@skill-map/cli 0.39.0 → 0.40.0

package/dist/cli.js

@@ -441,7 +441,6 @@ var claudeProvider = {
   id: "claude",
   pluginId: CLAUDE_PLUGIN_ID,
   kind: "provider",
-  version: "1.0.0",
   description: "Classifies files under `.claude/{agents,commands,skills}` as Claude Code agents, commands, and skills.",
   // Vendor provider: Claude Code only reads its own `.claude/` territory
   // and ignores `.codex/` / Antigravity layouts at runtime. Gating the
@@ -726,7 +725,6 @@ var atDirectiveExtractor = {
   id: ID,
   pluginId: CLAUDE_PLUGIN_ID,
   kind: "extractor",
-  version: "1.0.0",
   description: "Detects `@<token>` directives in a node's body using Claude Code rules. A bare handle (e.g. `@team`) becomes a `mentions` link; a file-flavoured token (e.g. `@docs/api.md`, `@./readme.md`) becomes a `references` link.",
   scope: "body",
   precondition: { provider: ["claude"] },
@@ -815,7 +813,6 @@ var slashCommandExtractor = {
   id: ID2,
   pluginId: CLAUDE_PLUGIN_ID,
   kind: "extractor",
-  version: "1.0.0",
   description: "Turns `/command` invocations in a node's body into arrows that point at the resolved slash command or skill, using Claude Code routing rules.",
   scope: "body",
   precondition: { provider: ["claude"] },
@@ -865,7 +862,6 @@ var antigravityProvider = {
   id: "antigravity",
   pluginId: ANTIGRAVITY_PLUGIN_ID,
   kind: "provider",
-  version: "1.0.0",
   description: "Declares the Google Antigravity runtime and its reserved built-in names.",
   // Vendor provider: marked gated for the day Antigravity grows its own
   // on-disk kind beyond the open standard. Today `kinds: {}` and
@@ -1014,7 +1010,6 @@ var openaiProvider = {
   id: "openai",
   pluginId: OPENAI_PLUGIN_ID,
   kind: "provider",
-  version: "1.0.0",
   description: "Classifies files under `.codex/agents/*.toml` as OpenAI Codex CLI sub-agents.",
   // Vendor provider: Codex CLI only reads its own `.codex/` territory.
   // Gating the classifier behind the active lens keeps the walker from
@@ -1072,7 +1067,6 @@ var agentSkillsProvider = {
   id: "agent-skills",
   pluginId: AGENT_SKILLS_PLUGIN_ID,
   kind: "provider",
-  version: "1.0.0",
   description: "Classifies files under `.agents/skills/<name>/SKILL.md` as Agent Skills.",
   read: { extensions: [".md"], parser: "frontmatter-yaml" },
   kinds: {
@@ -1120,7 +1114,6 @@ var coreMarkdownProvider = {
   id: "markdown",
   pluginId: CORE_PLUGIN_ID,
   kind: "provider",
-  version: "1.0.0",
   description: "Universal `.md` fallback. Claims any markdown file that no vendor-specific provider has classified.",
   read: { extensions: [".md"], parser: "frontmatter-yaml" },
   // Per spec § A.6, defaultRefreshAction values MUST be qualified
@@ -1156,10 +1149,14 @@ var coreMarkdownProvider = {
   },
   // No `resolution`: `core/markdown` is the universal fallback Provider,
   // it does not declare an invocation surface of its own. Mentions /
-  // slashes sourced from markdown bodies still resolve via OTHER
-  // Providers' resolution maps (the lookup keys on the source node's
-  // Provider id, not on `core/markdown`). Leaving the field absent keeps
-  // the contract narrow.
+  // slashes sourced from markdown bodies are still resolved by the
+  // post-walk transform, the lookup keys on the ACTIVE PROVIDER LENS
+  // (per `spec/architecture.md` §Provider · resolution rules), mirroring
+  // the extractor gate that authorised the emission in the first place.
+  // Leaving this field absent therefore has no resolver-side impact
+  // under any lens that DOES declare a resolution map; it would only
+  // matter the day `markdown` itself becomes a lens (which is not on
+  // the roadmap, the format is provider-agnostic by design).
   classify() {
     return "markdown";
   }
@@ -1171,7 +1168,6 @@ var annotationsExtractor = {
   id: ID3,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  version: "1.0.0",
   description: "Turns the `supersedes` and `supersededBy` entries from a node's `.sm` sidecar into arrows between nodes in the graph.",
   scope: "frontmatter",
   extract(ctx) {
@@ -1233,7 +1229,6 @@ var externalUrlCounterExtractor = {
   id: ID4,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  version: "1.0.0",
   description: "Counts the distinct external URLs in a node's body and shows the count on the card.",
   scope: "body",
   /**
@@ -1322,7 +1317,6 @@ var markdownLinkExtractor = {
   id: ID5,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  version: "1.0.0",
   description: "Turns markdown links (`[text](path)`) in a node's body into arrows between nodes in the graph.",
   scope: "body",
   extract(ctx) {
@@ -1384,7 +1378,6 @@ var mcpToolsExtractor = {
   id: ID6,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  version: "1.0.0",
   description: "Turns `tools: [mcp__<server>__<tool>]` entries in a node's frontmatter into an MCP node per unique server and an arrow from the source to each one.",
   scope: "frontmatter",
   extract(ctx) {
@@ -1446,7 +1439,6 @@ var toolsCounterExtractor = {
   id: ID7,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  version: "1.0.0",
   description: "Counts the tools an agent declares in its frontmatter and shows the count on the agent card.",
   scope: "frontmatter",
   precondition: { kind: ["claude/agent"] },
@@ -1513,34 +1505,15 @@ var annotationFieldUnknownAnalyzer = {
   id: ID8,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags typos or unrecognized keys in sidecars (`.sm`).",
   mode: "deterministic",
-  ui: {
-    // Corner badge on the graph card; count omitted when there is a
-    // single unknown field (avoids a noisy "icon + 1" chip).
-    alert: {
-      slot: "graph.node.alert",
-      // Filled warning triangle on the corner, matches the broken-ref
-      // alert's "attention-grabbing solid" pattern; the footer chip
-      // below stays outlined for the quieter counter pairing.
-      icon: "fa-solid fa-triangle-exclamation",
-      emitWhenEmpty: false
-    },
-    // Footer chip on the card, `_counter` shape but rendered icon-only
-    // (the analyzer emits `value: 0` so NodeCounter hides the number
-    // and only the glyph shows). PrimeIcons `pi-question-circle` so the
-    // visual weight matches `annotation-stale`'s `pi-clock` chip
-    // sitting next to it on the same footer row. `emitWhenEmpty: true`
-    // is required: with `value: 0` the slot treats the payload as
-    // empty, so the manifest has to opt in to keep the emission.
-    chip: {
-      slot: "card.footer.right",
-      icon: "pi-question-circle",
-      emitWhenEmpty: true,
-      priority: 30
-    }
-  },
+  // No `ui` declaration: the per-node icon-only chip used to surface
+  // "this sidecar declares unknown keys" on `card.footer.right`, but
+  // its severity (`warn`) is now folded into the aggregate counters
+  // emitted by `core/issue-counter`. The detection logic stays, the
+  // findings still ship as `Issue` records (visible in the inspector,
+  // `sm check`, etc.).
+  ui: {},
   // Analyzer body iterates every sidecar root and classifies each
   // key against three buckets (catalog / plugin namespace / unknown
   // root). The per-key branching IS the classification table; factoring
@@ -1623,19 +1596,7 @@ var annotationFieldUnknownAnalyzer = {
         bump2(node.path);
       }
     }
-    for (const [nodePath, count] of perNode) {
-      const tooltip = count === 1 ? ANNOTATION_FIELD_UNKNOWN_TEXTS.alertTooltipSingle : tx(ANNOTATION_FIELD_UNKNOWN_TEXTS.alertTooltipMany, { count });
-      ctx.emitContribution(nodePath, "alert", {
-        icon: "fa-solid fa-triangle-exclamation",
-        severity: "warn",
-        tooltip
-      });
-      ctx.emitContribution(nodePath, "chip", {
-        value: 0,
-        severity: "warn",
-        tooltip
-      });
-    }
+    void perNode;
     return issues;
   }
 };
@@ -1694,7 +1655,6 @@ var annotationOrphanAnalyzer = {
   id: ID9,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags sidecars (`.sm`) whose `.md` file no longer exists.",
   mode: "deterministic",
   evaluate(ctx) {
@@ -1746,7 +1706,6 @@ var annotationStaleAnalyzer = {
   id: ID10,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Marks sidecars (`.sm`) that are out of date with their `.md`.",
   mode: "deterministic",
   // The natural fix is to bump the node: refreshes `for` hashes,
@@ -1767,7 +1726,10 @@ var annotationStaleAnalyzer = {
       slot: "card.footer.right",
       icon: "pi-clock",
       emitWhenEmpty: true,
-      priority: 20
+      // First in the footer-right cluster: drift is the operator's
+      // entry point for "this node disagrees with its sidecar",
+      // followed by stability, then the severity counters.
+      priority: 10
     }
   },
   evaluate(ctx) {
@@ -1810,7 +1772,6 @@ var contributionOrphanAnalyzer = {
   id: ID11,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "0.0.0",
   description: "Warns about plugin data referencing nodes renamed or deleted in the latest scan.",
   mode: "deterministic",
   evaluate(_ctx) {
@@ -1818,6 +1779,89 @@ var contributionOrphanAnalyzer = {
   }
 };
 
+// plugins/core/analyzers/issue-counter/text.ts
+var ISSUE_COUNTER_TEXTS = {
+  errorTooltipSingle: "1 error",
+  errorTooltipMany: "{{count}} errors",
+  warnTooltipSingle: "1 warning",
+  warnTooltipMany: "{{count}} warnings"
+};
+
+// plugins/core/analyzers/issue-counter/index.ts
+var ID12 = "issue-counter";
+function countByTier(issues) {
+  const errors = /* @__PURE__ */ new Map();
+  const warns = /* @__PURE__ */ new Map();
+  for (const issue of issues) {
+    const bucket = issue.severity === "error" ? errors : issue.severity === "warn" ? warns : null;
+    if (!bucket) continue;
+    for (const nodeId of issue.nodeIds) {
+      bucket.set(nodeId, (bucket.get(nodeId) ?? 0) + 1);
+    }
+  }
+  return { errors, warns };
+}
+function emitTierChips(ctx, contributionId, severity, counts, singleTooltip, manyTooltip) {
+  for (const [nodePath, count] of counts) {
+    const capped = Math.min(count, 99);
+    ctx.emitContribution(nodePath, contributionId, {
+      value: capped,
+      severity,
+      tooltip: count === 1 ? singleTooltip : tx(manyTooltip, { count })
+    });
+  }
+}
+var issueCounterAnalyzer = {
+  id: ID12,
+  pluginId: CORE_PLUGIN_ID,
+  kind: "analyzer",
+  description: "Emits one aggregate severity chip per node (error + warn counts) from the live issue accumulator.",
+  mode: "deterministic",
+  phase: "aggregate",
+  ui: {
+    // Third in the footer-right cluster, after the drift chip
+    // (priority 10) and the stability badge (priority 20). The warn
+    // counter sits before the error counter so the operator reads
+    // "advisory → blocking" left-to-right.
+    warnCount: {
+      slot: "card.footer.right",
+      icon: "pi-exclamation-triangle",
+      emitWhenEmpty: false,
+      priority: 30
+    },
+    // Last in the cluster, the red chip pins to the right edge so the
+    // most severe signal anchors the row's reading position.
+    errorCount: {
+      slot: "card.footer.right",
+      icon: "pi-times-circle",
+      emitWhenEmpty: false,
+      priority: 40
+    }
+  },
+  evaluate(ctx) {
+    const accumulator = ctx.accumulatedIssues ?? [];
+    if (accumulator.length === 0) return [];
+    const { errors, warns } = countByTier(accumulator);
+    emitTierChips(
+      ctx,
+      "errorCount",
+      "danger",
+      errors,
+      ISSUE_COUNTER_TEXTS.errorTooltipSingle,
+      ISSUE_COUNTER_TEXTS.errorTooltipMany
+    );
+    emitTierChips(
+      ctx,
+      "warnCount",
+      "warn",
+      warns,
+      ISSUE_COUNTER_TEXTS.warnTooltipSingle,
+      ISSUE_COUNTER_TEXTS.warnTooltipMany
+    );
+    return [];
+  }
+};
+
 // plugins/core/analyzers/job-file-orphan/text.ts
 var JOB_FILE_ORPHAN_TEXTS = {
   /**
@@ -1828,12 +1872,11 @@ var JOB_FILE_ORPHAN_TEXTS = {
 };
 
 // plugins/core/analyzers/job-file-orphan/index.ts
-var ID12 = "job-file-orphan";
+var ID13 = "job-file-orphan";
 var jobFileOrphanAnalyzer = {
-  id: ID12,
+  id: ID13,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags leftover job result files (no live job references them). Clean up via `sm job prune --orphan-files`.",
   mode: "deterministic",
   evaluate(ctx) {
@@ -1842,7 +1885,7 @@ var jobFileOrphanAnalyzer = {
     const issues = [];
     for (const filePath of orphans) {
       issues.push({
-        analyzerId: ID12,
+        analyzerId: ID13,
         severity: "warn",
         nodeIds: [filePath],
         message: tx(JOB_FILE_ORPHAN_TEXTS.message, { filePath }),
@@ -1860,12 +1903,11 @@ var LINK_CONFLICT_TEXTS = {
 };
 
 // plugins/core/analyzers/link-conflict/index.ts
-var ID13 = "link-conflict";
+var ID14 = "link-conflict";
 var linkConflictAnalyzer = {
-  id: ID13,
+  id: ID14,
   pluginId: "core",
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags conflicting arrow meanings between extractors (e.g. `references` vs `invokes`).",
   mode: "deterministic",
   // Bucket links by (source, target), then per-bucket detect distinct
@@ -1910,7 +1952,7 @@ var linkConflictAnalyzer = {
       const [source, target] = key.split("\0");
       const kindList = variants.map((v) => v.kind).join(" / ");
       issues.push({
-        analyzerId: ID13,
+        analyzerId: ID14,
         severity: "warn",
         nodeIds: [source, target],
         message: tx(LINK_CONFLICT_TEXTS.message, {
@@ -1977,12 +2019,11 @@ function resolveLinkTargetToPath(link, nameIndex) {
 }
 
