@rungs/cli 0.3.1 → 0.4.0

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { dirname as dirname9, join as join14, resolve as resolve5 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { dirname as dirname11, join as join15, resolve as resolve7 } from "node:path";
 
 // src/manifest.ts
 import { readdirSync as readdirSync2, readFileSync, statSync as statSync2 } from "node:fs";
@@ -112,9 +112,27 @@ function loadManifest(dir) {
     dir
   };
   const p = manifest.provenance;
-  if (!p?.sources?.length) throw new Error(`${name}: [provenance].sources is required`);
-  if (!p?.patterns?.length) throw new Error(`${name}: [provenance].patterns is required`);
-  if (!p?.incident?.trim()) throw new Error(`${name}: [provenance].incident is required`);
+  if (!p) throw new Error(`${name}: [provenance] is required`);
+  const kind = p.kind ?? "extracted";
+  if (kind !== "extracted" && kind !== "designed") {
+    throw new Error(`${name}: [provenance].kind must be 'extracted' or 'designed', not '${kind}'`);
+  }
+  if (kind === "extracted") {
+    if (!p.sources?.length) throw new Error(`${name}: [provenance].sources is required`);
+    if (!p.patterns?.length) throw new Error(`${name}: [provenance].patterns is required`);
+    if (!p.incident?.trim()) throw new Error(`${name}: [provenance].incident is required`);
+  } else {
+    if (!p.rationale?.trim()) {
+      throw new Error(`${name}: [provenance].rationale is required when kind = "designed" \u2014 say why it exists, in the first person`);
+    }
+    if (p.incident?.trim()) {
+      throw new Error(`${name}: [provenance].incident belongs to an extracted module; a designed one has no incident to name`);
+    }
+    if (p.sources?.length) {
+      throw new Error(`${name}: [provenance].sources belongs to an extracted module; cite influences in the rationale instead`);
+    }
+  }
+  manifest.provenance = { ...p, kind };
   return manifest;
 }
 function loadAllModules(modulesRoot) {
@@ -175,16 +193,18 @@ function auditModules(mods) {
 }
 
 // src/detect.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4 } from "node:fs";
 import { join as join4 } from "node:path";
 
 // src/add.ts
-import { existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
-import { dirname, join as join3 } from "node:path";
+import { existsSync, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
 import { createHash } from "node:crypto";
 
 // src/substitute.ts
-import { basename, resolve } from "node:path";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { basename, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 function substitute(text, module, params) {
   return text.replace(/(^|[^$])\{\{([a-z_.]+)\}\}/g, (whole, lead, ref) => {
     const [a, b] = ref.includes(".") ? ref.split(".") : [module, ref];
@@ -201,8 +221,12 @@ function format(v) {
 function repoFacts(repoRoot) {
   return repoRoot ? { dirname: basename(resolve(repoRoot)) } : {};
 }
+function rungsFacts() {
+  const packageJson = resolve(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+  return { version: JSON.parse(readFileSync2(packageJson, "utf8")).version };
+}
 function resolveParams(mods, overrides = {}, repoRoot) {
-  const out = { repo: repoFacts(repoRoot) };
+  const out = {};
   for (const m of mods) {
     out[m.name] = {};
     for (const [k, spec] of Object.entries(m.params)) out[m.name][k] = spec.default;
@@ -210,6 +234,8 @@ function resolveParams(mods, overrides = {}, repoRoot) {
   for (const [mod, vals] of Object.entries(overrides)) {
     out[mod] = { ...out[mod] ?? {}, ...vals };
   }
+  out.repo = repoFacts(repoRoot);
+  out.rungs = rungsFacts();
   for (const m of mods) {
     for (const [k, v] of Object.entries(out[m.name])) {
       if (typeof v === "string" && v.includes("{{")) out[m.name][k] = substitute(v, m.name, out);
@@ -224,60 +250,331 @@ function markers(targetPath2, module, version) {
   return hash ? { begin: `# rungs:begin ${module}@${version}`, end: `# rungs:end ${module}` } : { begin: `<!-- rungs:begin ${module}@${version} -->`, end: `<!-- rungs:end ${module} -->` };
 }
 function mergeBlock(existing, fragment, module) {
-  const beginRe = new RegExp(`^[ \\t]*(?:<!--|#)\\s*rungs:begin ${module}(?:@[\\w.\\-]+)?\\s*(?:-->)?[ \\t]*$`, "m");
-  const endRe = new RegExp(`^[ \\t]*(?:<!--|#)\\s*rungs:end ${module}\\s*(?:-->)?[ \\t]*$`, "m");
+  const beginRe = new RegExp(
+    `^[ \\t]*(?:<!--|#)[ \\t]*rungs:begin ${module}(?:@[\\w.\\-]+)?[ \\t]*(?:-->)?[ \\t]*$`,
+    "m"
+  );
+  const endRe = new RegExp(
+    `^[ \\t]*(?:<!--|#)[ \\t]*rungs:end ${module}[ \\t]*(?:-->)?[ \\t]*$`,
+    "m"
+  );
   const b = existing.match(beginRe);
   const e = existing.match(endRe);
   if (b && e && b.index !== void 0 && e.index !== void 0 && e.index > b.index) {
     const before = existing.slice(0, b.index);
     const after = existing.slice(e.index + e[0].length);
-    return `${before}${fragment.trim()}${after}`;
-  }
-  const sep3 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  return `${existing}${sep3}${fragment.trim()}
+    const current = existing.slice(b.index, e.index + e[0].length);
+    const normalise = (value) => value.replace(/\r\n|\r|\n/g, "\n");
+    const replacement = fragment.trim();
+    if (normalise(current) === normalise(replacement)) return existing;
+    const newline = current.match(/\r\n|\r|\n/)?.[0] ?? existing.match(/\r\n|\r|\n/)?.[0] ?? "\n";
+    return `${before}${normalise(replacement).replace(/\n/g, newline)}${after}`;
+  }
+  const sep4 = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  return `${existing}${sep4}${fragment.trim()}
 `;
 }
 
+// src/emitted-path.ts
+import { lstatSync, realpathSync, statSync as statSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, relative as relative2, resolve as resolve2, sep as sep2, win32 } from "node:path";
+
+// src/storage-key.ts
+function canonicalCaselessSegmentKey(segment) {
+  return segment.normalize("NFKD").toLowerCase().toUpperCase().normalize("NFKD");
+}
+function canonicalCaselessSegmentEqual(left, right) {
+  return canonicalCaselessSegmentKey(left) === canonicalCaselessSegmentKey(right);
+}
+
+// src/emitted-path.ts
+var UnsafeEmittedPathError = class extends Error {
+  moduleName;
+  target;
+  reason;
+  constructor(moduleName, target, reason) {
+    super(`module '${moduleName}' emitted unsafe target ${JSON.stringify(target)}: ${reason}`);
+    this.name = "UnsafeEmittedPathError";
+    this.moduleName = moduleName;
+    this.target = target;
+    this.reason = reason;
+  }
+};
+var missingEntry = (error) => error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+function hasUnpairedUtf16Surrogate(value) {
+  for (let i = 0; i < value.length; i++) {
+    const unit = value.charCodeAt(i);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(i + 1);
+      if (!(next >= 56320 && next <= 57343)) return true;
+      i++;
+      continue;
+    }
+    if (unit >= 56320 && unit <= 57343) return true;
+  }
+  return false;
+}
+function canonicalCaselessAncestor(ancestor, descendant) {
+  const ancestorSegments = ancestor.split(sep2);
+  const descendantSegments = descendant.split(sep2);
+  return ancestorSegments.length < descendantSegments.length && ancestorSegments.every((segment, index) => canonicalCaselessSegmentEqual(segment, descendantSegments[index]));
+}
+function canonicalCaselessPathEqual(left, right) {
+  const leftSegments = left.split(sep2);
+  const rightSegments = right.split(sep2);
+  return leftSegments.length === rightSegments.length && leftSegments.every((segment, index) => canonicalCaselessSegmentEqual(segment, rightSegments[index]));
+}
+function canonicalWithMissing(path, moduleName, target) {
+  let cursor = resolve2(path);
+  const suffix = [];
+  for (; ; ) {
+    try {
+      lstatSync(cursor);
+    } catch (error) {
+      if (!missingEntry(error)) {
+        throw new UnsafeEmittedPathError(moduleName, target, "its existing ancestor cannot be inspected");
+      }
+      const parent = dirname2(cursor);
+      if (parent === cursor) {
+        throw new UnsafeEmittedPathError(moduleName, target, "no canonical existing ancestor can be established");
+      }
+      suffix.unshift(basename2(cursor));
+      cursor = parent;
+      continue;
+    }
+    let canonical;
+    try {
+      canonical = realpathSync.native(cursor);
+    } catch {
+      throw new UnsafeEmittedPathError(moduleName, target, "its existing ancestor cannot be resolved canonically");
+    }
+    if (suffix.length) {
+      try {
+        if (!statSync3(canonical).isDirectory()) {
+          throw new UnsafeEmittedPathError(moduleName, target, "its deepest existing ancestor is not a directory");
+        }
+      } catch (error) {
+        if (error instanceof UnsafeEmittedPathError) throw error;
+        throw new UnsafeEmittedPathError(moduleName, target, "its existing ancestor cannot be inspected");
+      }
+    }
+    return resolve2(canonical, ...suffix);
+  }
+}
+function resolveEmittedPath(repoRoot, moduleName, target) {
+  if (!target || target.includes("\0")) {
+    throw new UnsafeEmittedPathError(moduleName, target, "a non-empty portable relative file path is required");
+  }
+  const portable = target.replace(/\\/g, "/");
+  if (portable.startsWith("/") || win32.isAbsolute(target) || /^[A-Za-z]:/.test(portable)) {
+    throw new UnsafeEmittedPathError(moduleName, target, "absolute, rooted, and drive-relative paths are not allowed");
+  }
+  const segments = portable.split("/");
+  if (segments.includes("..")) {
+    throw new UnsafeEmittedPathError(moduleName, target, "parent traversal ('..') is not allowed");
+  }
+  if (segments.some((segment) => segment === "" || segment === ".")) {
+    throw new UnsafeEmittedPathError(moduleName, target, "empty and current-directory ('.') path segments are not allowed");
+  }
+  if (segments.some(hasUnpairedUtf16Surrogate)) {
+    throw new UnsafeEmittedPathError(
+      moduleName,
+      target,
+      "unpaired UTF-16 surrogate code units are not allowed in path segments"
+    );
+  }
+  if (segments.some((segment) => /[\u0000-\u001f<>:"|?*]/.test(segment) || /[ .]$/.test(segment))) {
+    throw new UnsafeEmittedPathError(
+      moduleName,
+      target,
+      "it contains a character or trailing suffix that is not a portable filename"
+    );
+  }
+  const windowsDevice = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
+  if (segments.some((segment) => windowsDevice.test(segment))) {
+    throw new UnsafeEmittedPathError(moduleName, target, "Windows device-name path segments are not allowed");
+  }
+  const canonicalRoot = canonicalWithMissing(repoRoot, moduleName, target);
+  const lexicalDestination = resolve2(repoRoot, ...segments);
+  const canonicalDestination = canonicalWithMissing(lexicalDestination, moduleName, target);
+  const fromRoot = relative2(canonicalRoot, canonicalDestination);
+  if (!fromRoot || fromRoot === ".." || fromRoot.startsWith(`..${sep2}`) || isAbsolute(fromRoot)) {
+    throw new UnsafeEmittedPathError(moduleName, target, "it resolves outside the canonical consumer repository");
+  }
+  let leafAlias = false;
+  try {
+    leafAlias = lstatSync(lexicalDestination).isSymbolicLink();
+  } catch (error) {
+    if (!missingEntry(error)) {
+      throw new UnsafeEmittedPathError(moduleName, target, "its destination cannot be inspected");
+    }
+  }
+  return { target: portable, absolute: canonicalDestination, leafAlias };
+}
+function preflightEmittedPaths(repoRoot, candidates) {
+  const resolved = candidates.map((candidate) => {
+    const destination = resolveEmittedPath(repoRoot, candidate.moduleName, candidate.target);
+    if (candidate.writeExisting) {
+      if (destination.leafAlias) {
+        throw new UnsafeEmittedPathError(
+          candidate.moduleName,
+          candidate.target,
+          "the destination is a symlink or junction leaf and this operation will not write through it"
+        );
+      }
+      try {
+        const leaf = lstatSync(destination.absolute);
+        if (!leaf.isFile()) {
+          throw new UnsafeEmittedPathError(
+            candidate.moduleName,
+            candidate.target,
+            "the existing destination is not a regular file"
+          );
+        }
+        if (leaf.nlink > 1) {
+          throw new UnsafeEmittedPathError(
+            candidate.moduleName,
+            candidate.target,
+            "the existing destination has multiple hard links and this operation will not overwrite it"
+          );
+        }
+      } catch (error) {
+        if (error instanceof UnsafeEmittedPathError) throw error;
+        if (!missingEntry(error)) {
+          throw new UnsafeEmittedPathError(
+            candidate.moduleName,
+            candidate.target,
+            "the destination cannot be inspected before writing"
+          );
+        }
+      }
+    }
+    return destination;
+  });
+  const seen = [];
+  for (let i = 0; i < candidates.length; i++) {
+    const candidate = candidates[i];
+    const destination = resolved[i];
+    const prior = seen.find((entry) => canonicalCaselessPathEqual(entry.resolved.absolute, destination.absolute));
+    if (!prior) {
+      const structural = seen.find(
+        (entry) => canonicalCaselessAncestor(entry.resolved.absolute, destination.absolute) || canonicalCaselessAncestor(destination.absolute, entry.resolved.absolute)
+      );
+      if (!structural) {
+        seen.push({ candidate, resolved: destination });
+        continue;
+      }
+      throw new UnsafeEmittedPathError(
+        candidate.moduleName,
+        candidate.target,
+        `it has a file/descendant collision with module '${structural.candidate.moduleName}' target '${structural.candidate.target}' after canonical resolution`
+      );
+    }
+    if (candidate.shared && prior.candidate.shared && destination.target === prior.resolved.target) continue;
+    throw new UnsafeEmittedPathError(
+      candidate.moduleName,
+      candidate.target,
+      `it collides with module '${prior.candidate.moduleName}' target '${prior.candidate.target}' after canonical resolution`
+    );
+  }
+  return resolved;
+}
+
 // src/add.ts
 var FRAGMENT_TARGET = {
   "AGENTS.md": "AGENTS.md",
   gitignore: ".gitignore",
   gitattributes: ".gitattributes"
 };
+var RESERVED_SHARED_SINKS = /* @__PURE__ */ new Set([
+  "AGENTS.md",
+  "CLAUDE.md",
+  ".gitignore",
+  ".gitattributes",
+  ".ai/gates.toml"
+]);
+var SHARED_FILE_OWNERS = /* @__PURE__ */ new Map([
+  ["instructions", /* @__PURE__ */ new Set(["AGENTS.md", "CLAUDE.md"])],
+  ["gates", /* @__PURE__ */ new Set([".ai/gates.toml"])]
+]);
+function ownsSharedFile(mod, sourceTarget, target) {
+  return sourceTarget === target && (SHARED_FILE_OWNERS.get(mod.name)?.has(sourceTarget) ?? false);
+}
+function reservedSharedSinkCandidates() {
+  return [...RESERVED_SHARED_SINKS].map((target) => ({
+    moduleName: "rungs reserved shared sink",
+    target,
+    shared: true
+  }));
+}
+function fileEmissions(mod, params, skillsDir = ".claude/skills") {
+  const out = [];
+  const sub = (text) => substitute(text, mod.name, params);
+  for (const [dir, prefix, disposition] of [
+    ["files", "", "create"],
+    ["rules", ".ai/rules/", "rule"],
+    ["skills", `${skillsDir}/`, "skill"]
+  ]) {
+    const base = join3(mod.dir, dir);
+    if (!existsSync(base)) continue;
+    for (const rel of walk(base)) {
+      const sourceTarget = (prefix + rel).replace(/\\/g, "/");
+      const target = sub(sourceTarget).replace(/\\/g, "/");
+      let content = sub(readFileSync3(join3(base, rel), "utf8"));
+      if (dir === "skills") content = withOptedInExtensions(mod, rel, content);
+      out.push({ target, content, disposition, shared: ownsSharedFile(mod, sourceTarget, target) });
+    }
+  }
+  return out;
+}
+function fragmentTargets(mod) {
+  const base = join3(mod.dir, "fragments");
+  if (!existsSync(base)) return [];
+  return walk(base).map((rel) => FRAGMENT_TARGET[rel]).filter((target) => Boolean(target));
+}
+function moduleTargets(mod, params, skillsDir, files = fileEmissions(mod, params, skillsDir)) {
+  return [
+    ...files.map((file) => ({ moduleName: mod.name, target: file.target, shared: file.shared })),
+    ...fragmentTargets(mod).map((target) => ({ moduleName: mod.name, target, shared: true, writeExisting: true })),
+    ...mod.gates.length ? [{ moduleName: mod.name, target: ".ai/gates.toml", shared: true, writeExisting: true }] : []
+  ];
+}
+function moduleEmissionCandidates(mods, params, skillsDir = ".claude/skills") {
+  return [
+    ...reservedSharedSinkCandidates(),
+    ...mods.flatMap((mod) => moduleTargets(mod, params, skillsDir))
+  ];
+}
+function preflightModuleEmissions(mods, repoRoot, params, skillsDir = ".claude/skills") {
+  preflightEmittedPaths(repoRoot, moduleEmissionCandidates(mods, params, skillsDir));
+}
+function prospectiveRuleEmissions(mods, params, skillsDir = ".claude/skills") {
+  return mods.flatMap(
+    (mod) => fileEmissions(mod, params, skillsDir).filter((file) => file.disposition === "rule").map((file) => ({ moduleName: mod.name, target: file.target, content: file.content }))
+  );
+}
 function addModule(mod, repoRoot, params, opts = {}) {
   const actions = [];
+  const skillsDir = opts.skillsDir ?? ".claude/skills";
+  const files = fileEmissions(mod, params, skillsDir);
+  const targets = moduleTargets(mod, params, skillsDir, files);
+  const reservations = reservedSharedSinkCandidates();
+  const resolved = preflightEmittedPaths(repoRoot, [...reservations, ...targets]).slice(reservations.length);
+  const destinations = new Map(targets.map((candidate, index) => [candidate.target, resolved[index].absolute]));
   const write = (rel, content, disposition) => {
-    const full = join3(repoRoot, rel);
+    const full = destinations.get(rel);
     if (existsSync(full)) {
       actions.push({ disposition: "skip-exists", target: rel, note: "already present \u2014 left alone" });
       return;
     }
     actions.push({ disposition, target: rel });
     if (opts.dryRun) return;
-    mkdirSync(dirname(full), { recursive: true });
+    mkdirSync(dirname3(full), { recursive: true });
     writeFileSync(full, content);
   };
   const sub = (text) => substitute(text, mod.name, params);
   const has = (d) => existsSync(join3(mod.dir, d));
-  if (has("files")) {
-    const base = join3(mod.dir, "files");
-    for (const rel of walk(base)) {
-      write(sub(rel), sub(readFileSync2(join3(base, rel), "utf8")), "create");
-    }
-  }
-  if (has("rules")) {
-    const base = join3(mod.dir, "rules");
-    for (const rel of walk(base)) {
-      write(join3(".ai", "rules", rel).split("\\").join("/"), sub(readFileSync2(join3(base, rel), "utf8")), "rule");
-    }
-  }
-  if (has("skills")) {
-    const base = join3(mod.dir, "skills");
-    const dir = opts.skillsDir ?? ".claude/skills";
-    for (const rel of walk(base)) {
-      write(`${dir}/${rel}`, withOptedInExtensions(mod, rel, sub(readFileSync2(join3(base, rel), "utf8"))), "skill");
-    }
-  }
+  for (const file of files) write(file.target, file.content, file.disposition);
   if (has("fragments")) {
     const base = join3(mod.dir, "fragments");
     for (const rel of walk(base)) {
@@ -286,9 +583,9 @@ function addModule(mod, repoRoot, params, opts = {}) {
         actions.push({ disposition: "merge", target: rel, note: "unknown fragment target \u2014 skipped" });
         continue;
       }
-      const full = join3(repoRoot, target);
-      const existing = existsSync(full) ? readFileSync2(full, "utf8") : "";
-      const fragment = sub(readFileSync2(join3(base, rel), "utf8"));
+      const full = destinations.get(target);
+      const existing = existsSync(full) ? readFileSync3(full, "utf8") : "";
+      const fragment = sub(readFileSync3(join3(base, rel), "utf8"));
       const merged = mergeBlock(existing, fragment, mod.name);
       actions.push({
         disposition: "merge",
@@ -296,7 +593,7 @@ function addModule(mod, repoRoot, params, opts = {}) {
         note: existing.includes(`rungs:begin ${mod.name}`) ? "block replaced" : "block appended"
       });
       if (!opts.dryRun) {
-        mkdirSync(dirname(full), { recursive: true });
+        mkdirSync(dirname3(full), { recursive: true });
         writeFileSync(full, merged);
       }
     }
@@ -305,9 +602,14 @@ function addModule(mod, repoRoot, params, opts = {}) {
 }
 function registerGates(mods, repoRoot, dryRun = false, adopted = []) {
   const actions = [];
-  const registry = join3(repoRoot, ".ai", "gates.toml");
+  const owners = [...adopted.length ? ["adopted"] : [], ...mods.filter((mod) => mod.gates.length).map((mod) => mod.name)];
+  const destinations = preflightEmittedPaths(
+    repoRoot,
+    owners.map((moduleName) => ({ moduleName, target: ".ai/gates.toml", shared: true, writeExisting: true }))
+  );
+  const registry = destinations[0]?.absolute ?? join3(repoRoot, ".ai", "gates.toml");
   if (adopted.length) {
-    const existing = existsSync(registry) ? readFileSync2(registry, "utf8") : "";
+    const existing = existsSync(registry) ? readFileSync3(registry, "utf8") : "";
     const { begin, end } = markers("gates.toml", "adopted", "1.0.0");
     const body = [
       begin,
@@ -327,18 +629,18 @@ why     = """Adopted from ${a.source}. Predates rungs and is owned by this repo.
     ].join("\n");
     actions.push({ disposition: "gate", target: ".ai/gates.toml", note: `adopted: ${adopted.length} entries` });
     if (!dryRun) {
-      mkdirSync(dirname(registry), { recursive: true });
+      mkdirSync(dirname3(registry), { recursive: true });
       writeFileSync(registry, mergeBlock(existing, body, "adopted"));
     }
   }
   for (const mod of mods) {
     if (!mod.gates.length) continue;
-    const existing = existsSync(registry) ? readFileSync2(registry, "utf8") : "";
+    const existing = existsSync(registry) ? readFileSync3(registry, "utf8") : "";
     const { begin, end } = markers("gates.toml", mod.name, mod.version);
     const body = [begin, ...mod.gates.map(gateEntry(mod)), end].join("\n");
     actions.push({ disposition: "gate", target: ".ai/gates.toml", note: `${mod.name}: ${mod.gates.length} entries` });
     if (dryRun) continue;
-    mkdirSync(dirname(registry), { recursive: true });
+    mkdirSync(dirname3(registry), { recursive: true });
     writeFileSync(registry, mergeBlock(existing, body, mod.name));
   }
   return actions;
@@ -366,6 +668,29 @@ function blockedByParadigm(order, paradigms) {
   }
   return blocked;
 }
+function blockedByConflict(order, present, all) {
+  const byName = new Map(all.map((m) => [m.name, m]));
+  const blocked = /* @__PURE__ */ new Map();
+  const partner = (mod) => {
+    const declared = mod.conflicts.find((other) => other !== mod.name && present.has(other));
+    if (declared) return declared;
+    for (const other of present) {
+      if (other === mod.name) continue;
+      if (byName.get(other)?.conflicts.includes(mod.name)) return other;
+    }
+    return void 0;
+  };
+  for (const mod of order) {
+    const against = partner(mod);
+    if (against) {
+      blocked.set(mod.name, { cause: mod.name, with: against });
+      continue;
+    }
+    const dep = mod.requires.find((d) => blocked.has(d));
+    if (dep) blocked.set(mod.name, blocked.get(dep));
+  }
+  return blocked;
+}
 function resolveInstallOrder(requested, all) {
   const byName = new Map(all.map((m) => [m.name, m]));
   const order = [];
@@ -398,7 +723,6 @@ function resolveInstallOrder(requested, all) {
   return { order, missing };
 }
 var contentHash = (s) => createHash("sha256").update(s.replace(/\r\n/g, "\n")).digest("hex").slice(0, 12);
-var SHARED = /* @__PURE__ */ new Set(["AGENTS.md", "CLAUDE.md", ".gitignore", ".gitattributes", ".ai/gates.toml"]);
 function withOptedInExtensions(mod, rel, content) {
   const name = rel.split(/[\\/]/)[0];
   const extensions = mod.skills?.[name]?.extensions;
@@ -414,21 +738,8 @@ ${added.join("\n")}
 }
 function emittedFiles(mod, params, skillsDir = ".claude/skills") {
   const out = /* @__PURE__ */ new Map();
-  const sub = (t) => substitute(t, mod.name, params);
-  for (const [dir, prefix] of [
-    ["files", ""],
-    ["rules", ".ai/rules/"],
-    ["skills", `${skillsDir}/`]
-  ]) {
-    const base = join3(mod.dir, dir);
-    if (!existsSync(base)) continue;
-    for (const rel of walk(base)) {
-      const target = sub(prefix + rel).split("\\").join("/");
-      if (SHARED.has(target)) continue;
-      let content = sub(readFileSync2(join3(base, rel), "utf8"));
-      if (dir === "skills") content = withOptedInExtensions(mod, rel, content);
-      out.set(target, content);
-    }
+  for (const file of fileEmissions(mod, params, skillsDir)) {
+    if (!file.shared) out.set(file.target, file.content);
   }
   return out;
 }
@@ -457,8 +768,9 @@ function writeInstallRecord(repoRoot, mods, params, harnesses, stamp, skillsDir
       lines.push(`params  = { ${Object.entries(p).map(([k, v]) => `${k} = ${JSON.stringify(v ?? "")}`).join(", ")} }`);
     }
     const emitted = emittedFiles(m, params, skillsDir);
-    const created = [...emitted].filter(([rel]) => wroteByModule?.get(m.name)?.has(rel) ?? existsSync(join3(repoRoot, rel)));
-    const kept = [...emitted].filter(([rel]) => !created.some(([c2]) => c2 === rel) && existsSync(join3(repoRoot, rel)));
+    const exists = (rel) => existsSync(resolveEmittedPath(repoRoot, m.name, rel).absolute);
+    const created = [...emitted].filter(([rel]) => wroteByModule?.get(m.name)?.has(rel) ?? exists(rel));
+    const kept = [...emitted].filter(([rel]) => !created.some(([c2]) => c2 === rel) && exists(rel));
     if (created.length) {
       lines.push(`[modules.${m.name}.hashes]`);
       for (const [rel, content] of created) lines.push(`"${rel}" = "${contentHash(content)}"`);
@@ -469,7 +781,10 @@ function writeInstallRecord(repoRoot, mods, params, harnesses, stamp, skillsDir
     }
     lines.push("");
   }
-  writeFileSync(join3(repoRoot, ".ai", "rungs.toml"), lines.join("\n"));
+  const record = preflightEmittedPaths(repoRoot, [
+    { moduleName: "rungs", target: ".ai/rungs.toml", writeExisting: true }
+  ])[0];
+  writeFileSync(record.absolute, lines.join("\n"));
 }
 function adoptableGates(files, patterns, repoRoot) {
   const runner = { ".mjs": "node", ".js": "node", ".ps1": "pwsh -File", ".sh": "bash" };
@@ -519,7 +834,7 @@ function detect(mod, repoRoot, files, installed) {
     for (const rel of candidates) {
       let text;
       try {
-        text = readFileSync3(join4(repoRoot, rel), "utf8");
+        text = readFileSync4(join4(repoRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -575,7 +890,7 @@ function infer(mod, repoRoot, files) {
       if (excluded.has(rel)) continue;
       let text;
       try {
-        text = readFileSync3(join4(repoRoot, rel), "utf8");
+        text = readFileSync4(join4(repoRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -590,7 +905,7 @@ function infer(mod, repoRoot, files) {
         if (excluded.has(rel)) continue;
         let text;
         try {
-          text = readFileSync3(join4(repoRoot, rel), "utf8");
+          text = readFileSync4(join4(repoRoot, rel), "utf8");
         } catch {
           continue;
         }
@@ -622,7 +937,9 @@ function scanRepo(repoRoot) {
 }
 function ownedState(mod, repoRoot, installed) {
   const params = installed.params_all ?? {};
-  const emitted = emittedFiles(mod, params, installed.skillsDir ?? ".claude/skills");
+  const skillsDir = installed.skillsDir ?? ".claude/skills";
+  preflightModuleEmissions([mod], repoRoot, params, skillsDir);
+  const emitted = emittedFiles(mod, params, skillsDir);
   const kept = new Set(installed.kept?.files ?? []);
   const out = {
     version: installed.version,
@@ -637,12 +954,17 @@ function ownedState(mod, repoRoot, installed) {
       out.kept.push(rel);
       continue;
     }
-    const full = join4(repoRoot, rel);
+    const resolved = resolveEmittedPath(repoRoot, mod.name, rel);
+    const full = resolved.absolute;
+    if (resolved.leafAlias) {
+      out.diverged.push(rel);
+      continue;
+    }
     if (!existsSync2(full)) {
       out.missing.push(rel);
       continue;
     }
-    const onDisk = contentHash(readFileSync3(full, "utf8"));
+    const onDisk = contentHash(readFileSync4(full, "utf8"));
     if (onDisk === contentHash(wouldEmit)) out.current.push(rel);
     else if (installed.hashes?.[rel] && onDisk === installed.hashes[rel]) out.stale.push(rel);
     else out.diverged.push(rel);
@@ -651,11 +973,18 @@ function ownedState(mod, repoRoot, installed) {
 }
 
