.dim("    directly, and CI runs, are not counted."));
+  }
+  console.log();
+  return n("fail") + n("unimplemented") + n("error") > 0 ? 1 : 0;
+}
+function cmdInit(root, profile, dryRun, harnesses, stamp) {
+  if (readRecord(root)) {
+    console.log(
+      c.yellow("\n  this repo is already initialised.") + c.dim(" Use `rungs add <module>` to install more, or `rungs upgrade`.\n")
+    );
+    return 1;
+  }
+  const names = PROFILES[profile];
+  if (!names) {
+    console.log(c.red(`
+  unknown profile '${profile}'.`) + c.dim(` Known: ${Object.keys(PROFILES).join(", ")}
+`));
+    return 1;
+  }
+  console.log(c.dim(`
+  profile '${profile}' \u2014 ${names.length} modules`));
+  return cmdAdd(names, root, dryRun, harnesses, stamp);
+}
+function cmdUpgrade(root, apply) {
+  const record = readRecord(root);
+  if (!record) {
+    console.log(c.yellow("\n  not a rungs repo \u2014 nothing to upgrade.\n"));
+    return 1;
+  }
+  const mods = loadAllModules(MODULES2);
+  const plan = planUpgrade(root, mods, record);
+  console.log(c.bold(`
+rungs upgrade \u2014 ${root}${apply ? "" : c.yellow("  (preview)")}
+`));
+  let stale = 0;
+  let diverged = 0;
+  for (const item of plan) {
+    const counts = item.files.reduce((a, f) => ({ ...a, [f.state]: (a[f.state] ?? 0) + 1 }), {});
+    stale += (counts.stale ?? 0) + (counts.missing ?? 0);
+    diverged += counts.diverged ?? 0;
+    const moved = item.from === item.to ? c.dim(item.to) : `${item.from} \u2192 ${c.bold(item.to)}`;
+    console.log(`  ${item.module.padEnd(14)} ${moved}  ${c.dim(Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(" \xB7 "))}`);
+    for (const f of item.files.filter((x) => x.state === "diverged")) {
+      console.log(`      ${c.yellow("diverged")} ${f.rel} ${c.dim("\u2014 yours, left alone")}`);
+    }
+  }
+  if (apply && stale) {
+    const written = applyUpgrade(root, mods, record, plan);
+    console.log(c.green(`
+  updated ${written} file(s)`));
+  }
+  console.log(
+    `
+  ${stale} to update \xB7 ${diverged} diverged
+` + c.dim("  Divergence is a decision, not an error: a file you edited is never overwritten.\n") + (apply ? "" : c.dim("  Run with --apply to write.\n"))
+  );
+  return 0;
+}
+function cmdEject(root, dryRun) {
+  if (!readRecord(root)) {
+    console.log(c.yellow("\n  not a rungs repo \u2014 nothing to eject.\n"));
+    return 1;
+  }
+  const result = eject(root, loadAllModules(MODULES2), dryRun);
+  console.log(c.bold(`
+rungs eject \u2014 ${root}${dryRun ? c.yellow("  (dry run)") : ""}
+`));
+  for (const a of result.actions.slice(0, 6)) console.log(c.dim(`  ${a}`));
+  if (result.actions.length > 6) console.log(c.dim(`  \u2026and ${result.actions.length - 6} more`));
+  console.log(
+    `
+  ${result.gates} declared gate(s) rewritten as commands.` + c.dim("\n  This repo no longer needs rungs installed to run its checks.\n") + c.dim("  Engine fixes stop arriving with a version bump \u2014 these files are yours now.\n")
+  );
+  return 0;
+}
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["--set"]);
+var COMMANDS = [
+  ["init [path] [profile]", "scaffold a repo \u2014 minimal \xB7 tracked \xB7 disciplined \xB7 hardened \xB7 fleet"],
+  ["doctor [path]", "detect what a repo already has, installed or not"],
+  ["add <module\u2026> [--into p]", "install modules, resolving dependencies and adopting what exists"],
+  ["check [path] [tier]", "run the registered gates and record the ledger"],
+  ["render [path]", "re-emit path-scoped rules per harness"],
+  ["upgrade [path]", "move to newer module versions, never touching what you edited"],
+  ["eject [path]", "materialise the engines; stop depending on rungs"],
+  ["setup git [path]", "install the merge drivers .gitattributes names"],
+  ["modules", "list the module set and audit the manifests"]
+];
+var FLAGS = [
+  ["--dry-run", "report what would happen, write nothing"],
+  ["--into <path>", "add: install into this repo instead of the working directory"],
+  ["--set m.param=value", "add/init: override a module parameter. Repeatable"],
+  ["--confirm-threshold", "add: install a module whose rung is above this repo"],