 // plugins/core/analyzers/link-counter/index.ts
-var ID14 = "link-counter";
+var ID15 = "link-counter";
 var linkCounterAnalyzer = {
-  id: ID14,
+  id: ID15,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Counts incoming and outgoing links per node.",
   mode: "deterministic",
   ui: {
@@ -2057,12 +2098,11 @@ var LINK_SELF_LOOP_TEXTS = {
 };
 
 // plugins/core/analyzers/link-self-loop/index.ts
-var ID15 = "link-self-loop";
+var ID16 = "link-self-loop";
 var linkSelfLoopAnalyzer = {
-  id: ID15,
+  id: ID16,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags links whose source is also their own resolved target (e.g. a body heading like `# /deploy` inside the file that defines `/deploy`).",
   mode: "deterministic",
   evaluate(ctx) {
@@ -2071,7 +2111,7 @@ var linkSelfLoopAnalyzer = {
     for (const link of ctx.links) {
       if (!isSelfLoop(link)) continue;
       issues.push({
-        analyzerId: ID15,
+        analyzerId: ID16,
         severity: "warn",
         nodeIds: [link.source],
         message: tx(LINK_SELF_LOOP_TEXTS.message, {
@@ -2175,10 +2215,9 @@ function resolveByName(link, indexes, ctx) {
   const winner = candidates.find((c) => allowedKinds.includes(c.kind));
   return winner ? winner.path : "none";
 }
-function lookupAllowedKinds(link, indexes, ctx) {
-  const sourceNode = indexes.nodeByPath.get(link.source);
-  if (!sourceNode) return void 0;
-  return ctx.providerResolution.get(sourceNode.provider)?.[link.kind];
+function lookupAllowedKinds(link, _indexes, ctx) {
+  if (ctx.activeProvider === null) return void 0;
+  return ctx.providerResolution.get(ctx.activeProvider)?.[link.kind];
 }
 function stripTriggerSigil(normalized) {
   if (!normalized) return null;
@@ -2221,12 +2260,11 @@ var NAME_RESERVED_TEXTS = {
 };
 
 // plugins/core/analyzers/name-reserved/index.ts
-var ID16 = "name-reserved";
+var ID17 = "name-reserved";
 var nameReservedAnalyzer = {
-  id: ID16,
+  id: ID17,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags two kinds of reserved-name collision: a file whose name shadows a built-in command of the active runtime, and a link that resolves to one of those reserved names.",
   mode: "deterministic",
   // eslint-disable-next-line complexity
@@ -2240,7 +2278,7 @@ var nameReservedAnalyzer = {
       const node = byPath3.get(path);
       if (!node) continue;
       issues.push({
-        analyzerId: ID16,
+        analyzerId: ID17,
         severity: "warn",
         nodeIds: [node.path],
         message: tx(NAME_RESERVED_TEXTS.message, {
@@ -2256,7 +2294,7 @@ var nameReservedAnalyzer = {
       const reservedNode = findReservedNodeForLink(link, reserved, byPath3);
       if (!reservedNode) continue;
       issues.push({
-        analyzerId: ID16,
+        analyzerId: ID17,
         severity: "warn",
         nodeIds: [link.source],
         message: tx(NAME_RESERVED_TEXTS.linkMessage, {
@@ -2317,30 +2355,32 @@ function normaliseId(raw) {
 }
 
 // plugins/core/analyzers/node-stability/index.ts
-var ID17 = "node-stability";
+var ID18 = "node-stability";
 var EXPERIMENTAL_TOOLTIP = "Experimental: API may change";
 var DEPRECATED_TOOLTIP = "Deprecated: avoid in new code";
 var nodeStabilityAnalyzer = {
-  id: ID17,
+  id: ID18,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Reports a node's stability stage (`experimental`, `deprecated`) on the card.",
   mode: "deterministic",
   ui: {
+    // Second in the footer-right cluster, after the drift chip and
+    // before the severity counters. Stability is a state badge, not a
+    // count, so its priority sits between the two semantic zones.
     experimental: {
       slot: "card.footer.right",
       icon: "fa-solid fa-flask",
       label: "experimental",
       emitWhenEmpty: false,
-      priority: 10
+      priority: 20
     },
     deprecated: {
       slot: "card.footer.right",
       icon: "pi-ban",
       label: "deprecated",
       emitWhenEmpty: false,
-      priority: 10
+      priority: 20
     }
   },
   evaluate(ctx) {
@@ -2353,7 +2393,7 @@ var nodeStabilityAnalyzer = {
           tooltip: EXPERIMENTAL_TOOLTIP
         });
         issues.push({
-          analyzerId: ID17,
+          analyzerId: ID18,
           severity: "info",
           nodeIds: [node.path],
           message: `Node '${node.path}' is marked experimental: API may change.`,
@@ -2366,7 +2406,7 @@ var nodeStabilityAnalyzer = {
           severity: "warn"
         });
         issues.push({
-          analyzerId: ID17,
+          analyzerId: ID18,
           severity: "warn",
           nodeIds: [node.path],
           message: `Node '${node.path}' is marked deprecated: avoid in new code.`,
@@ -2400,12 +2440,11 @@ var NODE_SUPERSEDED_TEXTS = {
 };
 
 // plugins/core/analyzers/node-superseded/index.ts
-var ID18 = "node-superseded";
+var ID19 = "node-superseded";
 var nodeSupersededAnalyzer = {
-  id: ID18,
+  id: ID19,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Marks nodes replaced by a newer one via `supersededBy`.",
   mode: "deterministic",
   evaluate(ctx) {
@@ -2414,7 +2453,7 @@ var nodeSupersededAnalyzer = {
       const supersededBy = pickSupersededBy(node);
       if (supersededBy === null) continue;
       issues.push({
-        analyzerId: ID18,
+        analyzerId: ID19,
         severity: "info",
         nodeIds: [node.path],
         message: tx(NODE_SUPERSEDED_TEXTS.message, {
@@ -2457,66 +2496,34 @@ var REFERENCE_BROKEN_TEXTS = {
 };
 
 // plugins/core/analyzers/reference-broken/index.ts
-var ID19 = "reference-broken";
+var ID20 = "reference-broken";
 var referenceBrokenAnalyzer = {
-  id: ID19,
+  id: ID20,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags arrows pointing at a node not part of the current scan.",
   mode: "deterministic",
-  ui: {
-    // Corner badge on the graph card; count omitted when there is a
-    // single broken ref (avoids a noisy "icon + 1" chip).
-    alert: {
-      slot: "graph.node.alert",
-      icon: "fa-solid fa-circle-xmark",
-      emitWhenEmpty: false
-    },
-    // Footer chip on the card. `_counter` shape, `value` always shows,
-    // so the operator sees "how many" at a glance. Renders OUTLINED
-    // (`fa-regular`) so the corner alert (filled, attention-grabbing)
-    // and the footer chip (quieter, paired with a number) read as two
-    // beats of the same signal rather than two identical glyphs.
-    chip: {
-      slot: "card.footer.right",
-      icon: "fa-regular fa-circle-xmark",
-      emitWhenEmpty: false,
-      priority: 40
-    }
-  },
-  // The resolver, the reference-paths escape hatch, the per-source
-  // aggregation, and the dual-slot emit (with single/plural tooltip and
-  // optional count) all live in one flow because they share the per-link
-  // loop. Splitting them would re-walk `ctx.links` three times.
-  // eslint-disable-next-line complexity
+  // No `ui` declaration: this analyzer used to emit a per-finding
+  // counter chip on `card.footer.right`, but that chip duplicated the
+  // aggregate severity counters now owned by `core/issue-counter`. The
+  // detection logic stays intact, only the chip emission is gone.
+  ui: {},
+  // The resolver, the reference-paths escape hatch, and the hint
+  // index all share the per-link loop, splitting would re-walk
+  // `ctx.links` once per concern. The per-source aggregation that
+  // historically lived alongside (driving the now-retired chip
+  // emission) moved into `core/issue-counter`.
   evaluate(ctx) {
     const byPath3 = new Set(ctx.nodes.map((n) => n.path));
     const byNormalizedName = indexByNormalizedName(ctx.nodes);
     const byBasenameWithoutName = indexByBasenameWithoutName(ctx.nodes);
     const refIndex = ctx.referenceablePaths && ctx.referenceablePaths.size > 0 && ctx.cwd ? { paths: ctx.referenceablePaths, cwd: ctx.cwd } : null;
     const issues = [];
-    const perNode = /* @__PURE__ */ new Map();
     for (const link of ctx.links) {
       if (isResolved(link, byPath3, byNormalizedName)) continue;
       if (refIndex && resolvesViaReferencePaths(link, refIndex)) continue;
       const candidates = findHintCandidates(link, byBasenameWithoutName);
       issues.push(buildIssue(link, candidates));
-      perNode.set(link.source, (perNode.get(link.source) ?? 0) + 1);
-    }
-    for (const [nodePath, count] of perNode) {
-      const tooltip = count === 1 ? REFERENCE_BROKEN_TEXTS.alertTooltipSingle : tx(REFERENCE_BROKEN_TEXTS.alertTooltipMany, { count });
-      const capped = Math.min(count, 99);
-      ctx.emitContribution(nodePath, "alert", {
-        icon: "fa-solid fa-circle-xmark",
-        severity: "danger",
-        tooltip
-      });
-      ctx.emitContribution(nodePath, "chip", {
-        value: capped,
-        severity: "danger",
-        tooltip
-      });
     }
     return issues;
   }
@@ -2528,8 +2535,14 @@ function buildIssue(link, hintCandidates = []) {
     trigger: link.trigger?.normalizedTrigger ?? null
   };
   const issue = {
-    analyzerId: ID19,
-    severity: "warn",
+    analyzerId: ID20,
+    // `error`, not `warn`: a link whose target is not in the scan is a
+    // structural defect the operator must notice, and the card chip
+    // paints `danger` (red) to match. Per the chip-vs-issue policy in
+    // `context/view-slots.md`, a `danger` chip MUST be backed by an
+    // `error` Issue so the visual signal lines up with the exit code
+    // and the global error count on the card.
+    severity: "error",
     nodeIds: [link.source],
     message: tx(REFERENCE_BROKEN_TEXTS.message, {
       kind: link.kind,
@@ -2638,12 +2651,11 @@ var REFERENCE_REDUNDANT_TEXTS = {
 };
 
 // plugins/core/analyzers/reference-redundant/index.ts
-var ID20 = "reference-redundant";
+var ID21 = "reference-redundant";
 var referenceRedundantAnalyzer = {
-  id: ID20,
+  id: ID21,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags when one node references the same target through two or more different links (e.g. a markdown link plus a `references:` entry).",
   mode: "deterministic",
   evaluate(ctx) {
@@ -2667,7 +2679,7 @@ var referenceRedundantAnalyzer = {
       const [source, resolvedTarget] = key.split("\0");
       const flat = flattenOccurrences(links);
       issues.push({
-        analyzerId: ID20,
+        analyzerId: ID21,
         severity: "warn",
         nodeIds: [source],
         message: tx(REFERENCE_REDUNDANT_TEXTS.message, {
@@ -2989,35 +3001,25 @@ var SCHEMA_VIOLATION_TEXTS = {
 };
 
 // plugins/core/analyzers/schema-violation/index.ts
-var ID21 = "schema-violation";
+var ID22 = "schema-violation";
 var schemaViolationAnalyzer = {
-  id: ID21,
+  id: ID22,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Flags nodes or links that violate the project schemas.",
   mode: "deterministic",
-  ui: {
-    // Corner badge on the graph card; surfaces when the node body /
-    // frontmatter fails schema validation (parse error, missing
-    // `name`/`description`, malformed YAML, etc.). Same visual
-    // chassis as `core/reference-broken`, danger severity.
-    alert: {
-      slot: "graph.node.alert",
-      icon: "fa-solid fa-triangle-exclamation",
-      emitWhenEmpty: false
-    },
-    // Footer chip that mirrors the corner alert with the actual
-    // count so the operator can scan the cards and prioritise.
-    // Outlined (vs the filled corner alert) per the broken-ref
-    // pattern: two beats of the same signal.
-    chip: {
-      slot: "card.footer.right",
-      icon: "fa-regular fa-triangle-exclamation",
-      emitWhenEmpty: false,
-      priority: 35
-    }
-  },
+  // No `ui` declaration: the per-node failure-count chip used to live
+  // on `card.footer.right`, but its information is now folded into the
+  // aggregate severity counters emitted by `core/issue-counter`. The
+  // findings still emit as `Issue` records, so `sm check` / inspector
+  // unchanged.
+  ui: {},
+  // Pre-existing complexity: validates every node + every link
+  // against multiple schemas with per-severity aggregation. The
+  // branching mirrors the schema catalog and splitting scatters the
+  // validation contract. Tracked as tech-debt; surfaced when an
+  // unrelated change touched the lint cache.
+  // eslint-disable-next-line complexity
   evaluate(ctx) {
     const validators = loadSchemaValidators();
     const findings = [];
@@ -3027,26 +3029,24 @@ var schemaViolationAnalyzer = {
       collectNodeFindings(validators, node, findings);
       collectFrontmatterBaseFindings(node, findings);
       if (findings.length > before) {
-        perNode.set(node.path, (perNode.get(node.path) ?? 0) + (findings.length - before));
+        let worst = "warn";
+        for (let i = before; i < findings.length; i++) {
+          if (findings[i].severity === "error") {
+            worst = "danger";
+            break;
+          }
+        }
+        const prev = perNode.get(node.path);
+        perNode.set(node.path, {
+          count: (prev?.count ?? 0) + (findings.length - before),
+          worst: prev?.worst === "danger" ? "danger" : worst
+        });
       }
     }
     for (const link of ctx.links) {
       collectLinkFindings(validators, link, findings);
     }
-    for (const [nodePath, count] of perNode) {
-      const tooltip = count === 1 ? SCHEMA_VIOLATION_TEXTS.alertTooltipSingle : tx(SCHEMA_VIOLATION_TEXTS.alertTooltipMany, { count });
-      const capped = Math.min(count, 99);
-      ctx.emitContribution(nodePath, "alert", {
-        icon: "fa-solid fa-triangle-exclamation",
-        severity: "danger",
-        tooltip
-      });
-      ctx.emitContribution(nodePath, "chip", {
-        value: capped,
-        severity: "danger",
-        tooltip
-      });
-    }
+    void perNode;
     return findings;
   }
 };
@@ -3054,7 +3054,7 @@ function collectNodeFindings(v, node, out) {
   const result = v.validate("node", toNodeForSchema(node));
   if (result.ok) return;
   out.push({
-    analyzerId: ID21,
+    analyzerId: ID22,
     severity: "error",
     nodeIds: [node.path],
     message: tx(SCHEMA_VIOLATION_TEXTS.nodeFailure, {
@@ -3073,7 +3073,7 @@ function collectFrontmatterBaseFindings(node, out) {
   if (isMissingStringField(fm, "description")) missing.push("description");
   if (missing.length === 0) return;
   out.push({
-    analyzerId: ID21,
+    analyzerId: ID22,
     // `warn` (not `error`) so the default `sm scan` exit code stays
     // 0 even when nodes are missing frontmatter base fields. Strict
     // mode (`sm scan --strict`) still escalates to exit 1. Matches
@@ -3095,7 +3095,7 @@ function collectLinkFindings(v, link, out) {
   const result = v.validate("link", toLinkForSchema(link));
   if (result.ok) return;
   out.push({
-    analyzerId: ID21,
+    analyzerId: ID22,
     severity: "error",
     nodeIds: [link.source],
     message: tx(SCHEMA_VIOLATION_TEXTS.linkFailure, {
@@ -3170,12 +3170,11 @@ var SIGNAL_COLLISION_TEXTS = {
 };
 