 // src/render.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname4, join as join5 } from "node:path";
+
+// src/text.ts
+function semanticText(text) {
+  return text.replace(/\r\n?/g, "\n");
+}
+
+// src/render.ts
 var DO_NOT_EDIT = (source) => `Generated by \`rungs render\` from ${source}. Do not edit \u2014 your changes are overwritten.`;
 function readRules(repoRoot) {
-  const dir = join5(repoRoot, ".ai", "rules");
+  const dir = resolveEmittedPath(repoRoot, "render", ".ai/rules").absolute;
   const rules = [];
   let files;
   try {
@@ -664,20 +993,24 @@ function readRules(repoRoot) {
     return rules;
   }
   for (const rel of files) {
-    const raw = readFileSync4(join5(dir, rel), "utf8");
-    const m = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
-    if (!m) continue;
-    const [, fm, body] = m;
-    rules.push({
-      file: rel,
-      description: scalar(fm, "description"),
-      paths: list(fm, "paths"),
-      enforcement: scalar(fm, "enforcement"),
-      body: body.trim()
-    });
+    const raw = semanticText(readFileSync5(join5(dir, rel), "utf8"));
+    const rule = parseRule(rel, raw);
+    if (rule) rules.push(rule);
   }
   return rules;
 }
+function parseRule(file, raw) {
+  const m = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!m) return null;
+  const [, fm, body] = m;
+  return {
+    file,
+    description: scalar(fm, "description"),
+    paths: list(fm, "paths"),
+    enforcement: scalar(fm, "enforcement"),
+    body: body.trim()
+  };
+}
 function scalar(fm, key) {
   const folded = fm.match(new RegExp(`^${key}:\\s*>-?\\s*\\n([\\s\\S]*?)(?=\\n\\S|$)`, "m"));
   if (folded) return folded[1].split("\n").map((l) => l.trim()).filter(Boolean).join(" ");
@@ -767,10 +1100,24 @@ function commonDirPrefix(paths) {
   const first = dirs[0];
   return dirs.every((d) => d === first) && first.includes("/") ? first : null;
 }
-function render(repoRoot, harnesses) {
+function prepareRender(repoRoot, harnesses, prospective = [], preceding = []) {
   const rules = readRules(repoRoot);
+  const owners = new Map(rules.map((rule) => [rule.file, "render"]));
+  const occupied = new Set(rules.map((rule) => `.ai/rules/${rule.file}`));
+  for (const pending of prospective) {
+    const source = resolveEmittedPath(repoRoot, pending.moduleName, pending.target);
+    if (occupied.has(source.target) || existsSync3(source.absolute)) continue;
+    occupied.add(source.target);
+    if (!source.target.startsWith(".ai/rules/")) continue;
+    const file = source.target.slice(".ai/rules/".length);
+    const rule = parseRule(file, pending.content);
+    if (!rule) continue;
+    rules.push(rule);
+    owners.set(file, pending.moduleName);
+  }
   const entries = [];
   const routingOnly = [];
+  const planned = [];
   for (const rule of rules) {
     for (const harness of harnesses) {
       const out = renderRule(rule, harness);
@@ -779,18 +1126,45 @@ function render(repoRoot, harnesses) {
         if (harness === "agents-md") routingOnly.push(rule);
         continue;
       }
-      const full = join5(repoRoot, out.target);
-      mkdirSync2(dirname2(full), { recursive: true });
-      writeFileSync2(full, out.content);
-      entries.push({ rule: rule.file, harness, target: out.target, dropped: out.dropped });
+      const entry = { rule: rule.file, harness, target: out.target, dropped: out.dropped };
+      entries.push(entry);
+      planned.push({ entry, target: out.target, content: out.content, owner: owners.get(rule.file) ?? "render" });
     }
   }
-  writeRoutingBlock(repoRoot, routingOnly, harnesses);
-  return entries;
+  const candidates = [
+    ...preceding,
+    ...planned.map((out) => ({ moduleName: out.owner, target: out.target, writeExisting: true })),
+    ...harnesses.includes("agents-md") ? [{ moduleName: "render", target: "AGENTS.md", shared: true, writeExisting: true }] : [],
+    { moduleName: "render", target: ".ai/render-report.md", writeExisting: true }
+  ];
+  const resolved = preflightEmittedPaths(repoRoot, candidates);
+  return {
+    entries,
+    outputs: planned.map((out, index) => ({
+      entry: out.entry,
+      content: out.content,
+      absolute: resolved[preceding.length + index].absolute
+    })),
+    routingOnly
+  };
+}
+function preflightRender(repoRoot, harnesses, prospective = [], preceding = []) {
+  prepareRender(repoRoot, harnesses, prospective, preceding);
+}
+function render(repoRoot, harnesses) {
+  const prepared = prepareRender(repoRoot, harnesses);
+  for (const output of prepared.outputs) {
+    mkdirSync2(dirname4(output.absolute), { recursive: true });
+    writeFileSync2(output.absolute, output.content);
+  }
+  writeRoutingBlock(repoRoot, prepared.routingOnly, harnesses);
+  return prepared.entries;
 }
 function writeRoutingBlock(repoRoot, rules, harnesses) {
   if (!harnesses.includes("agents-md")) return;
-  const target = join5(repoRoot, "AGENTS.md");
+  const target = preflightEmittedPaths(repoRoot, [
+    { moduleName: "render", target: "AGENTS.md", shared: true, writeExisting: true }
+  ])[0].absolute;
   if (!existsSync3(target)) return;
   const begin = "<!-- rungs:begin rules-routing -->";
   const end = "<!-- rungs:end rules-routing -->";
@@ -804,7 +1178,7 @@ function writeRoutingBlock(repoRoot, rules, harnesses) {
     ...rules.map((r) => `- \`${r.paths.join("`, `")}\` \u2192 [\`.ai/rules/${r.file}\`](.ai/rules/${r.file})`),
     end
   ].join("\n") : "";
-  const existing = readFileSync4(target, "utf8");
+  const existing = readFileSync5(target, "utf8");
   const beginRe = /^[ \t]*<!--\s*rungs:begin rules-routing\s*-->[ \t]*$/m;
   const endRe = /^[ \t]*<!--\s*rungs:end rules-routing\s*-->[ \t]*$/m;
   const b = existing.match(beginRe);
@@ -844,27 +1218,31 @@ function writeReport(repoRoot, entries, harnesses, stamp) {
     ""
   );
   const content = lines.join("\n");
-  writeFileSync2(join5(repoRoot, ".ai", "render-report.md"), content);
+  const target = preflightEmittedPaths(repoRoot, [
+    { moduleName: "render", target: ".ai/render-report.md", writeExisting: true }
+  ])[0].absolute;
+  writeFileSync2(target, content);
   return content;
 }
 
 // src/check.ts
-import { appendFileSync, existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
+import { appendFileSync, existsSync as existsSync7, readFileSync as readFileSync10, realpathSync as realpathSync2 } from "node:fs";
 import { execSync } from "node:child_process";
-import { dirname as dirname5, join as join10 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { dirname as dirname7, join as join11, resolve as resolve4 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { parse as parse2 } from "smol-toml";
 
 // src/engines.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
-import { join as join9, dirname as dirname4, resolve as resolve2 } from "node:path";
-import { fileURLToPath } from "node:url";
-import { parse as parseToml } from "smol-toml";
+import { existsSync as existsSync6, readFileSync as readFileSync9 } from "node:fs";
+import { join as join10, dirname as dirname6, resolve as resolve3 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { parse as parseToml2 } from "smol-toml";
 
 // src/selftest.ts
 import { mkdirSync as mkdirSync3, mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname5, join as join6 } from "node:path";
 function targetPath(table) {
   const t = Array.isArray(table) ? table[0] ?? {} : table ?? {};
   const pattern = t.file ?? [t.scan ?? []].flat()[0] ?? "**/*.md";
@@ -874,27 +1252,90 @@ function targetPath(table) {
 function build(root, table, fx, input) {
   const write = (rel, body) => {
     const full = join6(root, rel);
-    mkdirSync3(dirname3(full), { recursive: true });
+    mkdirSync3(dirname5(full), { recursive: true });
     writeFileSync3(full, body);
     return rel;
   };
   if (typeof input === "string") return [write(targetPath(table), `${input}
 `)];
   if (!fx || typeof fx !== "object") return null;
+  if (Array.isArray(fx.changed) && Array.isArray(fx.fragments)) {
+    const git2 = (...args2) => execFileSync("git", args2, { cwd: root, stdio: "pipe" }).toString().trim();
+    const changed = fx.changed.map(String);
+    git2("init", "-q", "-b", "main", ".");
+    git2("config", "user.email", "selftest@rungs.local");
+    git2("config", "user.name", "rungs-selftest");
+    const written = [write(".fixture-base", "base\n")];
+    if (changed.length && typeof fx.inherited_exempt === "string") {
+      written.push(write(
+        changed[0],
+        `// ${fx.inherited_exempt}
+export const fixtureState = 'base';
+`
+      ));
+    }
+    git2("add", "--all");
+    git2("commit", "-q", "-m", "base");
+    git2("switch", "-q", "-c", "fixture/change");
+    for (const [index, rel] of changed.entries()) {
+      const evidence = index === 0 && typeof fx.exempt === "string" ? fx.exempt : index === 0 && typeof fx.inherited_exempt === "string" ? fx.inherited_exempt : void 0;
+      const body = evidence ? `// ${evidence}
+export const fixtureState = 'branch';
+` : "fixture change\n";
+      written.push(write(rel, body));
+    }
+    const changelogDir = fx.dir ?? "changelog.d";
+    for (const rel of fx.fragments) {
+      const concrete = String(rel).replace(/\{\{changelog_dir\}\}/g, changelogDir);
+      written.push(write(concrete, "# fixture fragment\n"));
+    }
+    git2("add", "--all");
+    git2("commit", "-q", "-m", "fixture change");
+    return [...new Set(written)];
+  }
   if (fx.packages && typeof fx.packages === "object") {
     return Object.entries(fx.packages).map(
       ([rel, version]) => write(rel, JSON.stringify({ name: rel.replace(/\W/g, "-"), version }))
     );
   }
+  if (fx.versions && typeof fx.versions === "object") {
+    return Object.entries(fx.versions).map(([rel, version]) => {
+      const value = String(version).replace(/"/g, '\\"');
+      if (rel.endsWith(".toml")) return write(rel, `[project]
+version = "${value}"
+`);
+      if (rel.endsWith(".props")) {
+        return write(rel, `<Project><PropertyGroup><Version>${String(version)}</Version></PropertyGroup></Project>
+`);
+      }
+      return write(rel, JSON.stringify({ name: rel.replace(/\W/g, "-"), version }));
+    });
+  }
+  if (fx.version_files && typeof fx.version_files === "object") {
+    return Object.entries(fx.version_files).map(([rel, content]) => write(rel, String(content)));
+  }
   if (Array.isArray(fx.fragments) && typeof fx.version === "string") {
     const dir = fx.dir ?? "changelog.d";
     const written = fx.fragments.map((n) => write(`${dir}/${n}`, `# ${n}
 `));
-    written.push(write("package.json", JSON.stringify({ version: fx.version })));
+    if (fx.version_file === "Directory.Build.props") {
+      written.push(write("Directory.Build.props", `<Project><PropertyGroup><Version>${fx.version}</Version></PropertyGroup></Project>
+`));
+    } else if (fx.version_file === "pyproject.toml") {
+      written.push(write("pyproject.toml", `[project]
+version = "${fx.version}"
+`));
+    } else {
+      written.push(write("package.json", JSON.stringify({ version: fx.version })));
+    }
+    if ("consumed_through" in fx) {
+      written.push(write(`${dir}/CONSUMED_THROUGH`, `${fx.consumed_through}
+`));
+    }
     return written;
   }
   if (typeof fx.matching_files === "number") {
-    const base = fx.location ?? dirname3(targetPath(table));
+    const base = fx.location ?? dirname5(targetPath(table));
     const marker = fx.exempt ? `<!-- ${fx.exempt} -->
 ` : "";
     return Array.from(
@@ -936,10 +1377,11 @@ var CONTEXT_FREE = /* @__PURE__ */ new Set([
   "register-schema",
   "file-population",
   "changelog-freshness",
+  "change-requires-file",
   "computed-claim"
 ]);
 function deparam(spec, dir) {
-  const walk3 = (v) => typeof v === "string" ? v.replace(/\{\{[^}]+\}\}/g, dir) : Array.isArray(v) ? v.map(walk3) : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk3(x)])) : v;
+  const walk3 = (v) => typeof v === "string" ? v.replace(/\{\{changelog_dir\}\}/g, dir) : Array.isArray(v) ? v.map(walk3) : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk3(x)])) : v;
   return walk3(spec);
 }
 function runSelfTests(gateId, engine, table, blocks) {
@@ -959,9 +1401,9 @@ function runSelfTests(gateId, engine, table, blocks) {
       const files = build(root, table, b.fixture, b.input);
       let spec = b.fixture?.opted_in ? Array.isArray(table) ? table.map((s) => ({ ...s, extensions_opted_in: b.fixture.opted_in })) : { ...table, extensions_opted_in: b.fixture.opted_in } : table;
       if (Array.isArray(b.fixture?.fragments)) spec = deparam(spec, b.fixture.dir ?? "changelog.d");
-      if (Array.isArray(b.fixture?.exclude)) {
-        const ex = b.fixture.exclude;
-        spec = Array.isArray(spec) ? spec.map((s) => ({ ...s, exclude: ex })) : { ...spec, exclude: ex };
+      if (Array.isArray(b.fixture?.changed)) {
+        const base = b.fixture.base_branch ?? "main";
+        spec = Array.isArray(spec) ? spec.map((s) => ({ ...s, base_branch: base })) : { ...spec, base_branch: base };
       }
       if (!files) {
         out.push({ gate: gateId, expect, outcome: "unrun", detail: `no builder for fixture ${JSON.stringify(b.fixture).slice(0, 60)}` });
@@ -986,12 +1428,121 @@ function runSelfTests(gateId, engine, table, blocks) {
 }
 
