@tendrilapp/cli 0.1.40 → 0.1.41

package/dist/tendril.js

@@ -1980,8 +1980,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path50) {
-  return `--${path50.join("-")}`;
+function tokenPathToCssVar(path54) {
+  return `--${path54.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -2025,11 +2025,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path50 = variableNameToPath(variable.name);
-    if (path50.length === 0) {
+    const path54 = variableNameToPath(variable.name);
+    if (path54.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path50 };
+    return { variable, path: path54 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -2050,21 +2050,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path50 } of entries) {
+  for (const { variable, path: path54 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path50.slice(0, -1)) {
+    for (const segment of path54.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path50[path50.length - 1];
+    const leaf = path54[path54.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path50.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path54.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path50.join("."),
-      cssVar: tokenPathToCssVar(path50),
+      path: path54.join("."),
+      cssVar: tokenPathToCssVar(path54),
       type: token.$type,
       value: token.$value
     });
@@ -2253,9 +2253,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path50 = ctx.pathById.get(id);
-  if (path50 === void 0) ctx.unresolved.add(id);
-  return path50;
+  const path54 = ctx.pathById.get(id);
+  if (path54 === void 0) ctx.unresolved.add(id);
+  return path54;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -2290,8 +2290,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path50 = resolveBinding(ctx, id);
-        if (path50 !== void 0) tokens.add(path50);
+        const path54 = resolveBinding(ctx, id);
+        if (path54 !== void 0) tokens.add(path54);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -2299,8 +2299,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path50 = resolveBinding(ctx, radiusId);
-    if (path50 !== void 0) tokens.add(path50);
+    const path54 = resolveBinding(ctx, radiusId);
+    if (path54 !== void 0) tokens.add(path54);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -2310,10 +2310,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path50 = resolveBinding(ctx, gapId);
-      if (path50 !== void 0) {
-        layout.gap = path50;
-        tokens.add(path50);
+      const path54 = resolveBinding(ctx, gapId);
+      if (path54 !== void 0) {
+        layout.gap = path54;
+        tokens.add(path54);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -2322,10 +2322,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path50 = resolveBinding(ctx, id);
-        if (path50 !== void 0) {
-          paddingPaths.push(path50);
-          tokens.add(path50);
+        const path54 = resolveBinding(ctx, id);
+        if (path54 !== void 0) {
+          paddingPaths.push(path54);
+          tokens.add(path54);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -2533,9 +2533,17 @@ var init_src3 = __esm({
 });
 
 // packages/cli/src/invocation.ts
-import { existsSync as existsSync5, realpathSync } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, realpathSync } from "node:fs";
 import path5 from "node:path";
 import { fileURLToPath } from "node:url";
+function isDevTree(root) {
+  try {
+    const pkg = JSON.parse(readFileSync5(path5.join(root, "package.json"), "utf8"));
+    return pkg.private === true && pkg.name === "@tendrilapp/cli";
+  } catch {
+    return false;
+  }
+}
 function findPathTendril(pathEnv, platform) {
   const dirs = pathEnv.split(path5.delimiter).filter((d) => d !== "" && !/node_modules[\\/]\.bin/.test(d) && !/[\\/]_npx[\\/]/.test(d));
   const names = platform === "win32" ? ["tendril.cmd", "tendril.bat"] : ["tendril"];
@@ -2557,11 +2565,17 @@ function packageRootOf(file) {
   }
 }
 function resolveInvocation(pathEnv, platform, selfFile = fileURLToPath(import.meta.url)) {
+  let self = null;
+  try {
+    self = packageRootOf(realpathSync(selfFile));
+  } catch {
+    self = null;
+  }
+  if (self !== null && isDevTree(self)) return DEV_INVOCATION;
   const binary = findPathTendril(pathEnv, platform);
   if (binary === null) return NPX_INVOCATION;
   try {
     const onPath = packageRootOf(realpathSync(binary));
-    const self = packageRootOf(realpathSync(selfFile));
     if (onPath === null || self === null) return NPX_INVOCATION;
     return realpathSync(onPath) === realpathSync(self) ? "tendril" : NPX_INVOCATION;
   } catch {
@@ -2579,11 +2593,12 @@ function quoteArg(value) {
   if (/["`$]/.test(value)) throw new Error(`refusing to emit a shell argument containing a double quote, backtick or $: ${value}`);
   return /[\s'*?[\]()&;|<>#~]/.test(value) ? `"${value}"` : value;
 }
-var NPX_INVOCATION, cached;
+var NPX_INVOCATION, DEV_INVOCATION, cached;
 var init_invocation = __esm({
   "packages/cli/src/invocation.ts"() {
     "use strict";
     NPX_INVOCATION = "npx -y -p @tendrilapp/cli@latest tendril";
+    DEV_INVOCATION = "pnpm --filter @tendrilapp/cli dev";
     cached = null;
   }
 });
@@ -4350,7 +4365,7 @@ var init_font_collection = __esm({
 });
 
 // packages/verify/src/font-discovery.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync5, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync6, realpathSync as realpathSync2 } from "node:fs";
 import os2 from "node:os";
 import path12 from "node:path";
 function weightFromSubfamily(subfamily) {
@@ -4398,7 +4413,7 @@ function faceAt(bytes, view, dirOffset, file, faceIndex) {
 }
 function facesInFile(file) {
   try {
-    const bytes = new Uint8Array(readFileSync5(file));
+    const bytes = new Uint8Array(readFileSync6(file));
     if (bytes.length < 12) return [];
     const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
     if (isCollection(bytes)) {
@@ -4490,7 +4505,7 @@ var init_font_discovery = __esm({
 
 // packages/verify/src/font-resolve.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "node:fs";
 import os3 from "node:os";
 import path13 from "node:path";
 function fontCacheDir() {
@@ -4569,7 +4584,7 @@ async function resolveFonts(family, weights, cacheDir = DEFAULT_FONT_CACHE) {
     }
   }
   const mPath = path13.join(cacheDir, "manifest.json");
-  const prior = existsSync9(mPath) ? JSON.parse(readFileSync6(mPath, "utf8")) : [];
+  const prior = existsSync9(mPath) ? JSON.parse(readFileSync7(mPath, "utf8")) : [];
   const portable2 = resolved.map((m) => ({ ...m, file: path13.basename(m.file) }));
   const merged = [...prior.filter((p) => !resolved.some((m) => m.family === p.family && m.weight === p.weight)), ...portable2];
   if (resolved.length > 0) writeFileSync3(mPath, `${JSON.stringify(merged, null, 2)}
@@ -4583,7 +4598,7 @@ function addLocalFont(family, weight, filePath, cacheDir = DEFAULT_FONT_CACHE, f
   if (![".woff2", ".woff", ".ttf", ".otf", ".ttc"].includes(ext)) {
     throw new Error(`unsupported font file "${ext}" \u2014 use .woff2 (preferred), .woff, .ttf, .otf or .ttc`);
   }
-  let bytes = new Uint8Array(readFileSync6(src));
+  let bytes = new Uint8Array(readFileSync7(src));
   if (bytes.length === 0) throw new Error(`font file is empty: ${src}`);
   let storedExt = ext;
   if (isCollection(bytes)) {
@@ -4606,16 +4621,16 @@ ${shown}`
   writeFileSync3(file, bytes);
   const face = { family, weight, source: `${provenance}:${path13.basename(src)}`, sha256, file, license: "unknown" };
   const mPath = path13.join(cacheDir, "manifest.json");
-  const prior = existsSync9(mPath) ? JSON.parse(readFileSync6(mPath, "utf8")) : [];
+  const prior = existsSync9(mPath) ? JSON.parse(readFileSync7(mPath, "utf8")) : [];
   const merged = [...prior.filter((p) => !(p.family === family && p.weight === weight)), { ...face, file: path13.basename(file) }];
   writeFileSync3(mPath, `${JSON.stringify(merged, null, 2)}
 `);
   return face;
 }
 function checkFontLock(lockPath, cacheDir = DEFAULT_FONT_CACHE) {
-  const lock = JSON.parse(readFileSync6(lockPath, "utf8"));
+  const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
   const mPath = path13.join(cacheDir, "manifest.json");
-  const manifest = existsSync9(mPath) ? JSON.parse(readFileSync6(mPath, "utf8")) : [];
+  const manifest = existsSync9(mPath) ? JSON.parse(readFileSync7(mPath, "utf8")) : [];
   return lock.map((l) => {
     const m = manifest.find((x) => x.family === l.family && x.weight === l.weight);
     if (m === void 0) return { family: l.family, weight: l.weight, status: "missing" };
@@ -4627,7 +4642,7 @@ function resolvedFontFamilies(cacheDir = DEFAULT_FONT_CACHE) {
   if (!existsSync9(mPath)) return [];
   let entries;
   try {
-    entries = JSON.parse(readFileSync6(mPath, "utf8"));
+    entries = JSON.parse(readFileSync7(mPath, "utf8"));
   } catch {
     return [];
   }
@@ -4642,7 +4657,7 @@ function resolvedFontFamilies(cacheDir = DEFAULT_FONT_CACHE) {
 }
 function requiredFontsManifest(families, cacheDir = DEFAULT_FONT_CACHE) {
   const mPath = path13.join(cacheDir, "manifest.json");
-  const manifest = existsSync9(mPath) ? JSON.parse(readFileSync6(mPath, "utf8")) : [];
+  const manifest = existsSync9(mPath) ? JSON.parse(readFileSync7(mPath, "utf8")) : [];
   const wanted = new Set(families.map((f) => f.toLowerCase()));
   return manifest.filter((f) => wanted.has(f.family.toLowerCase())).map((f) => ({
     family: f.family,
@@ -4659,7 +4674,7 @@ function facesMissingLicense(cacheDir = DEFAULT_FONT_CACHE) {
   if (!existsSync9(mPath)) return [];
   let entries;
   try {
-    entries = JSON.parse(readFileSync6(mPath, "utf8"));
+    entries = JSON.parse(readFileSync7(mPath, "utf8"));
   } catch {
     return [];
   }
@@ -4672,7 +4687,7 @@ function verifiedFontFamilies(cacheDir = DEFAULT_FONT_CACHE) {
   if (!existsSync9(mPath)) return [];
   let entries;
   try {
-    entries = JSON.parse(readFileSync6(mPath, "utf8"));
+    entries = JSON.parse(readFileSync7(mPath, "utf8"));
   } catch {
     return [];
   }
@@ -4681,7 +4696,7 @@ function verifiedFontFamilies(cacheDir = DEFAULT_FONT_CACHE) {
     if (typeof e.family !== "string" || typeof e.weight !== "number" || typeof e.file !== "string") continue;
     const file = path13.isAbsolute(e.file) && existsSync9(e.file) ? e.file : path13.resolve(cacheDir, path13.basename(e.file));
     if (!existsSync9(file)) continue;
-    if (createHash2("sha256").update(readFileSync6(file)).digest("hex") !== e.sha256) continue;
+    if (createHash2("sha256").update(readFileSync7(file)).digest("hex") !== e.sha256) continue;
     const set = byFamily.get(e.family) ?? /* @__PURE__ */ new Set();
     set.add(e.weight);
     byFamily.set(e.family, set);
@@ -4703,7 +4718,7 @@ function addSystemFamily(family, opts = {}) {
   const overwrote = [];
   const cacheDir = opts.cacheDir ?? DEFAULT_FONT_CACHE;
   const manifestFile = path13.join(cacheDir, "manifest.json");
-  const prior = existsSync9(manifestFile) ? JSON.parse(readFileSync6(manifestFile, "utf8")) : [];
+  const prior = existsSync9(manifestFile) ? JSON.parse(readFileSync7(manifestFile, "utf8")) : [];
   const taken = /* @__PURE__ */ new Set();
   for (const face of faces) {
     const skip = (reason) => skipped.push({ subfamily: face.subfamily, weight: face.weight, reason });
@@ -4765,17 +4780,17 @@ var init_font_resolve = __esm({
 