 // plugins/core/analyzers/signal-collision/index.ts
-var ID22 = "signal-collision";
+var ID23 = "signal-collision";
 var signalCollisionAnalyzer = {
-  id: ID22,
+  id: ID23,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  version: "1.0.0",
   description: "Reports when two extractors fight over the same span of body text, or when a candidate link is dropped (extractor disabled, confidence too low) before it reaches the graph.",
   mode: "deterministic",
   evaluate(ctx) {
@@ -3198,7 +3197,7 @@ function makeIssue(signal) {
     const loserRange = signal.range ? `${signal.range.start}-${signal.range.end}` : "unknown";
     const winnerRange = `${winner.range.start}-${winner.range.end}`;
     return {
-      analyzerId: ID22,
+      analyzerId: ID23,
       severity: "warn",
       nodeIds: [signal.source],
       message: tx(SIGNAL_COLLISION_TEXTS.message, {
@@ -3231,7 +3230,7 @@ function makeIssue(signal) {
   if (resolution.extractorDisabled) {
     const loserRange = signal.range ? `${signal.range.start}-${signal.range.end}` : "unknown";
     return {
-      analyzerId: ID22,
+      analyzerId: ID23,
       severity: "warn",
       nodeIds: [signal.source],
       message: tx(SIGNAL_COLLISION_TEXTS.messageExtractorDisabled, {
@@ -3250,7 +3249,7 @@ function makeIssue(signal) {
     const loserRange = signal.range ? `${signal.range.start}-${signal.range.end}` : "unknown";
     const topCandidate = signal.candidates[0];
     return {
-      analyzerId: ID22,
+      analyzerId: ID23,
       severity: "warn",
       nodeIds: [signal.source],
       message: tx(SIGNAL_COLLISION_TEXTS.messageBelowFloor, {
@@ -3295,18 +3294,17 @@ var TRIGGER_COLLISION_TEXTS = {
 };
 
 // plugins/core/analyzers/trigger-collision/index.ts
-var ID23 = "trigger-collision";
+var ID24 = "trigger-collision";
 var ADVERTISING_KINDS = /* @__PURE__ */ new Set([
   "command",
   "skill",
   "agent"
 ]);
 var triggerCollisionAnalyzer = {
-  id: ID23,
+  id: ID24,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   mode: "deterministic",
-  version: "1.0.0",
   description: "Flags two or more nodes that claim the same `/command` or `@agent` name.",
   // Two claim-collection passes (advertisement + invocation) feeding
   // the bucket map. Per-bucket analysis lives in `analyzeTriggerBucket`.
@@ -3401,7 +3399,7 @@ function analyzeTriggerBucket(normalized, claims) {
     part: parts[0]
   });
   return {
-    analyzerId: ID23,
+    analyzerId: ID24,
     severity: "error",
     nodeIds,
     message,
@@ -3441,14 +3439,13 @@ var ASCII_FORMATTER_TEXTS = {
 };
 
 // plugins/core/formatters/ascii/index.ts
-var ID24 = "ascii";
+var ID25 = "ascii";
 var KIND_ORDER = ["agent", "command", "skill", "markdown"];
 var asciiFormatter = {
-  id: ID24,
+  id: ID25,
   pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
-  formatId: ID24,
-  version: "1.0.0",
+  formatId: ID25,
   description: "Renders the scan as plain text in three sections: nodes (grouped by kind), arrows, and issues. Used by `sm scan --format ascii`.",
   // ASCII tree formatter, header + per-kind sections + per-issue
   // section. Each section iterates and renders; splitting per section
@@ -3542,14 +3539,13 @@ function renderSection(out, kind, group) {
 }
 
 // plugins/core/formatters/json/index.ts
-var ID25 = "json";
+var ID26 = "json";
 var jsonFormatter = {
-  id: ID25,
+  id: ID26,
   pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
-  version: "1.0.0",
   description: "Renders the persisted scan as JSON (conforms to `scan-result.schema.json`). Used by `sm graph --format json` and `GET /api/graph?format=json`.",
-  formatId: ID25,
+  formatId: ID26,
   format(ctx) {
     if (ctx.scanResult !== void 0) {
       return JSON.stringify(ctx.scanResult);
@@ -3688,12 +3684,11 @@ function resolveSpecRoot2() {
 }
 
 // plugins/core/actions/node-bump/index.ts
-var ID26 = "node-bump";
+var ID27 = "node-bump";
 var nodeBumpAction = {
-  id: ID26,
+  id: ID27,
   pluginId: CORE_PLUGIN_ID,
   kind: "action",
-  version: "1.0.0",
   description: "Marks a node as updated: bumps `annotations.version`, refreshes sidecar hashes, and records the timestamp.",
   mode: "deterministic",
   // The runtime contract uses generic <TInput, TReport>; bump narrows
@@ -3749,12 +3744,11 @@ function pickCurrentVersion(overlay) {
 }
 
 // plugins/core/actions/node-supersede/index.ts
-var ID27 = "node-supersede";
+var ID28 = "node-supersede";
 var nodeSupersedeAction = {
-  id: ID27,
+  id: ID28,
   pluginId: CORE_PLUGIN_ID,
   kind: "action",
-  version: "0.0.0",
   description: "Declares the current node as superseded by another (writes `supersededBy` to the sidecar).",
   mode: "deterministic",
   invoke(_input, _ctx) {
@@ -3861,7 +3855,7 @@ var UPDATE_CHECK_TEXTS = {
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.39.0",
+  version: "0.40.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -4278,7 +4272,6 @@ var updateCheckHook = {
   id: "update-check",
   pluginId: CORE_PLUGIN_ID,
   kind: "hook",
-  version: "1.0.0",
   description: "Checks daily for a newer `skill-map` version on npm. Shows an `update available` banner when one is found.",
   triggers: ["boot"],
   async on(ctx) {
@@ -4294,43 +4287,43 @@ var updateCheckHook = {
 };
 
 // plugins/built-ins.ts
-var claudeProvider2 = { ...claudeProvider, pluginId: "claude" };
-var atDirectiveExtractor2 = { ...atDirectiveExtractor, pluginId: "claude" };
-var slashCommandExtractor2 = { ...slashCommandExtractor, pluginId: "claude" };
-var antigravityProvider2 = { ...antigravityProvider, pluginId: "antigravity" };
-var openaiProvider2 = { ...openaiProvider, pluginId: "openai" };
-var agentSkillsProvider2 = { ...agentSkillsProvider, pluginId: "agent-skills" };
-var coreMarkdownProvider2 = { ...coreMarkdownProvider, pluginId: "core" };
-var annotationsExtractor2 = { ...annotationsExtractor, pluginId: "core" };
-var externalUrlCounterExtractor2 = { ...externalUrlCounterExtractor, pluginId: "core" };
-var markdownLinkExtractor2 = { ...markdownLinkExtractor, pluginId: "core" };
-var mcpToolsExtractor2 = { ...mcpToolsExtractor, pluginId: "core" };
-var toolsCounterExtractor2 = { ...toolsCounterExtractor, pluginId: "core" };
-var annotationFieldUnknownAnalyzer2 = { ...annotationFieldUnknownAnalyzer, pluginId: "core" };
-var annotationOrphanAnalyzer2 = { ...annotationOrphanAnalyzer, pluginId: "core" };
-var annotationStaleAnalyzer2 = { ...annotationStaleAnalyzer, pluginId: "core" };
-var contributionOrphanAnalyzer2 = { ...contributionOrphanAnalyzer, pluginId: "core" };
-var jobFileOrphanAnalyzer2 = { ...jobFileOrphanAnalyzer, pluginId: "core" };
-var linkConflictAnalyzer2 = { ...linkConflictAnalyzer, pluginId: "core" };
-var linkCounterAnalyzer2 = { ...linkCounterAnalyzer, pluginId: "core" };
-var linkSelfLoopAnalyzer2 = { ...linkSelfLoopAnalyzer, pluginId: "core" };
-var nameReservedAnalyzer2 = { ...nameReservedAnalyzer, pluginId: "core" };
-var nodeStabilityAnalyzer2 = { ...nodeStabilityAnalyzer, pluginId: "core" };
-var nodeSupersededAnalyzer2 = { ...nodeSupersededAnalyzer, pluginId: "core" };
-var referenceBrokenAnalyzer2 = { ...referenceBrokenAnalyzer, pluginId: "core" };
-var referenceRedundantAnalyzer2 = { ...referenceRedundantAnalyzer, pluginId: "core" };
-var schemaViolationAnalyzer2 = { ...schemaViolationAnalyzer, pluginId: "core" };
-var signalCollisionAnalyzer2 = { ...signalCollisionAnalyzer, pluginId: "core" };
-var triggerCollisionAnalyzer2 = { ...triggerCollisionAnalyzer, pluginId: "core" };
-var asciiFormatter2 = { ...asciiFormatter, pluginId: "core" };
-var jsonFormatter2 = { ...jsonFormatter, pluginId: "core" };
-var nodeBumpAction2 = { ...nodeBumpAction, pluginId: "core" };
-var nodeSupersedeAction2 = { ...nodeSupersedeAction, pluginId: "core" };
-var updateCheckHook2 = { ...updateCheckHook, pluginId: "core" };
+var claudeProvider2 = { ...claudeProvider, pluginId: "claude", version: "0.40.0" };
+var atDirectiveExtractor2 = { ...atDirectiveExtractor, pluginId: "claude", version: "0.40.0" };
+var slashCommandExtractor2 = { ...slashCommandExtractor, pluginId: "claude", version: "0.40.0" };
+var antigravityProvider2 = { ...antigravityProvider, pluginId: "antigravity", version: "0.40.0" };
+var openaiProvider2 = { ...openaiProvider, pluginId: "openai", version: "0.40.0" };
+var agentSkillsProvider2 = { ...agentSkillsProvider, pluginId: "agent-skills", version: "0.40.0" };
+var coreMarkdownProvider2 = { ...coreMarkdownProvider, pluginId: "core", version: "0.40.0" };
+var annotationsExtractor2 = { ...annotationsExtractor, pluginId: "core", version: "0.40.0" };
+var externalUrlCounterExtractor2 = { ...externalUrlCounterExtractor, pluginId: "core", version: "0.40.0" };
+var markdownLinkExtractor2 = { ...markdownLinkExtractor, pluginId: "core", version: "0.40.0" };
+var mcpToolsExtractor2 = { ...mcpToolsExtractor, pluginId: "core", version: "0.40.0" };
+var toolsCounterExtractor2 = { ...toolsCounterExtractor, pluginId: "core", version: "0.40.0" };
+var annotationFieldUnknownAnalyzer2 = { ...annotationFieldUnknownAnalyzer, pluginId: "core", version: "0.40.0" };
+var annotationOrphanAnalyzer2 = { ...annotationOrphanAnalyzer, pluginId: "core", version: "0.40.0" };
+var annotationStaleAnalyzer2 = { ...annotationStaleAnalyzer, pluginId: "core", version: "0.40.0" };
+var contributionOrphanAnalyzer2 = { ...contributionOrphanAnalyzer, pluginId: "core", version: "0.40.0" };
+var issueCounterAnalyzer2 = { ...issueCounterAnalyzer, pluginId: "core", version: "0.40.0" };
+var jobFileOrphanAnalyzer2 = { ...jobFileOrphanAnalyzer, pluginId: "core", version: "0.40.0" };
+var linkConflictAnalyzer2 = { ...linkConflictAnalyzer, pluginId: "core", version: "0.40.0" };
+var linkCounterAnalyzer2 = { ...linkCounterAnalyzer, pluginId: "core", version: "0.40.0" };
+var linkSelfLoopAnalyzer2 = { ...linkSelfLoopAnalyzer, pluginId: "core", version: "0.40.0" };
+var nameReservedAnalyzer2 = { ...nameReservedAnalyzer, pluginId: "core", version: "0.40.0" };
+var nodeStabilityAnalyzer2 = { ...nodeStabilityAnalyzer, pluginId: "core", version: "0.40.0" };
+var nodeSupersededAnalyzer2 = { ...nodeSupersededAnalyzer, pluginId: "core", version: "0.40.0" };
+var referenceBrokenAnalyzer2 = { ...referenceBrokenAnalyzer, pluginId: "core", version: "0.40.0" };
+var referenceRedundantAnalyzer2 = { ...referenceRedundantAnalyzer, pluginId: "core", version: "0.40.0" };
+var schemaViolationAnalyzer2 = { ...schemaViolationAnalyzer, pluginId: "core", version: "0.40.0" };
+var signalCollisionAnalyzer2 = { ...signalCollisionAnalyzer, pluginId: "core", version: "0.40.0" };
+var triggerCollisionAnalyzer2 = { ...triggerCollisionAnalyzer, pluginId: "core", version: "0.40.0" };
+var asciiFormatter2 = { ...asciiFormatter, pluginId: "core", version: "0.40.0" };
+var jsonFormatter2 = { ...jsonFormatter, pluginId: "core", version: "0.40.0" };
+var nodeBumpAction2 = { ...nodeBumpAction, pluginId: "core", version: "0.40.0" };
+var nodeSupersedeAction2 = { ...nodeSupersedeAction, pluginId: "core", version: "0.40.0" };
+var updateCheckHook2 = { ...updateCheckHook, pluginId: "core", version: "0.40.0" };
 var builtInBundles = [
   {
     id: "claude",
-    granularity: "bundle",
     description: "Claude Code platform integration. Classifies files under `.claude/{agents,commands,skills}` and detects Claude-flavored slash commands and at-directives in their bodies.",
     extensions: [
       claudeProvider2,
@@ -4340,7 +4333,6 @@ var builtInBundles = [
   },
   {
     id: "antigravity",
-    granularity: "bundle",
     description: "Google Antigravity CLI platform integration (replaces the retired Gemini CLI). Antigravity adopted the open-standard `.agents/` layout, so skills are classified by the neutral `agent-skills` provider; this plugin contributes the Antigravity runtime identity and a seed list of reserved built-in names.",
     extensions: [
       antigravityProvider2
@@ -4348,7 +4340,6 @@ var builtInBundles = [
   },
   {
     id: "openai",
-    granularity: "bundle",
     description: "OpenAI Codex CLI platform integration. Classifies TOML sub-agent definitions under `.codex/agents/*.toml`.",
     extensions: [
       openaiProvider2
@@ -4356,7 +4347,6 @@ var builtInBundles = [
   },
   {
     id: "agent-skills",
-    granularity: "bundle",
     description: "Open-standard Agent Skills layout. Classifies skills under the vendor-neutral path `.agents/skills/<name>/SKILL.md` (adopted by Anthropic, OpenAI, Google). See agentskills.io.",
     extensions: [
       agentSkillsProvider2
@@ -4364,7 +4354,6 @@ var builtInBundles = [
   },
   {
     id: "core",
-    granularity: "extension",
     description: "Core extensions shared across providers: parsers, extractors, analyzers, actions, hooks, formatters, and the universal `.md` fallback provider.",
     extensions: [
       coreMarkdownProvider2,
@@ -4377,6 +4366,7 @@ var builtInBundles = [
       annotationOrphanAnalyzer2,
       annotationStaleAnalyzer2,
       contributionOrphanAnalyzer2,
+      issueCounterAnalyzer2,
       jobFileOrphanAnalyzer2,
       linkConflictAnalyzer2,
       linkCounterAnalyzer2,
@@ -8933,7 +8923,16 @@ var CHECK_TEXTS = {
   tipLine: "\nTip: `sm refresh <node>` to revalidate a file after fixes.\n",
   // --- prob stub advisory ---------------------------------------------------
   probStubAdvisory: "sm check --include-prob: probabilistic Analyzer dispatch requires the job subsystem (Step 10). Stub: skipped {{count}} probabilistic analyzer(s): {{analyzerIds}}. Deterministic analyzers ran as usual; full dispatch lands when the job subsystem ships.\n",
-  probStubAdvisoryAsync: "sm check --include-prob --async: probabilistic Analyzer dispatch requires the job subsystem (Step 10). Stub: skipped {{count}} probabilistic analyzer(s): {{analyzerIds}}. The --async flag is reserved for future encoding (returns job ids without waiting once jobs land); today it is a no-op. Deterministic analyzers ran as usual.\n"
+  probStubAdvisoryAsync: "sm check --include-prob --async: probabilistic Analyzer dispatch requires the job subsystem (Step 10). Stub: skipped {{count}} probabilistic analyzer(s): {{analyzerIds}}. The --async flag is reserved for future encoding (returns job ids without waiting once jobs land); today it is a no-op. Deterministic analyzers ran as usual.\n",
+  /**
+   * Emitted on stderr when `--analyzers` lists one or more ids the
+   * loaded analyzer registry does not know. The user almost always
+   * mistyped (e.g. `broken-ref` instead of `reference-broken`); listing
+   * the valid ids inline lets them fix the call without a second round
+   * trip through `sm plugins list`. Exit code is `ExitCode.Error` (2):
+   * bad usage, not "no issues found".
+   */
+  unknownAnalyzerIds: "sm check: unknown analyzer id(s) in --analyzers: {{unknown}}.\nValid ids (qualified or short form accepted):\n{{known}}\n"
 };
 