 // src/engines2.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { execFileSync } from "node:child_process";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync4, lstatSync as lstatSync2, readFileSync as readFileSync7 } from "node:fs";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { join as join8 } from "node:path";
+import { TextDecoder } from "node:util";
+
+// src/version-source.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+import { extname, join as join7 } from "node:path";
+import { SaxesParser } from "saxes";
+import { parse as parseToml } from "smol-toml";
+var invalidScalar = (where) => ({
+  ok: false,
+  reason: `${where} is not a non-empty string or finite number`
+});
+function scalar2(value, where) {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed ? { ok: true, value: trimmed } : invalidScalar(where);
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return { ok: true, value: String(value) };
+  }
+  return invalidScalar(where);
+}
+function dottedValue(parsed, path) {
+  if (!path.trim()) return { found: false };
+  let value = parsed;
+  for (const key of path.split(".")) {
+    if (!value || typeof value !== "object" || !Object.hasOwn(value, key)) return { found: false };
+    value = value[key];
+  }
+  return { found: true, value };
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function xmlElement(text, rel, xpath) {
+  const match = /^\/\/([A-Za-z_][A-Za-z0-9_.:-]*)$/.exec(xpath);
+  if (!match) return { ok: false, reason: `unsupported XML xpath '${xpath}'; expected //Element` };
+  const element = match[1];
+  const values = [];
+  const active = [];
+  try {
+    const parser = new SaxesParser({ fragment: false, xmlns: false, fileName: rel });
+    parser.on("doctype", () => {
+      throw new Error("DOCTYPE declarations are not supported in version sources");
+    });
+    parser.on("opentag", (tag) => {
+      for (const index of active) values[index].nested = true;
+      if (tag.name === element) {
+        values.push({ text: "", nested: false });
+        active.push(values.length - 1);
+      }
+    });
+    const append = (value) => {
+      for (const index of active) values[index].text += value;
+    };
+    parser.on("text", append);
+    parser.on("cdata", append);
+    parser.on("closetag", (tag) => {
+      if (tag.name === element) active.pop();
+    });
+    parser.write(text).close();
+  } catch (error) {
+    return { ok: false, reason: `contains invalid XML: ${errorMessage(error)}` };
+  }
+  if (!values.length) return { ok: false, reason: `does not contain configured element '${xpath}'` };
+  if (values.length > 1) {
+    return { ok: false, reason: `configured element '${xpath}' matched ${values.length} values; expected one` };
+  }
+  if (values[0].nested) {
+    return { ok: false, reason: `configured element '${xpath}' contains nested XML; expected scalar text` };
+  }
+  return scalar2(values[0].text, `configured element '${xpath}'`);
+}
+function readVersionSource(root, rel, source) {
+  let text;
+  try {
+    text = readFileSync6(join7(root, rel), "utf8");
+  } catch (error) {
+    return { ok: false, reason: `could not read version source: ${errorMessage(error)}` };
+  }
+  if (source.path && source.xpath) {
+    return { ok: false, reason: "declares both `path` and `xpath`; choose one version lookup" };
+  }
+  if (source.path) {
+    const extension = extname(rel).toLowerCase();
+    let parsed;
+    try {
+      if (extension === ".json") parsed = JSON.parse(text);
+      else if (extension === ".toml") parsed = parseToml(text);
+      else {
+        return {
+          ok: false,
+          reason: `cannot read dotted path '${source.path}' from '${extension || "(no extension)"}'; use JSON or TOML`
+        };
+      }
+    } catch (error) {
+      const format2 = extension === ".toml" ? "TOML" : "JSON";
+      return { ok: false, reason: `contains invalid ${format2}: ${errorMessage(error)}` };
+    }
+    const found = dottedValue(parsed, source.path);
+    if (!found.found) return { ok: false, reason: `does not contain configured path '${source.path}'` };
+    return scalar2(found.value, `configured path '${source.path}'`);
+  }
+  if (source.xpath) {
+    return xmlElement(text, rel, source.xpath);
+  }
+  return { ok: false, reason: "declares neither `path` nor `xpath` for its version value" };
+}
+
+// src/engines2.ts
 var read = (root, rel) => {
   try {
-    return readFileSync5(join7(root, rel), "utf8");
+    return semanticText(readFileSync7(join8(root, rel), "utf8"));
   } catch {
     return "";
   }
@@ -1104,6 +1655,7 @@ var registerSchema = (t, root, files) => {
         }
         for (const row of table.rows) {
           if (Object.values(row).every((v) => !v || v === "\u2014")) continue;
+          if (strip(Object.values(row)[0]) === "\u2014") continue;
           examined++;
           for (const [key, values] of Object.entries(t2.enum ?? {})) {
             const v = strip(row[key]);
@@ -1238,85 +1790,358 @@ var crossReference = (t, root, files) => {
   }
   return { findings, examined: skills.length };
 };
-var gitArgs = (root, args2) => execFileSync("git", args2, { cwd: root, stdio: "pipe" }).toString().trim();
-function landedWork(root, branch, base) {
-  const git2 = (...args2) => gitArgs(root, args2);
+var gitArgs = (root, args2) => execFileSync2("git", args2, { cwd: root, stdio: "pipe" }).toString().trim();
+var parseGitPathList = (output) => output.split("\0").filter(Boolean);
+var gitPaths = (root, args2) => parseGitPathList(execFileSync2("git", args2, { cwd: root, stdio: "pipe" }).toString());
+var gitRefExists = (root, ref) => {
   try {
-    const tip = git2("rev-parse", branch);
-    if (tip === git2("rev-parse", base)) return false;
-    return git2("log", base, "--merges", "--format=%P").split("\n").some((line) => line.trim().split(/\s+/).slice(1).includes(tip));
-  } catch {
+    gitArgs(root, ["show-ref", "--verify", "--quiet", ref]);
     return true;
-  }
-}
-var gitStatusReconcile = (t, root, files) => {
-  const findings = [];
-  let merged;
-  try {
-    merged = new Set(
-      gitArgs(root, ["branch", "--merged", t.integration_branch ?? "main", "--format=%(refname:short)"]).split("\n").map((s) => s.trim()).filter(Boolean)
-    );
   } catch {
-    return { findings: [{ message: "cannot read git branches; status not reconciled" }], examined: 0 };
+    return false;
   }
-  let examined = 0;
-  for (const rel of expand(files, ["docs/**/items/**/*.md"])) {
-    const text = read(root, rel);
-    if (exempted(text, t.exempt_marker)) continue;
-    const branch = text.match(new RegExp(`^${t.branch_field ?? "branch"}:\\s*(\\S+)`, "m"))?.[1];
-    const status = text.match(new RegExp(`^${t.status_field ?? "status"}:\\s*(\\S+)`, "m"))?.[1];
-    if (!branch || !status) continue;
-    examined++;
-    if (merged.has(branch) && (t.pre_review_statuses ?? []).includes(status) && landedWork(root, branch, t.integration_branch ?? "main")) {
-      findings.push({ file: rel, message: `branch ${branch} is merged but status is '${status}'` });
+};
+function resolveIntegrationRef(root, branch) {
+  const local = `refs/heads/${branch}`;
+  if (gitRefExists(root, local)) return { ref: local };
+  const origin = `refs/remotes/origin/${branch}`;
+  if (gitRefExists(root, origin)) return { ref: origin };
+  const remotes = gitArgs(root, ["remote"]).split("\n").map((remote) => remote.trim()).filter((remote) => remote && remote !== "origin");
+  const matches = remotes.map((remote) => `refs/remotes/${remote}/${branch}`).filter((ref) => gitRefExists(root, ref)).sort();
+  if (matches.length === 1) return { ref: matches[0] };
+  if (matches.length > 1) {
+    return {
+      finding: `integration branch '${branch}' is ambiguous across ${matches.join(", ")}`
+    };
+  }
+  return {
+    finding: `integration branch '${branch}' has no local or remote-tracking ref`
+  };
+}
+var matchesAny = (rel, patterns) => (patterns ?? []).some((pattern) => matchAny([rel], pattern).length > 0);
+var patternList = (value, allowEmpty = false) => Array.isArray(value) && (allowEmpty || value.length > 0) && value.every((pattern) => typeof pattern === "string" && pattern.trim().length > 0);
+function wrapperCloseAt(reason, wrapper) {
+  if (!wrapper.close) return -1;
+  if (wrapper.kind !== "quote") return reason.indexOf(wrapper.close);
+  for (let index = 0; index < reason.length; index++) {
+    if (reason[index] === "\\") {
+      index++;
+    } else if (reason[index] === wrapper.close) {
+      return index;
     }
   }
-  return { findings, examined };
-};
-var computedClaim = (t, root, files) => {
-  const specs = Array.isArray(t) ? t : [t];
-  const findings = [];
-  let examined = 0;
-  for (const spec of specs) {
-    const values = /* @__PURE__ */ new Map();
-    const excluded = (rel) => (spec.exclude ?? []).some((p) => matchAny([rel], p).length > 0);
-    for (const src of spec.sources ?? []) {
-      for (const rel of matchAny(files, src.file)) {
-        if (excluded(rel)) continue;
-        const text = read(root, rel);
-        let v;
-        if (src.path && rel.endsWith(".json")) {
-          try {
-            v = src.path.split(".").reduce((o, k) => o?.[k], JSON.parse(text));
-          } catch {
-          }
-        } else if (src.xpath) {
-          v = text.match(new RegExp(`<${src.xpath.split("//")[1]}>(.*?)<`))?.[1];
-        }
-        if (v) {
-          examined++;
-          values.set(rel, String(v));
-        }
+  return -1;
+}
+function exemptionEvidence(text, marker) {
+  const evidence = [];
+  let wrapper = { kind: "plain" };
+  for (let index = 0; index < text.length; index++) {
+    if (text.startsWith(marker, index)) {
+      const reasonAt = index + marker.length;
+      const cr = text.indexOf("\r", reasonAt);
+      const lf = text.indexOf("\n", reasonAt);
+      const lineEnd = cr < 0 ? lf < 0 ? text.length : lf : lf < 0 ? cr : Math.min(cr, lf);
+      const rawTail = text.slice(reasonAt, lineEnd);
+      const leading = rawTail.match(/^[ \t]*/)?.[0].length ?? 0;
+      if (/[\p{L}\p{N}]/u.test(rawTail[leading] ?? "")) {
+        let reason = rawTail.slice(leading);
+        const closeAt = wrapperCloseAt(reason, wrapper);
+        if (closeAt >= 0) reason = reason.slice(0, closeAt);
+        reason = reason.trimEnd();
+        if (reason) evidence.push(reason);
       }
     }
-    const distinct = new Set(values.values());
-    if (spec.rule === "all-agree" && distinct.size > 1) {
-      const where = [...values.entries()].map(([rel, v]) => `${rel}=${v}`).join(", ");
-      findings.push({
-        message: `${spec.id} disagrees across ${values.size} locations: ${where}` + (spec.autofix ? ` \u2014 run \`${spec.autofix}\`` : "") + (spec.exclude?.length ? "" : ". If one of these is versioned independently, list it in `exclude`.")
-      });
+    if (wrapper.kind === "line") {
+      if (text[index] === "\r" || text[index] === "\n") wrapper = { kind: "plain" };
+      continue;
     }
-  }
-  return { findings, examined };
-};
-
-// src/engines3.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join8 } from "node:path";
+    if (wrapper.kind === "block") {
+      if (text.startsWith("*/", index)) {
+        wrapper = { kind: "plain" };
+        index++;
+      }
+      continue;
+    }
+    if (wrapper.kind === "html") {
+      if (text.startsWith("-->", index)) {
+        wrapper = { kind: "plain" };
+        index += 2;
+      }
+      continue;
+    }
+    if (wrapper.kind === "quote") {
+      if (text[index] === "\\") {
+        index++;
+      } else if (text[index] === wrapper.close) {
+        wrapper = { kind: "plain" };
+      }
+      continue;
+    }
+    if (text.startsWith("//", index)) {
+      wrapper = { kind: "line" };
+      index++;
+    } else if (text.startsWith("/*", index)) {
+      wrapper = { kind: "block", close: "*/" };
+      index++;
+    } else if (text.startsWith("<!--", index)) {
+      wrapper = { kind: "html", close: "-->" };
+      index += 3;
+    } else if (text[index] === '"' || text[index] === "'" || text[index] === "`") {
+      wrapper = { kind: "quote", close: text[index] };
+    }
+  }
+  return evidence;
+}
+var utf8 = new TextDecoder("utf-8", { fatal: true });
+function gitTreeEntry(root, treeish, rel) {
+  const output = execFileSync2(
+    "git",
+    ["--literal-pathspecs", "ls-tree", "-z", treeish, "--", rel],
+    { cwd: root, stdio: "pipe" }
+  );
+  if (!output.length) return void 0;
+  const records = output.toString("utf8").split("\0").filter(Boolean);
+  if (records.length !== 1) throw new Error(`unexpected tree entry count for ${rel}`);
+  const match = records[0].match(/^([0-7]{6}) ([a-z]+) ([0-9a-f]+)\t/);
+  if (!match) throw new Error(`cannot parse tree entry for ${rel}`);
+  return { mode: match[1], type: match[2], oid: match[3] };
+}
+function candidateGitModesAreRegular(root, rel) {
+  const output = execFileSync2(
+    "git",
+    ["--literal-pathspecs", "ls-files", "--stage", "-z", "--", rel],
+    { cwd: root, stdio: "pipe" }
+  );
+  const entries = output.toString("utf8").split("\0").filter(Boolean).map((record) => {
+    const match = record.match(/^([0-7]{6}) [0-9a-f]+ ([0-3])\t/);
+    if (!match) throw new Error(`cannot parse index entry for ${rel}`);
+    return { mode: match[1], stage: match[2] };
+  });
+  return entries.length === 0 || entries.length === 1 && entries[0].stage === "0" && ["100644", "100755"].includes(entries[0].mode);
+}
+function candidateExemptionText(root, rel) {
+  let resolved;
+  try {
+    resolved = resolveEmittedPath(root, "release exemption evidence", rel);
+    if (resolved.leafAlias || !lstatSync2(resolved.absolute).isFile()) return void 0;
+  } catch {
+    return void 0;
+  }
+  if (!candidateGitModesAreRegular(root, rel)) return void 0;
+  const attributes = execFileSync2(
+    "git",
+    ["check-attr", "-z", "diff", "text", "binary", "--", rel],
+    { cwd: root, stdio: "pipe" }
+  ).toString().split("\0");
+  for (let index = 0; index + 2 < attributes.length; index += 3) {
+    const attribute = attributes[index + 1];
+    const value = attributes[index + 2];
+    if (attribute === "diff" && value === "unset" || attribute === "binary" && value === "set") {
+      return void 0;
+    }
+  }
+  try {
+    const bytes = readFileSync7(resolved.absolute);
+    if (bytes.includes(0)) return void 0;
+    return utf8.decode(bytes);
+  } catch {
+    return void 0;
+  }
+}
+function inheritedExemptionEvidence(root, mergeBase, marker) {
+  let paths = Buffer.alloc(0);
+  try {
+    paths = execFileSync2(
+      "git",
+      ["grep", "-I", "-l", "-z", "-F", "-e", marker, mergeBase, "--"],
+      { cwd: root, stdio: "pipe" }
+    );
+  } catch (error) {
+    if (error?.status !== 1) throw error;
+    paths = Buffer.isBuffer(error?.stdout) ? error.stdout : Buffer.from(error?.stdout ?? "");
+  }
+  const prefix = `${mergeBase}:`;
+  const inherited = /* @__PURE__ */ new Set();
+  for (const named of utf8.decode(paths).split("\0").filter(Boolean)) {
+    if (!named.startsWith(prefix)) throw new Error("cannot parse historical exemption path");
+    const rel = named.slice(prefix.length);
+    const entry = gitTreeEntry(root, mergeBase, rel);
+    if (!entry || entry.type !== "blob") throw new Error(`cannot resolve historical exemption blob for ${rel}`);
+    const bytes = execFileSync2("git", ["cat-file", "blob", entry.oid], { cwd: root, stdio: "pipe" });
+    if (bytes.includes(0)) throw new Error(`historical exemption blob is not text: ${rel}`);
+    for (const reason of exemptionEvidence(utf8.decode(bytes), marker)) inherited.add(reason);
+  }
+  return inherited;
+}
+function hasBranchLocalExemption(root, mergeBase, changed, marker) {
+  const inherited = inheritedExemptionEvidence(root, mergeBase, marker);
+  return changed.some((rel) => {
+    const text = candidateExemptionText(root, rel);
+    return text !== void 0 && exemptionEvidence(text, marker).some((reason) => !inherited.has(reason));
+  });
+}
+var changeRequiresFile = (t, root) => {
+  if (!patternList(t.require_when_changed) || !patternList(t.requires_one_of)) {
+    return {
+      findings: [{
+        message: "change-requires-file requires non-empty 'require_when_changed' and 'requires_one_of' pattern arrays"
+      }],
+      examined: 0
+    };
+  }
+  if (t.ignore_when_only !== void 0 && !patternList(t.ignore_when_only, true)) {
+    return {
+      findings: [{ message: "change-requires-file 'ignore_when_only' must be an array of non-empty patterns" }],
+      examined: 0
+    };
+  }
+  if (t.exempt_marker !== void 0 && (typeof t.exempt_marker !== "string" || !t.exempt_marker.trim())) {
+    return {
+      findings: [{ message: "change-requires-file 'exempt_marker' must be a non-empty string when configured" }],
+      examined: 0
+    };
+  }
+  const baseName = String(t.base_branch ?? "main");
+  let changed;
+  let mergeBase;
+  let untracked;
+  try {
+    const resolved = resolveIntegrationRef(root, baseName);
+    if (!resolved.ref) {
+      return {
+        findings: [{ message: `${resolved.finding}; required companion file not evaluated` }],
+        examined: 0
+      };
+    }
+    mergeBase = gitArgs(root, ["merge-base", "HEAD", resolved.ref]);
+    untracked = gitPaths(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
+    changed = [.../* @__PURE__ */ new Set([
+      ...gitPaths(root, ["diff", "--name-only", "--no-renames", "-z", mergeBase, "HEAD"]),
+      ...gitPaths(root, ["diff", "--cached", "--name-only", "--no-renames", "-z"]),
+      ...gitPaths(root, ["diff", "--name-only", "--no-renames", "-z"]),
+      ...untracked
+    ])].sort();
+  } catch {
+    return {
+      findings: [{ message: `cannot read git changes against '${baseName}'; required companion file not evaluated` }],
+      examined: 0
+    };
+  }
+  const examined = changed.length;
+  const ignore = t.ignore_when_only;
+  if (ignore?.length && changed.length && changed.every((rel) => matchesAny(rel, ignore))) {
+    return { findings: [], examined };
+  }
+  if (!changed.some((rel) => matchesAny(rel, t.require_when_changed))) {
+    return { findings: [], examined };
+  }
+  const companion = changed.find(
+    (rel) => matchesAny(rel, t.requires_one_of) && existsSync4(join8(root, rel))
+  );
+  if (companion) return { findings: [], examined };
+  if (t.exempt_marker) {
+    try {
+      if (hasBranchLocalExemption(root, mergeBase, changed, t.exempt_marker)) {
+        return { findings: [], examined };
+      }
+    } catch {
+      return {
+        findings: [{ message: `cannot read git exemption provenance against '${baseName}'; required companion file not evaluated` }],
+        examined: 0
+      };
+    }
+  }
+  return {
+    findings: [{ message: String(t.message ?? "changed shipping code requires a companion file").trim() }],
+    examined
+  };
+};
+function landedWork(root, branch, base) {
+  const git2 = (...args2) => gitArgs(root, args2);
+  try {
+    const tip = git2("rev-parse", branch);
+    if (tip === git2("rev-parse", base)) return false;
+    return git2("log", base, "--merges", "--format=%P").split("\n").some((line) => line.trim().split(/\s+/).slice(1).includes(tip));
+  } catch {
+    return true;
+  }
+}
+var gitStatusReconcile = (t, root, files) => {
+  const findings = [];
+  let merged;
+  let integrationRef;
+  try {
+    const integration = String(t.integration_branch ?? "main");
+    const resolved = resolveIntegrationRef(root, integration);
+    if (!resolved.ref) return { findings: [{ message: `${resolved.finding}; status not reconciled` }], examined: 0 };
+    integrationRef = resolved.ref;
+    merged = new Set(
+      gitArgs(root, ["branch", "--merged", integrationRef, "--format=%(refname:short)"]).split("\n").map((s) => s.trim()).filter(Boolean)
+    );
+  } catch {
+    return { findings: [{ message: "cannot read git branches; status not reconciled" }], examined: 0 };
+  }
+  let examined = 0;
+  for (const rel of expand(files, ["docs/**/items/**/*.md"])) {
+    const text = read(root, rel);
+    if (exempted(text, t.exempt_marker)) continue;
+    const branch = text.match(new RegExp(`^${t.branch_field ?? "branch"}:\\s*(\\S+)`, "m"))?.[1];
+    const status = text.match(new RegExp(`^${t.status_field ?? "status"}:\\s*(\\S+)`, "m"))?.[1];
+    if (!branch || !status) continue;
+    examined++;
+    if (merged.has(branch) && (t.pre_review_statuses ?? []).includes(status) && landedWork(root, branch, integrationRef)) {
+      findings.push({ file: rel, message: `branch ${branch} is merged but status is '${status}'` });
+    }
+  }
+  return { findings, examined };
+};
+var computedClaim = (t, root, files) => {
+  const specs = Array.isArray(t) ? t : [t];
+  const findings = [];
+  let examined = 0;
+  for (const spec of specs) {
+    const values = /* @__PURE__ */ new Map();
+    let specExamined = 0;
+    const excludePatterns = (spec.exclude ?? []).filter(
+      (pattern) => typeof pattern === "string" && pattern.trim().length > 0
+    );
+    const excluded = (rel) => excludePatterns.some((pattern) => matchAny([rel], pattern).length > 0);
+    for (const src of spec.sources ?? []) {
+      for (const rel of matchAny(files, src.file)) {
+        if (excluded(rel)) continue;
+        examined++;
+        specExamined++;
+        const result = readVersionSource(root, rel, src);
+        if (!result.ok) {
+          findings.push({ file: rel, message: `${spec.id} version source ${result.reason}` });
+          continue;
+        }
+        values.set(rel, result.value);
+      }
+    }
+    if (specExamined === 0) {
+      findings.push({
+        message: `${spec.id} found no configured version sources; check the source globs and exclusions`
+      });
+    }
+    const distinct = new Set(values.values());
+    if (spec.rule === "all-agree" && distinct.size > 1) {
+      const where = [...values.entries()].map(([rel, v]) => `${rel}=${v}`).join(", ");
+      findings.push({
+        message: `${spec.id} disagrees across ${values.size} locations: ${where}` + (spec.autofix ? ` \u2014 run \`${spec.autofix}\`` : "") + (excludePatterns.length ? "" : ". If one of these is versioned independently, set `release.version_exclude`.")
+      });
+    }
+  }
+  return { findings, examined };
+};
+
+// src/engines3.ts
+import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { join as join9 } from "node:path";
 var read2 = (root, rel) => {
   try {
-    return readFileSync6(join8(root, rel), "utf8");
+    return semanticText(readFileSync8(join9(root, rel), "utf8"));
   } catch {
     return "";
   }
@@ -1335,26 +2160,89 @@ var changelogFreshness = (t, root, files) => {
   const findings = [];
   let examined = 0;
   for (const spec of specs) {
-    const src = spec.version ?? {};
+    const sources = Array.isArray(spec.versions) ? spec.versions : [spec.version ?? { file: "package.json", path: "version" }];
     let current = null;
-    for (const rel of matchAny(files, src.file ?? "package.json")) {
-      try {
-        const raw = (src.path ?? "version").split(".").reduce((o, k) => o?.[k], JSON.parse(read2(root, rel)));
-        current = versionParts(String(raw ?? ""));
-      } catch {
+    let currentSource = "";
+    const versionProblems = [];
+    for (const source of sources) {
+      for (const rel of matchAny(files, source.file ?? "package.json")) {
+        const result = readVersionSource(root, rel, source);
+        if (!result.ok) {
+          versionProblems.push({ file: rel, message: `release version source ${result.reason}` });
+          continue;
+        }
+        const parsed = versionParts(result.value);
+        if (!parsed) {
+          versionProblems.push({
+            file: rel,
+            message: `release version source must contain a three-part numeric version; found ${JSON.stringify(result.value)}`
+          });
+          continue;
+        }
+        current = parsed;
+        if (current) {
+          currentSource = rel;
+          break;
+        }
       }
       if (current) break;
     }
-    if (!current) continue;
+    const marker = spec.consumed_through ?? "changelog.d/CONSUMED_THROUGH";
+    const markerExists = existsSync5(join9(root, marker));
+    if (!markerExists) {
+      findings.push({
+        file: marker,
+        message: `release consumption marker '${marker}' is missing \u2014 create it with 'none' if no release has consumed fragments, or the exact last consumed version`
+      });
+      continue;
+    }
+    examined++;
+    const markerRaw = read2(root, marker);
+    const markerValue = markerRaw.endsWith("\r\n") ? markerRaw.slice(0, -2) : markerRaw.endsWith("\n") ? markerRaw.slice(0, -1) : markerRaw;
+    if (markerValue === "UNINITIALIZED") {
+      findings.push({
+        file: marker,
+        message: `release consumption marker '${marker}' is UNINITIALIZED \u2014 replace it with 'none' if no release has consumed fragments, or the exact last consumed version`
+      });
+      continue;
+    }
+    const firstRelease = markerValue === "none";
+    const consumed = firstRelease || !/^\d+\.\d+\.\d+$/.test(markerValue) ? null : versionParts(markerValue);
+    if (!firstRelease && !consumed) {
+      findings.push({
+        file: marker,
+        message: `release consumption marker '${marker}' must contain exactly 'none' or a three-part numeric version; found ${JSON.stringify(markerValue)}`
+      });
+      continue;
+    }
+    findings.push(...versionProblems);
+    if (!current) {
+      if (consumed) {
+        findings.push({
+          file: sources[0]?.file ?? "package.json",
+          message: `cannot reconcile consumed-through ${markerValue} because none of the declared version sources contains a three-part numeric version`
+        });
+      }
+      continue;
+    }
+    if (consumed && versionCmp(consumed, current) !== 0) {
+      const relation = versionCmp(consumed, current) < 0 ? "below" : "above";
+      findings.push({
+        file: marker,
+        message: `release consumption marker names ${markerValue}, ${relation} version ${current.join(".")} in ${currentSource} \u2014 they must match in a steady tree; advance both during reversible release preparation`
+      });
+    }
     for (const rel of expand2(files, spec.fragments, [])) {
       const name = rel.split("/").pop().replace(/\.md$/, "");
       const v = versionParts(name);
       if (!v) continue;
       examined++;
-      if (versionCmp(v, current) < 0) {
+      const belowPackage = versionCmp(v, current) < 0;
+      const alreadyConsumed = consumed ? versionCmp(v, consumed) <= 0 : false;
+      if (belowPackage || alreadyConsumed) {
         findings.push({
           file: rel,
-          message: spec.message?.trim() || `fragment names ${name}, below the ${current.join(".")} being prepared \u2014 it was consumed by an earlier release and should have been deleted`
+          message: spec.message?.trim() || (alreadyConsumed ? `fragment names ${name}, at or below consumed-through ${markerValue} \u2014 it was already assembled and should have been deleted` : `fragment names ${name}, below package version ${current.join(".")} \u2014 it belongs to an earlier release and should have been deleted`)
         });
       }
     }
@@ -1446,7 +2334,7 @@ var rulePropagation = (t, root, files) => {
 var gitState = (t, root) => {
   let out;
   try {
-    out = execFileSync2("git", ["worktree", "list", "--porcelain"], { cwd: root, stdio: "pipe" }).toString();
+    out = execFileSync3("git", ["worktree", "list", "--porcelain"], { cwd: root, stdio: "pipe" }).toString();
   } catch {
     return { findings: [{ message: "cannot read git worktrees; checkout state unknown" }], examined: 0 };
   }
@@ -1471,7 +2359,7 @@ var mergeDriverCheck = (t, root) => {
   for (const driver of required) {
     let configured = "";
     try {
-      configured = execFileSync2("git", ["config", "--get", `merge.${driver}.driver`], { cwd: root, stdio: "pipe" }).toString().trim();
+      configured = execFileSync3("git", ["config", "--get", `merge.${driver}.driver`], { cwd: root, stdio: "pipe" }).toString().trim();
     } catch {
     }
     if (!configured) {
@@ -1522,11 +2410,55 @@ var boardReconcile = (t, root, _files) => {
   return { findings, examined };
 };
 