 // packages/verify/src/font-faces.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
 import path14 from "node:path";
 function injectedGroups(manifestPath2) {
   if (!existsSync10(manifestPath2)) return { groups: [], shared: false };
-  const claimed = JSON.parse(readFileSync7(manifestPath2, "utf8"));
+  const claimed = JSON.parse(readFileSync8(manifestPath2, "utf8"));
   const resolveFile = (f) => path14.isAbsolute(f) && existsSync10(f) ? f : path14.resolve(path14.dirname(manifestPath2), path14.basename(f));
   const byFile = /* @__PURE__ */ new Map();
   for (const f of claimed) {
     const file = resolveFile(f.file);
     if (!existsSync10(file)) continue;
-    if (createHash3("sha256").update(readFileSync7(file)).digest("hex") !== f.sha256) continue;
+    if (createHash3("sha256").update(readFileSync8(file)).digest("hex") !== f.sha256) continue;
     const k = `${f.family}:${f.file}`;
     const e = byFile.get(k) ?? { family: f.family, weights: [], file };
     e.weights.push(f.weight);
@@ -4788,7 +4803,7 @@ function fontFaceCss(manifestPath2 = path14.join(fontCacheDir(), "manifest.json"
   const { groups, shared } = injectedGroups(manifestPath2);
   return groups.map((e) => {
     const weight = shared || e.weights.length > 1 ? `${SPAN[0]} ${SPAN[1]}` : String(e.weights[0]);
-    return `@font-face { font-family: '${e.family}'; font-weight: ${weight}; font-style: normal; src: url(data:font/woff2;base64,${readFileSync7(e.file).toString("base64")}) format('woff2'); }`;
+    return `@font-face { font-family: '${e.family}'; font-weight: ${weight}; font-style: normal; src: url(data:font/woff2;base64,${readFileSync8(e.file).toString("base64")}) format('woff2'); }`;
   }).join("\n");
 }
 function injectedFamilyWeights(manifestPath2 = path14.join(fontCacheDir(), "manifest.json")) {
@@ -4816,7 +4831,7 @@ var init_font_faces = __esm({
 });
 
 // packages/verify/src/admission.ts
-import { readFileSync as readFileSync8, readdirSync as readdirSync4, existsSync as existsSync11, writeFileSync as writeFileSync4 } from "node:fs";
+import { readFileSync as readFileSync9, readdirSync as readdirSync4, existsSync as existsSync11, writeFileSync as writeFileSync4 } from "node:fs";
 import path15 from "node:path";
 import { build as build2 } from "esbuild";
 import postcss from "postcss";
@@ -4826,7 +4841,7 @@ function fontWeightsByFamily() {
   const mPath = path15.join(fontCacheDir(), "manifest.json");
   const out = /* @__PURE__ */ new Map();
   if (!existsSync11(mPath)) return out;
-  for (const f of JSON.parse(readFileSync8(mPath, "utf8")))
+  for (const f of JSON.parse(readFileSync9(mPath, "utf8")))
     out.set(f.family, [...out.get(f.family) ?? [], f.weight]);
   return out;
 }
@@ -4846,7 +4861,7 @@ var init_admission = __esm({
 });
 
 // packages/verify/src/candidate-css.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
 import path16 from "node:path";
 function candidateCss(bundleDir) {
   const files = ["tokens.css", "styles.css"].map((f) => path16.join(bundleDir, f));
@@ -4865,7 +4880,7 @@ function candidateCss(bundleDir) {
     }
     files.push(path16.join(dir, "tokens.css"), path16.join(dir, "styles.css"));
   }
-  return files.filter((f) => existsSync12(f)).map((f) => readFileSync9(f, "utf8")).join("\n");
+  return files.filter((f) => existsSync12(f)).map((f) => readFileSync10(f, "utf8")).join("\n");
 }
 var init_candidate_css = __esm({
   "packages/verify/src/candidate-css.ts"() {
@@ -5083,7 +5098,7 @@ __export(behavior_exports, {
   compileMount: () => compileMount,
   recordingIsDark: () => recordingIsDark
 });
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "node:fs";
 import path18 from "node:path";
 import { build as build3 } from "esbuild";
 import { chromium as chromium3 } from "playwright-core";
@@ -5159,8 +5174,8 @@ async function runSteps(page, spec, renderPose) {
         if (renderPose === void 0) return { id: spec.id, pass: false, detail: "commitMatchesPose requires a pose renderer" };
         await settle(page);
         const idle = await shotRoot(page);
-        for (const delay of [70, 130, 190]) {
-          await page.waitForTimeout(delay);
+        for (const delay2 of [70, 130, 190]) {
+          await page.waitForTimeout(delay2);
           await freezeAnimations(page);
           if (!(await shotRoot(page)).equals(idle)) {
             return { id: spec.id, pass: false, detail: "unmeasurable: the component's pixels change at rest (free-running animation or a timer in YOUR candidate) \u2014 the committed state cannot be observed through it; this IS fixable from code: keep every scored pose reachable with all motion idle (freezable CSS animation, no JS-driven repaints)" };
@@ -5455,7 +5470,7 @@ function recordingIsDark(task) {
   const f = path18.join(task.set, rep, "get_screenshot.json");
   if (!existsSync13(f)) return false;
   try {
-    const env = JSON.parse(readFileSync10(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync11(f, "utf8")).content.find((c) => c.type === "image");
     if (env?.data === void 0) return false;
     const png = PNG2.sync.read(Buffer.from(env.data, "base64"));
     let sum = 0;
@@ -6071,6 +6086,11 @@ var init_bundle = __esm({
       rep: z9.string(),
       similarity: z9.number(),
       inkRecall: z9.number(),
+      /** Pre-deadband measured values. Declared so the field SURVIVES the
+       * schema round-trip — the emitter writes it (bundle-emit) and zod was
+       * silently stripping it back out, so a reader could not tell a
+       * rounded 0.970 from a measured one. */
+      exact: z9.object({ similarity: z9.number(), inkRecall: z9.number() }).optional(),
       status: ConfigStatusSchema
     });
     BehaviorClaimSchema = z9.object({
@@ -6092,7 +6112,18 @@ var init_bundle = __esm({
         licenseNote: z9.string().optional(),
         /** Content hash over the set manifest + rep envelopes (the identity
          * verify compares against, not the path). */
-        hash: z9.string()
+        hash: z9.string(),
+        /** KIT IDENTITY (PROV-1). The Figma file key and component-set node
+         * the recording came from. Both are captured at plan time in the
+         * recording set and were being dropped here, which left a published
+         * bundle unable to say which kit it derives from — while the portal's
+         * consent model is scoped to exactly that file key (ADR-018 §3), and
+         * the right to publish attaches to a kit rather than to a folder
+         * someone named. Optional: recordings planned before this field
+         * existed carry neither, and a set can be a handed-in selection with
+         * no component set at all. Absent means NOT RECORDED, never "no kit". */
+        figmaFile: z9.string().optional(),
+        componentSetNode: z9.string().optional()
       }),
       environment: z9.object({
         chrome: z9.string(),
@@ -6141,6 +6172,198 @@ var init_bundle = __esm({
   }
 });
 
+// packages/metadata/src/published-surface.ts
+function classifyBundleSurface(files, opts) {
+  const published = [];
+  const excluded = [];
+  const unknown = [];
+  for (const raw of files) {
+    const path54 = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+    const inEvidence = path54.startsWith(`${EVIDENCE_DIR}/`);
+    const name = inEvidence ? path54.slice(EVIDENCE_DIR.length + 1) : path54;
+    if (name.includes("/")) {
+      unknown.push(path54);
+      continue;
+    }
+    if (inEvidence) {
+      if (name === "verify-report.json") published.push({ path: path54, role: "verify-report" });
+      else if (name === "diff-legend.txt") published.push({ path: path54, role: "diff-legend" });
+      else if (name === "inspect.html") published.push({ path: path54, role: "inspect-sheet" });
+      else {
+        const hit = EVIDENCE_PATTERNS.find((p) => p.re.test(name));
+        if (hit !== void 0) published.push({ path: path54, role: hit.role });
+        else unknown.push(path54);
+      }
+      continue;
+    }
+    if (name === opts.entry) published.push({ path: path54, role: "entry" });
+    else if (name === "styles.css") published.push({ path: path54, role: "styles" });
+    else if (name === "tokens.css") published.push({ path: path54, role: "tokens" });
+    else if (name === "fonts.css") published.push({ path: path54, role: "fonts" });
+    else if (name === "component.json") published.push({ path: path54, role: "manifest" });
+    else {
+      const skip = EXCLUDED.find((e) => e.test(name));
+      if (skip !== void 0) excluded.push({ path: path54, reason: skip.reason });
+      else unknown.push(path54);
+    }
+  }
+  const roles = new Set(published.map((p) => p.role));
+  return { published, excluded, unknown, missingRequired: REQUIRED_ROLES.filter((r) => !roles.has(r)) };
+}
+function missingInspectCrops(sheetText, publishedPaths) {
+  const held = new Set(publishedPaths);
+  const missing = /* @__PURE__ */ new Set();
+  for (const [, name] of sheetText.matchAll(/src="\.\/([^"]+)"/g)) {
+    const path54 = `${EVIDENCE_DIR}/${name}`;
+    if (!held.has(path54)) missing.add(path54);
+  }
+  return [...missing].sort();
+}
+var EVIDENCE_DIR, REQUIRED_ROLES, EXCLUDED, EVIDENCE_PATTERNS, SCORED_FILE_ROLES;
+var init_published_surface = __esm({
+  "packages/metadata/src/published-surface.ts"() {
+    "use strict";
+    EVIDENCE_DIR = "verify-evidence";
+    REQUIRED_ROLES = ["entry", "styles", "manifest", "verify-report", "evidence-triple"];
+    EXCLUDED = [
+      { test: (n) => n === "score-history.jsonl", reason: "generation loop score history" },
+      { test: (n) => n === "loop-state.json", reason: "generation loop state" },
+      { test: (n) => n === "run-log.json", reason: "generation run log" },
+      { test: (n) => n.endsWith(".md"), reason: "brief / debrief / model response" },
+      { test: (n) => n === ".DS_Store", reason: "macOS directory metadata" }
+    ];
+    EVIDENCE_PATTERNS = [
+      { re: /^.+-absent-\d+-(?:ref|render)\.png$/, role: "evidence-absent-crop" },
+      { re: /^.+-inspect-\d+-(?:ref|render)\.png$/, role: "evidence-zoom-crop" },
+      { re: /^.+-(?:ref|render|diff)\.png$/, role: "evidence-triple" }
+    ];
+    SCORED_FILE_ROLES = /* @__PURE__ */ new Set([
+      "entry",
+      "styles",
+      "tokens",
+      "fonts",
+      "manifest",
+      "evidence-triple",
+      "evidence-absent-crop",
+      "diff-legend"
+    ]);
+  }
+});
+
+// packages/metadata/src/bundle-files.ts
+import { createHash as createHash4 } from "node:crypto";
+import { readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import path19 from "node:path";
+function bundleFiles(dir, prefix = "") {
+  const out = [];
+  for (const entry of readdirSync6(dir).sort()) {
+    const full = path19.join(dir, entry);
+    const rel = prefix === "" ? entry : `${prefix}/${entry}`;
+    if (statSync3(full).isDirectory()) out.push(...bundleFiles(full, rel));
+    else out.push(rel);
+  }
+  return out;
+}
+function digestScoredFiles(bundleDir, entry) {
+  const surface = classifyBundleSurface(bundleFiles(bundleDir), { entry });
+  const out = {};
+  for (const file of surface.published) {
+    if (!SCORED_FILE_ROLES.has(file.role)) continue;
+    out[file.path] = createHash4("sha256").update(readFileSync12(path19.join(bundleDir, file.path))).digest("hex");
+  }
+  return out;
+}
+var init_bundle_files = __esm({
+  "packages/metadata/src/bundle-files.ts"() {
+    "use strict";
+    init_published_surface();
+  }
+});
+
+// packages/metadata/src/verify-report.ts
+function verifyReportForTransport(report, bundleName) {
+  const { dir: _dir, ...evidence } = report.evidence;
+  const { eyeCheck: _eyeCheck, ...rest } = report;
+  return { ...rest, bundle: bundleName, evidence };
+}
+function nonEmptyArray(value) {
+  return Array.isArray(value) && value.length > 0;
+}
+function undisclosedTrustFacts(report) {
+  if (report === null || typeof report !== "object" || Array.isArray(report)) return [];
+  const r = report;
+  const facts = [];
+  if (r["recordingSetDrift"] !== void 0 && r["recordingSetDrift"] !== null) {
+    facts.push({
+      pointer: "$.recordingSetDrift",
+      consequence: "the recording set that was scored is not the one the bundle stamps, so these scores describe a different design than the bundle claims"
+    });
+  }
+  if (nonEmptyArray(r["substitutedFamilies"])) {
+    facts.push({
+      pointer: "$.substitutedFamilies",
+      consequence: "a font family was substituted, so the scores measure a substitute face and no config can be certified under one"
+    });
+  }
+  if (nonEmptyArray(r["certBlockedByAbsentInk"])) {
+    facts.push({
+      pointer: "$.certBlockedByAbsentInk",
+      consequence: "certification was blocked by absent ink, which a verdict alone does not say"
+    });
+  }
+  return facts;
+}
+function isSetHash(value) {
+  return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+}
+function readScoredFiles(report) {
+  if (report === null || typeof report !== "object" || Array.isArray(report)) return void 0;
+  const value = report["scoredFiles"];
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entries = Object.entries(value);
+  if (entries.length === 0) return void 0;
+  const out = {};
+  for (const [path54, digest] of entries) {
+    if (path54 === "" || path54.startsWith("/") || path54.includes("..")) return void 0;
+    if (!isSetHash(digest)) return void 0;
+    out[path54] = digest;
+  }
+  return out;
+}
+function compareScoredFiles(recorded, actual) {
+  const missing = [];
+  const unscored = [];
+  const changed = [];
+  for (const [path54, digest] of Object.entries(recorded)) {
+    if (!(path54 in actual)) missing.push(path54);
+    else if (actual[path54] !== digest) changed.push(path54);
+  }
+  for (const path54 of Object.keys(actual)) if (!(path54 in recorded)) unscored.push(path54);
+  return { missing: missing.sort(), unscored: unscored.sort(), changed: changed.sort() };
+}
+function scoredRecordingSetHash(report) {
+  if (report === null || typeof report !== "object" || Array.isArray(report)) return void 0;
+  const r = report;
+  const drift = r["recordingSetDrift"];
+  if (drift !== null && typeof drift === "object" && !Array.isArray(drift)) {
+    const current = drift["current"];
+    if (isSetHash(current)) return current;
+  }
+  const manifest = r["bundleManifest"];
+  if (manifest !== null && typeof manifest === "object" && !Array.isArray(manifest)) {
+    const stamped = manifest["recordingSetHash"];
+    if (isSetHash(stamped)) return stamped;
+  }
+  return void 0;
+}
+var VERIFY_REPORT_FILENAME;
+var init_verify_report = __esm({
+  "packages/metadata/src/verify-report.ts"() {
+    "use strict";
+    VERIFY_REPORT_FILENAME = "verify-report.json";
+  }
+});
+
 // packages/metadata/src/motion-css.ts
 var MOTION_CSS_PATTERN, scannableCss, MOTION_TOKEN_NAMES;
 var init_motion_css = __esm({
@@ -6366,14 +6589,17 @@ var init_src4 = __esm({
     init_extract();
     init_recording_set();
     init_bundle();
+    init_bundle_files();
+    init_verify_report();
+    init_published_surface();
     init_motion_css();
     init_profile();
   }
 });
 