 // cli/util/conformance-env.ts
@@ -9474,20 +9473,17 @@ var PluginLoader = class {
    * into a helper would scatter the return-on-failure pattern without
    * making the orchestration clearer.
    */
-  // eslint-disable-next-line complexity
   async loadOne(pluginPath) {
     const pluginId = pathId(pluginPath);
     const manifestResult = this.#parseAndValidateManifest(pluginPath, pluginId);
     if (!manifestResult.ok) return manifestResult.failure;
     const manifest = manifestResult.manifest;
-    const granularity = manifest.granularity ?? "extension";
     if (this.#options.resolveEnabled && !this.#options.resolveEnabled(pluginId)) {
       return {
         path: pluginPath,
         id: pluginId,
         status: "disabled",
         manifest,
-        granularity,
         reason: PLUGIN_LOADER_TEXTS.disabledByConfig
       };
     }
@@ -9509,7 +9505,6 @@ var PluginLoader = class {
       id: pluginId,
       status: "enabled",
       manifest,
-      granularity,
       extensions: loaded,
       ...storageSchemasResult.schemas ? { storageSchemas: storageSchemasResult.schemas } : {}
     };
@@ -9567,7 +9562,6 @@ var PluginLoader = class {
         id: pluginId,
         status: "incompatible-spec",
         manifest,
-        granularity: manifest.granularity ?? "extension",
         reason: tx(PLUGIN_LOADER_TEXTS.incompatibleSpec, {
           installedSpecVersion: this.#options.specVersion,
           specCompat: manifest.specCompat
@@ -9886,25 +9880,9 @@ function isBuiltInExtensionEnabled(bundle, ext, resolveEnabled) {
   return isBundleEntryEnabled(bundle, ext.id, resolveEnabled);
 }
 function isBundleEntryEnabled(bundle, extId, resolveEnabled) {
-  if (bundle.granularity === "bundle") {
-    if (!resolveEnabled(bundle.id)) return false;
-    return resolveEnabled(qualifiedExtensionId(bundle.id, extId));
-  }
   return resolveEnabled(qualifiedExtensionId(bundle.id, extId));
 }
-function buildGranularityMap(discovered) {
-  const out = /* @__PURE__ */ new Map();
-  for (const plugin of discovered) {
-    out.set(plugin.id, plugin.granularity ?? "bundle");
-  }
-  return out;
-}
-function isPluginExtensionEnabled(ext, granularityMap, resolveEnabled) {
-  const granularity = granularityMap.get(ext.pluginId) ?? "bundle";
-  if (granularity === "bundle") {
-    if (!resolveEnabled(ext.pluginId)) return false;
-    return resolveEnabled(qualifiedExtensionId(ext.pluginId, ext.id));
-  }
+function isPluginExtensionEnabled(ext, resolveEnabled) {
   return resolveEnabled(qualifiedExtensionId(ext.pluginId, ext.id));
 }
 async function buildEnabledResolver(ctx) {
@@ -10423,7 +10401,6 @@ function filterBuiltInManifests(manifests, resolveEnabled) {
 // core/runtime/plugin-runtime/composer.ts
 function composeScanExtensions(opts) {
   const resolveEnabled = opts.resolveEnabled ?? opts.pluginRuntime.resolveEnabled;
-  const granularityMap = buildGranularityMap(opts.pluginRuntime.discovered);
   const providers = [];
   const extractors = [];
   const analyzers = [];
@@ -10435,16 +10412,16 @@ function composeScanExtensions(opts) {
     );
   }
   for (const ext of opts.pluginRuntime.extensions.providers) {
-    if (isPluginExtensionEnabled(ext, granularityMap, resolveEnabled)) providers.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) providers.push(ext);
   }
   for (const ext of opts.pluginRuntime.extensions.extractors) {
-    if (isPluginExtensionEnabled(ext, granularityMap, resolveEnabled)) extractors.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) extractors.push(ext);
   }
   for (const ext of opts.pluginRuntime.extensions.analyzers) {
-    if (isPluginExtensionEnabled(ext, granularityMap, resolveEnabled)) analyzers.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) analyzers.push(ext);
   }
   for (const ext of opts.pluginRuntime.extensions.hooks) {
-    if (isPluginExtensionEnabled(ext, granularityMap, resolveEnabled)) hooks.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) hooks.push(ext);
   }
   const finalProviders = opts.killSwitches?.providers === true ? [] : providers;
   const finalExtractors = opts.killSwitches?.extractors === true ? [] : extractors;
@@ -10491,7 +10468,6 @@ function accumulateBuiltInScanExtensions(buckets, resolveEnabled) {
 function composeFormatters(opts) {
   const noBuiltIns = opts.noBuiltIns ?? false;
   const resolveEnabled = opts.resolveEnabled ?? opts.pluginRuntime.resolveEnabled;
-  const granularityMap = buildGranularityMap(opts.pluginRuntime.discovered);
   const out = [];
   if (!noBuiltIns) {
     for (const bundle of builtInBundles) {
@@ -10503,32 +10479,24 @@ function composeFormatters(opts) {
     }
   }
   for (const ext of opts.pluginRuntime.extensions.formatters) {
-    if (isPluginExtensionEnabled(ext, granularityMap, resolveEnabled)) out.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) out.push(ext);
   }
   return out;
 }
 function registerEnabledExtensions(kernel, pluginRuntime, options = {}) {
   const noBuiltIns = options.noBuiltIns === true;
   const resolveEnabled = options.resolveEnabled ?? pluginRuntime.resolveEnabled;
-  const granularityMap = buildGranularityMap(pluginRuntime.discovered);
   if (!noBuiltIns) {
     const enabledBuiltIns = filterBuiltInManifests(listBuiltIns(), resolveEnabled);
     for (const manifest of enabledBuiltIns) kernel.registry.register(manifest);
   }
   for (const manifest of pluginRuntime.manifests) {
-    if (!isPluginExtensionEnabled(manifest, granularityMap, resolveEnabled)) continue;
+    if (!isPluginExtensionEnabled(manifest, resolveEnabled)) continue;
     kernel.registry.register(manifest);
   }
   if (kernel.setRegisteredAnnotationKeys) {
     const filteredAnnotations = pluginRuntime.annotationContributions.filter(
-      (entry) => (
-        // Annotation contributions live at plugin-id granularity (the
-        // catalog row carries `pluginId`, not `extensionId`), so the
-        // bundle-level toggle gates the entire row. Extension
-        // granularity falls through to the manifest-level filter above
-        // this surface is bundle-scoped by design.
-        resolveEnabled(entry.pluginId)
-      )
+      (entry) => resolveEnabled(entry.pluginId)
     );
     kernel.setRegisteredAnnotationKeys(filteredAnnotations);
   }
@@ -10536,7 +10504,6 @@ function registerEnabledExtensions(kernel, pluginRuntime, options = {}) {
     const userContribs = pluginRuntime.viewContributions.filter(
       (entry) => isPluginExtensionEnabled(
         { pluginId: entry.pluginId, id: entry.extensionId },
-        granularityMap,
         resolveEnabled
       )
     );
@@ -10602,22 +10569,8 @@ var CheckCommand = class extends SmCommand {
     const exit = requireDbOrExit(dbPath, this.context.stderr);
     if (exit !== null) return exit;
     const analyzerFilter = parseAnalyzersFlag(this.analyzers);
-    if (this.includeProb) {
-      const probAnalyzerIds = await detectProbAnalyzerIds({
-        noPlugins: this.noPlugins,
-        analyzerFilter,
-        printer: this.printer
-      });
-      if (probAnalyzerIds.length > 0) {
-        const template = this.async ? CHECK_TEXTS.probStubAdvisoryAsync : CHECK_TEXTS.probStubAdvisory;
-        this.printer.info(
-          tx(template, {
-            count: probAnalyzerIds.length,
-            analyzerIds: probAnalyzerIds.join(", ")
-          })
-        );
-      }
-    }
+    const preflight = await this.#preflightAnalyzerCatalog(analyzerFilter);
+    if (preflight.exit !== null) return preflight.exit;
     return withSqlite({ databasePath: dbPath, autoBackup: false }, async (adapter) => {
       let issues = await adapter.issues.listAll();
       if (this.node !== void 0) {
@@ -10640,6 +10593,53 @@ var CheckCommand = class extends SmCommand {
       return issues.some((i) => i.severity === "error") ? ExitCode.Issues : ExitCode.Ok;
     });
   }
+  /**
+   * Either an explicit `--analyzers` list or `--include-prob` forces a
+   * load of the live Analyzer catalog: the first needs it to validate
+   * the user-supplied ids against the registry, the second to enumerate
+   * registered probabilistic analyzers. Sharing a single load keeps
+   * `sm check` from paying for two passes when both flags are present.
+   *
+   * Returns `{ exit: <code> }` to short-circuit `run()` when the
+   * validation rejects an unknown id (the only path that aborts before
+   * the DB read). Successful runs return `{ exit: null }`.
+   */
+  async #preflightAnalyzerCatalog(analyzerFilter) {
+    const needsCatalog = analyzerFilter !== void 0 || this.includeProb;
+    if (!needsCatalog) return { exit: null };
+    const analyzers = await loadAnalyzerCatalog({
+      noPlugins: this.noPlugins,
+      printer: this.printer
+    });
+    if (analyzerFilter !== void 0) {
+      const validation = validateAnalyzerFilter(analyzerFilter, analyzers);
+      if (validation !== null) {
+        this.printer.error(validation);
+        return { exit: ExitCode.Error };
+      }
+    }
+    if (this.includeProb) {
+      this.#emitProbAdvisory(analyzers, analyzerFilter);
+    }
+    return { exit: null };
+  }
+  /**
+   * Walk the loaded catalog for probabilistic analyzers honouring the
+   * `--analyzers` filter and, when any survive, emit the stub stderr
+   * advisory naming them. Extracted so `run()` does not carry the
+   * branching for the `--include-prob` / `--async` advisory shapes.
+   */
+  #emitProbAdvisory(analyzers, analyzerFilter) {
+    const probAnalyzerIds = detectProbAnalyzerIds(analyzers, analyzerFilter);
+    if (probAnalyzerIds.length === 0) return;
+    const template = this.async ? CHECK_TEXTS.probStubAdvisoryAsync : CHECK_TEXTS.probStubAdvisory;
+    this.printer.info(
+      tx(template, {
+        count: probAnalyzerIds.length,
+        analyzerIds: probAnalyzerIds.join(", ")
+      })
+    );
+  }
 };
 function parseAnalyzersFlag(raw) {
   if (raw === void 0) return void 0;
@@ -10647,7 +10647,7 @@ function parseAnalyzersFlag(raw) {
   if (ids.length === 0) return void 0;
   return ids;
 }
-async function detectProbAnalyzerIds(opts) {
+async function loadAnalyzerCatalog(opts) {
   const pluginRuntime = opts.noPlugins ? emptyPluginRuntime() : await loadPluginRuntime();
   pluginRuntime.emitWarnings(opts.printer);
   const composed = composeScanExtensions({
@@ -10655,12 +10655,30 @@ async function detectProbAnalyzerIds(opts) {
     pluginRuntime,
     killSwitches: readConformanceKillSwitches()
   });
-  const analyzers = composed?.analyzers ?? [];
+  return composed?.analyzers ?? [];
+}
+function validateAnalyzerFilter(filter, analyzers) {
+  const knownQualified = /* @__PURE__ */ new Set();
+  const knownShort = /* @__PURE__ */ new Set();
+  for (const analyzer of analyzers) {
+    const qualified = qualifiedExtensionId(analyzer.pluginId, analyzer.id);
+    knownQualified.add(qualified);
+    knownShort.add(analyzer.id);
+  }
+  const unknown = filter.filter((id) => !knownQualified.has(id) && !knownShort.has(id));
+  if (unknown.length === 0) return null;
+  const knownList = [...knownQualified].sort().map((id) => `  ${id}`).join("\n");
+  return tx(CHECK_TEXTS.unknownAnalyzerIds, {
+    unknown: unknown.join(", "),
+    known: knownList
+  });
+}
+function detectProbAnalyzerIds(analyzers, analyzerFilter) {
   const probIds = [];
   for (const analyzer of analyzers) {
     if (analyzer.mode !== "probabilistic") continue;
     const qualified = qualifiedExtensionId(analyzer.pluginId, analyzer.id);
-    if (opts.analyzerFilter && !matchesAnalyzerFilter(qualified, opts.analyzerFilter)) continue;
+    if (analyzerFilter && !matchesAnalyzerFilter(qualified, analyzerFilter)) continue;
     probIds.push(qualified);
   }
   probIds.sort();
@@ -14733,8 +14751,8 @@ function isExternalUrlLink(link) {
 }
 