+// src/engine-table.ts
+var WHOLE_TABLE = "__whole__";
+var ENGINE_TABLE_KEYS = Object.freeze({
+  "file-budget": "file_budget",
+  sections: "sections",
+  "frontmatter-schema": "frontmatter_schema",
+  "link-integrity": "link_integrity",
+  "file-population": "file_population",
+  "gate-meta": "gate_meta",
+  "id-integrity": WHOLE_TABLE,
+  "render-freshness": "render_freshness",
+  "register-schema": "register_schema",
+  "self-declared-closure": "self_declared_closure",
+  "filename-schema": "filename_schema",
+  "cross-reference": "cross_reference",
+  "git-status-reconcile": "merged_status",
+  "computed-claim": "computed_claim",
+  "term-ownership": "term_ownership",
+  "rule-propagation": "rule_propagation",
+  "git-state": "git_state",
+  "merge-driver-check": "merge_driver_check",
+  "board-reconcile": "board_reconcile",
+  "changelog-freshness": "changelog_freshness",
+  "change-requires-file": "change_requires_file",
+  "shell-safety": "shell_safety"
+});
+var entryMatches = (entry, gateId) => !!entry?.id && gateId.includes(String(entry.id));
+function selectEngineTable(raw, engine, gateId) {
+  if (!Object.prototype.hasOwnProperty.call(ENGINE_TABLE_KEYS, engine)) {
+    throw new Error(`engine '${engine}' has no table-section mapping`);
+  }
+  const key = ENGINE_TABLE_KEYS[engine];
+  if (key === WHOLE_TABLE) return raw;
+  if (!raw || typeof raw !== "object" || !(key in raw)) {
+    throw new Error(`gate '${gateId}' requires table section '${key}' for engine '${engine}'`);
+  }
+  const section = raw[key];
+  if (!Array.isArray(section)) return section;
+  const identified = section.filter((entry) => entry?.id);
+  if (!identified.length) return section;
+  const matched = identified.filter((entry) => entryMatches(entry, gateId));
+  return matched.length ? section.filter((entry) => !entry?.id || entryMatches(entry, gateId)) : section;
+}
+
 // src/engines.ts
-var CLI_MODULES = join9(dirname4(fileURLToPath(import.meta.url)), "..", "modules");
+var CLI_MODULES = join10(dirname6(fileURLToPath2(import.meta.url)), "..", "modules");
 var read3 = (root, rel) => {
   try {
-    return readFileSync7(join9(root, rel), "utf8");
+    return semanticText(readFileSync9(join10(root, rel), "utf8"));
   } catch {
     return "";
   }
@@ -1545,7 +2477,7 @@ var fileBudget = (t, root, files) => {
   const findings = [];
   let examined = 0;
   for (const rel of targets) {
-    if (excluded.has(rel) || !existsSync6(join9(root, rel))) continue;
+    if (excluded.has(rel) || !existsSync6(join10(root, rel))) continue;
     examined++;
     const n = loadedLines(read3(root, rel));
     if (n > t.max_lines) {
@@ -1562,7 +2494,7 @@ var sections = (t, root, files) => {
     const targets = dropGenerated(root, spec.file ? [spec.file] : expand3(files, spec.scan));
     const excluded = new Set(expand3(files, spec.exclude, []));
     for (const rel of targets) {
-      if (excluded.has(rel) || !existsSync6(join9(root, rel))) continue;
+      if (excluded.has(rel) || !existsSync6(join10(root, rel))) continue;
       examined++;
       const text = read3(root, rel);
       const matches = [...text.matchAll(/^(#{1,6})\s+(.+?)\s*$/gm)];
@@ -1643,11 +2575,11 @@ var frontmatterSchema = (t, root, files) => {
   return { findings, examined };
 };
 function resolvesHere(root, rel, href) {
-  const from = dirname4(rel);
+  const from = dirname6(rel);
   const decoded = decodeURIComponent(href);
-  if (existsSync6(resolve2(root, from, decoded))) return true;
+  if (existsSync6(resolve3(root, from, decoded))) return true;
   const stripped = decoded.replace(/:\d+(?::\d+)?$/, "");
-  return stripped !== decoded && existsSync6(resolve2(root, from, stripped));
+  return stripped !== decoded && existsSync6(resolve3(root, from, stripped));
 }
 function backtickedPaths(rel, text, root, hints) {
   const out = [];
@@ -1661,7 +2593,7 @@ function backtickedPaths(rel, text, root, hints) {
     if (!raw.includes("/")) continue;
     if (!/\.[a-z0-9]{1,5}$/i.test(raw)) continue;
     const bare = raw.replace(/^\.\//, "");
-    if (!existsSync6(join9(root, bare)) && !existsSync6(resolve2(root, dirname4(rel), bare))) {
+    if (!existsSync6(join10(root, bare)) && !existsSync6(resolve3(root, dirname6(rel), bare))) {
       out.push({ message: `stale path in a code span \u2192 ${raw}` });
     }
   }
@@ -1714,9 +2646,9 @@ var filePopulation = (t, root, files) => {
 var gateMeta = (_t, root) => {
   const findings = [];
   let unrun = 0;
-  const registry = join9(root, ".ai", "gates.toml");
+  const registry = join10(root, ".ai", "gates.toml");
   if (!existsSync6(registry)) return { findings, examined: 0 };
-  const text = readFileSync7(registry, "utf8");
+  const text = semanticText(readFileSync9(registry, "utf8"));
   const entries = [...text.matchAll(/\[\[gates\]\][\s\S]*?(?=\n\[\[gates\]\]|\n# rungs:end|$)/g)].map((m) => m[0]);
   let examined = 0;
   for (const entry of entries) {
@@ -1725,8 +2657,8 @@ var gateMeta = (_t, root) => {
     const table = entry.match(/^table\s*=\s*"(.+)"/m)?.[1];
     if (!id || kind !== "declared" || !table) continue;
     examined++;
-    const tablePath = join9(CLI_MODULES, dirname4(table), "gates", table.split("/").pop());
-    const src = existsSync6(tablePath) ? readFileSync7(tablePath, "utf8") : "";
+    const tablePath = join10(CLI_MODULES, dirname6(table), "gates", table.split("/").pop());
+    const src = existsSync6(tablePath) ? semanticText(readFileSync9(tablePath, "utf8")) : "";
     const forGate = [...src.matchAll(/\[\[self_test\]\][\s\S]*?(?=\n\[\[|\n\[|$)/g)].map((m) => m[0]).filter((b) => b.includes(`gate   = "${id}"`) || b.includes(`gate    = "${id}"`) || b.includes(`gate = "${id}"`));
     for (const direction of ["pass", "fail"]) {
       if (!forGate.some((b) => new RegExp(`expect\\s*=\\s*"${direction}"`).test(b))) {
@@ -1737,9 +2669,14 @@ var gateMeta = (_t, root) => {
     const parsed = parseTable(tablePath, table.split("/")[0]);
     if (engine && parsed) {
       const blocks = (Array.isArray(parsed.self_test) ? parsed.self_test : []).filter((b) => b?.gate === id).map((b) => ({ expect: String(b.expect), input: b.input, fixture: b.fixture }));
-      for (const r of runSelfTests(id, engine, parsed[tableKeyFor(engine)] ?? parsed, blocks)) {
-        if (r.outcome === "mismatch") findings.push({ message: `self-test for '${id}' ${r.detail}` });
-        else if (r.outcome === "unrun") unrun++;
+      try {
+        const section = selectEngineTable(parsed, engine, id);
+        for (const r of runSelfTests(id, engine, section, blocks)) {
+          if (r.outcome === "mismatch") findings.push({ message: `self-test for '${id}' ${r.detail}` });
+          else if (r.outcome === "unrun") unrun++;
+        }
+      } catch (e) {
+        findings.push({ message: `gate '${id}' table dispatch failed: ${e.message}` });
       }
     }
   }
@@ -1764,30 +2701,11 @@ function parseTable(path, module) {
   try {
     const mods = loadAllModules(CLI_MODULES);
     const params = resolveParams(mods, {}, ".");
-    return parseToml(substitute(readFileSync7(path, "utf8"), module, params));
+    return parseToml2(substitute(semanticText(readFileSync9(path, "utf8")), module, params));
   } catch {
     return null;
   }
 }
-var tableKeyFor = (engine) => ({
-  "file-budget": "file_budget",
-  "frontmatter-schema": "frontmatter_schema",
-  "link-integrity": "link_integrity",
-  "file-population": "file_population",
-  "render-freshness": "render_freshness",
-  "register-schema": "register_schema",
-  "self-declared-closure": "self_declared_closure",
-  "filename-schema": "filename_schema",
-  "cross-reference": "cross_reference",
-  "git-status-reconcile": "merged_status",
-  "computed-claim": "computed_claim",
-  "term-ownership": "term_ownership",
-  "rule-propagation": "rule_propagation",
-  "git-state": "git_state",
-  "merge-driver-check": "merge_driver_check",
-  "board-reconcile": "board_reconcile",
-  "changelog-freshness": "changelog_freshness"
-})[engine] ?? engine;
 var ENGINES = {
   "file-budget": fileBudget,
   sections,
@@ -1808,18 +2726,19 @@ var ENGINES = {
   "git-state": gitState,
   "merge-driver-check": mergeDriverCheck,
   "board-reconcile": boardReconcile,
-  "changelog-freshness": changelogFreshness
+  "changelog-freshness": changelogFreshness,
+  "change-requires-file": changeRequiresFile
 };
 function isImplemented(engine) {
   return engine in ENGINES;
 }
 