 // packages/verify/src/bundle-quality.ts
-import { readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync2, writeFileSync as writeFileSync5, existsSync as existsSync14 } from "node:fs";
-import path19 from "node:path";
+import { readFileSync as readFileSync13, readdirSync as readdirSync7, rmSync as rmSync2, writeFileSync as writeFileSync5, existsSync as existsSync14 } from "node:fs";
+import path20 from "node:path";
 function unscopedReduceBlockFindings(file, css) {
   const stripped = css.replace(/\/\*[\s\S]*?\*\//g, (c) => c.replace(/[^\n]/g, " "));
   const media = /@media[^{]*prefers-reduced-motion\s*:\s*reduce[^{]*\{/.exec(stripped);
@@ -6431,16 +6657,16 @@ function recordedAssetFindings(entryFile, entrySource, recordedPaths) {
 function recordedAssetPaths(setDir, reps) {
   const map = /* @__PURE__ */ new Map();
   for (const rep of reps) {
-    const dir = path19.join(setDir, rep);
+    const dir = path20.join(setDir, rep);
     let files;
     try {
-      files = readdirSync6(dir).filter((f) => f.startsWith("asset-") && f.endsWith(".svg"));
+      files = readdirSync7(dir).filter((f) => f.startsWith("asset-") && f.endsWith(".svg"));
     } catch {
       continue;
     }
     for (const f of files) {
       try {
-        const svg = readFileSync11(path19.join(dir, f), "utf8");
+        const svg = readFileSync13(path20.join(dir, f), "utf8");
         for (const m of svg.matchAll(/\sd="([^"]+)"/g)) {
           const d = m[1];
           const owners = map.get(d) ?? [];
@@ -6508,17 +6734,17 @@ function recordedTokenMapState(setDir, reps) {
   const readMap = (file) => {
     if (!existsSync14(file)) return void 0;
     try {
-      const parsed = JSON.parse(envelopeFirstTextPart(JSON.parse(readFileSync11(file, "utf8"))) || "{}");
+      const parsed = JSON.parse(envelopeFirstTextPart(JSON.parse(readFileSync13(file, "utf8"))) || "{}");
       return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
     } catch {
       return {};
     }
   };
-  const setLevel = readMap(path19.join(setDir, "get_variable_defs.json"));
+  const setLevel = readMap(path20.join(setDir, "get_variable_defs.json"));
   if (setLevel !== void 0) return Object.keys(setLevel).length === 0 ? "empty" : "populated";
   let recorded = false;
   for (const rep of reps) {
-    const m = readMap(path19.join(setDir, rep, "get_variable_defs.json"));
+    const m = readMap(path20.join(setDir, rep, "get_variable_defs.json"));
     if (m === void 0) continue;
     recorded = true;
     if (Object.keys(m).length > 0) return "populated";
@@ -6530,7 +6756,7 @@ function recordedTokensByValue(setDir, reps) {
   const readMap = (file) => {
     if (!existsSync14(file)) return void 0;
     try {
-      const parsed = JSON.parse(envelopeFirstTextPart(JSON.parse(readFileSync11(file, "utf8"))) || "{}");
+      const parsed = JSON.parse(envelopeFirstTextPart(JSON.parse(readFileSync13(file, "utf8"))) || "{}");
       return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
     } catch {
       return void 0;
@@ -6548,8 +6774,8 @@ function recordedTokensByValue(setDir, reps) {
       byValue.set(key, candidates);
     }
   };
-  absorb(readMap(path19.join(setDir, "get_variable_defs.json")));
-  for (const rep of reps) absorb(readMap(path19.join(setDir, rep, "get_variable_defs.json")));
+  absorb(readMap(path20.join(setDir, "get_variable_defs.json")));
+  for (const rep of reps) absorb(readMap(path20.join(setDir, rep, "get_variable_defs.json")));
   return byValue;
 }
 function scannable(css) {
@@ -6658,11 +6884,11 @@ function conventionsFindings(entrySource, css, profile) {
 }
 async function checkBundleQuality(bundleDir, entry, set, fontManifest, motion, contract, profile) {
   const findings = [];
-  const entryPath = path19.join(bundleDir, entry);
-  const cssPath = path19.join(bundleDir, "styles.css");
-  const tokensPath = path19.join(bundleDir, "tokens.css");
-  const css = existsSync14(cssPath) ? readFileSync11(cssPath, "utf8") : "";
-  const tokensCss = existsSync14(tokensPath) ? readFileSync11(tokensPath, "utf8") : void 0;
+  const entryPath = path20.join(bundleDir, entry);
+  const cssPath = path20.join(bundleDir, "styles.css");
+  const tokensPath = path20.join(bundleDir, "tokens.css");
+  const css = existsSync14(cssPath) ? readFileSync13(cssPath, "utf8") : "";
+  const tokensCss = existsSync14(tokensPath) ? readFileSync13(tokensPath, "utf8") : void 0;
   findings.push(
     ...fontStackFindings(
       [
@@ -6675,8 +6901,8 @@ async function checkBundleQuality(bundleDir, entry, set, fontManifest, motion, c
   if (existsSync14(entryPath)) {
     const workDir = newScratchDir("quality");
     try {
-      const tsxPath = path19.join(workDir, entry);
-      writeFileSync5(tsxPath, readFileSync11(entryPath, "utf8"));
+      const tsxPath = path20.join(workDir, entry);
+      writeFileSync5(tsxPath, readFileSync13(entryPath, "utf8"));
       for (const d of runTscStrict([tsxPath]).diagnostics) {
         if (d.code === 2307 && /['"]\.\/composed\//.test(d.message)) continue;
         findings.push({ kind: "tsc", file: entry, ...d.line === void 0 ? {} : { line: d.line }, message: `TS${d.code}: ${d.message}` });
@@ -6686,7 +6912,7 @@ async function checkBundleQuality(bundleDir, entry, set, fontManifest, motion, c
     }
   }
   if (contract !== void 0 && existsSync14(entryPath)) {
-    findings.push(...expertLensFindings(entry, readFileSync11(entryPath, "utf8"), contract));
+    findings.push(...expertLensFindings(entry, readFileSync13(entryPath, "utf8"), contract));
   }
   for (const sheet of [
     { file: "styles.css", text: css },
@@ -6697,7 +6923,7 @@ async function checkBundleQuality(bundleDir, entry, set, fontManifest, motion, c
     findings.push(...placeholderSelectorFindings(sheet.file, sheet.text));
   }
   if (set !== void 0 && existsSync14(entryPath)) {
-    findings.push(...recordedAssetFindings(entry, readFileSync11(entryPath, "utf8"), recordedAssetPaths(set.dir, set.reps)));
+    findings.push(...recordedAssetFindings(entry, readFileSync13(entryPath, "utf8"), recordedAssetPaths(set.dir, set.reps)));
   }
   if (css !== "") {
     const mapState = set === void 0 ? void 0 : recordedTokenMapState(set.dir, set.reps);
@@ -6719,7 +6945,7 @@ async function checkBundleQuality(bundleDir, entry, set, fontManifest, motion, c
     })
   );
   if (profile !== void 0 && existsSync14(entryPath)) {
-    findings.push(...conventionsFindings(readFileSync11(entryPath, "utf8"), css, profile));
+    findings.push(...conventionsFindings(readFileSync13(entryPath, "utf8"), css, profile));
   }
   return { findings, tokensAbsent: tokensCss === void 0 && !/var\(\s*--/.test(css) };
 }
@@ -6820,8 +7046,8 @@ var init_effect_geometry = __esm({
 });
 