 // kernel/orchestrator/analyzers.ts
-async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, signals) {
-  const issues = [];
+async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, signals, seedIssues = []) {
+  const issues = [...seedIssues];
   const contributions = [];
   const validators = loadSchemaValidators();
   void registeredActionIds;
@@ -14742,7 +14760,8 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
     relativePath: o.relativePath,
     expectedMdPath: o.expectedMdPath
   }));
-  for (const analyzer of analyzers) {
+  const scheduled = orderAnalyzersByPhase(analyzers);
+  for (const analyzer of scheduled) {
     const qualifiedId2 = qualifiedExtensionId(analyzer.pluginId, analyzer.id);
     const declaredContributions = readDeclaredContributions(analyzer);
     const emitContribution = (nodePath, contributionId, payload) => {
@@ -14795,6 +14814,11 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
       annotationContributions,
       viewContributions,
       orphanJobFiles,
+      // `issues` is the live accumulator, mutated by `issues.push(...)`
+      // below as each analyzer's emission lands. Late-phase analyzers
+      // (`core/issue-counter`) read it to compute cross-analyzer
+      // aggregates. Treat as read-only on the analyzer side.
+      accumulatedIssues: issues,
       ...referenceablePaths ? { referenceablePaths } : {},
       ...cwd ? { cwd } : {},
       ...reservedNodePaths ? { reservedNodePaths } : {},
@@ -14811,6 +14835,12 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
   }
   return { issues, contributions };
 }
+function orderAnalyzersByPhase(analyzers) {
+  return analyzers.slice().sort((a, b) => phaseRank(a) - phaseRank(b));
+}
+function phaseRank(a) {
+  return a.phase === "aggregate" ? 1 : 0;
+}
 function validateIssue(analyzer, issue, emitter) {
   const severity = issue.severity;
   if (severity !== "error" && severity !== "warn" && severity !== "info") {
@@ -15955,7 +15985,7 @@ async function runScanInternal(_kernel, options) {
     else walked.internalLinks.push(link);
   }
   walked.signals = resolved.resolvedSignals;
-  const postWalkCtx = buildPostWalkTransformCtx(exts.providers, walked.nodes);
+  const postWalkCtx = buildPostWalkTransformCtx(exts.providers, walked.nodes, activeProviderId);
   walked.internalLinks = applyPostWalkTransforms(walked.internalLinks, walked.nodes, postWalkCtx);
   recomputeLinkCounts(walked.nodes, walked.internalLinks);
   recomputeExternalRefsCount(walked.nodes, walked.externalLinks, walked.cachedPaths);
@@ -15978,11 +16008,15 @@ async function runScanInternal(_kernel, options) {
     emitter,
     hookDispatcher,
     postWalkCtx.reservedNodePaths,
-    walked.signals
+    walked.signals,
+    // Seed the accumulator with orchestrator-emitted frontmatter
+    // issues so the aggregate phase (`core/issue-counter`) counts
+    // them on the per-node chip. The seeds are echoed back on
+    // `analyzerResult.issues`, no explicit push is needed below.
+    walked.frontmatterIssues
   );
   mergeAnalyzerEmissions(walked, analyzerResult, exts.analyzers);
   const issues = analyzerResult.issues;
-  for (const issue of walked.frontmatterIssues) issues.push(issue);
   const silenced = options.ignoreFilter ? (path) => options.ignoreFilter.ignores(path) : void 0;
   const renameOps = prior ? detectRenamesAndOrphans(prior, walked.nodes, issues, silenced) : [];
   const stats = buildScanStats(walked, issues, start);
@@ -15991,14 +16025,14 @@ async function runScanInternal(_kernel, options) {
   await hookDispatcher.dispatch("scan.completed", scanCompletedEvent);
   return buildScanReturn(walked, issues, renameOps, stats, options, setup);
 }
-function buildPostWalkTransformCtx(providers, nodes) {
+function buildPostWalkTransformCtx(providers, nodes, activeProvider) {
   const { kindRegistry, providerResolution, reservedNamesByProviderKind } = buildProviderIndexes(providers);
   const reservedNodePaths = buildReservedNodePaths(
     nodes,
     kindRegistry,
     reservedNamesByProviderKind
   );
-  return { kindRegistry, providerResolution, reservedNodePaths };
+  return { kindRegistry, providerResolution, activeProvider, reservedNodePaths };
 }
 function buildProviderIndexes(providers) {
   const kindRegistry = /* @__PURE__ */ new Map();
@@ -16450,9 +16484,18 @@ var SCAN_RUNNER_TEXTS = {
    * markers (`.claude/`, `.codex/`, `AGENTS.md`, `.cursor/`) anywhere
    * under cwd or the effective scan roots. Plain-markdown projects
    * keep scanning fine; provider-specific extractors silently no-op
-   * for this scan.
+   * for this scan. Follows `context/cli-output-style.md` §3.1b
+   * (two-line block, glyph + dim hint):
+   *   - line 1: `{{glyph}}` (yellow `⚠`) + headline naming the
+   *     missing markers,
+   *   - line 2 (indent 3): `{{hint}}`, dim, names the consequence
+   *     and the actionable next step.
+   * Both the full block AND the bare hint are catalog-side so the
+   * caller can wrap the hint in `ansi.dim(...)` without splitting
+   * the template manually.
    */
-  activeProviderNoMarkerWarning: "No provider markers detected (.claude/, .codex/, AGENTS.md, .cursor/). Scanning as universal markdown only; provider-specific link types (e.g. claude @-directives, /-commands) will not appear in the graph. Set `activeProvider` in .skill-map/settings.json or install a provider plugin to enable them.",
+  activeProviderNoMarkerWarning: "{{glyph}}  No provider markers detected (.claude/, .codex/, AGENTS.md, .cursor/).\n   {{hint}}\n",
+  activeProviderNoMarkerWarningHint: "Scanning as universal markdown only; provider-specific link types (e.g. claude @-directives, /-commands) will not appear. Set `activeProvider` in .skill-map/settings.json or install a provider plugin to enable them.",
   /**
    * Active-provider bootstrap: filesystem auto-detect found exactly
    * one marker and persisted the detected id to project settings.
@@ -16605,7 +16648,14 @@ async function bootstrapActiveProvider(opts) {
   }
   const detected = aggregateDetected(opts.cwd, opts.effectiveRoots, fromCwd.detected);
   if (detected.length === 0) {
-    opts.printer.warn(SCAN_RUNNER_TEXTS.activeProviderNoMarkerWarning);
+    const warnGlyph = opts.style?.warnGlyph ?? "\u26A0";
+    const dim = opts.style?.dim ?? ((s) => s);
+    opts.printer.warn(
+      tx(SCAN_RUNNER_TEXTS.activeProviderNoMarkerWarning, {
+        glyph: warnGlyph,
+        hint: dim(SCAN_RUNNER_TEXTS.activeProviderNoMarkerWarningHint)
+      })
+    );
     return { kind: "ok", activeProvider: null, source: "none" };
   }
   if (detected.length === 1) {
@@ -18814,21 +18864,6 @@ import { Command as Command22, Option as Option21 } from "clipanion";
 // cli/i18n/plugins.texts.ts
 var PLUGINS_TEXTS = {
   // --- enable / disable error guidance --------------------------------
-  // Spec § A.7, granularity validation. The CLI rejects mismatched ids
-  // up front (instead of silently writing a config_plugins row that the
-  // runtime would later ignore) so the user learns the model immediately.
-  /**
-   * Granularity-mismatch errors share a structured shape:
-   *   ✕  <headline>
-   *      <fix-line>
-   *      <hint-line>
-   * Glyph + indent + dim hint applied at the call site so all four
-   * "wrong shape" advisories read the same way.
-   */
-  granularityBundleRejectsQualified: "{{glyph}}  '{{bundleId}}' has granularity=bundle.\n   Use `sm plugins {{verb}} {{bundleId}}` to {{verb}} the whole bundle.\n   {{hint}}\n",
-  granularityBundleRejectsQualifiedHint: "Individual extensions inside a bundle-granularity plugin cannot be toggled.",
-  granularityExtensionRejectsBundleId: "{{glyph}}  '{{bundleId}}' has granularity=extension.\n   Use `sm plugins {{verb}} {{bundleId}}/<ext-id>` to {{verb}} a single extension.\n   {{hint}}\n",
-  granularityExtensionRejectsBundleIdHint: "Run `sm plugins list` for the per-extension qualified ids.",
   pluginNotFound: "{{glyph}}  Plugin not found: {{id}}\n   {{hint}}\n",
   pluginNotFoundHint: "Run `sm plugins list` for discovered ids and the qualified extension ids.",
   pluginLocked: '{{glyph}}  Plugin "{{id}}" is locked by the host and cannot be toggled.\n   {{hint}}\n',
@@ -18859,8 +18894,14 @@ var PLUGINS_TEXTS = {
   // --- list verb -------------------------------------------------------
   listEmpty: "No plugins discovered.\n",
   // --- doctor verb -----------------------------------------------------
-  /** One-line summary that opens the human doctor output. */
-  doctorSummary: "plugins doctor: {{enabled}} enabled \xB7 {{issues}} issue{{issuesPlural}} \xB7 {{warnings}} warning{{warningsPlural}}\n\n",
+  /**
+   * One-line summary that opens the human doctor output. `enabled` is
+   * the count of enabled extensions across every bundle (every
+   * extension is independently toggle-able by its qualified id); the
+   * value matches the row count rendered by `sm plugins list` once
+   * disabled extensions are filtered out.
+   */
+  doctorSummary: "plugins doctor: {{enabled}} enabled extension{{enabledPlural}} \xB7 {{issues}} issue{{issuesPlural}} \xB7 {{warnings}} warning{{warningsPlural}}\n\n",
   /** Source breakdown row (built-in vs user). Indented 4 to match the status rows. */
   doctorSourceRow: "    {{label}}  {{count}}\n",
   /** Status breakdown table heading. */
@@ -18894,8 +18935,35 @@ var PLUGINS_TEXTS = {
   toggleNeitherIdNorAllHint: "Examples: `sm plugins {{verb}} <id1> <id2>` (explicit set), `sm plugins {{verb}} --all` (every discovered plugin).",
   toggleResolveError: "{{error}}",
   toggleAppliedSingle: "{{verbPast}}: {{id}}\n",
-  toggleAppliedManyHeader: "{{verbPast}}: {{count}} plugin(s)\n",
+  toggleAppliedManyHeader: "{{verbPast}}: {{count}} extension(s)\n",
   toggleAppliedManyRow: "  - {{id}}\n",
+  /**
+   * Macro expansion summary printed on stderr before the confirm
+   * prompt (or before the `--yes` rejection). The block lists every
+   * qualified extension id the bare bundle id resolves to, so the
+   * user sees the exact set that would flip.
+   */
+  bundleMacroHeader: "sm plugins {{verb}} {{bundleId}}: this will affect {{count}} extensions:\n",
+  bundleMacroRow: "  - {{id}}\n",
+  /**
+   * Interactive prompt rendered to a TTY by the macro path. The
+   * `confirm` helper appends the `[y/N]` suffix from UTIL_TEXTS.
+   */
+  bundleMacroConfirmPrompt: "Apply this {{verb}} to every listed extension?",
+  /**
+   * Stderr advisory when a TTY user answers no to the macro prompt.
+   * The verb exits non-zero (ExitCode.Error) so callers can detect
+   * the cancellation.
+   */
+  bundleMacroCancelled: "Cancelled.\n",
+  /**
+   * Non-TTY rejection path: pipes / CI cannot prompt, so the verb
+   * refuses unless `--yes` is set. The body lines come from
+   * `bundleMacroHeader` / `bundleMacroRow` above; this template adds
+   * the directed re-run hint.
+   */
+  bundleMacroRequiresYes: "{{glyph}}  Refusing to {{verb}} multiple extensions without confirmation.\n   {{hint}}\n",
+  bundleMacroRequiresYesHint: "Re-run with --yes to apply, or pass a qualified id `<bundle>/<extension>` for a single extension.",
   // --- list / show renderers ------------------------------------------
   rowStatusOk: "ok",
   rowStatusOff: "off",
@@ -18941,17 +19009,15 @@ var PLUGINS_TEXTS = {
   /** Extensions block heading, separated from the header by a blank line. */
   detailExtensionsBlock: "\n",
   /**
-   * Extension row WITH per-extension glyph (granularity=extension).
-   * Used by built-in `core` and any user plugin that opts in. Padding
-   * for {{kind}} and {{name}} is computed at render time so columns
-   * align inside the block.
-   */
-  detailExtensionRowGlyph: "    {{glyph}}  {{kind}}  {{name}}  v{{version}}\n",
-  /**
-   * Extension row WITHOUT per-extension glyph (granularity=bundle).
-   * The bundle is the only toggle; per-extension status is implicit.
+   * Extension row inside the bundle detail. Every extension is
+   * independently toggle-able, so every row carries its own glyph
+   * (✓ / ✕). Padding for {{kind}} and {{name}} is computed at render
+   * time so columns align inside the block. `{{versionSuffix}}` is
+   * either `  v<x.y.z>` (user plugins) or empty (built-in bundles,
+   * which inherit the CLI version and do not maintain per-extension
+   * versions of their own).
    */
-  detailExtensionRowBare: "       {{kind}}  {{name}}  v{{version}}\n",
+  detailExtensionRowGlyph: "    {{glyph}}  {{kind}}  {{name}}{{versionSuffix}}\n",
   detailVersionUnknown: "?",
   detailCompatUnknown: "?",
   /**
@@ -19052,26 +19118,23 @@ async function loadAll(opts) {
 }
 function builtInRows(resolveEnabled) {
   return sortBundlesForPresentation(builtInBundles).map((bundle) => {
-    const bundleEnabled = resolveEnabled(bundle.id);
-    const extensions = bundle.extensions.map((ext) => extensionRowFromBuiltIn(ext, bundle, bundleEnabled, resolveEnabled));
+    const extensions = bundle.extensions.map((ext) => extensionRowFromBuiltIn(ext, bundle, resolveEnabled));
     const manifestSummary = bundle.extensions.map((ext) => `${ext.kind}:${qualifiedExtensionId(bundle.id, ext.id)}@${ext.version}`).join(", ");
     return {
       id: bundle.id,
-      granularity: bundle.granularity,
-      enabled: bundleEnabled,
+      enabled: extensions.some((e) => e.enabled),
       description: bundle.description,
       extensions,
       manifestSummary
     };
   });
 }
-function extensionRowFromBuiltIn(ext, bundle, bundleEnabled, resolveEnabled) {
-  const qualifiedEnabled = resolveEnabled(qualifiedExtensionId(bundle.id, ext.id));
+function extensionRowFromBuiltIn(ext, bundle, resolveEnabled) {
   const row = {
     id: ext.id,
     kind: ext.kind,
     version: ext.version,
-    enabled: bundle.granularity === "bundle" ? bundleEnabled && qualifiedEnabled : qualifiedEnabled,
+    enabled: resolveEnabled(qualifiedExtensionId(bundle.id, ext.id)),
     description: ext.description ?? ""
   };
   if (ext.entry !== void 0) row.entry = ext.entry;
@@ -19125,14 +19188,14 @@ var PluginsListCommand = class extends SmCommand {
       return ExitCode.Ok;
     }
     const ansi = this.ansiFor("stdout");
-    this.printer.data(renderListHuman(builtIns2, plugins, ansi));
+    this.printer.data(renderListHuman(builtIns2, plugins, resolveEnabled, ansi));
     return ExitCode.Ok;
   }
 };
-function renderListHuman(builtIns2, plugins, ansi) {
+function renderListHuman(builtIns2, plugins, resolveEnabled, ansi) {
   const rows = [
     ...builtIns2.map(builtInToListRow),
-    ...plugins.map(pluginToListRow)
+    ...plugins.map((p) => pluginToListRow(p, resolveEnabled))
   ];
   const idWidth = Math.max(...rows.map((r) => r.id.length));
   const countWidth = Math.max(
@@ -19163,9 +19226,9 @@ function renderListHuman(builtIns2, plugins, ansi) {
   return lines.join("\n") + "\n" + PLUGINS_TEXTS.listTipShow;
 }
 function builtInToListRow(b) {
-  const names = b.granularity === "extension" ? b.extensions.map(
+  const names = b.extensions.map(
     (e) => e.enabled ? e.id : `${PLUGINS_TEXTS.rowGlyphOff} ${e.id}`
-  ) : b.extensions.map((e) => e.id);
+  );
   return {
     id: b.id,
     enabled: b.enabled,
@@ -19173,9 +19236,14 @@ function builtInToListRow(b) {
     names
   };
 }
-function pluginToListRow(p) {
-  const enabled = p.status === "enabled";
-  const names = p.extensions?.map((e) => sanitizeForTerminal(e.id)) ?? [];
+function pluginToListRow(p, resolveEnabled) {
+  const isLoaded = p.status === "enabled";
+  const extensions = p.extensions ?? [];
+  const enabled = isLoaded ? extensions.length === 0 || extensions.some((e) => resolveEnabled(qualifiedExtensionId(p.id, e.id))) : false;
+  const names = extensions.map((e) => {
+    const safeId = sanitizeForTerminal(e.id);
+    return resolveEnabled(qualifiedExtensionId(p.id, e.id)) ? safeId : `${PLUGINS_TEXTS.rowGlyphOff} ${safeId}`;
+  });
   const reason = p.status === "enabled" ? void 0 : sanitizeForTerminal(p.reason ?? "") || void 0;
   return {
     id: sanitizeForTerminal(p.id),
@@ -19213,11 +19281,10 @@ var PluginsShowCommand = class extends SmCommand {
       Accepts a bundle / plugin id (\`core\`, \`claude\`, \`my-plugin\`)
       or a qualified extension id (\`core/<ext-id>\`,
       \`<plugin>/<ext-id>\`). When given a qualified id, validates the
-      extension exists and renders the parent bundle's detail (which
-      lists every extension with per-extension status for
-      granularity=extension bundles like \`core\`). The same id shapes
-      \`sm plugins enable\` and \`sm plugins disable\` accept resolve
-      cleanly here too.
+      extension exists and renders a single-extension detail block.
+      The bare form renders the parent bundle's detail with per-extension
+      status. The same id shapes \`sm plugins enable\` and
+      \`sm plugins disable\` accept resolve cleanly here too.
     `
   });
   id = Option22.String({ required: true });
@@ -19348,16 +19415,13 @@ function sortExtensionsCanonical(exts) {
   });
 }
 function renderBuiltInDetail(b, ansi) {
-  const enabled = b.enabled;
-  const glyph = enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff);
+  const glyph = b.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff);
