@sdd-method/maintain-cli 0.3.0 → 0.5.0

package/dist/lib/ci-binding/index.js

@@ -8,14 +8,21 @@
  * wrote is pristine and re-renders with no override, and only an edited copy needs --allow-overwrite.
  * The binding is remembered in the lock too (`ci_binding:`, absent meaning github), so an estate
  * chooses it once.
+ *
+ * `local` is the binding with no host: the module is written and nothing calls it but people, for an
+ * estate that validates on its own machines only (the module is run with `dagger call` there). Sync
+ * removes the wrapper this tool wrote for the previous binding when its block still hashes to the
+ * lock's digest; an edited one is drift, and a file without markers is the adopter's and stays.
  */
-import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { dirname, join } from "node:path";
 import { BLOCK_BEGIN, BLOCK_END, WORKFLOW_REL_PATH, renderMethodManagedWorkflowBlock, renderMethodValidationWorkflow, } from "../init/ci-workflow.js";
 import { detectBlockDrift, writeMarkedBlockFile } from "../sync/yaml-block-merge.js";
 import { DAGGER_VERSION, MODULE_CALL, MODULE_DIR, REBUILD_FLAG, REBUILD_SCRIPT, moduleSha256, renderModuleFiles } from "./module.js";
-export const CI_BINDINGS = ["github", "gitlab", "jenkins"];
+/** The bindings that render a wrapper for a CI host. */
+export const HOST_BINDINGS = ["github", "gitlab", "jenkins"];
+export const CI_BINDINGS = [...HOST_BINDINGS, "local"];
 /** M-ADR 0219 §8.2 (ruled 2026-10-16): what every SDD has before it chooses. */
 export const DEFAULT_CI_BINDING = "github";
 /**
@@ -31,6 +38,9 @@ export function parseCiRunner(s) {
 export function isCiBinding(s) {
     return CI_BINDINGS.includes(s);
 }
+export function isHostBinding(s) {
+    return HOST_BINDINGS.includes(s);
+}
 const HASH = { begin: BLOCK_BEGIN, end: BLOCK_END };
 // Groovy has no '#' comments.
 const SLASH = { begin: "// method-managed: begin", end: "// method-managed: end" };
@@ -84,6 +94,8 @@ function gitlabBlock(profile, runner) {
         '    DOCKER_TLS_CERTDIR: "/certs"',
         '    DOCKER_TLS_VERIFY: "1"',
         '    DOCKER_CERT_PATH: "/certs/client"',
+        // Full history: the behaviour-store stale check diffs living specs against each change's agreed commit.
+        '    GIT_DEPTH: "0"',
         "  rules:",
         '    - if: $CI_PIPELINE_SOURCE == "merge_request_event"',
         "    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
@@ -168,8 +180,41 @@ export function blockSha256(text, markers) {
 export async function syncCiBinding(o) {
     const failures = [];
     const log = [];
+    const was = o.prevLock?.ciBinding;
+    const sameBinding = (was ?? DEFAULT_CI_BINDING) === o.binding;
+    if (o.binding === "local") {
+        // No host. A switch removes the wrapper this tool wrote for the previous binding, but only when its
+        // block still hashes to the lock's digest: an edited block is drift, a file without markers is the
+        // adopter's and stays.
+        if (o.runner !== undefined && o.runner.length > 0) {
+            failures.push("--ci-runner names where a CI host runs the job; the local binding has no host. Drop --ci-runner (or choose a host binding).");
+        }
+        let removal = null;
+        const previous = sameBinding ? null : was === undefined ? DEFAULT_CI_BINDING : isHostBinding(was) ? was : null;
+        if (previous !== null) {
+            const prevHost = HOST_WRAPPERS[previous];
+            const abs = join(o.targetRepo, prevHost.relPath);
+            const text = await tryRead(abs);
+            const sha = blockSha256(text, prevHost.markers);
+            if (text !== null && sha === null) {
+                log.push(`${prevHost.relPath} has no method-managed markers, so it is the adopter's: left in place.`);
+            }
+            else if (text !== null && (sha === o.prevLock?.ciWorkflowBlockSha256 || o.allowDrift)) {