 // packages/verify/src/bundle-score.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import path20 from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "node:fs";
+import path21 from "node:path";
 import { build as build4 } from "esbuild";
 import { chromium as chromium4 } from "playwright-core";
 function getFontFaces2() {
@@ -6875,7 +7101,7 @@ function chooseSeat(cropAt, ref, padW, padH, backdrop, origin, extents) {
 }
 function metadataRoot(set, rep) {
   try {
-    const text = JSON.parse(readFileSync12(path20.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
+    const text = JSON.parse(readFileSync14(path21.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
     return parseMetadataStructure(text);
   } catch {
     return void 0;
@@ -6930,19 +7156,19 @@ function smallSemanticNodes(set, rep, maxArea = 1024) {
   });
 }
 function repMeta(set, rep) {
-  const text = JSON.parse(readFileSync12(path20.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
+  const text = JSON.parse(readFileSync14(path21.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
   const root = parseMetadataStructure(text);
   return { w: Math.round(root.width ?? 100), h: Math.round(root.height ?? 40) };
 }
 function repRef(set, rep) {
-  const env = JSON.parse(readFileSync12(path20.join(set, rep, "get_screenshot.json"), "utf8")).content.find((c) => c.type === "image");
+  const env = JSON.parse(readFileSync14(path21.join(set, rep, "get_screenshot.json"), "utf8")).content.find((c) => c.type === "image");
   return Uint8Array.from(Buffer.from(env?.data ?? "", "base64"));
 }
 function repEffectExtents(set, rep) {
-  const file = path20.join(set, rep, "get_design_context.json");
+  const file = path21.join(set, rep, "get_design_context.json");
   if (!existsSync15(file)) return void 0;
   try {
-    const text = JSON.parse(readFileSync12(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
+    const text = JSON.parse(readFileSync14(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
     const extents = shadowExtents(text);
     return extents.top + extents.right + extents.bottom + extents.left > 0 ? extents : void 0;
   } catch {
@@ -6952,17 +7178,17 @@ function repEffectExtents(set, rep) {
 async function scoreBundleForTask(task, bundleDir, bar = BAR, opts = {}) {
   if (opts.evidenceDir !== void 0) {
     mkdirSync3(opts.evidenceDir, { recursive: true });
-    writeFileSync6(path20.join(opts.evidenceDir, "diff-legend.txt"), DIFF_LEGEND_TEXT);
+    writeFileSync6(path21.join(opts.evidenceDir, "diff-legend.txt"), DIFF_LEGEND_TEXT);
   }
   const CONFIGS2 = task.configs;
   const timeoutMs = opts.mountDeadlineMs ?? ENGINE_MOUNT_DEADLINE_MS;
-  const entryTsx = path20.join(bundleDir, task.entry);
+  const entryTsx = path21.join(bundleDir, task.entry);
   if (!existsSync15(entryTsx)) return CONFIGS2.map((c) => ({ rep: c.rep, similarity: 0, inkRecall: 0, exact: { similarity: 0, inkRecall: 0 }, pass: false, error: `${task.entry} missing` }));
   const css = candidateCss(bundleDir);
   const mountSrc = `
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
-import * as B from ${JSON.stringify(path20.resolve(entryTsx))};
+import * as B from ${JSON.stringify(path21.resolve(entryTsx))};
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown> } }).__cfg;
 const C = (B as Record<string, unknown>)[cfg.component] as Parameters<typeof createElement>[0] | undefined;
 const root = document.getElementById("root");
@@ -7061,12 +7287,12 @@ body{margin:0;background:rgb(${backdrop.join(",")})}
             return name === void 0 ? c : { ...c, name };
           });
           if (opts.evidenceDir !== void 0) {
-            writeFileSync6(path20.join(opts.evidenceDir, `${cfg.rep}-render.png`), scored);
-            writeFileSync6(path20.join(opts.evidenceDir, `${cfg.rep}-ref.png`), ref);
-            writeFileSync6(path20.join(opts.evidenceDir, `${cfg.rep}-diff.png`), diffPng(scored, ref, [], backdrop));
+            writeFileSync6(path21.join(opts.evidenceDir, `${cfg.rep}-render.png`), scored);
+            writeFileSync6(path21.join(opts.evidenceDir, `${cfg.rep}-ref.png`), ref);
+            writeFileSync6(path21.join(opts.evidenceDir, `${cfg.rep}-diff.png`), diffPng(scored, ref, [], backdrop));
             for (const [i, c] of absent.slice(0, 3).entries()) {
-              writeFileSync6(path20.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-ref.png`), zoomCrop(ref, c));
-              writeFileSync6(path20.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-render.png`), zoomCrop(scored, c));
+              writeFileSync6(path21.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-ref.png`), zoomCrop(ref, c));
+              writeFileSync6(path21.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-render.png`), zoomCrop(scored, c));
             }
           }
           return {
@@ -7313,7 +7539,7 @@ var init_parity = __esm({
 // packages/verify/src/composition.ts
 import { createRequire as createRequire2 } from "node:module";
 import { existsSync as existsSync16 } from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 import { build as build6 } from "esbuild";
 import { chromium as chromium7 } from "playwright-core";
 function getFontFaces4() {
@@ -7321,9 +7547,9 @@ function getFontFaces4() {
   return _fontFaces4;
 }
 async function compileInstrumentedMount(task, bundleDir, composedParts = []) {
-  const entryTsx = path21.join(bundleDir, task.entry);
+  const entryTsx = path22.join(bundleDir, task.entry);
   if (!existsSync16(entryTsx)) return { error: `${task.entry} missing` };
-  const requireFromVerify = createRequire2(path21.join(VERIFY_PKG_DIR, "package.json"));
+  const requireFromVerify = createRequire2(path22.join(VERIFY_PKG_DIR, "package.json"));
   let realJsxPath;
   try {
     realJsxPath = requireFromVerify.resolve("react/jsx-runtime");
@@ -7334,8 +7560,8 @@ async function compileInstrumentedMount(task, bundleDir, composedParts = []) {
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
 import { __registerParts } from "react/jsx-runtime";
-import * as B from ${JSON.stringify(path21.resolve(entryTsx))};
-${composedParts.map((p, i) => `import * as CP${i} from ${JSON.stringify(path21.resolve(bundleDir, p.modulePath))};`).join("\n")}
+import * as B from ${JSON.stringify(path22.resolve(entryTsx))};
+${composedParts.map((p, i) => `import * as CP${i} from ${JSON.stringify(path22.resolve(bundleDir, p.modulePath))};`).join("\n")}
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown>; partComponents: string[] } }).__cfg;
 const pairs: Array<[unknown, string]> = [];
 for (const name of cfg.partComponents) {
@@ -7391,7 +7617,7 @@ function expectedParts(task, roles, mainSlug) {
 }
 function interiorRegions(setDir, roles) {
   const mains = roles.main;
-  const withInterior = mains.filter((m) => existsSync16(path21.join(setDir, m, "get_metadata_interior.json")));
+  const withInterior = mains.filter((m) => existsSync16(path22.join(setDir, m, "get_metadata_interior.json")));
   if (withInterior.length === 0) {
     return { unavailable: "no interior geometry recorded for any main (pre-obligation set) \u2014 re-record with `tendril record` to enable crop checks" };
   }
@@ -7665,16 +7891,16 @@ export const jsxs = (t, p, k) => real.jsxs(t, inject(t, p), k);
 
 // packages/verify/src/occlusion.ts
 import { existsSync as existsSync17 } from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 import { build as build7 } from "esbuild";
 import { chromium as chromium8 } from "playwright-core";
 async function compileTwoUp(task, bundleDir) {
-  const entryTsx = path22.join(bundleDir, task.entry);
+  const entryTsx = path23.join(bundleDir, task.entry);
   if (!existsSync17(entryTsx)) return { error: `${task.entry} missing` };
   const src = `
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
-import * as B from ${JSON.stringify(path22.resolve(entryTsx))};
+import * as B from ${JSON.stringify(path23.resolve(entryTsx))};
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown> } }).__cfg;
 const C = (B as Record<string, unknown>)[cfg.component] as Parameters<typeof createElement>[0] | undefined;
 for (const id of ["first", "second"]) {
@@ -7925,26 +8151,26 @@ var init_src5 = __esm({
 });
 
 // packages/cli/src/environment.ts
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
-import path23 from "node:path";
-import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "node:fs";
+import path24 from "node:path";
+import { createHash as createHash5 } from "node:crypto";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function cliVersion() {
   try {
-    return JSON.parse(readFileSync14(path23.join(path23.dirname(fileURLToPath5(import.meta.url)), "..", "package.json"), "utf8")).version ?? "dev";
+    return JSON.parse(readFileSync16(path24.join(path24.dirname(fileURLToPath5(import.meta.url)), "..", "package.json"), "utf8")).version ?? "dev";
   } catch {
     return "dev";
   }
 }
 function environmentStamp(taskFamilies) {
-  const manifestPath2 = path23.join(fontCacheDir(), "manifest.json");
+  const manifestPath2 = path24.join(fontCacheDir(), "manifest.json");
   let fontsHash = null;
   if (existsSync18(manifestPath2)) {
     try {
-      const entries = JSON.parse(readFileSync14(manifestPath2, "utf8"));
+      const entries = JSON.parse(readFileSync16(manifestPath2, "utf8"));
       const scoped = taskFamilies === void 0 || taskFamilies === null ? entries : entries.filter((f) => taskFamilies.some((fam) => fam.toLowerCase() === f.family.toLowerCase()));
       const faces = scoped.map((f) => `${f.family}:${f.weight}:${f.sha256}`).sort();
-      fontsHash = faces.length === 0 ? null : createHash4("sha256").update(faces.join("\n")).digest("hex").slice(0, 16);
+      fontsHash = faces.length === 0 ? null : createHash5("sha256").update(faces.join("\n")).digest("hex").slice(0, 16);
     } catch {
       fontsHash = null;
     }
@@ -7985,8 +8211,8 @@ var init_describe = __esm({
 });
 
 // packages/cli/src/env.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "node:fs";
-import path24 from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "node:fs";
+import path25 from "node:path";
 function parseEnv(content) {
   const entries = /* @__PURE__ */ new Map();
   for (const line of content.split("\n")) {
@@ -7998,9 +8224,9 @@ function parseEnv(content) {
 function resolveCredential(name) {
   const fromProcess = process.env[name];
   if (fromProcess) return fromProcess;
-  const envPath = path24.resolve(process.env["INIT_CWD"] ?? process.cwd(), ".env");
+  const envPath = path25.resolve(process.env["INIT_CWD"] ?? process.cwd(), ".env");
   if (!existsSync19(envPath)) return void 0;
-  return parseEnv(readFileSync15(envPath, "utf8")).get(name);
+  return parseEnv(readFileSync17(envPath, "utf8")).get(name);
 }
 var init_env = __esm({
   "packages/cli/src/env.ts"() {
@@ -8059,18 +8285,200 @@ var init_output = __esm({
   }
 });
 