   const count = b.extensions.length;
-  const qualify = b.granularity === "extension";
   const sorted = sortExtensionsCanonical(b.extensions);
   const items = sorted.map((ext) => ({
-    glyph: b.granularity === "extension" ? ext.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff) : null,
+    glyph: ext.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff),
     kind: ext.kind,
-    name: qualify ? `${b.id}/${ext.id}` : ext.id,
-    version: ext.version
+    name: `${b.id}/${ext.id}`
   }));
   return tx(PLUGINS_TEXTS.detailHeaderBuiltIn, {
     glyph,
@@ -19425,15 +19489,18 @@ function renderPluginDetailFields(match) {
 function collectPluginExtensionItems(match, ansi) {
   const enabled = match.status === "enabled";
   if (!enabled || !match.extensions) return [];
-  const qualify = match.granularity === "extension";
   const safeBundleId = sanitizeForTerminal(match.id);
   const sorted = sortExtensionsCanonical(match.extensions);
   return sorted.map((ext) => {
     const safeExtId = sanitizeForTerminal(ext.id);
     return {
-      glyph: match.granularity === "extension" ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : null,
+      // User plugins surfaced via `loadAll` already filter on the
+      // resolver, so a reachable extension on this surface is enabled
+      // by construction. The disabled path goes through the bundle
+      // status header above (✕ on the row).
+      glyph: ansi.green(PLUGINS_TEXTS.rowGlyphOk),
       kind: sanitizeForTerminal(ext.kind),
-      name: qualify ? `${safeBundleId}/${safeExtId}` : safeExtId,
+      name: `${safeBundleId}/${safeExtId}`,
       version: sanitizeForTerminal(ext.version)
     };
   });
@@ -19441,29 +19508,21 @@ function collectPluginExtensionItems(match, ansi) {
 function renderExtensionItems(items) {
   if (items.length === 0) return "";
   const kindWidth = Math.max(...items.map((i) => i.kind.length));
-  const nameWidth = Math.max(...items.map((i) => i.name.length));
+  const anyVersion = items.some((i) => i.version !== void 0);
+  const nameWidth = anyVersion ? Math.max(...items.map((i) => i.name.length)) : 0;
   const out = [];
   for (const item of items) {
     const kind = item.kind.padEnd(kindWidth);
-    const name = item.name.padEnd(nameWidth);
-    if (item.glyph !== null) {
-      out.push(
-        tx(PLUGINS_TEXTS.detailExtensionRowGlyph, {
-          glyph: item.glyph,
-          kind,
-          name,
-          version: item.version
-        })
-      );
-    } else {
-      out.push(
-        tx(PLUGINS_TEXTS.detailExtensionRowBare, {
-          kind,
-          name,
-          version: item.version
-        })
-      );
-    }
+    const name = anyVersion ? item.name.padEnd(nameWidth) : item.name;
+    const versionSuffix = item.version ? `  v${item.version}` : "";
+    out.push(
+      tx(PLUGINS_TEXTS.detailExtensionRowGlyph, {
+        glyph: item.glyph,
+        kind,
+        name,
+        versionSuffix
+      })
+    );
   }
   return out.join("");
 }
@@ -19474,7 +19533,7 @@ function renderBuiltInExtensionDetail(bundleId, ext, ansi) {
     qualifiedId: sanitizeForTerminal(`${bundleId}/${ext.id}`),
     source: ansi.dim(PLUGINS_TEXTS.sourceBuiltIn)
   });
-  const meta = { kind: ext.kind, version: ext.version };
+  const meta = { kind: ext.kind };
   if (ext.description) meta.description = ext.description;
   if (ext.entry !== void 0) meta.entry = ext.entry;
   return header + "\n" + renderExtensionFields(meta);
@@ -19513,7 +19572,12 @@ function readInstanceMeta(instance) {
 function renderExtensionFields(meta) {
   const fields = [];
   fields.push({ label: PLUGINS_TEXTS.detailFieldKind, value: sanitizeForTerminal(meta.kind) });
-  fields.push({ label: PLUGINS_TEXTS.detailFieldVersion, value: sanitizeForTerminal(meta.version) });
+  if (meta.version) {
+    fields.push({
+      label: PLUGINS_TEXTS.detailFieldVersion,
+      value: sanitizeForTerminal(meta.version)
+    });
+  }
   if (meta.stability) {
     fields.push({
       label: PLUGINS_TEXTS.detailFieldStability,
@@ -19567,7 +19631,7 @@ var PluginsDoctorCommand = class extends SmCommand {
     const plugins = await loadAll({ pluginDir: this.pluginDir });
     const resolveEnabled = await buildResolver();
     const builtIns2 = builtInRows(resolveEnabled);
-    const counts = countByStatus(builtIns2, plugins);
+    const counts = countByStatus(builtIns2, plugins, resolveEnabled);
     const knownKinds = collectKnownKinds(plugins);
     const applicableKindWarnings = collectApplicableKindWarnings(plugins, knownKinds);
     const unknownSlotWarnings = collectUnknownSlotWarnings(plugins, KNOWN_SLOT_NAMES);
@@ -19602,6 +19666,7 @@ var PluginsDoctorCommand = class extends SmCommand {
     this.printer.data(
       tx(PLUGINS_TEXTS.doctorSummary, {
         enabled,
+        enabledPlural: enabled === 1 ? "" : "s",
         issues: badCount,
         issuesPlural: badCount === 1 ? "" : "s",
         warnings,
@@ -19699,7 +19764,7 @@ var PluginsDoctorCommand = class extends SmCommand {
     }
   }
 };
-function countByStatus(builtIns2, plugins) {
+function countByStatus(builtIns2, plugins, resolveEnabled) {
   const counts = {
     enabled: 0,
     disabled: 0,
@@ -19710,15 +19775,20 @@ function countByStatus(builtIns2, plugins) {
     "id-collision": 0
   };
   for (const b of builtIns2) {
-    if (b.granularity === "bundle") {
-      counts[b.enabled ? "enabled" : "disabled"]++;
-    } else {
-      for (const ext of b.extensions) {
-        counts[ext.enabled ? "enabled" : "disabled"]++;
-      }
+    for (const ext of b.extensions) {
+      counts[ext.enabled ? "enabled" : "disabled"]++;
+    }
+  }
+  for (const p of plugins) {
+    if (p.status !== "enabled" || !p.extensions) {
+      counts[p.status]++;
+      continue;
+    }
+    for (const ext of p.extensions) {
+      const enabled = resolveEnabled(`${p.id}/${ext.id}`);
+      counts[enabled ? "enabled" : "disabled"]++;
     }
   }
-  for (const p of plugins) counts[p.status]++;
   return counts;
 }
 function forEachProviderInstance(plugins, callback) {
@@ -19911,6 +19981,9 @@ function buildDoctorJsonEnvelope(args2) {
 import { Command as Command25, Option as Option24 } from "clipanion";
 var TogglePluginsBase = class extends SmCommand {
   all = Option24.Boolean("--all", false);
+  yes = Option24.Boolean("--yes,-y", false, {
+    description: "Skip the interactive confirm when a bare bundle id (or --all) fans the toggle out across multiple extensions."
+  });
   ids = Option24.Rest({ name: "ids" });
   async toggle(enabled) {
     const verb = enabled ? "enable" : "disable";
@@ -19919,14 +19992,17 @@ var TogglePluginsBase = class extends SmCommand {
     if (argError !== null) return argError;
     const plugins = await loadAll({ pluginDir: void 0 });
     const catalogue = bundleCatalogue(plugins);
-    const targetsResult = this.#pickTargets(catalogue, verb, stderrAnsi);
+    const targetsResult = this.#pickTargets(catalogue, stderrAnsi);
     if (typeof targetsResult === "number") return targetsResult;
     let targets = targetsResult;
+    const macroOk = await this.#confirmMacroIfNeeded(targets, verb, stderrAnsi);
+    if (!macroOk) return ExitCode.Error;
     const lockError = this.#applyLockGate(targets, stderrAnsi);
     if (typeof lockError === "number") return lockError;
     targets = lockError;
-    await this.#persistTargets(targets, enabled);
-    this.#renderSuccess(targets, enabled);
+    const keys = expandToKeys(targets);
+    await this.#persistKeys(keys, enabled);
+    this.#renderSuccess(keys, enabled);
     return ExitCode.Ok;
   }
   /**
@@ -19959,87 +20035,166 @@ var TogglePluginsBase = class extends SmCommand {
   /**
    * Resolve `<id>...` against the catalogue or fan out via `--all`.
    * Returns the target list on success, or the exit code on a
-   * directed-error path (unknown id, granularity mismatch).
+   * directed-error path (unknown id, malformed qualified id).
    *
-   * `--all` is a macro on bundle ids: every plugin / bundle the user
-   * can see. We deliberately do NOT expand to qualified
-   * <bundle>/<ext> keys, that would silently flip a granularity
-   * policy. For granularity=extension bundles the user already hits
-   * the directed error message when they try the bundle id directly,
-   * so `--all` skips them here too and the real "disable every core
-   * extension" intent is served by `--no-built-ins` on `sm scan`.
-   *
-   * Variadic mode is all-or-nothing: the first bad id aborts the
-   * batch before any DB write, so the user never lands in a partial
-   * state. Repeated ids in the same call are deduped.
+   * Repeated ids in the same call are deduped at the target level
+   * (`origin === 'bare'` and `origin === 'qualified'` rows stay
+   * distinct so the macro-confirm path can address each correctly).
+   * The first unknown id aborts the batch before any DB write so the
+   * user never lands in a partial state.
    */
-  #pickTargets(catalogue, verb, ansi) {
+  #pickTargets(catalogue, ansi) {
     if (this.all) {
-      return catalogue.filter((b) => b.granularity === "bundle").map((b) => b.id);
+      return catalogue.map((b) => ({
+        origin: "bare",
+        bundleId: b.id,
+        keys: b.extensionIds.map((extId) => qualifiedExtensionId(b.id, extId))
+      }));
     }
-    const keys = [];
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
     for (const rawId of this.ids) {
-      const resolved = resolveToggleTarget(rawId, catalogue, verb, ansi);
+      const resolved = resolveToggleTarget(rawId, catalogue, ansi);
       if ("error" in resolved) {
         this.printer.error(tx(PLUGINS_TEXTS.toggleResolveError, { error: resolved.error }));
         return ExitCode.NotFound;
       }
-      keys.push(resolved.key);
+      const novelKeys = resolved.keys.filter((k) => !seen.has(k));
+      if (novelKeys.length === 0) continue;
+      for (const k of novelKeys) seen.add(k);
+      out.push({ ...resolved, keys: novelKeys });
     }
-    return [...new Set(keys)];
+    return out;
+  }
+  /**
+   * Macro gate: when the request would fan a single user input out
+   * across more than one extension (either `--all` or a bare bundle
+   * id whose bundle holds ≥2 extensions), confirm the intent.
+   *
+   * Resolution order:
+   *   1. `--yes` flag: skip the prompt entirely.
+   *   2. TTY stdin: render the list + ask interactively (`[y/N]`).
+   *   3. Non-TTY (CI / pipe / agent harness): refuse with a directed
+   *      message that names the extensions and points at `--yes`.
+   *
+   * Returns `true` when the verb should proceed, `false` when it
+   * should abort. Single-extension targets (bare bundle id mapping to
+   * one child, or qualified ids) skip the gate uniformly.
+   */
+  // Cyclomatic count comes from the three-stage gate (--yes shortcut,
+  // TTY interactive path, non-TTY rejection) folded over the targets
+  // loop. Splitting them scatters the contract without making the
+  // algorithm clearer.
+  // eslint-disable-next-line complexity
+  async #confirmMacroIfNeeded(targets, verb, ansi) {
+    const macroTargets = targets.filter((t) => requiresMacroConfirm(t));
+    if (macroTargets.length === 0) return true;
+    if (this.yes) return true;
+    const isTty = Boolean(this.context.stdin && "isTTY" in this.context.stdin && this.context.stdin.isTTY);
+    for (const target of macroTargets) {
+      const bundleLabel = target.origin === "bare" ? target.bundleId ?? "--all" : "--all";
+      this.printer.info(
+        tx(PLUGINS_TEXTS.bundleMacroHeader, {
+          verb,
+          bundleId: sanitizeForTerminal(bundleLabel),
+          count: target.keys.length
+        })
+      );
+      for (const key of target.keys) {
+        this.printer.info(tx(PLUGINS_TEXTS.bundleMacroRow, { id: sanitizeForTerminal(key) }));
+      }
+    }
+    if (!isTty) {
+      this.printer.error(
+        tx(PLUGINS_TEXTS.bundleMacroRequiresYes, {
+          glyph: ansi.red("\u2715"),
+          verb,
+          hint: ansi.dim(PLUGINS_TEXTS.bundleMacroRequiresYesHint)
+        })
+      );
+      return false;
+    }
+    const ok = await confirm(
+      tx(PLUGINS_TEXTS.bundleMacroConfirmPrompt, { verb }),
+      { stdin: this.context.stdin, stderr: this.context.stderr }
+    );
+    if (!ok) {
+      this.printer.info(PLUGINS_TEXTS.bundleMacroCancelled);
+    }
+    return ok;
   }
   /**
    * Host lock, see `src/kernel/config/locked-plugins.ts`. Bulk modes
-   * (`--all` or an explicit batch of >1 ids) silently skip locked
-   * targets so the user can still toggle the rest. Single-id mode
-   * surfaces a directed exit-5 message so the user knows their one
-   * intended target was refused.
+   * (`--all`, an explicit batch of >1 targets, or a macro expansion
+   * with >1 keys) silently skip locked extensions so the user can
+   * still toggle the rest. Single-extension mode surfaces a directed
+   * exit-5 message so the user knows their one intended target was
+   * refused.
    */
   #applyLockGate(targets, ansi) {
-    if (this.all || this.ids.length > 1) return targets.filter((id) => !isPluginLocked(id));
-    const lockedHit = targets.find((id) => isPluginLocked(id));
-    if (!lockedHit) return targets;
+    const totalKeys = targets.reduce((acc, t) => acc + t.keys.length, 0);
+    const bulk = this.all || this.ids.length > 1 || totalKeys > 1;
+    if (bulk) {
+      return targets.map((t) => ({ ...t, keys: t.keys.filter((k) => !isPluginLocked(k)) }));
+    }
+    const onlyKey = targets[0]?.keys[0];
+    if (!onlyKey || !isPluginLocked(onlyKey)) return targets;
     this.printer.error(
       tx(PLUGINS_TEXTS.pluginLocked, {
         glyph: ansi.red("\u2715"),
-        id: sanitizeForTerminal(lockedHit),
+        id: sanitizeForTerminal(onlyKey),
         hint: ansi.dim(PLUGINS_TEXTS.pluginLockedHint)
       })
     );
     return ExitCode.NotFound;
   }
   /**
-   * Persist the toggle in `config_plugins`. On disable, also purge
-   * the plugin's `scan_contributions` rows immediately (matches the
-   * BFF route, see `server/routes/plugins.ts:applyChangeToAdapter`).
-   * `targets` carries either a bare bundle id (e.g. `claude`) or a
-   * qualified `<bundle>/<ext>` (e.g. `core/slash-command`); the split mirrors
-   * how the catalog sweep groups rows.
+   * Persist every qualified id in `config_plugins`. On disable, also
+   * purge the plugin's `scan_contributions` rows immediately (matches
+   * the BFF route, see `server/routes/plugins.ts:applyChangeToAdapter`).
+   * Every key is `<bundle>/<ext>` shape so the contribution purge can
+   * split into `(pluginId, extensionId)` cleanly.
    */
-  async #persistTargets(targets, enabled) {
+  async #persistKeys(keys, enabled) {
     const ctx = defaultRuntimeContext();
     const dbPath = resolveDbPath({ db: void 0, cwd: ctx.cwd });
     await withSqlite({ databasePath: dbPath, autoBackup: false }, async (adapter) => {
-      for (const id of targets) {
+      for (const id of keys) {
         await adapter.pluginConfig.set(id, enabled);
         if (!enabled) await purgeContributionsFor(adapter, id);
       }
     });
   }
-  #renderSuccess(targets, enabled) {
+  #renderSuccess(keys, enabled) {
     const verbPast = enabled ? "enabled" : "disabled";
-    if (targets.length === 1) {
-      this.printer.data(tx(PLUGINS_TEXTS.toggleAppliedSingle, { verbPast, id: targets[0] }));
+    if (keys.length === 1) {
+      this.printer.data(tx(PLUGINS_TEXTS.toggleAppliedSingle, { verbPast, id: keys[0] }));
     } else {
       this.printer.data(
-        tx(PLUGINS_TEXTS.toggleAppliedManyHeader, { verbPast, count: targets.length })
+        tx(PLUGINS_TEXTS.toggleAppliedManyHeader, { verbPast, count: keys.length })
       );
-      for (const id of targets) {
+      for (const id of keys) {
         this.printer.data(tx(PLUGINS_TEXTS.toggleAppliedManyRow, { id }));
       }
     }
   }
 };
+function requiresMacroConfirm(target) {
+  if (target.origin !== "bare") return false;
+  return target.keys.length >= 2;
+}
+function expandToKeys(targets) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const t of targets) {
+    for (const k of t.keys) {
+      if (seen.has(k)) continue;
+      seen.add(k);
+      out.push(k);
+    }
+  }
+  return out;
+}
 async function purgeContributionsFor(adapter, id) {
   const slash = id.indexOf("/");
   if (slash < 0) {
@@ -20052,25 +20207,24 @@ var PluginsEnableCommand = class extends TogglePluginsBase {
   static paths = [["plugins", "enable"]];
   static usage = Command25.Usage({
     category: "Plugins",
-    description: "Enable one or more plugins (or --all). Persists in config_plugins.",
+    description: "Enable one or more extensions (or --all). Persists in config_plugins.",
     details: `
-      Writes a row to config_plugins with enabled=1 per id. Takes
-      precedence over the team-shared baseline at
+      Writes a row to config_plugins with enabled=1 per qualified
+      extension id. Takes precedence over the team-shared baseline at
       settings.json#/plugins/<id>/enabled. Use sm plugins disable to
       flip; sm config reset plugins.<id>.enabled drops the settings.json
       baseline.
 