+                removal = { abs, rel: prevHost.relPath, text, host: prevHost };
+            }
+            else if (text !== null) {
+                failures.push(`${prevHost.relPath}: the method-managed block was edited since the last sync (it no longer matches the lock's digest), so switching to the local binding will not remove it. Re-run with --allow-overwrite to remove the block; adopter content outside the markers is kept.`);
+            }
+        }
+        const mod = await checkModule(o, failures, log);
+        if (o.checkOnly || failures.length > 0)
+            return { failures, log, wrapperSha: null, moduleSha: mod.shaOnDisk };
+        await writeModule(o, mod, log, "; the local binding calls it from no CI host");
+        if (removal !== null)
+            await removeWrapper(removal, o.profile, log);
+        return { failures, log, wrapperSha: null, moduleSha: mod.shaRendered };
+    }
     const host = HOST_WRAPPERS[o.binding];
-    const sameBinding = (o.prevLock?.ciBinding ?? DEFAULT_CI_BINDING) === o.binding;
     // 1. The host wrapper.
     const wrapperAbs = join(o.targetRepo, host.relPath);
     const existing = await tryRead(wrapperAbs);
@@ -187,16 +232,44 @@ export async function syncCiBinding(o) {
     else if (markerless && !o.allowOverwrite) {
         failures.push(`${host.relPath} exists without method-managed markers — refusing to overwrite adopter content. Re-run with --allow-overwrite to replace the file.`);
     }
-    // 2. The module: every file it renders, compared as one set.
+    // 2. The module.
+    const mod = await checkModule(o, failures, log);
+    if (o.checkOnly || failures.length > 0) {
+        return { failures, log, wrapperSha: null, moduleSha: mod.shaOnDisk };
+    }
+    const written = await writeMarkedBlockFile(wrapperAbs, existing === null ? host.file(o.profile, o.runner) : block, host.markers, o.allowOverwrite);
+    if (written.changed)
+        log.push(`${existing === null ? "Wrote" : "Refreshed"} ${host.relPath}.`);
+    await writeModule(o, mod, log, "");
+    // A binding switch between hosts leaves the previous host's file alone: it is the adopter's to delete
+    // once the new host runs, and deleting it here would remove a job some branch protection may still
+    // require. (From local there is no previous host file.)
+    if (!sameBinding && (was === undefined || isHostBinding(was))) {
+        const prevHost = HOST_WRAPPERS[was ?? DEFAULT_CI_BINDING];
+        if ((await tryRead(join(o.targetRepo, prevHost.relPath))) !== null) {
+            log.push(`CI binding is now ${o.binding}; ${prevHost.relPath} (the previous binding) is left in place. Delete it once ${host.relPath} runs.`);
+        }
+    }
+    return {
+        failures,
+        log,
+        wrapperSha: blockSha256(await tryRead(wrapperAbs), host.markers),
+        moduleSha: mod.shaRendered,
+    };
+}
+/**
+ * The module: every file it renders, compared as one set. Pristine when the files on disk hash to the
+ * lock's digest. The render may list a file the last sync never wrote (the generator gained one): it is
+ * absent, not edited, so the digest over the files present decides. A file the adopter deleted still
+ * changes that digest, so it is still drift.
+ */
+async function checkModule(o, failures, log) {
     const rendered = renderModuleFiles();
     const onDisk = [];
     for (const [rel] of rendered)
         onDisk.push([rel, await tryRead(join(o.targetRepo, MODULE_DIR, rel))]);
     const present = onDisk.some(([, c]) => c !== null);
     const matches = rendered.every(([rel, c], i) => onDisk[i][0] === rel && onDisk[i][1] === c);
-    // Pristine when the files on disk hash to the lock's digest. The render may list a file the last sync
-    // never wrote (the generator gained one): it is absent, not edited, so the digest over the files present