 // src/check.ts
-var MODULES = join10(dirname5(fileURLToPath2(import.meta.url)), "..", "modules");
+var MODULES = join11(dirname7(fileURLToPath3(import.meta.url)), "..", "modules");
 function loadRegistry(repoRoot) {
-  const path = join10(repoRoot, ".ai", "gates.toml");
+  const path = join11(repoRoot, ".ai", "gates.toml");
   if (!existsSync7(path)) return { runner: {}, gates: [] };
-  const raw = parse2(readFileSync8(path, "utf8"));
+  const raw = parse2(readFileSync10(path, "utf8"));
   return { runner: raw.runner ?? {}, gates: raw.gates ?? [] };
 }
 function tierSelects(runnerTiers, requested, gateTier) {
@@ -1838,6 +2757,49 @@ var UnknownTierError = class extends Error {
     this.declared = declared;
   }
 };
+function commandText(value) {
+  if (value === void 0 || value === null) return "";
+  return Buffer.isBuffer(value) ? value.toString("utf8") : String(value);
+}
+function normalizeCommandText(value, repoRoot) {
+  let text = commandText(value).replace(/\r\n?/g, "\n").trim();
+  const absolute = resolve4(repoRoot);
+  const roots = [absolute];
+  try {
+    roots.push(realpathSync2.native(absolute));
+  } catch {
+  }
+  const variants = [...new Set(roots.flatMap((root) => [
+    root,
+    root.replaceAll("\\", "/"),
+    root.replaceAll("/", "\\")
+  ]))].sort((left, right) => right.length - left.length);
+  for (const variant of variants) {
+    const escaped = variant.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    text = text.replace(new RegExp(escaped, process.platform === "win32" ? "gi" : "g"), "<repo>");
+  }
+  return text;
+}
+function commandFailure(error, repoRoot) {
+  const stderr = normalizeCommandText(error?.stderr, repoRoot);
+  const stdout = normalizeCommandText(error?.stdout, repoRoot);
+  const fallback = normalizeCommandText(error?.message, repoRoot);
+  const status = typeof error?.status === "number" ? String(error.status) : error?.signal ? `signal ${error.signal}` : "unknown";
+  const streams = [
+    ...stderr ? [`stderr:
+${stderr}`] : [],
+    ...stdout ? [`stdout:
+${stdout}`] : []
+  ];
+  const detail = streams.length ? streams.join("\n") : fallback;
+  const diagnostic = `command exited with status ${status}${detail ? `
+${detail}` : ""}`;
+  return {
+    message: diagnostic,
+    identity: `command:${status}${detail ? `
+${detail}` : ""}`
+  };
+}
 function runGates(repoRoot, tier, now = () => Date.now(), only) {
   const { runner, gates } = loadRegistry(repoRoot);
   const runnerTiers = Array.isArray(runner?.tiers) ? runner.tiers : [];
@@ -1859,7 +2821,7 @@ function runGates(repoRoot, tier, now = () => Date.now(), only) {
         execSync(g.command, { cwd: repoRoot, stdio: "pipe" });
       } catch (e) {
         status = "fail";
-        findings = [{ message: String(e.stderr ?? e.stdout ?? e.message).trim().split("\n").slice(-3).join(" ") }];
+        findings = [commandFailure(e, repoRoot)];
       }
     } else if (!g.engine || !isImplemented(g.engine)) {
       status = "unimplemented";
@@ -1871,12 +2833,7 @@ function runGates(repoRoot, tier, now = () => Date.now(), only) {
         findings = [{ message: `table '${g.table}' not found` }];
       } else {
         try {
-          const key = tableKey(g.engine);
-          let section = table[key] ?? table;
-          if (Array.isArray(section) && section.some((s) => s?.id)) {
-            const mine = section.filter((s) => !s.id || g.id.includes(s.id));
-            if (mine.length) section = mine;
-          }
+          const section = selectEngineTable(table, g.engine, g.id);
           const r = ENGINES[g.engine](section, repoRoot, files);
           findings = r.findings;
           examined = r.examined;
@@ -1905,10 +2862,10 @@ function runGates(repoRoot, tier, now = () => Date.now(), only) {
 function loadTable(ref, repoRoot) {
   if (!ref) return null;
   const [mod, file] = ref.split("/");
-  const path = join10(MODULES, mod, "gates", file);
+  const path = join11(MODULES, mod, "gates", file);
   if (!existsSync7(path)) return null;
   try {
-    return parse2(substitute(readFileSync8(path, "utf8"), mod, installedParams(repoRoot)));
+    return parse2(substitute(readFileSync10(path, "utf8"), mod, installedParams(repoRoot)));
   } catch {
     return null;
   }
@@ -1917,10 +2874,10 @@ var paramCache = null;
 function installedParams(repoRoot) {
   if (paramCache?.root === repoRoot) return paramCache.params;
   const defaults = resolveParams(loadAllModules(MODULES), {}, repoRoot);
-  const recordPath = join10(repoRoot, ".ai", "rungs.toml");
+  const recordPath = join11(repoRoot, ".ai", "rungs.toml");
   if (existsSync7(recordPath)) {
     try {
-      const rec = parse2(readFileSync8(recordPath, "utf8"));
+      const rec = parse2(readFileSync10(recordPath, "utf8"));
       for (const [name, entry] of Object.entries(rec.modules ?? {})) {
         if (entry?.params) defaults[name] = { ...defaults[name] ?? {}, ...entry.params };
       }
@@ -1930,38 +2887,17 @@ function installedParams(repoRoot) {
   paramCache = { root: repoRoot, params: defaults };
   return defaults;
 }
-var tableKey = (engine) => ({
-  "file-budget": "file_budget",
-  sections: "sections",
-  "frontmatter-schema": "frontmatter_schema",
-  "link-integrity": "link_integrity",
-  "file-population": "file_population",
-  "gate-meta": "gate_meta",
-  "id-integrity": "__whole__",
-  "render-freshness": "render_freshness",
-  "register-schema": "register_schema",
-  "self-declared-closure": "self_declared_closure",
-  "filename-schema": "filename_schema",
-  "cross-reference": "cross_reference",
-  "git-status-reconcile": "merged_status",
-  "computed-claim": "computed_claim",
-  "term-ownership": "term_ownership",
-  "rule-propagation": "rule_propagation",
-  "git-state": "git_state",
-  "merge-driver-check": "merge_driver_check",
-  "board-reconcile": "board_reconcile"
-})[engine] ?? engine;
 function appendLedger(repoRoot, runs, stamp) {
   const { runner } = loadRegistry(repoRoot);
   if (runner.ledger === false) return;
-  const path = join10(repoRoot, ".ai", ".gate-ledger.jsonl");
+  const path = join11(repoRoot, ".ai", ".gate-ledger.jsonl");
   const lines = runs.map((r) => JSON.stringify({ at: stamp, id: r.id, status: r.status, ms: r.ms, examined: r.examined })).join("\n");
   appendFileSync(path, lines + "\n");
 }
 function ledgerQuestions(repoRoot, gates) {
-  const path = join10(repoRoot, ".ai", ".gate-ledger.jsonl");
+  const path = join11(repoRoot, ".ai", ".gate-ledger.jsonl");
   if (!existsSync7(path)) return { neverFired: [], alwaysFires: [], runs: 0 };
-  const rows = readFileSync8(path, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
+  const rows = readFileSync10(path, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
   const by = /* @__PURE__ */ new Map();
   for (const r of rows) {
     const e = by.get(r.id) ?? { total: 0, failed: 0 };
@@ -1976,12 +2912,12 @@ function ledgerQuestions(repoRoot, gates) {
 }
 
 // src/lifecycle.ts
-import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname6, join as join11 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname8, join as join12 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { execFileSync as execFileSync4 } from "node:child_process";
 import { parse as parse3 } from "smol-toml";
-var SRC = dirname6(fileURLToPath3(import.meta.url));
+var SRC = dirname8(fileURLToPath4(import.meta.url));
 var PROFILES = {
   minimal: ["instructions"],
   tracked: ["instructions", "gates", "backlog", "findings", "adr", "session"],
@@ -1990,10 +2926,18 @@ var PROFILES = {
   fleet: ["instructions", "gates", "backlog", "findings", "adr", "session", "ci", "specs", "workflows", "skills", "audit", "release", "doc-authority", "concurrency", "design-sync"]
 };
 function readRecord(repoRoot) {
-  const p = join11(repoRoot, ".ai", "rungs.toml");
+  const resolved = resolveEmittedPath(repoRoot, "rungs", ".ai/rungs.toml");
+  if (resolved.leafAlias) {
+    throw new UnsafeEmittedPathError(
+      "rungs",
+      ".ai/rungs.toml",
+      "the install record is a symlink or junction leaf and will not be used as configuration"
+    );
+  }
+  const p = resolved.absolute;
   if (!existsSync8(p)) return null;
   try {
-    const raw = parse3(readFileSync9(p, "utf8"));
+    const raw = parse3(readFileSync11(p, "utf8"));
     return { harnesses: raw.repo?.harnesses ?? [], modules: raw.modules ?? {} };
   } catch {
     return null;
@@ -2003,20 +2947,26 @@ function planUpgrade(repoRoot, mods, record) {
   const params = resolveParams(mods, paramsFrom(record), repoRoot);
   const skillsDir = record.harnesses.includes("claude") ? ".claude/skills" : ".agents/skills";
   const items = [];
-  for (const mod of mods) {
+  const installedMods = mods.filter((mod) => record.modules[mod.name]);
+  preflightModuleEmissions(installedMods, repoRoot, params, skillsDir);
+  for (const mod of installedMods) {
     const installed = record.modules[mod.name];
-    if (!installed) continue;
     const emitted = emittedFiles(mod, params, skillsDir);
     const files = [];
     const kept = new Set(installed.kept?.files ?? []);
     for (const [rel, wouldEmit] of emitted) {
       if (kept.has(rel)) continue;
-      const full = join11(repoRoot, rel);
+      const resolved = resolveEmittedPath(repoRoot, mod.name, rel);
+      const full = resolved.absolute;
+      if (resolved.leafAlias) {
+        files.push({ rel, state: "diverged" });
+        continue;
+      }
       if (!existsSync8(full)) {
         files.push({ rel, state: "missing" });
         continue;
       }
-      const onDisk = contentHash(readFileSync9(full, "utf8"));
+      const onDisk = contentHash(readFileSync11(full, "utf8"));
       const recorded = installed.hashes?.[rel];
       if (onDisk === contentHash(wouldEmit)) files.push({ rel, state: "current" });
       else if (recorded && onDisk === recorded) files.push({ rel, state: "stale" });
@@ -2029,23 +2979,51 @@ function planUpgrade(repoRoot, mods, record) {
 function applyUpgrade(repoRoot, mods, record, plan) {
   const params = resolveParams(mods, paramsFrom(record), repoRoot);
   const skillsDir = record.harnesses.includes("claude") ? ".claude/skills" : ".agents/skills";
+  const prepared = plan.map((item) => {
+    const mod = mods.find((candidate) => candidate.name === item.module);
+    if (!mod) throw new Error(`upgrade plan names unknown module '${item.module}'`);
+    const emitted = emittedFiles(mod, params, skillsDir);
+    const files = item.files.map((file) => {
+      const resolved = resolveEmittedPath(repoRoot, mod.name, file.rel);
+      if ((file.state === "stale" || file.state === "missing") && resolved.leafAlias) {
+        throw new UnsafeEmittedPathError(
+          mod.name,
+          file.rel,
+          "the destination is a symlink or junction leaf and upgrade will not write through it"
+        );
+      }
+      if ((file.state === "stale" || file.state === "missing") && !emitted.has(resolved.target)) {
+        throw new Error(`module '${mod.name}' upgrade plan names target '${file.rel}' that the module does not emit`);
+      }
+      return { ...file, target: resolved.target, absolute: resolved.absolute };
+    });
+    return { item, mod, emitted, files };
+  });
+  const writable = new Set(
+    prepared.flatMap(
+      ({ mod, files }) => files.filter((file) => file.state === "stale" || file.state === "missing").map((file) => `${mod.name}\0${file.target}`)
+    )
+  );
+  preflightEmittedPaths(repoRoot, [
+    ...moduleEmissionCandidates(prepared.map(({ mod }) => mod), params, skillsDir).map(
+      (candidate) => writable.has(`${candidate.moduleName}\0${candidate.target}`) ? { ...candidate, writeExisting: true } : candidate
+    ),
+    { moduleName: prepared[0]?.mod.name ?? "upgrade", target: ".ai/rungs.toml", writeExisting: true }
+  ]);
   let written = 0;
   const rewritten = /* @__PURE__ */ new Map();
-  for (const item of plan) {
-    const mod = mods.find((m) => m.name === item.module);
-    const emitted = emittedFiles(mod, params, skillsDir);
-    for (const f of item.files) {
+  for (const { mod, emitted, files } of prepared) {
+    for (const f of files) {
       if (f.state !== "stale" && f.state !== "missing") continue;
-      const full = join11(repoRoot, f.rel);
-      const content = emitted.get(f.rel);
-      mkdirSync4(dirname6(full), { recursive: true });
-      writeFileSync4(full, content);
+      const content = emitted.get(f.target);
+      mkdirSync4(dirname8(f.absolute), { recursive: true });
+      writeFileSync4(f.absolute, content);
       if (!rewritten.has(mod.name)) rewritten.set(mod.name, /* @__PURE__ */ new Map());
-      rewritten.get(mod.name).set(f.rel, contentHash(content));
+      rewritten.get(mod.name).set(f.target, contentHash(content));
       written++;
     }
   }
-  const upgraded = plan.map((p) => mods.find((m) => m.name === p.module)).filter(Boolean);
+  const upgraded = prepared.map(({ mod }) => mod);
   const gateActions = upgraded.length ? registerGates(upgraded, repoRoot, false) : [];
   const recorded = updateRecordAfterUpgrade(
     repoRoot,
@@ -2054,9 +3032,13 @@ function applyUpgrade(repoRoot, mods, record, plan) {
   return { written, gates: gateActions.length, recorded };
 }
 function updateRecordAfterUpgrade(repoRoot, updates) {
-  const path = join11(repoRoot, ".ai", "rungs.toml");
+  const path = preflightEmittedPaths(repoRoot, [
+    { moduleName: updates[0]?.module ?? "upgrade", target: ".ai/rungs.toml", writeExisting: true }
+  ])[0].absolute;
   if (!existsSync8(path) || !updates.length) return 0;
-  const lines = readFileSync9(path, "utf8").split("\n");
+  const original = readFileSync11(path, "utf8");
+  const newline = original.match(/\r\n|\r|\n/)?.[0] ?? "\n";
+  const lines = semanticText(original).split("\n");
   const byModule = new Map(updates.map((u) => [u.module, u]));
   let changed = 0;
   let current = null;
@@ -2078,14 +3060,16 @@ function updateRecordAfterUpgrade(repoRoot, updates) {
       const entry = /^"([^"]+)"\s*=/.exec(line);
       const replacement = entry && byModule.get(current.module).hashes.get(entry[1]);
       if (replacement) {
-        out.push(`"${entry[1]}" = "${replacement}"`);
-        changed++;
+        const next = `"${entry[1]}" = "${replacement}"`;
+        if (next !== line) changed++;
+        out.push(next);
         continue;
       }
     }
     out.push(line);
   }
-  writeFileSync4(path, out.join("\n"));
+  const updated = out.join(newline);
+  if (changed > 0 && updated !== original) writeFileSync4(path, updated);
   return changed;
 }
 function paramsFrom(record) {
@@ -2096,8 +3080,8 @@ function paramsFrom(record) {
   return out;
 }
 function eject(repoRoot, mods, dryRun = false) {
-  const dest = join11(repoRoot, ".rungs");
-  const engines = ["glob.ts", "engines.ts", "engines2.ts"];
+  const dest = join12(repoRoot, ".rungs");
+  const engines = ["glob.ts", "text.ts", "engine-table.ts", "engines.ts", "engines2.ts"];
   const { gates } = loadRegistry(repoRoot);
   const declared = gates.filter((g) => g.kind === "declared" && g.table);
   const tables = [...new Set(declared.map((g) => g.table))];
@@ -2106,24 +3090,24 @@ function eject(repoRoot, mods, dryRun = false) {
   for (const t of tables) actions.push(`.rungs/tables/${t.replace("/", "-").replace(/.toml$/, ".json")}`);
   actions.push(".rungs/run-gate.mjs", ".ai/gates.toml (rewritten to command gates)");
   if (dryRun) return { actions, gates: declared.length };
-  mkdirSync4(join11(dest, "tables"), { recursive: true });
-  for (const f of engines) copyFileSync(join11(SRC, f), join11(dest, f));
+  mkdirSync4(join12(dest, "tables"), { recursive: true });
+  for (const f of engines) copyFileSync(join12(SRC, f), join12(dest, f));
   const record = readRecord(repoRoot);
   const params = resolveParams(mods, record ? paramsFrom(record) : {}, repoRoot);
   for (const t of tables) {
     const [mod, file] = t.split("/");
-    const src = join11(SRC, "..", "modules", mod, "gates", file);
+    const src = join12(SRC, "..", "modules", mod, "gates", file);
     if (!existsSync8(src)) continue;
     try {
-      const parsed = parse3(substitute(readFileSync9(src, "utf8"), mod, params));
-      writeFileSync4(join11(dest, "tables", `${mod}-${file.replace(/\.toml$/, ".json")}`), JSON.stringify(parsed, null, 2));
+      const parsed = parse3(substitute(readFileSync11(src, "utf8"), mod, params));
+      writeFileSync4(join12(dest, "tables", `${mod}-${file.replace(/\.toml$/, ".json")}`), JSON.stringify(parsed, null, 2));
     } catch {
     }
   }
-  writeFileSync4(join11(dest, "run-gate.mjs"), RUNNER);
-  writeFileSync4(join11(dest, "README.md"), EJECT_README);
-  const registry = join11(repoRoot, ".ai", "gates.toml");
-  let text = readFileSync9(registry, "utf8");
+  writeFileSync4(join12(dest, "run-gate.mjs"), RUNNER);
+  writeFileSync4(join12(dest, "README.md"), EJECT_README);
+  const registry = join12(repoRoot, ".ai", "gates.toml");
+  let text = readFileSync11(registry, "utf8");
   for (const g of declared) {
     text = text.replace(
       new RegExp(`(id\\s*=\\s*"${g.id}"[\\s\\S]*?)kind\\s*=\\s*"declared"`),
@@ -2143,6 +3127,7 @@ import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ENGINES } from './engines.ts';
+import { selectEngineTable } from './engine-table.ts';
 import { walk } from './glob.ts';
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -2159,12 +3144,7 @@ if (!engine || !ENGINES[engine]) { console.error(\`gate \${id}: engine '\${engin
 // Tables were converted to JSON when this was ejected, so nothing here needs a
 // TOML parser \u2014 or any dependency at all beyond Node itself.
 const raw = JSON.parse(readFileSync(join(here, 'tables', table.replace('/', '-').replace(/\\.toml$/, '.json')), 'utf8'));
-const KEYS = { 'file-budget': 'file_budget', 'frontmatter-schema': 'frontmatter_schema', 'link-integrity': 'link_integrity', 'file-population': 'file_population', 'gate-meta': 'gate_meta', 'render-freshness': 'render_freshness', 'register-schema': 'register_schema', 'self-declared-closure': 'self_declared_closure', 'filename-schema': 'filename_schema', 'cross-reference': 'cross_reference', 'git-status-reconcile': 'merged_status', 'computed-claim': 'computed_claim' };
-let section = raw[KEYS[engine] ?? engine] ?? raw;
-if (Array.isArray(section) && section.some((s) => s?.id)) {
-  const mine = section.filter((s) => !s.id || id.includes(s.id));
-  if (mine.length) section = mine;
-}
+const section = selectEngineTable(raw, engine, id);
 const r = ENGINES[engine](section, root, walk(root));
 for (const f of r.findings) console.error(\`  \${f.file ? f.file + ': ' : ''}\${f.message}\`);
 process.exit(r.findings.length ? 1 : 0);
@@ -2185,17 +3165,17 @@ itself to whoever finds it.
 To go back, delete this directory and re-run \`rungs add\`.
 `;
 function setupGit(repoRoot, dryRun = false) {
-  const attrs = join11(repoRoot, ".gitattributes");
+  const attrs = join12(repoRoot, ".gitattributes");
   if (!existsSync8(attrs)) return { drivers: [], rerere: false };
-  const drivers = [...new Set([...readFileSync9(attrs, "utf8").matchAll(/merge=(rungs-[\w-]+)/g)].map((m) => m[1]))];
+  const drivers = [...new Set([...readFileSync11(attrs, "utf8").matchAll(/merge=(rungs-[\w-]+)/g)].map((m) => m[1]))];
   const done = [];
   for (const d of drivers) {
     const cmd2 = d === "rungs-generated" ? `node -e "process.stderr.write('refusing to text-merge a generated artifact; regenerate it instead
 ');process.exit(1)"` : "git merge-file -L ours -L base -L theirs %A %O %B";
     if (!dryRun) {
       try {
-        execFileSync3("git", ["config", `merge.${d}.name`, `rungs ${d.replace("rungs-", "")} driver`], { cwd: repoRoot, stdio: "pipe" });
-        execFileSync3("git", ["config", `merge.${d}.driver`, cmd2], { cwd: repoRoot, stdio: "pipe" });
+        execFileSync4("git", ["config", `merge.${d}.name`, `rungs ${d.replace("rungs-", "")} driver`], { cwd: repoRoot, stdio: "pipe" });
+        execFileSync4("git", ["config", `merge.${d}.driver`, cmd2], { cwd: repoRoot, stdio: "pipe" });
       } catch {
         continue;
       }
@@ -2205,7 +3185,7 @@ function setupGit(repoRoot, dryRun = false) {
   let rerere = false;
   if (!dryRun) {
     try {
-      execFileSync3("git", ["config", "rerere.enabled", "true"], { cwd: repoRoot, stdio: "pipe" });
+      execFileSync4("git", ["config", "rerere.enabled", "true"], { cwd: repoRoot, stdio: "pipe" });
       rerere = true;
     } catch {
     }
@@ -2252,12 +3232,7 @@ function explainWith(engines, mods, results, repoRoot, files) {
         continue;
       }
       try {
-        const key = tableKey(g.engine);
-        let section = table[key] ?? table;
-        if (Array.isArray(section) && section.some((s) => s?.id)) {
-          const mine = section.filter((s) => !s.id || g.id.includes(s.id));
-          if (mine.length) section = mine;
-        }
+        const section = selectEngineTable(table, g.engine, g.id);
         const r = engines[g.engine](section, repoRoot, files);
         if (r.findings.length) {
           reported.push({ module: mod.name, gate: g.id, why: g.why, findings: r.findings, examined: r.examined });
@@ -2286,32 +3261,71 @@ function collapseDuplicates(reported) {
 }
 