-      Accepts one or more ids in one call, e.g.
-      'sm plugins enable claude antigravity openai'. Batches are
-      all-or-nothing: a single unknown / mismatched id aborts before
-      any write. Repeated ids are deduped. Locked plugins inside a
-      batch are silently skipped.
+      Accepts qualified ids (\`claude/at-directive\`) and bare bundle
+      ids (\`claude\`, which fans the toggle out across every extension
+      inside the bundle). Multi-extension bundles need --yes (or an
+      interactive TTY confirm) to avoid flipping 27 core extensions by
+      accident. Single-extension bundles (openai, agent-skills,
+      antigravity) apply without prompting.
 
-      Granularity: a bundle-granularity plugin (default for user plugins,
-      and the built-in 'claude' bundle) accepts only the bundle id. An
-      extension-granularity plugin (the built-in 'core' bundle) accepts
-      only qualified ids '<bundle>/<ext-id>'. Mismatches are rejected
-      with directed guidance.
+      Batches are all-or-nothing: a single unknown id aborts before
+      any write. Repeated ids are deduped. Locked extensions inside a
+      batch are silently skipped.
     `
   });
   async run() {
@@ -20081,24 +20235,23 @@ var PluginsDisableCommand = class extends TogglePluginsBase {
   static paths = [["plugins", "disable"]];
   static usage = Command25.Usage({
     category: "Plugins",
-    description: "Disable one or more plugins (or --all). Persists in config_plugins; does not delete files.",
+    description: "Disable one or more extensions (or --all). Persists in config_plugins; does not delete files.",
     details: `
-      Writes a row to config_plugins with enabled=0 per id. Discovery
-      still surfaces the plugin in sm plugins list, but with
-      status=disabled; its extensions are not imported and the kernel
-      will not run them.
-
-      Accepts one or more ids in one call, e.g.
-      'sm plugins disable antigravity openai agent-skills'. Batches are
-      all-or-nothing: a single unknown / mismatched id aborts before
-      any write. Repeated ids are deduped. Locked plugins inside a
+      Writes a row to config_plugins with enabled=0 per qualified
+      extension id. Discovery still surfaces the plugin in
+      sm plugins list, but with status=disabled; the kernel will not
+      run any of its disabled extensions.
+
+      Accepts qualified ids (\`core/markdown-link\`) and bare bundle
+      ids (\`core\`, which fans the toggle out across every extension
+      inside the bundle). Multi-extension bundles need --yes (or an
+      interactive TTY confirm) to avoid flipping 27 core extensions by
+      accident. Single-extension bundles (openai, agent-skills,
+      antigravity) apply without prompting.
+
+      Batches are all-or-nothing: a single unknown id aborts before
+      any write. Repeated ids are deduped. Locked extensions inside a
       batch are silently skipped.
-
-      Granularity: a bundle-granularity plugin (default for user plugins,
-      and the built-in 'claude' bundle) accepts only the bundle id. An
-      extension-granularity plugin (the built-in 'core' bundle) accepts
-      only qualified ids '<bundle>/<ext-id>'. Mismatches are rejected
-      with directed guidance.
     `
   });
   async run() {
@@ -20110,23 +20263,21 @@ function bundleCatalogue(plugins) {
   for (const bundle of builtInBundles) {
     out.push({
       id: bundle.id,
-      granularity: bundle.granularity,
       extensionIds: bundle.extensions.map((e) => e.id)
     });
   }
   for (const p of plugins) {
     out.push({
       id: p.id,
-      granularity: p.granularity ?? "bundle",
       extensionIds: p.extensions?.map((e) => e.id) ?? []
     });
   }
   return out;
 }
-function resolveToggleTarget(id, catalogue, verb, ansi) {
-  return id.includes("/") ? resolveQualifiedToggle(id, catalogue, verb, ansi) : resolveBareToggle(id, catalogue, verb, ansi);
+function resolveToggleTarget(id, catalogue, ansi) {
+  return id.includes("/") ? resolveQualifiedToggle(id, catalogue, ansi) : resolveBareToggle(id, catalogue);
 }
-function resolveQualifiedToggle(id, catalogue, verb, ansi) {
+function resolveQualifiedToggle(id, catalogue, ansi) {
   const errGlyph = ansi.red("\u2715");
   const [bundleId, extId, ...rest] = id.split("/");
   if (!bundleId || !extId || rest.length > 0) {
@@ -20148,17 +20299,6 @@ function resolveQualifiedToggle(id, catalogue, verb, ansi) {
       })
     };
   }
-  if (bundle.granularity === "bundle") {
-    return {
-      error: tx(PLUGINS_TEXTS.granularityBundleRejectsQualified, {
-        glyph: errGlyph,
-        bundleId: sanitizeForTerminal(bundleId),
-        extId: sanitizeForTerminal(extId),
-        verb,
-        hint: ansi.dim(PLUGINS_TEXTS.granularityBundleRejectsQualifiedHint)
-      })
-    };
-  }
   if (!bundle.extensionIds.includes(extId)) {
     return {
       error: tx(PLUGINS_TEXTS.qualifiedIdNotFound, {
@@ -20170,31 +20310,27 @@ function resolveQualifiedToggle(id, catalogue, verb, ansi) {
       })
     };
   }
-  return { key: qualifiedExtensionId(bundleId, extId) };
+  return {
+    origin: "qualified",
+    keys: [qualifiedExtensionId(bundleId, extId)]
+  };
 }
-function resolveBareToggle(id, catalogue, verb, ansi) {
-  const errGlyph = ansi.red("\u2715");
+function resolveBareToggle(id, catalogue) {
   const bundle = catalogue.find((b) => b.id === id);
   if (!bundle) {
     return {
       error: tx(PLUGINS_TEXTS.pluginNotFound, {
-        glyph: errGlyph,
+        glyph: "\u2715",
         id: sanitizeForTerminal(id),
-        hint: ansi.dim(PLUGINS_TEXTS.pluginNotFoundHint)
-      })
-    };
-  }
-  if (bundle.granularity === "extension") {
-    return {
-      error: tx(PLUGINS_TEXTS.granularityExtensionRejectsBundleId, {
-        glyph: errGlyph,
-        bundleId: sanitizeForTerminal(id),
-        verb,
-        hint: ansi.dim(PLUGINS_TEXTS.granularityExtensionRejectsBundleIdHint)
+        hint: PLUGINS_TEXTS.pluginNotFoundHint
       })
     };
   }
-  return { key: bundle.id };
+  return {
+    origin: "bare",
+    bundleId: bundle.id,
+    keys: bundle.extensionIds.map((extId) => qualifiedExtensionId(bundle.id, extId))
+  };
 }
 