-    // decides. A file the adopter deleted still changes that digest, so it is still drift.
     const lockSha = o.prevLock?.ciModuleSha256;
     const modulePristine = lockSha !== undefined &&
         (moduleSha256(onDisk) === lockSha || moduleSha256(onDisk.filter(([, c]) => c !== null)) === lockSha);
@@ -206,35 +279,37 @@ export async function syncCiBinding(o) {
     if (present && !matches && !modulePristine && !o.allowDrift) {
         failures.push(`${MODULE_DIR}/: the method-managed module differs from what this sdd-cli renders. Either the generator changed since the last sync (expected after a CLI upgrade) or a file was hand-edited. Re-run with --allow-overwrite to re-render it.`);
     }
-    if (o.checkOnly || failures.length > 0) {
-        return { failures, log, wrapperSha: null, moduleSha: moduleSha256(onDisk) };
+    return { rendered, present, matches, shaOnDisk: moduleSha256(onDisk), shaRendered: moduleSha256(rendered) };
+}
+async function writeModule(o, mod, log, note) {
+    if (mod.matches)
+        return;
+    for (const [rel, content] of mod.rendered) {
+        const abs = join(o.targetRepo, MODULE_DIR, rel);
+        await mkdir(dirname(abs), { recursive: true });
+        await writeFile(abs, content, "utf8");
     }
-    const written = await writeMarkedBlockFile(wrapperAbs, existing === null ? host.file(o.profile, o.runner) : block, host.markers, o.allowOverwrite);
-    if (written.changed)
-        log.push(`${existing === null ? "Wrote" : "Refreshed"} ${host.relPath}.`);
-    if (!matches) {
-        for (const [rel, content] of rendered) {
-            const abs = join(o.targetRepo, MODULE_DIR, rel);
-            await mkdir(dirname(abs), { recursive: true });
-            await writeFile(abs, content, "utf8");
-        }
-        log.push(`${present ? "Refreshed" : "Wrote"} ${MODULE_DIR}/ (the Method Validation module, M-ADR 0219).`);
+    log.push(`${mod.present ? "Refreshed" : "Wrote"} ${MODULE_DIR}/ (the Method Validation module, M-ADR 0219)${note}.`);
+}
+/**
+ * Remove a wrapper's method-managed block. The file goes with it when what remains is this tool's own
+ * template text (or nothing), since then no line of it is the adopter's; otherwise the rest is kept.
+ */
+async function removeWrapper(r, profile, log) {
+    const cut = (text) => {
+        const b = text.indexOf(r.host.markers.begin);
+        const e = text.indexOf(r.host.markers.end, b) + r.host.markers.end.length;
+        return (text.slice(0, b) + text.slice(e)).replace(/^\n+/, "");
+    };
+    const rest = cut(r.text);
+    if (rest.trim() === "" || rest.trim() === cut(r.host.file(profile)).trim()) {
+        await rm(r.abs);
+        log.push(`Removed ${r.rel}: the local binding has no CI host, and the file held only this tool's wrapper.`);
     }
-    // A binding switch leaves the previous host's file alone: it is the adopter's to delete once the
-    // new host runs, and deleting it here would remove a job some branch protection may still require.
-    if (!sameBinding) {
-        const was = o.prevLock?.ciBinding;
-        const previous = HOST_WRAPPERS[was !== undefined && isCiBinding(was) ? was : DEFAULT_CI_BINDING];
-        if ((await tryRead(join(o.targetRepo, previous.relPath))) !== null) {
-            log.push(`CI binding is now ${o.binding}; ${previous.relPath} (the previous binding) is left in place. Delete it once ${host.relPath} runs.`);
-        }
+    else {
+        await writeFile(r.abs, rest, "utf8");
+        log.push(`Removed the method-managed block from ${r.rel}; the adopter content outside it is kept.`);
     }
-    return {
-        failures,
-        log,
-        wrapperSha: blockSha256(await tryRead(wrapperAbs), host.markers),
-        moduleSha: moduleSha256(rendered),
-    };
 }
 async function tryRead(path) {
     try {