+// packages/cli/src/publish-client.ts
+import { chmodSync, existsSync as existsSync20, mkdirSync as mkdirSync4, readFileSync as readFileSync18, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import os4 from "node:os";
+import path26 from "node:path";
+function sessionPath() {
+  return process.env["TENDRIL_SESSION_PATH"] ?? path26.join(os4.homedir(), ".tendril", "session.json");
+}
+function readStoredSession(file = sessionPath()) {
+  if (!existsSync20(file)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync18(file, "utf8"));
+    if (typeof parsed.origin !== "string" || typeof parsed.token !== "string") return void 0;
+    return { origin: parsed.origin, token: parsed.token };
+  } catch {
+    return void 0;
+  }
+}
+function writeStoredSession(session, file = sessionPath()) {
+  mkdirSync4(path26.dirname(file), { recursive: true });
+  writeFileSync7(file, `${JSON.stringify(session, null, 2)}
+`, { mode: 384 });
+  chmodSync(file, 384);
+}
+function clearStoredSession(file = sessionPath()) {
+  if (existsSync20(file)) rmSync3(file);
+}
+function tokenFor(origin, file = sessionPath()) {
+  const fromEnv = process.env["TENDRIL_TOKEN"];
+  if (fromEnv !== void 0 && fromEnv !== "") {
+    const pinned = (process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+    if (pinned !== "" && pinned !== origin) return { ok: false, reason: "origin-mismatch", from: "env", boundTo: pinned };
+    return { ok: true, token: fromEnv, from: "env" };
+  }
+  const stored = readStoredSession(file);
+  if (stored === void 0) return { ok: false, reason: "none" };
+  if (stored.origin !== origin) return { ok: false, reason: "origin-mismatch", from: "file", boundTo: stored.origin };
+  return { ok: true, token: stored.token, from: "file" };
+}
+function isSecureOrigin(origin) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && (url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]");
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var InsecureOriginError, HttpPublishClient, REQUEST_TIMEOUT_MS, RETRIES, BACKOFF_MS;
+var init_publish_client = __esm({
+  "packages/cli/src/publish-client.ts"() {
+    "use strict";
+    InsecureOriginError = class extends Error {
+      constructor(origin) {
+        super(`${origin} is not https, so a session token sent there would travel in the clear`);
+        this.origin = origin;
+        this.name = "InsecureOriginError";
+      }
+      origin;
+    };
+    HttpPublishClient = class {
+      origin;
+      token;
+      send;
+      constructor(options) {
+        this.origin = options.origin.replace(/\/+$/, "");
+        if (!isSecureOrigin(this.origin)) throw new InsecureOriginError(this.origin);
+        this.token = options.token;
+        this.send = options.fetch ?? globalThis.fetch;
+      }
+      acceptTerms(input) {
+        return this.json("POST", "/api/consent", input);
+      }
+      begin(input) {
+        return this.json("POST", "/api/publications", input, true);
+      }
+      async upload(input) {
+        const encoded = input.relPath.split("/").map(encodeURIComponent).join("/");
+        return this.request("PUT", `/api/publications/${encodeURIComponent(input.publicationId)}/objects/${encoded}`, {
+          body: input.bytes,
+          contentType: "application/octet-stream",
+          retryable: true
+        });
+      }
+      commit(input) {
+        return this.json("POST", `/api/publications/${encodeURIComponent(input.publicationId)}/commit`, {}, true);
+      }
+      issueShareLink(input) {
+        return this.json("POST", `/api/publications/${encodeURIComponent(input.publicationId)}/shares`, {
+          expiresAt: input.expiresAt,
+          recipientEmail: input.recipientEmail
+        });
+      }
+      listShareLinks(input) {
+        return this.request("GET", `/api/publications/${encodeURIComponent(input.publicationId)}/shares`, {
+          body: "",
+          contentType: "application/json",
+          retryable: true
+        });
+      }
+      revokeShareLink(input) {
+        return this.request("DELETE", `/api/publications/${encodeURIComponent(input.publicationId)}/shares/${encodeURIComponent(input.shareLinkId)}`, {
+          body: "",
+          contentType: "application/json",
+          retryable: true
+        });
+      }
+      json(method, pathname, body, retryable = false) {
+        return this.request(method, pathname, { body: JSON.stringify(body), contentType: "application/json", retryable });
+      }
+      async request(method, pathname, init) {
+        let response;
+        let lastError = "";
+        const attempts = init.retryable === true ? RETRIES : 1;
+        for (let attempt = 1; ; attempt += 1) {
+          try {
+            response = await this.send(`${this.origin}${pathname}`, {
+              method,
+              headers: { authorization: `Bearer ${this.token}`, "content-type": init.contentType },
+              // GET and DELETE carry nothing. `fetch` THROWS on a GET with a
+              // body — even an empty string — so this is a hard requirement
+              // rather than tidiness.
+              ...method === "GET" || method === "HEAD" || init.body === "" ? {} : { body: init.body },
+              // A publish that hangs forever is worse than one that fails:
+              // the user cannot tell it from slow, and there is nothing to
+              // act on. Node's fetch has no default timeout at all.
+              signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+            });
+          } catch (error) {
+            lastError = error.message;
+            if (attempt >= attempts) {
+              return {
+                ok: false,
+                status: 0,
+                refusal: `could not reach ${this.origin} after ${String(attempt)} ${attempt === 1 ? "try" : "tries"}: ${lastError}`
+              };
+            }
+            await delay(BACKOFF_MS * attempt);
+            continue;
+          }
+          if (response.status >= 500 && attempt < attempts) {
+            await delay(BACKOFF_MS * attempt);
+            continue;
+          }
+          break;
+        }
+        const text = await response.text();
+        let parsed;
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          return {
+            ok: false,
+            status: response.status,
+            refusal: `${this.origin} answered with ${String(response.status)} and something that is not JSON, so it is probably not a Tendril portal`
+          };
+        }
+        const record = parsed ?? {};
+        if (response.ok) return { ok: true, value: parsed };
+        return {
+          ok: false,
+          status: response.status,
+          refusal: typeof record["refusal"] === "string" ? record["refusal"] : `the portal refused with ${String(response.status)}`,
+          ...Array.isArray(record["detail"]) ? { detail: record["detail"] } : {},
+          ...Array.isArray(record["missing"]) ? { missing: record["missing"] } : {},
+          ...isRecord(record["needsConsent"]) ? { needsConsent: record["needsConsent"] } : {},
+          ...isRecord(record["needsConfirmation"]) ? { needsConfirmation: record["needsConfirmation"] } : {}
+        };
+      }
+    };
+    REQUEST_TIMEOUT_MS = 12e4;
+    RETRIES = 3;
+    BACKOFF_MS = 500;
+  }
+});
+
 // packages/cli/src/entitlement.ts
-import { chmodSync, existsSync as existsSync20, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync21, mkdirSync as mkdirSync5, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "node:fs";
 import crypto from "node:crypto";
-import os4 from "node:os";
-import path25 from "node:path";
+import os5 from "node:os";
+import path27 from "node:path";
 function entitlementPath() {
-  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path25.join(os4.homedir(), ".tendril", "entitlement.json");
+  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path27.join(os5.homedir(), ".tendril", "entitlement.json");
 }
 function readStoredEntitlement(file = entitlementPath()) {
-  if (!existsSync20(file)) return void 0;
+  if (!existsSync21(file)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync16(file, "utf8"));
+    const parsed = JSON.parse(readFileSync19(file, "utf8"));
     if (typeof parsed.token !== "string" || typeof parsed.lastRefreshAt !== "number") return void 0;
     return { token: parsed.token, lastRefreshAt: parsed.lastRefreshAt };
   } catch {
@@ -8078,10 +8486,10 @@ function readStoredEntitlement(file = entitlementPath()) {
   }
 }
 function writeStoredEntitlement(stored, file = entitlementPath()) {
-  mkdirSync4(path25.dirname(file), { recursive: true });
-  writeFileSync7(file, `${JSON.stringify(stored, null, 2)}
+  mkdirSync5(path27.dirname(file), { recursive: true });
+  writeFileSync8(file, `${JSON.stringify(stored, null, 2)}
 `);
-  chmodSync(file, 384);
+  chmodSync2(file, 384);
 }
 function parseEntitlementToken(token) {
   if (!token.startsWith(ENT_PREFIX)) return { error: "not a tendril entitlement token" };
@@ -8163,9 +8571,9 @@ var init_entitlement = __esm({
 
 // packages/cli/src/commands/doctor.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync17, readdirSync as readdirSync7 } from "node:fs";
-import os5 from "node:os";
-import path26 from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync20, readdirSync as readdirSync8 } from "node:fs";
+import os6 from "node:os";
+import path28 from "node:path";
 function withDeadline(work, ms) {
   return Promise.race([
     work,
@@ -8225,19 +8633,19 @@ async function runDoctorChecks(options) {
       remediation: "Install Google Chrome (or Chromium), or set CHROME_PATH to a Chromium-family browser binary."
     });
   }
-  const fontManifest = path26.join(fontCacheDir(), "manifest.json");
+  const fontManifest = path28.join(fontCacheDir(), "manifest.json");
   checks.push(
-    existsSync21(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync17(fontManifest, "utf8")).length} faces)` } : {
+    existsSync22(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync20(fontManifest, "utf8")).length} faces)` } : {
       name: "font-cache",
       ok: true,
       detail: `font cache empty at ${fontCacheDir()} \u2014 normal on a fresh machine; faces resolve per design system at first use`,
       remediation: `Nothing to do now: \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` fetches exactly what a recording declares, and generate/verify name that command \u2014 with the set filled in \u2014 when they need it.`
     }
   );
-  const pluginRoot = path26.join(os5.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
-  if (existsSync21(pluginRoot)) {
+  const pluginRoot = path28.join(os6.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
+  if (existsSync22(pluginRoot)) {
     try {
-      const versions = readdirSync7(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
+      const versions = readdirSync8(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
       const newest = versions.sort((a, b) => versionIsNewer(a, b) ? 1 : -1)[0];
       if (newest !== void 0) {
         const skewed = versionIsNewer(newest, cliVersion());
@@ -8271,13 +8679,52 @@ async function runDoctorChecks(options) {
   checks.push(
     ent.ok ? ent.mode === "pre-launch" ? { name: "entitlement", ok: true, detail: "pre-launch build \u2014 entitlement gates present but unarmed (no public key shipped); record/generate run freely" } : { name: "entitlement", ok: true, detail: `active plan "${ent.claims.plan}" until ${new Date(ent.claims.exp).toISOString().slice(0, 10)}${ent.stale ? " (stale \u2014 renews at next opportunity)" : ""}` } : { name: "entitlement", ok: false, detail: ent.error, remediation: ent.remediation }
   );
+  checks.push(await portalSessionCheck(options.fetchImpl ?? fetch));
   const figmaToken = resolveCredential("FIGMA_TOKEN");
   checks.push({
     name: "figma-pat",
     ok: true,
     detail: figmaToken ? "FIGMA_TOKEN configured but unused \u2014 recording runs over the Figma MCP transport" : "FIGMA_TOKEN not set \u2014 not needed; recording runs over the Figma MCP transport"
   });
-  return { ok: checks.filter((c) => c.name !== "figma-pat" && c.name !== "openrouter-key" && c.name !== "path-skew").every((c) => c.ok), checks };
+  return {
+    ok: checks.filter((c) => c.name !== "figma-pat" && c.name !== "openrouter-key" && c.name !== "path-skew" && c.name !== "portal-session").every((c) => c.ok),
+    checks
+  };
+}
+async function portalSessionCheck(fetchImpl) {
+  const stored = readStoredSession();
+  const connectHint = `Run ${tendrilCommand("login")} and approve in your browser (agents: call the tendril_login tool, relay the link and code, then tendril_login_wait) \u2014 or mint a token under "Connect your CLI" in your portal library and use ${tendrilCommand("login --paste")}.`;
+  if (stored === void 0) {
+    return { name: "portal-session", ok: true, detail: `not signed in to a portal \u2014 publishing needs it, verification never does. ${connectHint}` };
+  }
+  let response;
+  try {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), 5e3);
+    timer.unref?.();
+    response = await fetchImpl(`${stored.origin}/api/whoami`, { headers: { authorization: `Bearer ${stored.token}` }, signal: ctl.signal });
+    clearTimeout(timer);
+  } catch {
+    return { name: "portal-session", ok: true, detail: `${stored.origin} did not answer \u2014 the stored session could not be checked. Publishing will say so precisely if it is actually dead.` };
+  }
+  if (!response.ok) {
+    return {
+      name: "portal-session",
+      ok: false,
+      detail: `the session stored for ${stored.origin} no longer works there (${String(response.status)}) \u2014 it was revoked or expired`,
+      remediation: connectHint
+    };
+  }
+  const body = await response.json();
+  const email = typeof body.email === "string" && body.email !== "" ? ` as ${body.email}` : "";
+  const expiry = typeof body.sessionExpiresAt === "string" ? body.sessionExpiresAt : null;
+  const daysLeft = expiry === null ? null : Math.floor((Date.parse(expiry) - Date.now()) / 864e5);
+  return {
+    name: "portal-session",
+    ok: true,
+    detail: `signed in to ${stored.origin}${email}${expiry === null ? "" : `, session good until ${expiry.slice(0, 10)}`}`,
+    ...daysLeft !== null && daysLeft <= 7 ? { remediation: `That is ${String(daysLeft)} day(s) away \u2014 run ${tendrilCommand("login")} soon for a fresh session.` } : {}
+  };
 }
 function probeVersion(binary) {
   const windowsShim = /\.(cmd|bat)$/i.test(binary);
@@ -8352,6 +8799,7 @@ var init_doctor = __esm({
     init_environment();
     init_invocation();
     init_output();
+    init_publish_client();
     init_entitlement();
     DEFAULT_MCP_URL = "http://127.0.0.1:3845/mcp";
     DOCTOR_DESCRIPTION = {
@@ -9467,8 +9915,8 @@ var init_engine_curated = __esm({
 });
 