 // cli/commands/plugins/create.ts
@@ -20245,7 +20381,6 @@ var PluginsCreateCommand = class extends SmCommand {
       version: "0.1.0",
       specCompat: `^${specVersion}`,
       catalogCompat: "^1.0.0",
-      granularity: "bundle",
       description: "Generated by `sm plugins create`. Edit to taste.",
       settings: {
         keywords: {
@@ -20361,7 +20496,7 @@ var VIEW_SLOTS_CATALOG = [
   { id: "card.subtitle.left", summary: "Single non-negative integer in the card subtitle row." },
   { id: "card.footer.left", summary: "Counter chip in the left footer of the card." },
   { id: "card.footer.right", summary: "Counter chip in the right footer of the card." },
-  { id: "graph.node.alert", summary: "Corner badge decoration on the graph node (alert / status)." },
+  { id: "graph.node.alert", summary: 'Reserved corner badge on the graph node, special-case signals only. No core analyzer emits here; routine "this node has a problem" findings belong in `card.footer.right`.' },
   { id: "inspector.header.badge.counter", summary: "Counter chip in the inspector header badge cluster." },
   { id: "inspector.header.badge.tag", summary: "Qualitative tag chip in the inspector header badge cluster." },
   { id: "inspector.body.panel.breakdown", summary: "Top-N labeled values rendered as a bar chart in the inspector body." },
@@ -21659,13 +21794,12 @@ var ScanCommand = class extends SmCommand {
     const ansi = this.ansiFor("stdout");
     const cwd = defaultRuntimeContext().cwd;
     const hasErrors = exitCode2 === ExitCode.Issues;
-    const issuesCount = result.stats.issuesCount;
-    const glyph = hasErrors ? ansi.red("\u2715") : ansi.green("\u2713");
+    const severityCounts = countBySeverity(result.issues);
+    const glyph = hasErrors ? " " : ansi.green("\u2713");
     const counts = formatScanCounts({
       nodes: result.stats.nodesCount,
       links: result.stats.linksCount,
-      issues: issuesCount,
-      hasErrors,
+      severities: severityCounts,
       ansi
     });
     const duration = ansi.dim(`in ${result.stats.durationMs}ms`);
@@ -21712,11 +21846,49 @@ var ScanCommand = class extends SmCommand {
     return exitCode2;
   }
 };
+function countBySeverity(issues) {
+  const buckets = {
+    error: /* @__PURE__ */ new Set(),
+    warn: /* @__PURE__ */ new Set(),
+    info: /* @__PURE__ */ new Set()
+  };
+  for (const i of issues) {
+    const tier = i.severity;
+    const bucket = buckets[tier];
+    if (!bucket) continue;
+    fillSeverityBucket(bucket, i.nodeIds);
+  }
+  return { errors: buckets.error.size, warns: buckets.warn.size, info: buckets.info.size };
+}
+function fillSeverityBucket(bucket, nodeIds) {
+  const ids = nodeIds ?? [];
+  if (ids.length === 0) {
+    bucket.add("");
+    return;
+  }
+  for (const id of ids) bucket.add(id);
+}
 function formatScanCounts(opts) {
-  const { nodes, links, issues, hasErrors, ansi } = opts;
-  const issuesText = `${issues} ${plural(issues, "issue")}`;
-  const issuesColored = issues === 0 ? ansi.dim(issuesText) : hasErrors ? ansi.red(issuesText) : ansi.yellow(issuesText);
-  return `${nodes} ${plural(nodes, "node")} \xB7 ${links} ${plural(links, "link")} \xB7 ${issuesColored}`;
+  const { nodes, links, severities, ansi } = opts;
+  const parts = [
+    `${nodes} ${plural(nodes, "node")}`,
+    `${links} ${plural(links, "link")}`
+  ];
+  const total = severities.errors + severities.warns + severities.info;
+  if (total === 0) {
+    parts.push(ansi.dim("0 issues"));
+  } else {
+    if (severities.errors > 0) {
+      parts.push(ansi.red(`${severities.errors} ${plural(severities.errors, "error")}`));
+    }
+    if (severities.warns > 0) {
+      parts.push(ansi.yellow(`${severities.warns} ${plural(severities.warns, "warning")}`));
+    }
+    if (severities.info > 0) {
+      parts.push(ansi.dim(`${severities.info} info`));
+    }
+  }
+  return parts.join(" \xB7 ");
 }
 function plural(count, word) {
   return count === 1 ? word : `${word}s`;
@@ -22199,10 +22371,10 @@ var SERVER_TEXTS = {
   pluginsBodyNotJson: "Request body must be valid JSON.",
   pluginsBodyNotObject: "Request body must be a JSON object.",
   pluginsEnabledRequired: "`enabled` is required and must be a boolean.",
-  // 400, granularity mismatch. Two flavours so the message is useful
-  // when the operator hits the wrong route by hand.
-  pluginsGranularityExtensionExpected: 'Plugin "{{id}}" has granularity:"extension"; toggle individual extensions via PATCH /api/plugins/{{id}}/extensions/<extensionId>.',
-  pluginsGranularityBundleExpected: 'Plugin "{{id}}" has granularity:"bundle"; toggle the whole bundle via PATCH /api/plugins/{{id}}.',
+  // 400, cascade route rejects qualified ids: the bare-id PATCH is the
+  // bundle macro endpoint. Anything containing `/` needs the dedicated
+  // per-extension route below.
+  pluginsCascadeRouteQualifiedRejected: 'Plugin id "{{id}}" contains "/"; toggle individual extensions via PATCH /api/plugins/<bundle>/extensions/<extensionId>.',
   // 404, unknown plugin / extension.
   pluginsUnknown: 'No plugin with id "{{id}}".',
   pluginsExtensionUnknown: 'Plugin "{{bundleId}}" has no extension named "{{extensionId}}".',
@@ -23209,7 +23381,7 @@ function registerPluginsRoute(app, deps) {
     const id = c.req.param("id");
     if (id.includes("/")) {
       throw new HTTPException8(400, {
-        message: tx(SERVER_TEXTS.pluginsGranularityExtensionExpected, { id })
+        message: tx(SERVER_TEXTS.pluginsCascadeRouteQualifiedRejected, { id })
       });
     }
     const handle = findHandle(id, deps);
@@ -23218,18 +23390,15 @@ function registerPluginsRoute(app, deps) {
         message: tx(SERVER_TEXTS.pluginsUnknown, { id })
       });
     }
-    if (granularityOf(handle) !== "bundle") {
-      throw new HTTPException8(400, {
-        message: tx(SERVER_TEXTS.pluginsGranularityExtensionExpected, { id })
-      });
-    }
     if (isPluginLocked(id)) {
       throw new HTTPException8(403, {
         message: tx(SERVER_TEXTS.pluginsLocked, { id })
       });
     }
     const body = await parsePatchBody(c.req.raw);
-    return await persistAndProject(c, deps, id, body.enabled);
+    const childIds = bundleExtensionIds(handle).map((extId) => qualifiedExtensionId(id, extId));
+    const writable = childIds.filter((q) => !isPluginLocked(q));
+    return await persistManyAndProject(c, deps, writable, body.enabled);
   });
   app.patch("/api/plugins/:bundleId/extensions/:extensionId", async (c) => {
     const bundleId = c.req.param("bundleId");
@@ -23278,7 +23447,6 @@ function listItems(deps, resolveEnabled) {
 }
 function buildBuiltInItems(resolveEnabled) {
   return sortBundlesForPresentation(builtInBundles).map((bundle) => {
-    const bundleEnabled = resolveEnabled(bundle.id);
     const bundleLocked = isPluginLocked(bundle.id);
     const extensions = bundle.extensions.map((ext) => {
       const qualified = qualifiedExtensionId(bundle.id, ext.id);
@@ -23292,6 +23460,7 @@ function buildBuiltInItems(resolveEnabled) {
         ...extLocked ? { locked: true } : {}
       };
     });
+    const bundleEnabled = extensions.some((e) => e.enabled);
     return {
       id: bundle.id,
       version: firstVersion(bundle.extensions),
@@ -23299,7 +23468,6 @@ function buildBuiltInItems(resolveEnabled) {
       status: bundleEnabled ? "enabled" : "disabled",
       reason: null,
       source: "built-in",
-      granularity: bundle.granularity,
       description: bundle.description,
       ...extensions.length > 0 ? { extensions } : {},
       ...bundleLocked ? { locked: true } : {}
@@ -23310,9 +23478,8 @@ function buildDiscoveredItems(discovered, deps, resolveEnabled) {
   return discovered.map((plugin) => buildDiscoveredItem(plugin, deps, resolveEnabled));
 }
 function buildDiscoveredItem(plugin, deps, resolveEnabled) {
-  const granularity = plugin.granularity ?? "bundle";
   const bundleLocked = isPluginLocked(plugin.id);
-  const extensions = projectExtensionRows(plugin, granularity, resolveEnabled, bundleLocked);
+  const extensions = projectExtensionRows(plugin, resolveEnabled, bundleLocked);
   const optional = optionalDiscoveredFields(plugin, extensions);
   return {
     id: plugin.id,
@@ -23321,7 +23488,6 @@ function buildDiscoveredItem(plugin, deps, resolveEnabled) {
     status: projectStatus(plugin, resolveEnabled),
     reason: plugin.reason ?? null,
     source: classifyPluginSource(plugin.path, deps),
-    granularity,
     ...optional,
     ...bundleLocked ? { locked: true } : {},
     ...plugin.status === "disabled" ? { startsAsDisabled: true } : {}
@@ -23334,7 +23500,7 @@ function optionalDiscoveredFields(plugin, extensions) {
   if (extensions) out.extensions = extensions;
   return out;
 }
-function projectExtensionRows(plugin, _granularity, resolveEnabled, bundleLocked) {
+function projectExtensionRows(plugin, resolveEnabled, bundleLocked) {
   if (!plugin.extensions || plugin.extensions.length === 0) return void 0;
   return plugin.extensions.map((ext) => {
     const description = readInstanceDescription(ext.instance);
@@ -23383,6 +23549,18 @@ async function persistAndProject(c, deps, configKey, enabled) {
   );
   return projectListResponse(c, deps, overrides);
 }
+async function persistManyAndProject(c, deps, keys, enabled) {
+  const overrides = await tryWithSqlite(
+    { databasePath: deps.options.dbPath, autoBackup: false },
+    async (adapter) => {
+      for (const key of keys) {
+        await applyChangeToAdapter(adapter, key, enabled);
+      }
+      return await adapter.pluginConfig.loadOverrideMap();
+    }
+  );
+  return projectListResponse(c, deps, overrides);
+}
 async function applyChangeToAdapter(adapter, configKey, enabled) {
   await adapter.pluginConfig.set(configKey, enabled);
   if (enabled) return;
@@ -23426,13 +23604,6 @@ function validateBulkChange(change, deps) {
         message: tx(SERVER_TEXTS.pluginsUnknown, { id: change.id })
       };
     }
-    if (granularityOf(handle2) !== "bundle") {
-      return {
-        status: 400,
-        code: "bad-query",
-        message: tx(SERVER_TEXTS.pluginsGranularityExtensionExpected, { id: change.id })
-      };
-    }
     if (isPluginLocked(change.id)) {
       return {
         status: 403,
@@ -23473,13 +23644,22 @@ async function persistBulkAndProject(c, deps, changes) {
     { databasePath: deps.options.dbPath, autoBackup: false },
     async (adapter) => {
       for (const change of changes) {
-        await applyChangeToAdapter(adapter, change.id, change.enabled);
+        const writeKeys = expandBulkChangeKeys(change, deps);
+        for (const key of writeKeys) {
+          await applyChangeToAdapter(adapter, key, change.enabled);
+        }
       }
       return await adapter.pluginConfig.loadOverrideMap();
     }
   );
   return projectListResponse(c, deps, overrides);
 }
+function expandBulkChangeKeys(change, deps) {
+  if (change.id.includes("/")) return [change.id];
+  const handle = findHandle(change.id, deps);
+  if (!handle) return [];
+  return bundleExtensionIds(handle).map((extId) => qualifiedExtensionId(change.id, extId)).filter((q) => !isPluginLocked(q));
+}
 async function buildFreshResolver2(deps) {
   return buildFreshResolver({
     databasePath: deps.options.dbPath,
@@ -23497,8 +23677,11 @@ function findHandle(id, deps) {
   if (discovered) return { kind: "discovered", plugin: discovered };
   return null;
 }
-function granularityOf(handle) {
-  return handle.kind === "built-in" ? handle.bundle.granularity : handle.plugin.granularity ?? "bundle";
+function bundleExtensionIds(handle) {
+  if (handle.kind === "built-in") {
+    return handle.bundle.extensions.map((e) => e.id);
+  }
+  return (handle.plugin.extensions ?? []).map((e) => e.id);
 }
 function hasExtension(handle, extensionId) {
   if (handle.kind === "built-in") {