package/dist/lib/ci-binding/module.js

@@ -12,6 +12,7 @@
  */
 import { createHash } from "node:crypto";
 import { getMaintainCliVersion, getVerifyCliVersion } from "../package-version.js";
+import { OPENSPEC_VERSION } from "../validate/behaviour-store.js";
 /** Where the module lives in an SDD (M-ADR 0219 §4.3, ruled 2026-10-16). */
 export const MODULE_DIR = ".dagger/method-validation";
 /**
@@ -27,7 +28,7 @@ export const REBUILD_SCRIPT = `${MODULE_DIR}/catalogue-rebuild.sh`;
 /**
  * Left in the git directory by REBUILD_SCRIPT when the rebuild ran, whether or not it pushed. Every
  * wrapper turns it into the module's --catalogue-rebuild, so the freshness step gates exactly where
- * the rebuild ran (sdm-jts.9's ruling) and the wrapper holds no condition of its own.
+ * the rebuild ran and the wrapper holds no condition of its own.
  */
 export const REBUILD_RAN_MARKER = "sdd-catalogue-rebuild-ran";
 /** What every wrapper appends to MODULE_CALL: --catalogue-rebuild when, and only when, the rebuild ran. */
@@ -37,8 +38,9 @@ const VERIFY_PIN = "@@VERIFY_CLI_VERSION@@";
 // scan would read this text as an import of the CLI's own and refuse a dependency it does not declare.
 const DAGGER_SDK = "@@DAGGER_SDK@@";
 const MAINTAIN_PIN = "@@MAINTAIN_CLI_VERSION@@";
+const OPENSPEC_PIN = "@@OPENSPEC_VERSION@@";
 // The module's own source. String.raw keeps it byte-for-byte, so it holds no backtick; its only
-// substitutions are the three markers above, which renderModuleFiles replaces.
+// substitutions are the four markers above, which renderModuleFiles replaces.
 const INDEX_TS = String.raw `/**
  * Method Validation (M-ADR 0219): the method-managed validation job, as one Dagger module. Every CI
  * host calls it, and none keeps a step list of its own. Written by sdd-cli sync and method-managed:
@@ -57,6 +59,8 @@ import { dag, Container, Directory, File, object, func, ReturnType } from ${DAGG
 // Pinned, so a run is reproducible and every tool the validators shell out to is named here.
 const NODE_IMAGE = "node:20-bookworm"
 const YQ_VERSION = "v4.44.3"
+// The behaviour-store checks run OpenSpec at exactly the version the method depends on (M-ADR 0223 ruling 2), telemetry off.
+const OPENSPEC_VERSION = "${OPENSPEC_PIN}"
 
 interface PlanStep {
   id: string
@@ -69,8 +73,8 @@ interface PlanStep {
 @object()
 export class MethodValidation {
   /**
-   * The toolchain: Node, git, bash, python3, ripgrep, a pinned yq, and the exact-pinned verify and
-   * maintain CLIs. A tarball, when given, replaces the published package (a release candidate).
+   * The toolchain: Node, git, bash, python3, ripgrep, a pinned yq, the pinned OpenSpec CLI, and the
+   * exact-pinned verify and maintain CLIs. A tarball, when given, replaces the published package (a release candidate).
    */
   @func()
   toolchain(
@@ -99,7 +103,11 @@ export class MethodValidation {
       c = c.withFile("/pkgs/maintain-cli.tgz", maintainTarball)
       pkgs.push("/pkgs/maintain-cli.tgz")
     } else pkgs.push("@sdd-method/maintain-cli@" + maintainVersion)
-    return c.withExec(["npm", "install", "-g", "--silent", ...pkgs])
+    pkgs.push("@fission-ai/openspec@" + OPENSPEC_VERSION)
+    return c
+      .withEnvVariable("OPENSPEC_TELEMETRY", "0")
+      .withEnvVariable("DO_NOT_TRACK", "1")
+      .withExec(["npm", "install", "-g", "--silent", ...pkgs])
   }
 
   /**
@@ -130,10 +138,12 @@ export class MethodValidation {
     for (const step of plan.steps) {
       const ran = base.withExec([step.tool, ...step.args], { expect: ReturnType.Any })
       const code = await ran.exitCode()
-      const verdict = code === 0 ? "PASS" : step.advisory ? "ADVISORY" : "FAIL"
+      // A step that ran over an empty population (no behaviour store, say) reports N/A, never PASS.
+      const measuredNothing = code === 0 && /^\[(N\/A|SKIP)\] /m.test(await ran.stdout()) && !/^\[PASS\] (?!All validators)/m.test(await ran.stdout())
+      const verdict = code === 0 ? (measuredNothing ? "N/A" : "PASS") : step.advisory ? "ADVISORY" : "FAIL"
       if (code !== 0 && !step.advisory) failed++
       lines.push(verdict.padEnd(8) + " exit " + code + "  " + step.id + "  (" + step.title + ")")
-      if (code !== 0) {
+      if (code !== 0 || measuredNothing) {
         const out = (await ran.stdout()) + (await ran.stderr())
         lines.push(...out.trim().split("\n").slice(-6).map((l) => "           " + l))
       }
@@ -257,7 +267,7 @@ export function renderModuleFiles(pins = { verify: getVerifyCliVersion(), mainta
         ["catalogue-rebuild.sh", REBUILD_SH],
         ["dagger.json", DAGGER_JSON],
         ["package.json", PACKAGE_JSON],
-        ["src/index.ts", INDEX_TS.split(VERIFY_PIN).join(pins.verify).split(MAINTAIN_PIN).join(pins.maintain).split(DAGGER_SDK).join('"@dagger.io' + '/dagger"')],
+        ["src/index.ts", INDEX_TS.split(VERIFY_PIN).join(pins.verify).split(MAINTAIN_PIN).join(pins.maintain).split(OPENSPEC_PIN).join(OPENSPEC_VERSION).split(DAGGER_SDK).join('"@dagger.io' + '/dagger"')],
         ["tsconfig.json", TSCONFIG_JSON],
         ["yarn.lock", YARN_LOCK],
     ];