+  ["--apply", "upgrade: write the changes, rather than preview them"],
+  ["--fast, --full", "check: pick the gate tier, as the positional also does"],
+  ["--params", "modules: show every module parameter, its default and its allowed values"],
+  ["--copilot", "also emit Copilot instruction files"]
+];
+function renderHelp() {
+  const pad = Math.max(...COMMANDS.map(([u]) => u.length)) + 2;
+  const fpad = Math.max(...FLAGS.map(([f]) => f.length)) + 2;
+  return [
+    ``,
+    `${c.bold("rungs")} \u2014 installs and maintains a repository's agentic development system`,
+    ``,
+    ...COMMANDS.map(([u, b]) => `  ${c.bold(`rungs ${u.split(" ")[0]}`)}${u.slice(u.split(" ")[0].length).padEnd(pad - u.split(" ")[0].length)} ${c.dim(b)}`),
+    ``,
+    ...FLAGS.map(([f, b]) => `  ${c.dim(f.padEnd(fpad))} ${c.dim(b)}`),
+    ``
+  ].join("\n");
+}
+var [, , cmd, ...rest] = process.argv;
+var flags = /* @__PURE__ */ new Set();
+var args = [];
+var flagValues = {};
+var missingValue = null;
+for (let i = 0; i < rest.length; i++) {
+  const token = rest[i];
+  if (!token.startsWith("--")) {
+    args.push(token);
+    continue;
+  }
+  const eq = token.indexOf("=");
+  const name = eq === -1 ? token : token.slice(0, eq);
+  if (!VALUE_FLAGS.has(name)) {
+    flags.add(name);
+    continue;
+  }
+  const next = rest[i + 1];
+  const value = eq === -1 ? next === void 0 || next.startsWith("--") ? void 0 : rest[++i] : token.slice(eq + 1);
+  if (value === void 0) missingValue = name;
+  else (flagValues[name] ??= []).push(value);
+}
+var strayOverride = args.find((a) => /^[a-z][a-z0-9_-]*\.[a-z][a-z0-9_]*=/.test(a));
+var STAMP = process.env.RUNGS_DATE ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+var HARNESSES = flags.has("--copilot") ? ["claude", "copilot", "agents-md"] : ["claude", "agents-md"];
+if (missingValue) {
+  console.log(c.red(`
+  ${missingValue} expects a value \u2014 ${missingValue} module.param=value
+`));
+  process.exit(1);
+}
+if (strayOverride) {
+  console.log(
+    c.red(`
+  stray override: ${strayOverride}`) + c.dim(`
+  Nothing claimed it, so it would be read as a path or a module name.`) + c.dim(`
+  Did you mean: --set ${strayOverride}
+`)
+  );
+  process.exit(1);
+}
+switch (cmd) {
+  case "modules":
+    process.exit(cmdModules(flags.has("--params")));
+  case "doctor":
+    process.exit(cmdDoctor(args[0] ?? process.cwd()));
+  case "check": {
+    const tier = args[1] ?? (flags.has("--full") ? "full" : flags.has("--fast") ? "fast" : void 0);
+    process.exit(cmdCheck(resolve3(args[0] ?? process.cwd()), tier, STAMP));
+  }
+  case "init": {
+    const profile = args[1] ?? "tracked";
+    process.exit(cmdInit(resolve3(args[0] ?? process.cwd()), profile, flags.has("--dry-run"), HARNESSES, STAMP));
+  }
+  case "upgrade":
+    process.exit(cmdUpgrade(resolve3(args[0] ?? process.cwd()), flags.has("--apply")));
+  case "eject":
+    process.exit(cmdEject(resolve3(args[0] ?? process.cwd()), flags.has("--dry-run")));
+  case "setup": {
+    const r = setupGit(resolve3(args[1] ?? process.cwd()), flags.has("--dry-run"));
+    console.log(
+      r.drivers.length ? `
+  installed ${r.drivers.length} merge driver(s): ${r.drivers.join(", ")}` + (r.rerere ? c.dim(" \xB7 rerere on") : "") + c.dim("\n  Declared drivers were inert until now \u2014 a fresh clone needs this once.\n") : c.dim("\n  no rungs merge drivers declared in .gitattributes\n")
+    );
+    process.exit(0);
+  }
+  case "render":
+    process.exit(cmdRender(resolve3(args[0] ?? process.cwd()), HARNESSES, STAMP));
+  case "add": {
+    const target = flags.has("--into") ? args[args.length - 1] : process.cwd();
+    const names = flags.has("--into") ? args.slice(0, -1) : args;
+    process.exit(cmdAdd(names, resolve3(target), flags.has("--dry-run"), HARNESSES, STAMP));
+  }
+  default: {
+    const wantedHelp = cmd === void 0 || cmd === "help" || cmd === "--help" || cmd === "-h";
+    if (!wantedHelp) console.log(c.red(`
+  unknown command: ${cmd}`));
+    console.log(renderHelp());
+    process.exit(wantedHelp ? 0 : 1);
+  }
+}
+//# sourceMappingURL=cli.js.map