 // packages/generate/src/loop.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync6, readFileSync as readFileSync19, renameSync, writeFileSync as writeFileSync9 } from "node:fs";
-import path29 from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync7, readFileSync as readFileSync22, renameSync, writeFileSync as writeFileSync10 } from "node:fs";
+import path31 from "node:path";
 import { z as z13 } from "zod";
 function objective(scores, behaviors) {
   const vals = scores.map((s) => Math.min(s.similarity, s.inkRecall));
@@ -9510,9 +9958,9 @@ ${absentLines.join("\n")}` : ""}
 Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink credits a recorded pixel when ANY render ink lands within 1px of it, so ink=1 proves coverage \u2014 not presence, shape, or colour. A wrong-shaped mark over the right region, or a wrong-coloured one that is still ink, scores 1.000; and a recorded mark within ~30 channel-sum of the backdrop (#f6f6f6 on white is 27) is not ink at all, so it can be absent at ink 1.000 with no MISSING line. With ink=1 AND low sim, coverage held while pixels differ, so start with the TWO causes below \u2014 but never read ink=1 as "nothing is missing": confirm every faint or small recorded mark (hairlines, dividers, low-contrast controls) exists in your render. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
-  if (!existsSync23(path29.join(outDir, "run-log.json")) && !existsSync23(path29.join(outDir, "loop-state.json"))) return void 0;
+  if (!existsSync24(path31.join(outDir, "run-log.json")) && !existsSync24(path31.join(outDir, "loop-state.json"))) return void 0;
   let n = 1;
-  while (existsSync23(`${outDir}-prev-${n}`)) n += 1;
+  while (existsSync24(`${outDir}-prev-${n}`)) n += 1;
   renameSync(outDir, `${outDir}-prev-${n}`);
   return `${outDir}-prev-${n}`;
 }
@@ -9521,14 +9969,14 @@ async function runEngineLoop(opts) {
   const plateau = opts.plateau ?? 2;
   const progress = opts.onProgress ?? (() => {
   });
-  const statePath = path29.join(opts.outDir, "loop-state.json");
-  const resuming = opts.resume === true && existsSync23(statePath);
+  const statePath = path31.join(opts.outDir, "loop-state.json");
+  const resuming = opts.resume === true && existsSync24(statePath);
   if (!resuming) {
     const archived = archivePriorRun(opts.outDir);
     if (archived !== void 0) progress(`previous run archived to ${archived}`);
   }
-  mkdirSync6(opts.outDir, { recursive: true });
-  const scratch = path29.join(opts.outDir, ".candidate");
+  mkdirSync7(opts.outDir, { recursive: true });
+  const scratch = path31.join(opts.outDir, ".candidate");
   let attempts = [];
   let log = [];
   let best;
@@ -9536,7 +9984,7 @@ async function runEngineLoop(opts) {
   let nonAccepted = 0;
   let stopReason = "max-iterations";
   if (resuming) {
-    const restored = LoopStateSchema.parse(JSON.parse(readFileSync19(statePath, "utf8")));
+    const restored = LoopStateSchema.parse(JSON.parse(readFileSync22(statePath, "utf8")));
     attempts = restored.attempts;
     log = restored.iterations;
     spentUsd = restored.spentUsd;
@@ -9551,12 +9999,12 @@ async function runEngineLoop(opts) {
     progress(`resumed: ${log.length} iteration(s), $${spentUsd.toFixed(3)} spent, best pass=${best?.objective[0] ?? 0}`);
   }
   const persist = () => {
-    writeFileSync9(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
+    writeFileSync10(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
 `);
   };
   const writeCandidate = (files) => {
-    mkdirSync6(scratch, { recursive: true });
-    for (const [name, content] of Object.entries(files)) writeFileSync9(path29.join(scratch, name), content);
+    mkdirSync7(scratch, { recursive: true });
+    for (const [name, content] of Object.entries(files)) writeFileSync10(path31.join(scratch, name), content);
   };
   const scoreCandidate = async (candidate, iter, usd, modelMs) => {
     writeCandidate(candidate.files);
@@ -9614,8 +10062,8 @@ async function runEngineLoop(opts) {
       const usd = candidate.usage?.usd ?? 0;
       spentUsd += usd;
       if (candidate.raw !== void 0) {
-        mkdirSync6(path29.join(opts.outDir, "responses"), { recursive: true });
-        writeFileSync9(path29.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
+        mkdirSync7(path31.join(opts.outDir, "responses"), { recursive: true });
+        writeFileSync10(path31.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
       }
       if (candidate.files[opts.entry] === void 0 || candidate.files["styles.css"] === void 0) {
         const finish = candidate.usage?.finishReason ?? "?";
@@ -9641,10 +10089,10 @@ async function runEngineLoop(opts) {
       }
     }
   }
-  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync9(path29.join(opts.outDir, name), content);
+  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync10(path31.join(opts.outDir, name), content);
   const final = best !== void 0 ? await opts.score(opts.outDir) : { scores: [], behaviors: [] };
-  writeFileSync9(
-    path29.join(opts.outDir, "run-log.json"),
+  writeFileSync10(
+    path31.join(opts.outDir, "run-log.json"),
     `${JSON.stringify(
       {
         ...opts.meta,
@@ -9711,8 +10159,8 @@ var init_loop2 = __esm({
 });
 
 // packages/generate/src/brief.ts
-import { existsSync as existsSync24, readFileSync as readFileSync20 } from "node:fs";
-import path30 from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync23 } from "node:fs";
+import path32 from "node:path";
 import { PNG as PNG3 } from "pngjs";
 function singleAxes2(name) {
   const parsed = parseVariantAxes(name);
@@ -10152,15 +10600,15 @@ function authorBehaviors(api, extras = {}) {
   };
 }
 function envelopeText(file) {
-  return envelopeFirstTextPart(JSON.parse(readFileSync20(file, "utf8")));
+  return envelopeFirstTextPart(JSON.parse(readFileSync23(file, "utf8")));
 }
 function metadataText(file) {
-  return envelopeTextContent(JSON.parse(readFileSync20(file, "utf8")));
+  return envelopeTextContent(JSON.parse(readFileSync23(file, "utf8")));
 }
 function dismissEvidence(setDir, repSlugs) {
   for (const slug of repSlugs) {
-    const f = path30.join(setDir, slug, "get_design_context.json");
-    if (!existsSync24(f)) continue;
+    const f = path32.join(setDir, slug, "get_design_context.json");
+    if (!existsSync25(f)) continue;
     const text = envelopeText(f);
     const propHit = /[{,]\s*(\w*dismiss\w*)\s*=\s*true\b/i.exec(text);
     if (propHit !== null) return { evidence: `emission prop "${propHit[1]}"`, visibleReps: [] };
@@ -10187,9 +10635,9 @@ function dismissEvidence(setDir, repSlugs) {
       const glyphIsTheComponent = (() => {
         const slugToCheck = vis.visibleIn[0];
         if (slugToCheck === void 0) return false;
-        const metaFile = path30.join(setDir, slugToCheck, "get_metadata.json");
+        const metaFile = path32.join(setDir, slugToCheck, "get_metadata.json");
         try {
-          const root = parseMetadataStructure(envelopeTextContent(JSON.parse(readFileSync20(metaFile, "utf8"))));
+          const root = parseMetadataStructure(envelopeTextContent(JSON.parse(readFileSync23(metaFile, "utf8"))));
           if (root.children.length !== 1) return false;
           const contains = (n) => normalizedLayerName(n.name) === norm2 || n.children.some(contains);
           return contains(root.children[0]);
@@ -10209,10 +10657,10 @@ function dismissEvidence(setDir, repSlugs) {
   return void 0;
 }
 function recordedReferencePng(setDir, slug) {
-  const f = path30.join(setDir, slug, "get_screenshot.json");
-  if (!existsSync24(f)) return void 0;
+  const f = path32.join(setDir, slug, "get_screenshot.json");
+  if (!existsSync25(f)) return void 0;
   try {
-    const env = JSON.parse(readFileSync20(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync23(f, "utf8")).content.find((c) => c.type === "image");
     return env?.data === void 0 ? void 0 : Uint8Array.from(Buffer.from(env.data, "base64"));
   } catch {
     return void 0;
@@ -10253,7 +10701,7 @@ function recordedFontNeeds(setDir, opts = {}) {
     for (const m of text.matchAll(/font-\['([^':\]]+)(?::([^'\]]+))?'/g)) famAdd(m[1], m[2] === void 0 ? void 0 : styleWeight(m[2]));
     for (const m of text.matchAll(/family-name:var\([^,)]*,\s*'([^':\]]+)(?::([^'\]]+))?'/g)) famAdd(m[1], m[2] === void 0 ? void 0 : styleWeight(m[2]));
     for (const m of text.matchAll(/\bfont-(thin|extralight|light|normal|medium|semibold|bold|extrabold|black)\b/g)) unpaired.add(STYLE_WEIGHTS2[m[1]]);
-    for (const m of text.matchAll(/font-weight:\s*([1-9]00)\b/g)) unpaired.add(Number(m[1]));
+    for (const m of text.matchAll(/font-weight:\s*([1-9]\d{2})\b/g)) unpaired.add(Number(m[1]));
   };
   const fromDefs = (text) => {
     let defs;
@@ -10271,15 +10719,34 @@ function recordedFontNeeds(setDir, opts = {}) {
       }
       if (/^[A-Za-z][A-Za-z0-9 ]{1,39}$/.test(v.trim())) famAdd(v.trim());
     }
+    fromFontCalls(defs);
   };
+  function fromFontCalls(defs) {
+    for (const v of Object.values(defs)) {
+      if (typeof v !== "string") continue;
+      const call = /\bFont\(\s*family:\s*"?([^",]+)"?\s*,([^)]*)\)/.exec(v);
+      if (call === null) continue;
+      const rest = call[2];
+      const explicit = /\bweight:\s*([1-9]\d{2})\b/.exec(rest);
+      const styleRef = /\bstyle:\s*([^,)]+)/.exec(rest);
+      let weight = explicit === null ? void 0 : Number(explicit[1]);
+      if (weight === void 0 && styleRef !== null) {
+        const ref = styleRef[1].trim().replace(/^"|"$/g, "");
+        weight = styleWeight((typeof defs[ref] === "string" ? defs[ref] : ref).trim());
+      }
+      const famRef = call[1].trim();
+      const family = typeof defs[famRef] === "string" ? defs[famRef].trim() : famRef;
+      if (/^[A-Za-z][A-Za-z0-9 ]{1,39}$/.test(family)) famAdd(family, weight);
+    }
+  }
   const manifest = loadManifest(setDir);
-  const setDefs = path30.join(setDir, "get_variable_defs.json");
-  if (existsSync24(setDefs)) fromDefs(envelopeText(setDefs));
+  const setDefs = path32.join(setDir, "get_variable_defs.json");
+  if (existsSync25(setDefs)) fromDefs(envelopeText(setDefs));
   for (const rep of manifest.reps) {
-    const ctx = path30.join(setDir, rep.slug, "get_design_context.json");
-    if (existsSync24(ctx)) fromEmission(envelopeText(ctx));
-    const defs = path30.join(setDir, rep.slug, "get_variable_defs.json");
-    if (existsSync24(defs)) fromDefs(envelopeText(defs));
+    const ctx = path32.join(setDir, rep.slug, "get_design_context.json");
+    if (existsSync25(ctx)) fromEmission(envelopeText(ctx));
+    const defs = path32.join(setDir, rep.slug, "get_variable_defs.json");
+    if (existsSync25(defs)) fromDefs(envelopeText(defs));
   }
   return [...byFamily.entries()].map(([family, paired]) => {
     const weights = /* @__PURE__ */ new Set([...paired, ...opts.pairedOnly === true ? [] : unpaired]);
@@ -10290,10 +10757,10 @@ function symbolFontGlyphCount(setDir, reps) {
   const PUA = /[\uE000-\uF8FF\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}]/u;
   const glyphs = /* @__PURE__ */ new Set();
   for (const rep of reps) {
-    const file = path30.join(setDir, rep, "get_metadata.json");
-    if (!existsSync24(file)) continue;
+    const file = path32.join(setDir, rep, "get_metadata.json");
+    if (!existsSync25(file)) continue;
     try {
-      const text = JSON.parse(readFileSync20(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
+      const text = JSON.parse(readFileSync23(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
       for (const m of text.matchAll(/<text\s[^>]*name="([^"]*)"/g)) {
         const name = decodeXmlEntities(m[1]).replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16))).replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number(d)));
         if (PUA.test(name)) glyphs.add(name);
@@ -10319,8 +10786,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const propRep = [];
   const perRep = [];
   for (const slug of repSlugs) {
-    const f = path30.join(setDir, slug, "get_design_context.json");
-    if (!existsSync24(f)) continue;
+    const f = path32.join(setDir, slug, "get_design_context.json");
+    if (!existsSync25(f)) continue;
     const code = envelopeText(f);
     const props = /* @__PURE__ */ new Map();
     for (const m of code.matchAll(/[{,]\s*(\w+)\s*=\s*"((?:[^"\\]|\\.)*)"/g)) {
@@ -10346,8 +10813,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const axisValuesBySlug = /* @__PURE__ */ new Map();
   const valuesByAxis = /* @__PURE__ */ new Map();
   for (const slug of repSlugs) {
-    const metaFile = path30.join(setDir, slug, "get_metadata.json");
-    if (!existsSync24(metaFile)) continue;
+    const metaFile = path32.join(setDir, slug, "get_metadata.json");
+    if (!existsSync25(metaFile)) continue;
     const name = symbolName(metadataText(metaFile));
     if (name === void 0) continue;
     const values = /* @__PURE__ */ new Set();
@@ -10462,8 +10929,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   const poses = [];
   const missing = [];
   for (const rep of manifest.reps) {
-    const metaFile = path30.join(setDir, rep.slug, "get_metadata.json");
-    if (!existsSync24(metaFile)) {
+    const metaFile = path32.join(setDir, rep.slug, "get_metadata.json");
+    if (!existsSync25(metaFile)) {
       missing.push(rep.slug);
       continue;
     }
@@ -10477,8 +10944,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   if (missing.length > 0) {
     throw new Error(`recording set ${setDir} is missing metadata for ${missing.length} rep(s): ${missing.slice(0, 5).join(", ")}${missing.length > 5 ? ", \u2026" : ""}`);
   }
-  const setMeta = path30.join(setDir, "get_metadata.json");
-  const latticeNames = manifest.latticeNames ?? (existsSync24(setMeta) ? [...metadataText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
+  const setMeta = path32.join(setDir, "get_metadata.json");
+  const latticeNames = manifest.latticeNames ?? (existsSync25(setMeta) ? [...metadataText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
   const defaults = { ...manifest.defaults ?? {}, ...opts.defaults ?? {} };
   const recordedFonts = recordedFontFamilies(setDir);
   const textSlots = recordedTextSlots(setDir, manifest.reps.map((r) => r.slug));
@@ -10679,17 +11146,17 @@ var init_brief = __esm({
 });
 