package/dist/lib/init/ci-workflow.js

@@ -93,6 +93,8 @@ function buildMethodManagedBlock(profile, runner) {
         // The branch itself when rebuilding, so the rebuild lands on it; otherwise the event's own ref.
         "          ref: ${{ steps.catalogue-token.outputs.token != '' && (github.head_ref || github.ref_name) || '' }}",
         "          persist-credentials: false",
+        // Full history: the behaviour-store stale check diffs living specs against each change's agreed commit.
+        "          fetch-depth: 0",
         "      - name: Install Dagger",
         `        run: curl -fsSL https://dl.dagger.io/dagger/install.sh | BIN_DIR="$RUNNER_TEMP/dagger" DAGGER_VERSION=${DAGGER_VERSION} sh && echo "$RUNNER_TEMP/dagger" >> "$GITHUB_PATH"`,
         "      - name: Rebuild catalogues",

package/dist/lib/lock-file.js

@@ -215,7 +215,7 @@ function parseVersioned(raw) {
             // a YAML reader parses 113 of 325 entries in one real lock as MAPPINGS
             // rather than strings — silently, with no error. Quoting on write is the
             // fix; reading both forms ships first so no lock can be written that an
-            // older reader cannot parse. See method-open-items §3l.
+            // older reader cannot parse.
             const entry = stripQuotes(line.slice("      - ".length));
             const withDigest = DIGEST_ENTRY_RE.exec(entry);
             if (withDigest) {

package/dist/lib/pack/reference-closure.js

@@ -14,10 +14,10 @@
  * ENFORCEMENT (validate-link-closure.sh). A subset cannot satisfy closure
  * without ceasing to be a subset.
  *
- * Parser hardening comes from the estate that measured this problem — the
- * four traps their link audit hit are this module's controls: markdown
+ * Parser hardening covers the four traps a real link audit hit, which are
+ * this module's controls: markdown
  * targets containing SPACES (unencoded paths must not truncate at the first
- * space), targets containing PARENTHESES (balance them; "…(ReBAC).md" broke
+ * space), targets containing PARENTHESES (balance them; "…(v2).md" broke
  * every naive regex), URL-ENCODED targets (%20, %3A… decode before
  * resolving), and never scanning outside the payload set (no cache dirs —
  * guaranteed here by construction, since only staged payload paths are read).

package/dist/lib/package-version.js

@@ -83,7 +83,7 @@ export function getVerifyCliVersion() {
 }
 /**
  * The @sdd-method/maintain-cli version released WITH this sdd-cli. The managed CI workflow's
- * catalogue freshness step installs exactly this version (M-ADR 0218 §5; ruled 2026-10-15, sdm-jts.6).
+ * catalogue freshness step installs exactly this version (M-ADR 0218 §5).
  * Read the same way as the verify version, for the same reason (dist/ copy, never scripts/ live).
  */
 export function getMaintainCliVersion() {

package/dist/lib/snapshot/manifest.js

@@ -82,7 +82,7 @@ export async function readManifest(areaRoot, id) {
     }
     if (!Array.isArray(raw.members))
         problems.push("members must be a list");
-    // A hand-written revision of digits only (`50834756022`) parses as a NUMBER, and
+    // A hand-written revision of digits only (`12345678901`) parses as a NUMBER, and
     // a strict comparison with the folder's string suffix then calls an unchanged
     // member changed. Identity fields are strings, whatever YAML made of them.
     for (const m of raw.members ?? []) {

package/dist/lib/sync/adr-transitions.js

@@ -90,7 +90,7 @@ export async function planAdrTransitions(bundleRootDir, targetRepo, previousVers
     const protectedFromRemoval = [];
     const movedPaths = [];
     /**
-     * FIRST ADOPTION replays the bundle's whole transition history (ledger §3ae).
+     * FIRST ADOPTION replays the bundle's whole transition history.
      * A repo adopting a bundle for the first time receives its CURRENT state, so
      * every transition in the log happened before this repo existed as an
      * adopter — yet the log is filtered only by "newer than the last applied