 // src/backlog.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync10, renameSync, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname7, join as join12, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import {
+  existsSync as existsSync9,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync12,
+  realpathSync as realpathSync3,
+  renameSync,
+  statSync as statSync5,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { dirname as dirname9, isAbsolute as isAbsolute2, join as join13, relative as relative3, resolve as resolve5, sep as sep3 } from "node:path";
+var ARCHIVE_OPERATION = "backlog archive";
+var missingEntry2 = (error) => error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+function existingDirectory(path) {
+  try {
+    if (!statSync5(path.absolute).isDirectory()) {
+      throw new UnsafeEmittedPathError(ARCHIVE_OPERATION, path.target, "the existing archive tree entry is not a directory");
+    }
+    return true;
+  } catch (error) {
+    if (error instanceof UnsafeEmittedPathError) throw error;
+    if (missingEntry2(error)) return false;
+    throw new UnsafeEmittedPathError(ARCHIVE_OPERATION, path.target, "the archive tree entry cannot be inspected");
+  }
+}
+function resolveArchiveTree(repoRoot, backlogRoot = "docs/backlog") {
+  const [items, archive] = preflightEmittedPaths(repoRoot, [
+    { moduleName: ARCHIVE_OPERATION, target: `${backlogRoot}/items` },
+    { moduleName: ARCHIVE_OPERATION, target: `${backlogRoot}/archive` }
+  ]);
+  const suffix = "/items";
+  const root = items.target.slice(0, -suffix.length);
+  return {
+    root,
+    items,
+    archive,
+    itemsExists: existingDirectory(items),
+    archiveExists: existingDirectory(archive)
+  };
+}
 var FINISHED = /* @__PURE__ */ new Set(["done", "rejected"]);
 var field = (text, name) => text.match(new RegExp(`^${name}:\\s*(\\S+)`, "m"))?.[1] ?? "";
-var posix = (p) => p.split(sep2).join("/");
+var posix = (p) => p.split(sep3).join("/");
 var LINK = /\]\((?!https?:|#|mailto:)([^)\s#]+)((?:#[^)\s]*)?)\)/g;
 function planArchive(repoRoot, backlogRoot = "docs/backlog") {
-  const itemsDir = join12(repoRoot, ...backlogRoot.split("/"), "items");
-  const archiveDir = join12(repoRoot, ...backlogRoot.split("/"), "archive");
+  const tree = resolveArchiveTree(repoRoot, backlogRoot);
   const moves = [];
   const held = [];
-  const files = walk(repoRoot);
-  const items = files.filter((f) => posix(f).startsWith(posix(relative2(repoRoot, itemsDir)) + "/") && f.endsWith(".md"));
+  if (!tree.itemsExists) return { root: tree.root, moves, rewrites: [], held };
+  const beneath = (directory) => walk(directory.absolute).filter((file) => file.endsWith(".md")).map((file) => `${directory.target}/${posix(file)}`).sort();
+  const items = beneath(tree.items);
+  const archived = tree.archiveExists ? beneath(tree.archive) : [];
   for (const rel of items) {
     const base = posix(rel).split("/").pop();
     if (/^(README|TEMPLATE)\.md$/i.test(base)) continue;
-    const text = readFileSync10(join12(repoRoot, rel), "utf8");
+    const source = resolveEmittedPath(repoRoot, ARCHIVE_OPERATION, rel);
+    const text = readFileSync12(source.absolute, "utf8");
     const status = field(text, "status");
     const id = field(text, "id");
     if (!FINISHED.has(status)) continue;
     if (field(text, "type") === "epic") {
       const children = (text.match(/^children:\s*\[(.*)\]/m)?.[1] ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-      const archived = files.filter((f) => posix(f).startsWith(posix(relative2(repoRoot, archiveDir)) + "/") && f.endsWith(".md"));
       const unfinished = children.filter((c2) => {
         const f = items.find((i) => i.includes(`${c2}-`)) ?? archived.find((i) => i.includes(`${c2}-`));
-        return !f || !FINISHED.has(field(readFileSync10(join12(repoRoot, f), "utf8"), "status"));
+        return !f || !FINISHED.has(field(readFileSync12(resolveEmittedPath(repoRoot, ARCHIVE_OPERATION, f).absolute, "utf8"), "status"));
       });
       if (unfinished.length) {
         held.push({ file: rel, reason: `epic with unfinished children: ${unfinished.join(", ")}` });
@@ -2322,67 +3336,238 @@ function planArchive(repoRoot, backlogRoot = "docs/backlog") {
       id,
       status,
       from: rel,
-      to: posix(join12(relative2(repoRoot, archiveDir), posix(rel).split("/").pop()))
+      to: `${tree.archive.target}/${posix(rel).split("/").pop()}`
     });
   }
-  const moved = new Map(moves.map((m) => [resolve3(repoRoot, m.from), m.to]));
-  const rewrites = [];
-  for (const rel of files) {
-    if (!isRewritable(rel)) continue;
-    const links = retargets(repoRoot, rel, moved).length;
-    if (links || moved.has(resolve3(repoRoot, rel))) rewrites.push({ file: rel, links });
-  }
-  return { root: backlogRoot, moves, rewrites, held };
+  const provisional = { root: tree.root, moves, rewrites: [], held };
+  const prepared = prepareArchive(repoRoot, provisional);
+  return {
+    ...provisional,
+    rewrites: prepared.rewrites.map(({ file, links }) => ({ file, links }))
+  };
 }
 function isRewritable(rel) {
   const p = posix(rel);
   if (!p.endsWith(".md")) return false;
   return !/^modules\/[^/]+\/(files|fragments)\//.test(p) && !p.startsWith("node_modules/");
 }
-function retargets(repoRoot, rel, moved) {
-  const oldDir = dirname7(resolve3(repoRoot, rel));
-  const selfMoved = moved.get(resolve3(repoRoot, rel));
-  const newDir = dirname7(resolve3(repoRoot, selfMoved ?? rel));
-  const out = [];
-  for (const m of readFileSync10(join12(repoRoot, rel), "utf8").matchAll(LINK)) {
-    const href = m[1];
-    if (href.includes("{{")) continue;
-    const target = resolve3(oldDir, decodeURIComponent(href));
-    const targetMoved = moved.get(target);
+function retargets(repoRoot, rel, moved, source = readFileSync12(join13(repoRoot, ...rel.split("/")), "utf8")) {
+  const oldDir = dirname9(resolve5(repoRoot, rel));
+  const movedDestination = (path) => {
+    const lexical = moved.get(path);
+    if (lexical) return lexical;
+    try {
+      return moved.get(realpathSync3.native(path));
+    } catch {
+      return void 0;
+    }
+  };
+  const selfMoved = movedDestination(resolve5(repoRoot, rel));
+  const newDir = dirname9(resolve5(repoRoot, selfMoved ?? rel));
+  const out = [];
+  for (const m of source.matchAll(LINK)) {
+    const href = m[1];
+    if (href.includes("{{")) continue;
+    const target = resolve5(oldDir, decodeURIComponent(href));
+    const targetMoved = movedDestination(target);
     if (!targetMoved && !selfMoved) continue;
     if (!targetMoved && !existsSync9(target)) continue;
-    const targetNew = targetMoved ? resolve3(repoRoot, targetMoved) : target;
-    const to = posix(relative2(newDir, targetNew));
+    const targetNew = targetMoved ? resolve5(repoRoot, targetMoved) : target;
+    const to = posix(relative3(newDir, targetNew));
     if (to !== posix(href)) out.push({ href, to });
   }
   return out;
 }
-function applyArchive(repoRoot, plan) {
-  const moved = new Map(plan.moves.map((m) => [resolve3(repoRoot, m.from), m.to]));
-  for (const rel of walk(repoRoot)) {
-    if (!isRewritable(rel)) continue;
-    const edits = retargets(repoRoot, rel, moved);
-    if (!edits.length) continue;
-    const path = join12(repoRoot, rel);
-    let text = readFileSync10(path, "utf8");
-    text = text.replace(LINK, (whole, href, anchor) => {
-      const edit = edits.find((e) => e.href === href);
-      return edit ? `](${edit.to}${anchor})` : whole;
-    });
-    writeFileSync5(path, text);
+function requireRegularFile(path, purpose) {
+  if (path.leafAlias) {
+    throw new UnsafeEmittedPathError(
+      ARCHIVE_OPERATION,
+      path.target,
+      `the ${purpose} is a symlink or junction leaf`
+    );
+  }
+  try {
+    if (!lstatSync3(path.absolute).isFile()) {
+      throw new UnsafeEmittedPathError(ARCHIVE_OPERATION, path.target, `the ${purpose} is not a regular file`);
+    }
+  } catch (error) {
+    if (error instanceof UnsafeEmittedPathError) throw error;
+    if (missingEntry2(error)) {
+      throw new UnsafeEmittedPathError(ARCHIVE_OPERATION, path.target, `the ${purpose} no longer exists`);
+    }
+    throw new UnsafeEmittedPathError(ARCHIVE_OPERATION, path.target, `the ${purpose} cannot be inspected`);
+  }
+}
+function requireMissingDestination(path) {
+  if (path.leafAlias) {
+    throw new UnsafeEmittedPathError(
+      ARCHIVE_OPERATION,
+      path.target,
+      "the archive destination is an existing symlink or junction leaf"
+    );
+  }
+  try {
+    lstatSync3(path.absolute);
+    throw new UnsafeEmittedPathError(ARCHIVE_OPERATION, path.target, "the archive destination already exists");
+  } catch (error) {
+    if (error instanceof UnsafeEmittedPathError) throw error;
+    if (!missingEntry2(error)) {
+      throw new UnsafeEmittedPathError(ARCHIVE_OPERATION, path.target, "the archive destination cannot be inspected");
+    }
+  }
+}
+function requireCanonicalDescendant(directory, path, purpose) {
+  const fromDirectory = relative3(directory.absolute, path.absolute);
+  if (!fromDirectory || fromDirectory === ".." || fromDirectory.startsWith(`..${sep3}`) || isAbsolute2(fromDirectory)) {
+    throw new UnsafeEmittedPathError(
+      ARCHIVE_OPERATION,
+      path.target,
+      `the ${purpose} resolves outside the canonical '${directory.target}' tree`
+    );
+  }
+}
+function prepareMoves(repoRoot, plan, tree) {
+  if (plan.root !== tree.root) {
+    throw new UnsafeEmittedPathError(
+      ARCHIVE_OPERATION,
+      plan.root,
+      `the plan root does not match its normalized archive root '${tree.root}'`
+    );
+  }
+  const itemsPrefix = `${tree.items.target}/`;
+  const archivePrefix = `${tree.archive.target}/`;
+  for (const move of plan.moves) {
+    if (!move.from.startsWith(itemsPrefix)) {
+      throw new UnsafeEmittedPathError(
+        ARCHIVE_OPERATION,
+        move.from,
+        `an archive source must be below '${tree.items.target}'`
+      );
+    }
+    const expected = `${archivePrefix}${move.from.split("/").pop()}`;
+    if (move.to !== expected) {
+      throw new UnsafeEmittedPathError(
+        ARCHIVE_OPERATION,
+        move.to,
+        `the archive destination for '${move.from}' must be '${expected}'`
+      );
+    }
+  }
+  const resolved = preflightEmittedPaths(
+    repoRoot,
+    plan.moves.flatMap((move) => [
+      { moduleName: ARCHIVE_OPERATION, target: move.from },
+      { moduleName: ARCHIVE_OPERATION, target: move.to }
+    ])
+  );
+  return plan.moves.map((move, index) => {
+    const from = resolved[index * 2];
+    const to = resolved[index * 2 + 1];
+    requireCanonicalDescendant(tree.items, from, "archive source");
+    requireCanonicalDescendant(tree.archive, to, "archive destination");
+    requireRegularFile(from, "archive source");
+    requireMissingDestination(to);
+    const source = readFileSync12(from.absolute, "utf8");
+    if (field(source, "id") !== move.id || field(source, "status") !== move.status || !FINISHED.has(move.status)) {
+      throw new UnsafeEmittedPathError(
+        ARCHIVE_OPERATION,
+        move.from,
+        "the archive plan is stale or does not match the source item frontmatter"
+      );
+    }
+    return { move, from, to };
+  });
+}
+function preparedText(source, edits) {
+  return source.replace(LINK, (whole, href, anchor) => {
+    const edit = edits.find((candidate) => candidate.href === href);
+    return edit ? `](${edit.to}${anchor})` : whole;
+  });
+}
+function rewriteSummary(rewrites) {
+  return rewrites.map(({ file, links }) => ({ file, links })).sort((left, right) => left.file.localeCompare(right.file));
+}
+function prepareArchive(repoRoot, plan, verifyRecordedRewrites = false) {
+  const tree = resolveArchiveTree(repoRoot, plan.root);
+  const moves = prepareMoves(repoRoot, plan, tree);
+  if (verifyRecordedRewrites) {
+    const recorded = preflightEmittedPaths(
+      repoRoot,
+      plan.rewrites.map((rewrite) => ({
+        moduleName: ARCHIVE_OPERATION,
+        target: rewrite.file,
+        writeExisting: true
+      }))
+    );
+    recorded.forEach((path) => requireRegularFile(path, "recorded rewrite target"));
+  }
+  const moved = /* @__PURE__ */ new Map();
+  for (const { move, from } of moves) {
+    moved.set(resolve5(repoRoot, ...move.from.split("/")), move.to);
+    moved.set(from.absolute, move.to);
+  }
+  const candidatePaths = [];
+  const seenCanonical = /* @__PURE__ */ new Set();
+  const addCandidate = (file) => {
+    if (!isRewritable(file)) return;
+    const path = resolveEmittedPath(repoRoot, ARCHIVE_OPERATION, file);
+    if (seenCanonical.has(path.absolute)) return;
+    seenCanonical.add(path.absolute);
+    candidatePaths.push({ file, path });
+  };
+  moves.forEach(({ move }) => addCandidate(move.from));
+  if (verifyRecordedRewrites) plan.rewrites.forEach(({ file }) => addCandidate(file));
+  walk(repoRoot).sort().forEach(addCandidate);
+  const drafts = candidatePaths.flatMap(({ file, path }) => {
+    const original = readFileSync12(path.absolute, "utf8");
+    const edits = retargets(repoRoot, file, moved, original);
+    if (!edits.length) return [];
+    return [{ file, original, updated: preparedText(original, edits), links: edits.length }];
+  });
+  const paths = preflightEmittedPaths(
+    repoRoot,
+    drafts.map((rewrite) => ({
+      moduleName: ARCHIVE_OPERATION,
+      target: rewrite.file,
+      writeExisting: true
+    }))
+  );
+  const rewrites = drafts.map((rewrite, index) => ({ ...rewrite, path: paths[index] }));
+  rewrites.forEach(({ path }) => requireRegularFile(path, "rewrite target"));
+  if (verifyRecordedRewrites) {
+    const expected = [...plan.rewrites].sort((left, right) => left.file.localeCompare(right.file));
+    const actual = rewriteSummary(rewrites);
+    if (JSON.stringify(expected) !== JSON.stringify(actual)) {
+      throw new UnsafeEmittedPathError(
+        ARCHIVE_OPERATION,
+        plan.root,
+        "the archive plan is stale: its complete rewrite set no longer matches the repository"
+      );
+    }
   }
-  for (const m of plan.moves) {
-    const to = join12(repoRoot, ...m.to.split("/"));
-    mkdirSync5(dirname7(to), { recursive: true });
-    renameSync(join12(repoRoot, m.from), to);
+  return { moves, rewrites };
+}
+function applyArchive(repoRoot, plan) {
+  const prepared = prepareArchive(repoRoot, plan, true);
+  for (const rewrite of prepared.rewrites) {
+    if (readFileSync12(rewrite.path.absolute, "utf8") !== rewrite.original) {
+      throw new UnsafeEmittedPathError(
+        ARCHIVE_OPERATION,
+        rewrite.file,
+        "the rewrite target changed after archive preflight"
+      );
+    }
   }
+  for (const move of prepared.moves) mkdirSync5(dirname9(move.to.absolute), { recursive: true });
+  for (const rewrite of prepared.rewrites) writeFileSync5(rewrite.path.absolute, rewrite.updated);
+  for (const move of prepared.moves) renameSync(move.from.absolute, move.to.absolute);
 }
 