 // packages/generate/src/segments.ts
-import { existsSync as existsSync25, readFileSync as readFileSync21, readdirSync as readdirSync9 } from "node:fs";
-import path31 from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync24, readdirSync as readdirSync10 } from "node:fs";
+import path33 from "node:path";
 function repText(set, rep, tool) {
-  const env = JSON.parse(readFileSync21(path31.join(set, rep, `${tool}.json`), "utf8"));
+  const env = JSON.parse(readFileSync24(path33.join(set, rep, `${tool}.json`), "utf8"));
   return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function refPngDims(set, rep) {
-  const f = path31.join(set, rep, "get_screenshot.json");
-  if (!existsSync25(f)) return void 0;
+  const f = path33.join(set, rep, "get_screenshot.json");
+  if (!existsSync26(f)) return void 0;
   try {
-    const env = JSON.parse(readFileSync21(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync24(f, "utf8")).content.find((c) => c.type === "image");
     if (env?.data === void 0) return void 0;
     const buf = Buffer.from(env.data, "base64");
     if (buf.length < 24 || buf.readUInt32BE(0) !== 2303741511) return void 0;
@@ -10755,20 +11222,20 @@ DROPPED from the map, untrustworthy in the source export \u2014 for these, each
 }
 function buildSegments(task, mode = "fenced") {
   const SET = task.set;
-  let defsRecorded = existsSync25(path31.join(SET, "get_variable_defs.json"));
+  let defsRecorded = existsSync26(path33.join(SET, "get_variable_defs.json"));
   let rawDefs = {};
-  if (existsSync25(path31.join(SET, "get_variable_defs.json"))) {
-    const text = envelopeFirstTextPart(JSON.parse(readFileSync21(path31.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
+  if (existsSync26(path33.join(SET, "get_variable_defs.json"))) {
+    const text = envelopeFirstTextPart(JSON.parse(readFileSync24(path33.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
     try {
       rawDefs = JSON.parse(text);
     } catch {
     }
   } else {
     for (const cfg of task.configs) {
-      const f = path31.join(SET, cfg.rep, "get_variable_defs.json");
-      if (!existsSync25(f)) continue;
+      const f = path33.join(SET, cfg.rep, "get_variable_defs.json");
+      if (!existsSync26(f)) continue;
       defsRecorded = true;
-      const text = envelopeFirstTextPart(JSON.parse(readFileSync21(f, "utf8"))) || "{}";
+      const text = envelopeFirstTextPart(JSON.parse(readFileSync24(f, "utf8"))) || "{}";
       try {
         for (const [k, v] of Object.entries(JSON.parse(text))) rawDefs[k] ??= v;
       } catch {
@@ -10776,8 +11243,8 @@ function buildSegments(task, mode = "fenced") {
     }
   }
   const emissionTexts = task.configs.map((cfg) => {
-    const f = path31.join(SET, cfg.rep, "get_design_context.json");
-    return existsSync25(f) ? envelopeFirstTextPart(JSON.parse(readFileSync21(f, "utf8"))) : "";
+    const f = path33.join(SET, cfg.rep, "get_design_context.json");
+    return existsSync26(f) ? envelopeFirstTextPart(JSON.parse(readFileSync24(f, "utf8"))) : "";
   });
   const { map, note } = cleanTokenMap(rawDefs, emissionTexts);
   const defs = JSON.stringify(map, null, 1);
@@ -10795,9 +11262,9 @@ TOKEN MAP NEVER RECORDED: this set holds no get_variable_defs envelope, so wheth
   for (const cfg of task.configs) {
     const meta = stripFigmaInstructions(repText(SET, cfg.rep, "get_metadata"));
     const emission = stripFigmaInstructions(repText(SET, cfg.rep, "get_design_context"));
-    const assets = readdirSync9(path31.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
+    const assets = readdirSync10(path33.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
 \`\`\`svg
-${readFileSync21(path31.join(SET, cfg.rep, f), "utf8")}
+${readFileSync24(path33.join(SET, cfg.rep, f), "utf8")}
 \`\`\``).join("\n");
     const refNote = (() => {
       const dims = refPngDims(SET, cfg.rep);
@@ -10833,7 +11300,7 @@ Optionally a third block with \`/* FILE: tokens.css */\`.`);
   } else {
     parts.push(`
 ## Output format
-Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path31.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
+Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path33.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
   }
   return parts.join("\n");
 }
@@ -10900,9 +11367,9 @@ var init_adapter = __esm({
 });
 