package/dist/lib/sync/config.js

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
@@ -57,7 +58,7 @@ export async function loadSyncConfig(configPath) {
             const rel = `${name}/${name}-${ver}.tar.gz`;
             source = isUrl(resolvedBase)
                 ? `${resolvedBase.replace(/\/$/, "")}/${rel}`
-                : resolve(resolvedBase, name, `${name}-${ver}.tar.gz`);
+                : localBundle(resolve(resolvedBase, name), `${name}-${ver}`);
         }
         else {
             throw new Error(`Sync config ${absPath} bundles[${i}] missing required field: source ` +
@@ -69,4 +70,10 @@ export async function loadSyncConfig(configPath) {
         ? { version, bundles }
         : { version, bundleSource, bundles };
 }
+// <dir>/<stem>.tar.gz, or <dir>/<stem>.tgz when only that exists (same bytes, another name).
+function localBundle(dir, stem) {
+    const tarGz = resolve(dir, `${stem}.tar.gz`);
+    const tgz = resolve(dir, `${stem}.tgz`);
+    return !existsSync(tarGz) && existsSync(tgz) ? tgz : tarGz;
+}
 //# sourceMappingURL=config.js.map

package/dist/lib/sync/diff.js

@@ -154,7 +154,7 @@ export function computeRemovals(prevPaths, incomingPaths, options) {
 }
 /**
  * SHADOW COLLISIONS — an incoming managed file whose basename already exists at
- * a SHALLOWER, unmanaged path in the adopter's repo (ledger §3ap).
+ * a SHALLOWER, unmanaged path in the adopter's repo.
  *
  * When the distributed surface MOVES a file, copies previously delivered at the
  * old location are stranded as unmanaged files. They keep resolving, so nothing

package/dist/lib/sync/index.js

@@ -102,7 +102,12 @@ export async function runSync(opts, stdout = (line) => process.stdout.write(line
             stdout(fail(`method-baseline.lock names ci_runner '${prevLock.ciRunner}', which is not a list of runner labels. Re-run with --ci-runner <label[,label]> or --ci-runner default.`));
             return { exitCode: 1 };
         }
-        const ciRunner = opts.ciRunner ?? lockRunner;
+        // The local binding has no host to run on: a runner the lock recorded for an earlier host binding is
+        // dropped (and the lock line with it); only an explicit --ci-runner with local is refused.
+        const droppedRunner = ciBinding === "local" && opts.ciRunner === undefined && lockRunner !== undefined && lockRunner.length > 0;
+        const ciRunner = ciBinding === "local" && opts.ciRunner === undefined ? undefined : opts.ciRunner ?? lockRunner;
+        if (droppedRunner)
+            stdout(info(`ci_runner '${prevLock.ciRunner}' dropped: the local binding has no CI host to run on.`));
         const lockSource = prevLock?.cliSource;
         if (lockSource !== undefined && !CLI_SOURCES.includes(lockSource)) {
             stdout(fail(`method-baseline.lock names cli_source '${lockSource}', which is not one of ${CLI_SOURCES.join(", ")}. Re-run with --cli-source <source> to choose one.`));
@@ -239,7 +244,7 @@ export async function runSync(opts, stdout = (line) => process.stdout.write(line
         if (cacheOnlyPaths.length > 0) {
             stdout(info(`Cache-only (scaffold-source/registry) files: ${cacheOnlyPaths.length} — extracted to .sdd/bundle-cache, not materialised`));
         }
-        // SHADOW-COLLISION FLAG (ledger §3ap, the durable move-rule's machinery).
+        // SHADOW-COLLISION FLAG (the durable move-rule's machinery).
         // When the distributed surface MOVES a file, previously-delivered copies at
         // the old location are stranded as unmanaged files: they keep resolving, so
         // nothing breaks loudly, and they silently go stale as their managed twins
@@ -270,7 +275,7 @@ export async function runSync(opts, stdout = (line) => process.stdout.write(line
             }
         }
         stdout(info(`Conflicts: ${conflicts.length}`));
-        // RELABEL (ledger §3y.2): the raw count mixes two different things and an
+        // RELABEL: the raw count mixes two different things and an
         // adopter's dry-run reported 31 where the artefacts on disk numbered 5.
         // Nothing was wrong with the mechanism — the LABEL claimed deletions for
         // lock entries whose paths were never materialised (cache-only payload