 // src/concurrency.ts
-import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync11, rmSync as rmSync2, writeFileSync as writeFileSync6, unlinkSync } from "node:fs";
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readdirSync as readdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync6, unlinkSync } from "node:fs";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { hostname } from "node:os";
-import { join as join13, resolve as resolve4, dirname as dirname8, basename as basename2 } from "node:path";
+import { join as join14, resolve as resolve6, dirname as dirname10, basename as basename3 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 function loopParams(root) {
   const p = installedParams(root).concurrency ?? {};
@@ -2397,7 +3582,7 @@ function loopParams(root) {
   };
 }
 function git(root, args2) {
-  return execFileSync4("git", args2, { cwd: root, stdio: "pipe", encoding: "utf8" }).trim();
+  return execFileSync5("git", args2, { cwd: root, stdio: "pipe", encoding: "utf8" }).trim();
 }
 function gitOk(root, args2) {
   try {
@@ -2414,6 +3599,199 @@ function revParse(root, ref) {
     return null;
   }
 }
+function parseGitRefFormatOutput(output) {
+  if (output === void 0 || output === "--show-ref-format") return "files";
+  if (output === "files" || output === "reftable") return output;
+  throw new Error(`unsupported Git ref format '${output}'`);
+}
+function gitWorktrees(root) {
+  const out = execFileSync5("git", ["worktree", "list", "--porcelain", "-z"], {
+    cwd: root,
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  const rows = [];
+  let row;
+  for (const field2 of out.split("\0")) {
+    if (!field2) {
+      if (row) rows.push(row);
+      row = void 0;
+    } else if (field2.startsWith("worktree ")) {
+      if (row) rows.push(row);
+      row = { path: field2.slice("worktree ".length) };
+    } else if (row && field2.startsWith("branch ")) {
+      row.branch = field2.slice("branch ".length);
+    }
+  }
+  if (row) rows.push(row);
+  return rows;
+}
+function gitLocalBranchRefs(root) {
+  const out = git(root, ["for-each-ref", "--format=%(refname)%09%(objectname)%09%(symref)", "refs/heads/"]);
+  const refs = /* @__PURE__ */ new Map();
+  if (out) {
+    for (const line of out.split("\n")) {
+      const [ref, oid, symref] = line.split("	");
+      refs.set(ref, { ref, oid, ...symref ? { symref } : {} });
+    }
+  }
+  const common = resolve6(root, git(root, ["rev-parse", "--git-common-dir"]));
+  const heads = join14(common, "refs", "heads");
+  const visit = (directory, prefix) => {
+    if (!existsSync10(directory)) return;
+    for (const entry of readdirSync4(directory, { withFileTypes: true })) {
+      const shortName = prefix ? `${prefix}/${entry.name}` : entry.name;
+      const path = join14(directory, entry.name);
+      if (entry.isDirectory()) {
+        visit(path, shortName);
+        continue;
+      }
+      const ref = `refs/heads/${shortName}`;
+      if (entry.name.endsWith(".lock")) continue;
+      if (!entry.isFile()) throw new Error(`branch ref '${ref}' is not a regular loose-ref file`);
+      const value = readFileSync13(path, "utf8").replace(/[\r\n]+$/, "");
+      if (value.startsWith("ref: ")) {
+        refs.set(ref, { ref, oid: "", symref: value.slice("ref: ".length) });
+      } else {
+        const enumerated = refs.get(ref);
+        if (!enumerated || enumerated.symref || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value) || enumerated.oid.toLowerCase() !== value.toLowerCase()) throw new Error(`branch ref '${ref}' has an unreadable or unresolved loose-ref value`);
+      }
+    }
+  };
+  let refFormatOutput;
+  try {
+    refFormatOutput = git(root, ["rev-parse", "--show-ref-format"]);
+  } catch {
+  }
+  const refFormat = parseGitRefFormatOutput(refFormatOutput);
+  if (refFormat === "files") visit(heads, "");
+  return [...refs.values()];
+}
+function symbolicRefTarget(root, ref) {
+  try {
+    return git(root, ["symbolic-ref", "--quiet", ref]);
+  } catch {
+    return null;
+  }
+}
+function refStorageCollides(left, right) {
+  const leftSegments = left.split("/");
+  const rightSegments = right.split("/");
+  const shared = Math.min(leftSegments.length, rightSegments.length);
+  for (let index = 0; index < shared; index++) {
+    if (!canonicalCaselessSegmentEqual(leftSegments[index], rightSegments[index])) return false;
+    if (leftSegments[index] !== rightSegments[index] && index < leftSegments.length - 1 && index < rightSegments.length - 1) return true;
+  }
+  return true;
+}
+function exactDirectRef(root, stored, shortName, role, required) {
+  const wanted = `refs/heads/${shortName}`;
+  const label = role === "integration" ? `configured integration branch '${shortName}'` : `configured green ref '${shortName}'`;
+  if (!gitOk(root, ["check-ref-format", wanted])) {
+    return { error: `${label} is not a valid direct local branch ref; land is refused.` };
+  }
+  const exactSymbolicTarget = symbolicRefTarget(root, wanted);
+  if (exactSymbolicTarget) {
+    return { error: `${label} is symbolic (${wanted} -> ${exactSymbolicTarget}); land requires a direct local branch ref and is refused.` };
+  }
+  const alias = stored.find((entry) => entry.ref !== wanted && refStorageCollides(entry.ref, wanted));
+  if (alias) {
+    return { error: `${label} collides with case-aliased or directory/file-conflicting stored ref '${alias.ref}'; remove the ambiguity and retry.` };
+  }
+  const exact = stored.find((entry) => entry.ref === wanted);
+  if (!exact) {
+    if (required) return { error: `${label} has no exact stored local ref '${wanted}'; land is refused.` };
+    return { value: { ref: wanted, oid: null } };
+  }
+  if (exact.symref) {
+    return {
+      error: `${label} is symbolic (${exact.ref} -> ${exact.symref}); land requires a direct local branch ref and is refused.`
+    };
+  }
+  return { value: { ref: exact.ref, oid: exact.oid } };
+}
+function managedRefsState(root, integration, green) {
+  try {
+    const stored = gitLocalBranchRefs(root);
+    const worktrees2 = gitWorktrees(root);
+    const integrationRef = exactDirectRef(root, stored, integration, "integration", true);
+    if (!integrationRef.value) return integrationRef;
+    const greenRef = exactDirectRef(root, stored, green, "green", false);
+    if (!greenRef.value) return greenRef;
+    const withHolders = (ref) => ({
+      ...ref,
+      holders: worktrees2.filter((worktree) => worktree.branch !== void 0 && refStorageCollides(worktree.branch, ref.ref)).map((worktree) => worktree.path)
+    });
+    return {
+      value: {
+        integration: withHolders(integrationRef.value),
+        green: withHolders(greenRef.value)
+      }
+    };
+  } catch {
+    return {
+      error: "cannot enumerate local branch refs and worktrees; managed-ref identity or checkout state is unknown, so land is refused."
+    };
+  }
+}
+function createDirectRef(root, ref, oid) {
+  const input = `option no-deref\0create ${ref}\0${oid}\0`;
+  execFileSync5("git", ["update-ref", "--stdin", "-z", "-m", "rungs park verified merge"], {
+    cwd: root,
+    stdio: "pipe",
+    input: Buffer.from(input, "utf8")
+  });
+}
+function parkVerifiedMerge(root, preferred, merged, reserved) {
+  const derived = `${preferred}-${merged}`;
+  const flat = `rungs-park-${merged}`;
+  for (let index = 0; index < 1e3; index++) {
+    const candidate = index === 0 ? preferred : index === 1 ? derived : index === 2 ? flat : `${flat}-${index - 2}`;
+    const wanted = `refs/heads/${candidate}`;
+    const reservedCollision = [...reserved].some((name) => refStorageCollides(wanted, `refs/heads/${name}`));
+    if (reservedCollision || !gitOk(root, ["check-ref-format", wanted])) continue;
+    for (let inspection = 0; inspection < 2; inspection++) {
+      let stored;
+      let worktrees2;
+      try {
+        stored = gitLocalBranchRefs(root);
+        worktrees2 = gitWorktrees(root);
+      } catch {
+        return { error: "cannot enumerate refs and worktrees, so no recovery ref can be created safely." };
+      }
+      const exact = stored.find((entry) => entry.ref === wanted);
+      const alias = stored.find((entry) => entry.ref !== wanted && refStorageCollides(entry.ref, wanted));
+      const exactSymbolicTarget = symbolicRefTarget(root, wanted);
+      const held = worktrees2.some(
+        (worktree) => worktree.branch !== void 0 && refStorageCollides(worktree.branch, wanted)
+      );
+      if (alias || exact?.symref || exactSymbolicTarget || held) break;
+      if (exact) {
+        if (exact.oid === merged) return { name: candidate };
+        break;
+      }
+      try {
+        createDirectRef(root, wanted, merged);
+        return { name: candidate };
+      } catch {
+      }
+    }
+  }
+  return { error: `could not allocate an unheld collision-free recovery ref below '${preferred}'.` };
+}
+function advanceVerifiedRefs(root, integration, green, merged) {
+  const input = [
+    "option no-deref\0",
+    `update ${integration.ref}\0${merged}\0${integration.oid}\0`,
+    "option no-deref\0",
+    green.oid === null ? `create ${green.ref}\0${merged}\0` : `update ${green.ref}\0${merged}\0${green.oid}\0`
+  ].join("");
+  execFileSync5("git", ["update-ref", "--stdin", "-z", "-m", "rungs land verified merge"], {
+    cwd: root,
+    stdio: "pipe",
+    input: Buffer.from(input, "utf8")
+  });
+}
 function sessionStart(root, branch, at, dryRun = false) {
   const { integration, greenRef } = loopParams(root);
   const lines = [];
@@ -2431,7 +3809,7 @@ function sessionStart(root, branch, at, dryRun = false) {
     lines.push(`no ${greenRef} ref yet \u2014 cutting from the tip of ${integration} (${baseSha.slice(0, 8)}) instead.`);
     lines.push(`That tip has not been verified by a land. The first successful \`rungs land\` creates ${greenRef}.`);
   }
-  const path = resolve4(at ?? join13(dirname8(root), `${basename2(root)}-${branch.replace(/[^\w.-]+/g, "-")}`));
+  const path = resolve6(at ?? join14(dirname10(root), `${basename3(root)}-${branch.replace(/[^\w.-]+/g, "-")}`));
   if (existsSync10(path)) return { ok: false, lines: [`${path} already exists \u2014 rungs never writes over a directory it did not create`] };
   lines.push(`worktree ${path}`);
   lines.push(`branch   ${branch}`);
@@ -2476,7 +3854,7 @@ function preflight(root) {
   return { ok: true, lines };
 }
 function lockPath(root) {
-  return join13(git(root, ["rev-parse", "--git-common-dir"]).replace(/^\.git$/, join13(root, ".git")), "rungs-land.lock");
+  return join14(git(root, ["rev-parse", "--git-common-dir"]).replace(/^\.git$/, join14(root, ".git")), "rungs-land.lock");
 }
 function alive(pid) {
   try {
@@ -2486,18 +3864,89 @@ function alive(pid) {
     return e?.code === "EPERM";
   }
 }
+var findingIdentity = (finding) => typeof finding === "string" ? finding : finding.identity;
+var findingDiagnostic = (finding) => typeof finding === "string" ? finding : finding.diagnostic;
+function failingIdentities(outcome) {
+  return new Map(outcome.failing.map((failure) => [
+    failure.id,
+    new Set(failure.findings.map(findingIdentity))
+  ]));
+}
+function coversGateIds(outcome, ids) {
+  const failedIds = new Set(outcome.failing.map((failure) => failure.id));
+  return [...failedIds].every((id) => ids.has(id)) && failedIds.size + outcome.pass >= ids.size;
+}
+function exactControlEligibility(root, integrationOid) {
+  try {
+    let attached = "";
+    try {
+      attached = execFileSync5("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], {
+        cwd: root,
+        stdio: "pipe",
+        encoding: "utf8"
+      }).trim();
+    } catch (error) {
+      if (error?.status !== 1) {
+        return { ok: false, reason: "the invoking worktree HEAD attachment state could not be read" };
+      }
+    }
+    if (attached) {
+      return { ok: false, reason: `the invoking worktree is attached to '${attached}', not detached` };
+    }
+    const head = revParse(root, "HEAD");
+    if (head !== integrationOid) {
+      return {
+        ok: false,
+        reason: `the invoking worktree is at ${head?.slice(0, 8) ?? "an unreadable HEAD"}, not integration ${integrationOid.slice(0, 8)}`
+      };
+    }
+    const status = execFileSync5(
+      "git",
+      ["--no-optional-locks", "status", "--porcelain=v1", "-z", "--untracked-files=all"],
+      { cwd: root, stdio: "pipe" }
+    );
+    if (status.length) {
+      return { ok: false, reason: "the invoking worktree has tracked, staged or non-ignored untracked changes" };
+    }
+    return { ok: true };
+  } catch {
+    return { ok: false, reason: "the invoking worktree state could not be verified" };
+  }
+}
 function land(root, branch, runner, dryRun = false) {
   const { integration, greenRef, integPrefix } = loopParams(root);
   const lines = [];
   if (!branch) return { ok: false, lines: ["a branch name is required: `rungs land <branch>`"] };
   const head = revParse(root, `refs/heads/${branch}`);
   if (!head) return { ok: false, lines: [`branch '${branch}' does not exist`] };
-  const before = revParse(root, `refs/heads/${integration}`);
+  const preferredParked = `${integPrefix}${branch}`;
+  const initialManaged = managedRefsState(root, integration, greenRef);
+  if (!initialManaged.value) return { ok: false, lines: [initialManaged.error] };
+  const { integration: initialIntegration, green: initialGreen } = initialManaged.value;
+  if (initialIntegration.ref === initialGreen.ref) {
+    return {
+      ok: false,
+      lines: [`configured integration branch '${integration}' and green ref '${greenRef}' resolve to the same direct ref; land requires two distinct managed refs.`]
+    };
+  }
+  const before = initialIntegration.oid;
   if (!before) return { ok: false, lines: [`'${integration}' does not resolve`] };
+  const heldManagedRef = [initialIntegration, initialGreen].find((ref) => ref.holders.length);
+  if (heldManagedRef) {
+    const name = heldManagedRef.ref.slice("refs/heads/".length);
+    return {
+      ok: false,
+      lines: [
+        `'${name}' is checked out in ${heldManagedRef.holders.length} worktree(s), so land is refused:`,
+        ...heldManagedRef.holders.map((path) => `  ${path}`),
+        "Switch each listed worktree to another branch or detach it (`git switch --detach`), then retry."
+      ]
+    };
+  }
   const lp = lockPath(root);
   if (existsSync10(lp)) {
     try {
-      const held = JSON.parse(readFileSync11(lp, "utf8"));
+      const held = JSON.parse(readFileSync13(lp, "utf8"));
       if (held.host === hostname() && alive(held.pid)) {
         return {
           ok: false,
@@ -2513,13 +3962,13 @@ function land(root, branch, runner, dryRun = false) {
     }
   }
   if (dryRun) {
-    lines.push(`would merge ${branch} (${head.slice(0, 8)}) onto ${integration} (${before.slice(0, 8)}) via ${integPrefix}${branch}, verify, then advance.`);
+    lines.push(`would merge ${branch} (${head.slice(0, 8)}) onto ${integration} (${before.slice(0, 8)}) via ${preferredParked}, verify, then atomically advance ${integration} and ${greenRef}.`);
     return { ok: true, lines };
   }
   const lock = { pid: process.pid, host: hostname(), started: (/* @__PURE__ */ new Date()).toISOString(), branch };
   writeFileSync6(lp, JSON.stringify(lock));
-  const scratch = mkdtempSync2(join13(tmpdir2(), "rungs-land-"));
-  const parked = `${integPrefix}${branch}`;
+  const scratch = mkdtempSync2(join14(tmpdir2(), "rungs-land-"));
+  let preserveScratch = false;
   try {
     git(root, ["worktree", "add", "--detach", scratch, before]);
     try {
@@ -2540,6 +3989,35 @@ function land(root, branch, runner, dryRun = false) {
     const merged = git(scratch, ["rev-parse", "HEAD"]);
     const res = runner(scratch);
     lines.push(`merged tree ${merged.slice(0, 8)} \u2014 ${res.pass} pass \xB7 ${res.failing.length} fail`);
+    const refuseWithRecovery = (details, guidance) => {
+      const recovery = parkVerifiedMerge(
+        root,
+        preferredParked,
+        merged,
+        /* @__PURE__ */ new Set([integration, greenRef, branch])
+      );
+      if (!recovery.name) {
+        git(scratch, ["reset", "--hard", merged]);
+        preserveScratch = true;
+        return {
+          ok: false,
+          lines: [
+            ...lines,
+            ...details,
+            `The verified merge ${merged} could not be parked safely: ${recovery.error}`,
+            `Its detached scratch worktree is retained at ${scratch}. Resolve the ref/worktree state, create a recovery branch at that exact commit, then remove the scratch explicitly.`
+          ]
+        };
+      }
+      return {
+        ok: false,
+        lines: [
+          ...lines,
+          ...details,
+          `Your verified merge is parked on '${recovery.name}'. ${guidance}`
+        ]
+      };
+    };
     if (res.failing.length) {
       const ids = new Set(res.failing.map((f) => f.id));
       let base = null;
@@ -2549,65 +4027,157 @@ function land(root, branch, runner, dryRun = false) {
       } catch {
         base = null;
       }
-      const attributable = base !== null && base.failing.length + base.pass >= ids.size;
-      const baseFindings = new Map((base?.failing ?? []).map((f) => [f.id, new Set(f.findings)]));
+      const baseAttributable = base !== null && coversGateIds(base, ids);
+      let control = null;
+      let controlIssue = "";
+      const eligibleBefore = exactControlEligibility(root, before);
+      if (!eligibleBefore.ok) {
+        controlIssue = eligibleBefore.reason;
+      } else {
+        try {
+          control = runner(root, ids);
+          const eligibleAfter = exactControlEligibility(root, before);
+          if (!eligibleAfter.ok) {
+            control = null;
+            controlIssue = `the invoking control changed while gates ran: ${eligibleAfter.reason}`;
+          }
+        } catch {
+          control = null;
+          controlIssue = "the exact integration control could not be gated";
+        }
+      }
+      if (control && !coversGateIds(control, ids)) {
+        control = null;
+        controlIssue = "some failing gates did not run in the exact integration control";
+      }
+      const controlAttributable = control !== null;
+      const baseFindings = base ? failingIdentities(base) : /* @__PURE__ */ new Map();
+      const controlFindings = control ? failingIdentities(control) : /* @__PURE__ */ new Map();
       const introduced = [];
       const inherited = [];
+      const unverified = [];
+      const addFinding = (target, id, finding) => {
+        let failure = target.find((entry) => entry.id === id);
+        if (!failure) {
+          failure = { id, findings: [] };
+          target.push(failure);
+        }
+        failure.findings.push(finding);
+      };
       for (const f of res.failing) {
-        const seen = attributable ? baseFindings.get(f.id) ?? /* @__PURE__ */ new Set() : null;
-        const fresh = seen ? f.findings.filter((x) => !seen.has(x)) : f.findings;
-        if (fresh.length) introduced.push({ id: f.id, findings: fresh });
-        else inherited.push(f);
+        const atBase = baseAttributable ? baseFindings.get(f.id) ?? /* @__PURE__ */ new Set() : null;
+        const inControl = controlAttributable ? controlFindings.get(f.id) ?? /* @__PURE__ */ new Set() : null;
+        for (const finding of f.findings) {
+          const identity = findingIdentity(finding);
+          if (!atBase || !atBase.has(identity)) {
+            addFinding(introduced, f.id, finding);
+          } else if (!inControl || !inControl.has(identity)) {
+            addFinding(unverified, f.id, finding);
+          } else {
+            addFinding(inherited, f.id, finding);
+          }
+        }
       }
       for (const f of inherited) {
-        lines.push(`  inherited  ${f.id}${f.findings[0] ? ` \u2014 ${f.findings[0]}` : ""}`);
+        lines.push(`  inherited  ${f.id}${f.findings[0] ? ` \u2014 ${findingDiagnostic(f.findings[0])}` : ""}`);
       }
       for (const f of introduced) {
-        lines.push(`  INTRODUCED ${f.id}${f.findings[0] ? ` \u2014 ${f.findings[0]}` : ""}`);
-        for (const extra of f.findings.slice(1, 4)) lines.push(`             ${extra}`);
+        lines.push(`  INTRODUCED ${f.id}${f.findings[0] ? ` \u2014 ${findingDiagnostic(f.findings[0])}` : ""}`);
+        for (const extra of f.findings.slice(1, 4)) lines.push(`             ${findingDiagnostic(extra)}`);
       }
       if (base === null) {
         lines.push("  The merge base could not be gated, so nothing here is attributable and all of it blocks.");
-      } else if (!attributable) {
+      } else if (!baseAttributable) {
         lines.push("  Some gates could not be attributed against the merge base, so they block. We do not land on an unknown.");
       }
+      if (controlIssue) {
+        lines.push(`  CONTROL UNAVAILABLE \u2014 ${controlIssue}; inherited failure cannot be established.`);
+      }
+      for (const f of unverified) {
+        if (controlAttributable) {
+          const mismatch = (controlFindings.get(f.id)?.size ?? 0) > 0 ? "the detached base scratch and exact integration control reported different findings" : "the exact integration control passed while the detached base scratch failed";
+          lines.push(`  UNVERIFIED ${f.id} \u2014 ${mismatch}; the scratch environment cannot establish inheritance.`);
+          if (f.findings[0]) {
+            lines.push(`             ${findingDiagnostic(f.findings[0]).replace(/\n/g, "\n             ")}`);
+          }
+        } else {
+          lines.push(`  UNVERIFIED ${f.id}${f.findings[0] ? ` \u2014 ${findingDiagnostic(f.findings[0])}` : ""}`);
+        }
+      }
       if (introduced.length) {
-        git(root, ["update-ref", `refs/heads/${parked}`, merged]);
-        lines.push(
-          `${introduced.length} introduced by this branch. ${integration} is unchanged, and the merged tree is parked on '${parked}' \u2014 fix it there and land again.`
+        return refuseWithRecovery(
+          [`${introduced.length} introduced by this branch. ${integration} and ${greenRef} were not advanced.`],
+          "Fix it there and land again; recovery-ref cleanup remains operator-owned."
+        );
+      }
+      if (unverified.length || !baseAttributable || !controlAttributable) {
+        const unverifiedCount = unverified.reduce((total, failure) => total + failure.findings.length, 0);
+        return refuseWithRecovery(
+          [
+            `${unverifiedCount || res.failing.length} failure(s) could not be verified as inherited. ${integration} and ${greenRef} were not advanced.`
+          ],
+          `Run land from a clean detached checkout at ${integration} (${before.slice(0, 8)}) with the gate runtime available, then retry.`
         );
-        return { ok: false, lines };
       }
       lines.push(
         `${inherited.length} failure(s), all already red on ${integration} before this branch. Landing anyway \u2014 they are not this branch's to fix, and blocking on them is how a gate gets bypassed.`
       );
       git(scratch, ["reset", "--hard", merged]);
     }
+    const lateManaged = managedRefsState(root, integration, greenRef);
+    if (!lateManaged.value) {
+      return refuseWithRecovery(
+        [
+          "managed-ref identity and checkout state could not be revalidated after verification, so the atomic advance is refused.",
+          `  ${lateManaged.error}`
+        ],
+        `Re-run \`rungs land ${branch}\` after ref identity and checkout state can be verified.`
+      );
+    }
+    const { integration: lateIntegration, green: lateGreen } = lateManaged.value;
+    const lateHolder = [lateIntegration, lateGreen].find((ref) => ref.holders.length);
+    if (lateHolder) {
+      const name = lateHolder.ref.slice("refs/heads/".length);
+      return refuseWithRecovery(
+        [
+          `'${name}' became checked out in ${lateHolder.holders.length} worktree(s) while this land was verifying, so the atomic ref advance is refused:`,
+          ...lateHolder.holders.map((path) => `  ${path}`),
+          "Switch each listed worktree to another branch or detach it (`git switch --detach`), then retry."
+        ],
+        `Re-run \`rungs land ${branch}\` to rebuild the merge after releasing the branch.`
+      );
+    }
+    if (lateIntegration.oid !== initialIntegration.oid || lateGreen.oid !== initialGreen.oid) {
+      const moved = [
+        ...lateIntegration.oid !== initialIntegration.oid ? [integration] : [],
+        ...lateGreen.oid !== initialGreen.oid ? [greenRef] : []
+      ];
+      return refuseWithRecovery(
+        [`${moved.join(" and ")} moved while this land was verifying, so the atomic advance was refused rather than overwriting concurrent work.`],
+        `Re-run \`rungs land ${branch}\` to rebuild the merge on the new managed-ref state.`
+      );
+    }
     try {
-      git(root, ["update-ref", `refs/heads/${integration}`, merged, before]);
+      advanceVerifiedRefs(root, initialIntegration, initialGreen, merged);
     } catch {
-      git(root, ["update-ref", `refs/heads/${parked}`, merged]);
-      return {
-        ok: false,
-        lines: [
-          ...lines,
-          `${integration} moved while this land was verifying, so the advance was refused rather than overwriting it.`,
-          `Your verified merge is parked on '${parked}'. Re-run \`rungs land ${branch}\` to rebuild it on the new tip.`
-        ]
-      };
+      return refuseWithRecovery(
+        [`${integration} or ${greenRef} moved, became symbolic, or could not be locked while this land was verifying. The atomic managed-ref transaction was refused, so Rungs did not partially update either ref.`],
+        `Re-run \`rungs land ${branch}\` to rebuild the merge after inspecting the competing ref state.`
+      );
     }
-    git(root, ["update-ref", `refs/heads/${greenRef}`, merged]);
-    lines.push(`${integration} \u2192 ${merged.slice(0, 8)}, and ${greenRef} now marks it verified.`);
-    if (revParse(root, `refs/heads/${parked}`)) git(root, ["update-ref", "-d", `refs/heads/${parked}`]);
+    lines.push(`${integration} and ${greenRef} \u2192 ${merged.slice(0, 8)} in one atomic verified-ref transaction.`);
+    lines.push("Existing recovery refs are retained; cleanup remains an explicit operator decision.");
     return { ok: true, lines };
   } finally {
-    try {
-      git(root, ["worktree", "remove", "--force", scratch]);
-    } catch {
-      rmSync2(scratch, { recursive: true, force: true });
+    if (!preserveScratch) {
       try {
-        git(root, ["worktree", "prune"]);
+        git(root, ["worktree", "remove", "--force", scratch]);
       } catch {
+        rmSync2(scratch, { recursive: true, force: true });
+        try {
+          git(root, ["worktree", "prune"]);
+        } catch {
+        }
       }
     }
     try {
@@ -2636,10 +4206,40 @@ function worktrees(root) {
   return { rows, integration };
 }
 
+// src/help.ts
+var COMMANDS = [
+  ["init [path] [profile]", "scaffold a repo \u2014 minimal \xB7 tracked \xB7 disciplined \xB7 hardened \xB7 fleet"],
+  ["doctor [path]", "detect what a repo already has, installed or not"],
+  ["add <module\u2026> [--into p]", "install modules, resolving dependencies and adopting what exists"],
+  ["check [path] [tier]", "run the registered gates and record the ledger"],
+  ["render [path]", "re-emit path-scoped rules per harness"],
+  ["upgrade [path]", "move to newer module versions, never touching what you edited"],
+  ["eject [path]", "materialise the engines; stop depending on rungs"],
+  ["setup git [path]", "install the merge drivers .gitattributes names"],
+  ["modules", "list the module set and audit the manifests"],
+  ["backlog archive [path]", "move finished items to archive/, repointing every link"],
+  ["session start <branch>", "cut a branch and worktree from the last verified merge"],
+  ["preflight [path]", "did the integration branch change files you changed?"],
+  ["land <branch>", "merge \u2192 verify the merged tree \u2192 advance, or refuse and park it"],
+  ["worktrees [path]", "which worktrees are merged, prunable, or merged and still dirty"]
+];
+var FLAGS = [
+  ["--dry-run", "report what would happen, write nothing"],
+  ["--explain", "doctor: also run the detectors over what this repo already has"],
+  ["--confirm-paradigm", "add: install a module this repo already solves another way"],
+  ["--confirm-conflict", "add: install a module that declares a conflict with one already here"],
+  ["--into <path>", "add: install into this repo instead of the working directory"],
+  ["--set m.param=value", "add/init: override a module parameter. Repeatable"],
+  ["--confirm-threshold", "add: install a module whose rung is above this repo"],
+  ["--apply", "upgrade: write the changes, rather than preview them"],
+  ["--fast, --full", "check: pick the gate tier, as the positional also does"],
+  ["--params", "modules: show every module parameter, its default and its allowed values"],
+  ["--copilot", "also emit Copilot instruction files"]
+];
+
 // src/cli.ts
-import { existsSync as existsSync11 } from "node:fs";
-var HERE = dirname9(fileURLToPath4(import.meta.url));
-var MODULES2 = join14(HERE, "..", "modules");
+var HERE = dirname11(fileURLToPath5(import.meta.url));
+var MODULES2 = join15(HERE, "..", "modules");
 var c = {
   dim: (s) => `\x1B[2m${s}\x1B[0m`,
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
@@ -2648,6 +4248,13 @@ var c = {
   green: (s) => `\x1B[32m${s}\x1B[0m`,
   cyan: (s) => `\x1B[36m${s}\x1B[0m`
 };
+function pathRefusal(error) {
+  if (!(error instanceof UnsafeEmittedPathError)) throw error;
+  console.log(c.red(`
+  refused: ${error.message}
+`) + c.dim("  Nothing was written. Fix the named path or repository alias and retry.\n"));
+  return 1;
+}
 var STATE_LABEL = {
   absent: c.dim("absent"),
   "ours-current": c.green("ours"),
@@ -2663,8 +4270,12 @@ ${mods.length} modules
 `));
   for (const m of mods) {
     const deps = m.requires.length ? c.dim(` \u2190 ${m.requires.join(", ")}`) : "";
-    console.log(`  ${c.bold(m.name.padEnd(14))} rung ${m.rung}${deps}`);
+    const designed = m.provenance.kind === "designed" ? c.yellow("  designed") : "";
+    console.log(`  ${c.bold(m.name.padEnd(14))} rung ${m.rung}${deps}${designed}`);
     console.log(`  ${" ".repeat(14)} ${c.dim(m.summary)}`);
+    if (designed) {
+      console.log(`  ${" ".repeat(14)} ${c.dim(`not extracted \u2014 ${firstSentence(m.provenance.rationale ?? "")}`)}`);
+    }
     if (!showParams) continue;
     for (const [name, spec] of Object.entries(m.params)) {
       const shown = spec.default === void 0 ? c.dim("(none)") : JSON.stringify(spec.default);
@@ -2697,13 +4308,18 @@ ${mods.length} modules
   return issues.length === 0 ? 0 : 1;
 }
 function cmdDoctor(target, doExplain = false) {
-  const root = resolve5(target);
+  const root = resolve7(target);
   const mods = loadAllModules(MODULES2);
   console.log(c.bold(`
 rungs doctor \u2014 ${root}
 `));
   const files = scanRepo(root);
-  const record = readRecord(root);
+  let record;
+  try {
+    record = readRecord(root);
+  } catch (error) {
+    return pathRefusal(error);
+  }
   console.log(
     c.dim(`  scanned ${files.length} files`) + (record ? c.dim(` \xB7 installed ${Object.keys(record.modules).length} module(s)`) : c.dim(" \xB7 not a rungs repo")) + "\n"
   );
@@ -2711,10 +4327,15 @@ rungs doctor \u2014 ${root}
     Object.entries(record?.modules ?? {}).flatMap(([n, e]) => e.params ? [[n, e.params]] : [])
   ), root);
   const skillsDir = record?.harnesses.includes("claude") === false ? ".agents/skills" : ".claude/skills";
-  const results = mods.map((m) => {
-    const installed = record?.modules[m.name];
-    return detect(m, root, files, installed ? { ...installed, skillsDir, params_all: params } : void 0);
-  });
+  let results;
+  try {
+    results = mods.map((m) => {
+      const installed = record?.modules[m.name];
+      return detect(m, root, files, installed ? { ...installed, skillsDir, params_all: params } : void 0);
+    });
+  } catch (error) {
+    return pathRefusal(error);
+  }
   const byState = (s) => results.filter((r) => r.state === s);
   for (const r of results) {
     const mod = mods.find((m) => m.name === r.module);
@@ -2916,8 +4537,27 @@ rungs add ${names.join(" ")} \u2192 ${root}${dryRun ? c.yellow("  (dry run)") :
     }
     console.log(c.dim("      You will have two systems for one job. That is a choice, not a merge.\n"));
   }
+  let record;
+  try {
+    record = readRecord(root);
+  } catch (error) {
+    return pathRefusal(error);
+  }
+  const present = /* @__PURE__ */ new Set([...Object.keys(record?.modules ?? {}), ...order.map((m) => m.name)]);
+  const declared = blockedByConflict(order, present, mods);
+  const conflictOverride = flags.has("--confirm-conflict");
+  if (conflictOverride && declared.size) {
+    for (const [name, clash] of declared) {
+      if (clash.cause !== name) continue;
+      console.log(
+        c.yellow(`  ${name}: installing alongside ${clash.with}, which it declares a conflict with`) + c.dim(" \u2014 --confirm-conflict")
+      );
+    }
+    console.log(c.dim("      The author said these two do not coexist. You are overruling them, not merging them.\n"));
+  }
+  const conflicts = conflictOverride ? /* @__PURE__ */ new Map() : declared;
   let toInstall = order;
-  if (blocked.size) {
+  if (blocked.size || conflicts.size) {
     for (const mod of order) {
       const cause = blocked.get(mod.name);
       if (!cause) continue;
@@ -2931,17 +4571,55 @@ rungs add ${names.join(" ")} \u2192 ${root}${dryRun ? c.yellow("  (dry run)") :
         console.log(c.yellow(`  ${mod.name}: not installed \u2014 it requires ${cause}.`));
       }
     }
-    toInstall = resolveInstallOrder(names.filter((n) => !blocked.has(n)), mods).order;
-    const dropped = order.filter((m) => !toInstall.includes(m) && !blocked.has(m.name));
+    for (const mod of order) {
+      const clash = conflicts.get(mod.name);
+      if (!clash || blocked.has(mod.name)) continue;
+      if (clash.cause === mod.name) {
+        const declarer = mod.conflicts.includes(clash.with) ? mod.name : clash.with;
+        console.log(c.yellow(`  ${mod.name}: conflicts with ${clash.with}`));
+        console.log(
+          c.dim(`      declared by ${declarer}`) + c.dim(present.has(clash.with) && !order.some((m) => m.name === clash.with) ? ", which this repo already has" : ", and both were requested")
+        );
+      } else {
+        console.log(c.yellow(`  ${mod.name}: not installed \u2014 it requires ${clash.cause}.`));
+      }
+    }
+    const refused = /* @__PURE__ */ new Set([...blocked.keys(), ...conflicts.keys()]);
+    toInstall = resolveInstallOrder(names.filter((n) => !refused.has(n)), mods).order;
+    const dropped = order.filter((m) => !toInstall.includes(m) && !refused.has(m.name));
     if (dropped.length) {
       console.log(c.dim(`      ${dropped.map((m) => m.name).join(", ")} not written \u2014 pulled in only for the above`));
     }
+    const escapes = [blocked.size ? "--confirm-paradigm" : "", conflicts.size ? "--confirm-conflict" : ""].filter(Boolean);
     console.log(
       c.dim(`
-  Pass --confirm-paradigm to install anyway.`) + (toInstall.length ? c.dim(" Continuing with the rest.\n") : c.dim(" Nothing was written.\n"))
+  Pass ${escapes.join(" / ")} to install anyway.`) + (toInstall.length ? c.dim(" Continuing with the rest.\n") : c.dim(" Nothing was written.\n"))
     );
     if (!toInstall.length) return 1;
   }
+  for (const mod of toInstall.filter((m) => m.provenance.kind === "designed")) {
+    console.log(
+      c.yellow(`  ${mod.name}: designed, not extracted`) + c.dim(` \u2014 ${firstSentence(mod.provenance.rationale ?? "")}`)
+    );
+  }
+  const actualInstall = toInstall.filter(
+    (mod) => !(mod.threshold?.confirm && !dryRun && !flags.has("--confirm-threshold"))
+  );
+  try {
+    preflightModuleEmissions(actualInstall, root, params, skillsDir);
+    preflightRender(
+      root,
+      harnesses,
+      prospectiveRuleEmissions(actualInstall, params, skillsDir),
+      [
+        ...moduleEmissionCandidates(actualInstall, params, skillsDir),
+        { moduleName: "rungs", target: ".ai/gates.toml", shared: true, writeExisting: true },
+        { moduleName: "rungs", target: ".ai/rungs.toml", writeExisting: true }
+      ]
+    );
+  } catch (error) {
+    return pathRefusal(error);
+  }
   const installed = [];
   const wrote = /* @__PURE__ */ new Map();
   for (const mod of toInstall) {
@@ -2978,7 +4656,7 @@ rungs add ${names.join(" ")} \u2192 ${root}${dryRun ? c.yellow("  (dry run)") :
   registered ${gateActions.reduce((n, a) => n + Number(a.note.split(": ")[1].split(" ")[0]), 0)} gates from ${gateActions.length} module(s)`));
   }
   if (!dryRun) {
-    writeInstallRecord(root, order, params, harnesses, stamp, skillsDir, wrote);
+    writeInstallRecord(root, installed, params, harnesses, stamp, skillsDir, wrote);
     const entries = render(root, harnesses);
     writeReport(root, entries, harnesses, stamp);
     console.log(
@@ -2990,6 +4668,11 @@ rungs add ${names.join(" ")} \u2192 ${root}${dryRun ? c.yellow("  (dry run)") :
   return 0;
 }
 function cmdRender(root, harnesses, stamp) {
+  try {
+    preflightRender(root, harnesses);
+  } catch (error) {
+    return pathRefusal(error);
+  }
   const entries = render(root, harnesses);
   writeReport(root, entries, harnesses, stamp);
   console.log(c.bold(`
@@ -3020,11 +4703,18 @@ function landRunner(dir, only) {
   const failing = runs.filter((r) => r.status === "fail" || r.status === "error");
   return {
     pass: runs.filter((r) => r.status === "pass").length,
-    // `file: message`, so the same broken link in the same file is the same
-    // finding across two runs, and a *new* one is visibly not.
+    // Keep a stable comparison identity separate from the operator-facing
+    // diagnostic. `file: identity` makes the same broken link in the same file
+    // the same finding across runs, while command diagnostics can stay complete.
     failing: failing.map((r) => ({
       id: r.id,
-      findings: r.findings.map((f) => `${f.file ? `${f.file}: ` : ""}${f.message}`)
+      findings: r.findings.map((f) => {
+        const prefix = f.file ? `${f.file}: ` : "";
+        return {
+          identity: `${prefix}${f.identity ?? f.message}`,
+          diagnostic: `${prefix}${f.message}`
+        };
+      })
     }))
   };
 }
@@ -3085,7 +4775,7 @@ rungs check \u2014 ${root}${tier ? ` (${tier} tier)` : ""}
       `  ${mark[r.status]} ${r.id.padEnd(34)} ${c.dim(`${r.ms}ms`)}` + (r.examined ? c.dim(`  ${r.examined} examined`) : "")
     );
     for (const f of r.findings.slice(0, 4)) {
-      console.log(`         ${c.dim(f.file ? `${f.file}: ` : "")}${f.message}`);
+      console.log(`         ${c.dim(f.file ? `${f.file}: ` : "")}${f.message.replace(/\n/g, "\n         ")}`);
     }
     if (r.findings.length > 4) console.log(c.dim(`         \u2026and ${r.findings.length - 4} more`));
   }
@@ -3119,16 +4809,28 @@ function reportLedger(root) {
   console.log(c.dim("    directly, and CI runs, are not counted.\n"));
 }
 function cmdBacklogArchive(root, dryRun) {
-  const record = readRecord(root);
+  let record;
+  try {
+    record = readRecord(root);
+  } catch (error) {
+    return pathRefusal(error);
+  }
   const configured = record?.modules["backlog"]?.params?.root;
   const backlogRoot = `docs/${configured ?? "backlog"}`;
-  if (!existsSync11(join14(root, ...backlogRoot.split("/"), "items"))) {
+  let tree;
+  let plan;
+  try {
+    tree = resolveArchiveTree(root, backlogRoot);
+    plan = planArchive(root, backlogRoot);
+  } catch (error) {
+    return pathRefusal(error);
+  }
+  if (!tree.itemsExists) {
     console.log(c.red(`
   no backlog at ${backlogRoot}/items
 `));
     return 1;
   }
-  const plan = planArchive(root, backlogRoot);
   console.log(c.bold(`
 rungs backlog archive \u2192 ${root}${dryRun ? c.yellow("  (dry run)") : ""}
 `));
@@ -3155,14 +4857,24 @@ rungs backlog archive \u2192 ${root}${dryRun ? c.yellow("  (dry run)") : ""}
     console.log(c.dim("\n  Nothing written. Drop --dry-run to apply.\n"));
     return 0;
   }
-  applyArchive(root, plan);
+  try {
+    applyArchive(root, plan);
+  } catch (error) {
+    return pathRefusal(error);
+  }
   console.log(c.green(`
   archived ${plan.moves.length} item(s)`) + c.dim(" \u2014 ids stay spent and every citation still resolves."));
   console.log(c.dim("  Run `rungs check` to confirm.\n"));
   return 0;
 }
 function cmdInit(root, profile, dryRun, harnesses, stamp) {
-  if (readRecord(root)) {
+  let existing;
+  try {
+    existing = readRecord(root);
+  } catch (error) {
+    return pathRefusal(error);
+  }
+  if (existing) {
     console.log(
       c.yellow("\n  this repo is already initialised.") + c.dim(" Use `rungs add <module>` to install more, or `rungs upgrade`.\n")
     );
@@ -3180,13 +4892,23 @@ function cmdInit(root, profile, dryRun, harnesses, stamp) {
   return cmdAdd(names, root, dryRun, harnesses, stamp);
 }
 function cmdUpgrade(root, apply) {
-  const record = readRecord(root);
+  let record;
+  try {
+    record = readRecord(root);
+  } catch (error) {
+    return pathRefusal(error);
+  }
   if (!record) {
     console.log(c.yellow("\n  not a rungs repo \u2014 nothing to upgrade.\n"));
     return 1;
   }
   const mods = loadAllModules(MODULES2);
-  const plan = planUpgrade(root, mods, record);
+  let plan;
+  try {
+    plan = planUpgrade(root, mods, record);
+  } catch (error) {
+    return pathRefusal(error);
+  }
   console.log(c.bold(`
 rungs upgrade \u2014 ${root}${apply ? "" : c.yellow("  (preview)")}
 `));
@@ -3203,7 +4925,13 @@ rungs upgrade \u2014 ${root}${apply ? "" : c.yellow("  (preview)")}
     }
   }
   if (apply) {
-    const { written, gates, recorded } = applyUpgrade(root, mods, record, plan);
+    let result;
+    try {
+      result = applyUpgrade(root, mods, record, plan);
+    } catch (error) {
+      return pathRefusal(error);
+    }
+    const { written, gates, recorded } = result;
     const parts = [
       written ? `${written} file(s)` : "",
       gates ? `${gates} gate registration(s)` : "",
@@ -3220,7 +4948,13 @@ rungs upgrade \u2014 ${root}${apply ? "" : c.yellow("  (preview)")}
   return 0;
 }
 function cmdEject(root, dryRun) {
-  if (!readRecord(root)) {
+  let record;
+  try {
+    record = readRecord(root);
+  } catch (error) {
+    return pathRefusal(error);
+  }
+  if (!record) {
     console.log(c.yellow("\n  not a rungs repo \u2014 nothing to eject.\n"));
     return 1;
   }
@@ -3237,34 +4971,6 @@ rungs eject \u2014 ${root}${dryRun ? c.yellow("  (dry run)") : ""}
   return 0;
 }
 var VALUE_FLAGS = /* @__PURE__ */ new Set(["--set"]);
-var COMMANDS = [
-  ["init [path] [profile]", "scaffold a repo \u2014 minimal \xB7 tracked \xB7 disciplined \xB7 hardened \xB7 fleet"],
-  ["doctor [path]", "detect what a repo already has, installed or not"],
-  ["add <module\u2026> [--into p]", "install modules, resolving dependencies and adopting what exists"],
-  ["check [path] [tier]", "run the registered gates and record the ledger"],
-  ["render [path]", "re-emit path-scoped rules per harness"],
-  ["upgrade [path]", "move to newer module versions, never touching what you edited"],
-  ["eject [path]", "materialise the engines; stop depending on rungs"],
-  ["setup git [path]", "install the merge drivers .gitattributes names"],
-  ["modules", "list the module set and audit the manifests"],
-  ["backlog archive [path]", "move finished items to archive/, repointing every link"],
-  ["session start <branch>", "cut a branch and worktree from the last verified merge"],
-  ["preflight [path]", "did the integration branch change files you changed?"],
-  ["land <branch>", "merge \u2192 verify the merged tree \u2192 advance, or refuse and park it"],
-  ["worktrees [path]", "which worktrees are merged, prunable, or merged and still dirty"]
-];
-var FLAGS = [
-  ["--dry-run", "report what would happen, write nothing"],
-  ["--explain", "doctor: also run the detectors over what this repo already has"],
-  ["--confirm-paradigm", "add: install a module this repo already solves another way"],
-  ["--into <path>", "add: install into this repo instead of the working directory"],
-  ["--set m.param=value", "add/init: override a module parameter. Repeatable"],
-  ["--confirm-threshold", "add: install a module whose rung is above this repo"],
-  ["--apply", "upgrade: write the changes, rather than preview them"],
-  ["--fast, --full", "check: pick the gate tier, as the positional also does"],
-  ["--params", "modules: show every module parameter, its default and its allowed values"],
-  ["--copilot", "also emit Copilot instruction files"]
-];
 function renderHelp() {
   const pad = Math.max(...COMMANDS.map(([u]) => u.length)) + 2;
   const fpad = Math.max(...FLAGS.map(([f]) => f.length)) + 2;
@@ -3330,20 +5036,20 @@ switch (cmd) {
   unknown: rungs backlog ${args[0] ?? ""}`) + c.dim("\n  The only subcommand is `archive`.\n"));
       process.exit(1);
     }
-    process.exit(cmdBacklogArchive(resolve5(args[1] ?? process.cwd()), flags.has("--dry-run")));
+    process.exit(cmdBacklogArchive(resolve7(args[1] ?? process.cwd()), flags.has("--dry-run")));
   }
   case "check": {
     const tier = args[1] ?? (flags.has("--full") ? "full" : flags.has("--fast") ? "fast" : void 0);
-    process.exit(cmdCheck(resolve5(args[0] ?? process.cwd()), tier, STAMP));
+    process.exit(cmdCheck(resolve7(args[0] ?? process.cwd()), tier, STAMP));
   }
   case "init": {
     const profile = args[1] ?? "tracked";
-    process.exit(cmdInit(resolve5(args[0] ?? process.cwd()), profile, flags.has("--dry-run"), HARNESSES, STAMP));
+    process.exit(cmdInit(resolve7(args[0] ?? process.cwd()), profile, flags.has("--dry-run"), HARNESSES, STAMP));
   }
   case "upgrade":
-    process.exit(cmdUpgrade(resolve5(args[0] ?? process.cwd()), flags.has("--apply")));
+    process.exit(cmdUpgrade(resolve7(args[0] ?? process.cwd()), flags.has("--apply")));
   case "eject":
-    process.exit(cmdEject(resolve5(args[0] ?? process.cwd()), flags.has("--dry-run")));
+    process.exit(cmdEject(resolve7(args[0] ?? process.cwd()), flags.has("--dry-run")));
   case "setup": {
     if (args[0] !== "git") {
       console.log(
@@ -3352,7 +5058,7 @@ switch (cmd) {
       );
       process.exit(1);
     }
-    const r = setupGit(resolve5(args[1] ?? process.cwd()), flags.has("--dry-run"));
+    const r = setupGit(resolve7(args[1] ?? process.cwd()), flags.has("--dry-run"));
     console.log(
       r.drivers.length ? `
   installed ${r.drivers.length} merge driver(s): ${r.drivers.join(", ")}` + (r.rerere ? c.dim(" \xB7 rerere on") : "") + c.dim("\n  Declared drivers were inert until now \u2014 a fresh clone needs this once.\n") : c.dim("\n  no rungs merge drivers declared in .gitattributes\n")
@@ -3360,7 +5066,7 @@ switch (cmd) {
     process.exit(0);
   }
   case "render":
-    process.exit(cmdRender(resolve5(args[0] ?? process.cwd()), HARNESSES, STAMP));
+    process.exit(cmdRender(resolve7(args[0] ?? process.cwd()), HARNESSES, STAMP));
   case "session": {
     if (args[0] !== "start") {
       console.log(c.red(`
@@ -3370,15 +5076,15 @@ switch (cmd) {
     process.exit(report(sessionStart(process.cwd(), args[1], args[2], flags.has("--dry-run"))));
   }
   case "preflight":
-    process.exit(report(preflight(resolve5(args[0] ?? process.cwd()))));
+    process.exit(report(preflight(resolve7(args[0] ?? process.cwd()))));
   case "land":
     process.exit(report(land(process.cwd(), args[0], landRunner, flags.has("--dry-run"))));
   case "worktrees":
-    process.exit(cmdWorktrees(resolve5(args[0] ?? process.cwd())));
+    process.exit(cmdWorktrees(resolve7(args[0] ?? process.cwd())));
   case "add": {
     const target = flags.has("--into") ? args[args.length - 1] : process.cwd();
     const names = flags.has("--into") ? args.slice(0, -1) : args;
-    process.exit(cmdAdd(names, resolve5(target), flags.has("--dry-run"), HARNESSES, STAMP));
+    process.exit(cmdAdd(names, resolve7(target), flags.has("--dry-run"), HARNESSES, STAMP));
   }
   default: {
     const wantedHelp = cmd === void 0 || cmd === "help" || cmd === "--help" || cmd === "-h";