 // packages/generate/src/bundle-emit.ts
-import { createHash as createHash5 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync26, mkdirSync as mkdirSync7, readFileSync as readFileSync22, readdirSync as readdirSync10, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "node:fs";
-import path32 from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import { copyFileSync, existsSync as existsSync27, mkdirSync as mkdirSync8, readFileSync as readFileSync25, readdirSync as readdirSync11, rmSync as rmSync4, writeFileSync as writeFileSync11 } from "node:fs";
+import path34 from "node:path";
 function pinFromConfigs(configs) {
   const domains = /* @__PURE__ */ new Map();
   const kinds = /* @__PURE__ */ new Map();
@@ -10971,9 +11438,9 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   const notices = [];
   const licenseTexts = /* @__PURE__ */ new Map();
   for (const face of faces) {
-    const src = path32.join(cacheDir, path32.basename(face.file));
-    const target = `./fonts/${path32.basename(face.file)}`;
-    const format = FONT_FORMATS[path32.extname(face.file).toLowerCase()] ?? "truetype";
+    const src = path34.join(cacheDir, path34.basename(face.file));
+    const target = `./fonts/${path34.basename(face.file)}`;
+    const format = FONT_FORMATS[path34.extname(face.file).toLowerCase()] ?? "truetype";
     const family = face.family.replace(/['\\]/g, "").replace(/\*\//g, "");
     const decl = `@font-face { font-family: '${family}'; font-weight: ${face.weight}; font-style: normal; src: url(${target}) format('${format}'); }`;
     const license = normalizeFontLicense(face.license);
@@ -11011,14 +11478,14 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
           `/* ${decl} */`
         );
       }
-    } else if (existsSync26(src) && createHash5("sha256").update(readFileSync22(src)).digest("hex") === face.sha256) {
-      mkdirSync7(path32.join(bundleDir, "fonts"), { recursive: true });
-      copyFileSync(src, path32.join(bundleDir, "fonts", path32.basename(face.file)));
+    } else if (existsSync27(src) && createHash6("sha256").update(readFileSync25(src)).digest("hex") === face.sha256) {
+      mkdirSync8(path34.join(bundleDir, "fonts"), { recursive: true });
+      copyFileSync(src, path34.join(bundleDir, "fonts", path34.basename(face.file)));
       licenseTexts.set(terms.file, terms.text);
       const upstream = upstreamAttribution(face);
       notices.push(
         "",
-        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path32.basename(face.file)}`,
+        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path34.basename(face.file)}`,
         `  licence:   ${terms.title} \u2014 full text in ./${terms.file}`,
         `  source:    ${face.source}`,
         `  sha256:    ${face.sha256}`,
@@ -11032,9 +11499,9 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   }
   if (lines.length === 0) return null;
   if (notices.length > 0) {
-    const fontsDir = path32.join(bundleDir, "fonts");
-    for (const [file, text] of licenseTexts) writeFileSync10(path32.join(fontsDir, file), text);
-    writeFileSync10(path32.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
+    const fontsDir = path34.join(bundleDir, "fonts");
+    for (const [file, text] of licenseTexts) writeFileSync11(path34.join(fontsDir, file), text);
+    writeFileSync11(path34.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
 `);
     header.push(
       "/* REDISTRIBUTION: the face files in ./fonts/ are redistributed under the licences",
@@ -11046,10 +11513,10 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
 `;
 }
 function countLatticeSymbols(setDir) {
-  const manifestFile = path32.join(setDir, "recording-set.json");
-  if (existsSync26(manifestFile)) {
+  const manifestFile = path34.join(setDir, "recording-set.json");
+  if (existsSync27(manifestFile)) {
     try {
-      const stored = JSON.parse(readFileSync22(manifestFile, "utf8"));
+      const stored = JSON.parse(readFileSync25(manifestFile, "utf8"));
       if (stored.variantScope !== "component-set") return null;
       const lattice = stored.latticeNames;
       if (lattice !== void 0 && lattice.length > 0) return lattice.length;
@@ -11057,13 +11524,13 @@ function countLatticeSymbols(setDir) {
     }
   }
   const files = [
-    path32.join(setDir, "get_metadata.json"),
-    ...existsSync26(setDir) ? readdirSync10(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path32.join(setDir, f)) : []
-  ].filter((f) => existsSync26(f));
+    path34.join(setDir, "get_metadata.json"),
+    ...existsSync27(setDir) ? readdirSync11(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path34.join(setDir, f)) : []
+  ].filter((f) => existsSync27(f));
   if (files.length === 0) return null;
   let count = 0;
   for (const f of files) {
-    const text = envelopeTextContent(JSON.parse(readFileSync22(f, "utf8")));
+    const text = envelopeTextContent(JSON.parse(readFileSync25(f, "utf8")));
     count += [...text.matchAll(/name="([^"]*)"/g)].filter((m) => m[1].includes("=")).length;
   }
   return count > 0 ? count : null;
@@ -11071,23 +11538,23 @@ function countLatticeSymbols(setDir) {
 function recordingSetHash(setDir, configs) {
   const relPaths = [];
   for (const name of ["recording-set.json", "completeness-manifest.json", "get_variable_defs.json", "get_metadata.json"]) {
-    if (existsSync26(path32.join(setDir, name))) relPaths.push(name);
+    if (existsSync27(path34.join(setDir, name))) relPaths.push(name);
   }
   for (const cfg of configs) {
     for (const f of ["get_design_context.json", "get_metadata.json", "get_screenshot.json", "get_variable_defs.json"]) {
-      if (existsSync26(path32.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
+      if (existsSync27(path34.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
     }
-    if (existsSync26(path32.join(setDir, cfg.rep))) {
-      for (const asset of readdirSync10(path32.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
+    if (existsSync27(path34.join(setDir, cfg.rep))) {
+      for (const asset of readdirSync11(path34.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
         relPaths.push(`${cfg.rep}/${asset}`);
       }
     }
   }
   return hashRecordingSet(
     relPaths,
-    (p) => new Uint8Array(readFileSync22(path32.join(setDir, p))),
+    (p) => new Uint8Array(readFileSync25(path34.join(setDir, p))),
     (chunks) => {
-      const h = createHash5("sha256");
+      const h = createHash6("sha256");
       for (const c of chunks) h.update(c);
       return h.digest("hex");
     }
@@ -11097,6 +11564,17 @@ function statusOf(s) {
   const tier = tierOf(s, BARS.cert);
   return tier === "certified" && (s.absentInk?.length ?? 0) > 0 ? "pass" : tier;
 }
+function kitIdentity(setDir) {
+  try {
+    const m = loadManifest(setDir);
+    return {
+      ...typeof m.figmaFile === "string" ? { figmaFile: m.figmaFile } : {},
+      ...typeof m.componentSetNode === "string" ? { componentSetNode: m.componentSetNode } : {}
+    };
+  } catch {
+    return {};
+  }
+}
 function emitBundleV1(opts) {
   const substituted = (opts.substitutedFamilies ?? []).length > 0;
   const parityFailed = new Set(opts.behaviors.filter((b) => b.id.startsWith("parity:") && !b.pass).map((b) => b.id.slice("parity:".length)));
@@ -11115,8 +11593,8 @@ function emitBundleV1(opts) {
   const prelude = opts.behaviors.filter((b) => b.id.startsWith("prelude:"));
   const parity = opts.behaviors.filter((b) => b.id.startsWith("parity:"));
   const contract = opts.behaviors.filter((b) => CONTRACT_CHECK_IDS.has(b.id));
-  const cssFiles = ["styles.css", "tokens.css"].map((f) => path32.join(opts.bundleDir, f)).filter((f) => existsSync26(f));
-  const families = cssFontFamilies(cssFiles.map((f) => readFileSync22(f, "utf8")).join("\n"));
+  const cssFiles = ["styles.css", "tokens.css"].map((f) => path34.join(opts.bundleDir, f)).filter((f) => existsSync27(f));
+  const families = cssFontFamilies(cssFiles.map((f) => readFileSync25(f, "utf8")).join("\n"));
   const requiredFonts = requiredFontsManifest(families, opts.fontCacheDir).map((f) => ({
     family: f.family,
     weight: f.weight,
@@ -11145,12 +11623,21 @@ function emitBundleV1(opts) {
         // resolvable via verify's --set override).
         path: (() => {
           const base = process.env["INIT_CWD"] ?? process.cwd();
-          const rel = path32.relative(base, opts.task.set);
+          const rel = path34.relative(base, opts.task.set);
           return rel !== "" && !rel.startsWith("..") ? rel : opts.task.set;
         })(),
         component: opts.componentName,
         ...opts.licenseNote !== void 0 ? { licenseNote: opts.licenseNote } : {},
-        hash: recordingSetHash(opts.task.set, opts.task.configs)
+        hash: recordingSetHash(opts.task.set, opts.task.configs),
+        // PROV-1: kit identity, carried through from the recording set.
+        // Captured at plan time and previously dropped here, which left
+        // a published bundle unable to name the kit it derives from —
+        // and the portal's consent is scoped to exactly this file key
+        // (ADR-018 §3), because the right to publish attaches to a kit.
+        // Read defensively: a set planned before these fields existed,
+        // or one built from a handed-in selection, legitimately has
+        // neither, and absent must read as NOT RECORDED.
+        ...kitIdentity(opts.task.set)
       },
       environment: { ...opts.environment, ...(opts.substitutedFamilies ?? []).length > 0 ? { substitutedFamilies: opts.substitutedFamilies } : {} },
       coverage: { recordedConfigs: statuses.length, latticeConfigs: lattice },
@@ -11173,25 +11660,25 @@ function emitBundleV1(opts) {
     })
   };
   const written = [];
-  const manifestPath2 = path32.join(opts.bundleDir, "component.json");
-  writeFileSync10(manifestPath2, `${JSON.stringify(manifest, null, 2)}
+  const manifestPath2 = path34.join(opts.bundleDir, "component.json");
+  writeFileSync11(manifestPath2, `${JSON.stringify(manifest, null, 2)}
 `);
   written.push(manifestPath2);
-  const stylesPath = path32.join(opts.bundleDir, "styles.css");
-  if (existsSync26(stylesPath)) {
+  const stylesPath = path34.join(opts.bundleDir, "styles.css");
+  if (existsSync27(stylesPath)) {
     const comment = cssProvenanceComment({ pass, scored: statuses.length, certified, latticeConfigs: lattice });
-    const current = readFileSync22(stylesPath, "utf8");
+    const current = readFileSync25(stylesPath, "utf8");
     const stripped = current.replace(/^\/\* tendril bundle v\d+ [^]*?\*\/\n/, "");
-    writeFileSync10(stylesPath, `${comment}
+    writeFileSync11(stylesPath, `${comment}
 ${stripped}`);
     written.push(stylesPath);
   }
-  const fontsCssPath = path32.join(opts.bundleDir, "fonts.css");
-  rmSync3(path32.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
-  rmSync3(fontsCssPath, { force: true });
+  const fontsCssPath = path34.join(opts.bundleDir, "fonts.css");
+  rmSync4(path34.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
+  rmSync4(fontsCssPath, { force: true });
   const fontsCss = fontsCssFor(requiredFontsManifest(families, opts.fontCacheDir), opts.bundleDir, opts.fontCacheDir, opts.substitutedFamilies ?? []);
   if (fontsCss !== null) {
-    writeFileSync10(fontsCssPath, fontsCss);
+    writeFileSync11(fontsCssPath, fontsCss);
     written.push(fontsCssPath);
   }
   const unrecorded = lattice === null ? null : Math.max(0, lattice - statuses.length);
@@ -11619,9 +12106,9 @@ DEALINGS IN THE FONT SOFTWARE.
 });
 
 // packages/generate/src/compose-pins.ts
-import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync27, readFileSync as readFileSync23, readdirSync as readdirSync11, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
-import path33 from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { existsSync as existsSync28, readFileSync as readFileSync26, readdirSync as readdirSync12, realpathSync as realpathSync3, statSync as statSync4 } from "node:fs";
+import path35 from "node:path";
 function bundleDirs(roots, depth = 4) {
   const found = [];
   const seen = /* @__PURE__ */ new Set();
@@ -11630,31 +12117,31 @@ function bundleDirs(roots, depth = 4) {
     try {
       key = realpathSync3(dir);
     } catch {
-      key = path33.resolve(dir);
+      key = path35.resolve(dir);
     }
     if (seen.has(key)) return;
     seen.add(key);
-    if (existsSync27(path33.join(dir, "component.json"))) {
+    if (existsSync28(path35.join(dir, "component.json"))) {
       found.push(key);
       return;
     }
     if (remaining === 0) return;
     let entries;
     try {
-      entries = readdirSync11(dir);
+      entries = readdirSync12(dir);
     } catch {
       return;
     }
     for (const e of entries) {
       if (e === "node_modules" || e.startsWith(".")) continue;
-      const full = path33.join(dir, e);
+      const full = path35.join(dir, e);
       try {
-        if (statSync3(full).isDirectory()) walk2(full, remaining - 1);
+        if (statSync4(full).isDirectory()) walk2(full, remaining - 1);
       } catch {
       }
     }
   };
-  for (const r of roots) walk2(path33.resolve(r), depth);
+  for (const r of roots) walk2(path35.resolve(r), depth);
   return found;
 }
 function composedPins(hostSet, libraryRoots) {
@@ -11673,7 +12160,7 @@ function composedPins(hostSet, libraryRoots) {
     let pinned = false;
     const failures = [];
     for (const rel of partnerRels) {
-      const partnerSet = path33.resolve(hostSet, rel);
+      const partnerSet = path35.resolve(hostSet, rel);
       let partnerTask;
       let partnerManifest;
       try {
@@ -11702,7 +12189,7 @@ function composedPins(hostSet, libraryRoots) {
       const wantHash = recordingSetHash(partnerSet, partnerTask.configs);
       const matches = candidates.filter((dir) => {
         try {
-          const parsed = readBundleManifest(readFileSync23(path33.join(dir, "component.json"), "utf8"));
+          const parsed = readBundleManifest(readFileSync26(path35.join(dir, "component.json"), "utf8"));
           return parsed.manifest?.provenance.recordingSet.hash === wantHash;
         } catch {
           return false;
@@ -11715,13 +12202,13 @@ function composedPins(hostSet, libraryRoots) {
         continue;
       }
       if (matches.length > 1) {
-        failures.push(`${rel}: ${matches.length} bundles join the same recording hash (${matches.map((m) => path33.basename(m)).join(", ")}) \u2014 ambiguous; remove or point --library away from the duplicates`);
+        failures.push(`${rel}: ${matches.length} bundles join the same recording hash (${matches.map((m) => path35.basename(m)).join(", ")}) \u2014 ambiguous; remove or point --library away from the duplicates`);
         continue;
       }
       const bundleDir = matches[0];
       let manifest;
       try {
-        manifest = readBundleManifest(readFileSync23(path33.join(bundleDir, "component.json"), "utf8")).manifest;
+        manifest = readBundleManifest(readFileSync26(path35.join(bundleDir, "component.json"), "utf8")).manifest;
       } catch {
         manifest = void 0;
       }
@@ -11738,8 +12225,8 @@ function composedPins(hostSet, libraryRoots) {
       const moduleFiles = [];
       let fileIssue;
       for (const name of [manifest.entry, "styles.css", "tokens.css", "fonts.css"]) {
-        const file = path33.join(bundleDir, name);
-        if (!existsSync27(file)) {
+        const file = path35.join(bundleDir, name);
+        if (!existsSync28(file)) {
           if (name === manifest.entry || name === "styles.css") {
             fileIssue = `${rel}: partner bundle is missing ${name}`;
             break;
@@ -11748,7 +12235,7 @@ function composedPins(hostSet, libraryRoots) {
         }
         let bytes;
         try {
-          bytes = readFileSync23(file);
+          bytes = readFileSync26(file);
         } catch {
           fileIssue = `${rel}: partner file ${name} at ${bundleDir} is unreadable`;
           break;
@@ -11757,7 +12244,7 @@ function composedPins(hostSet, libraryRoots) {
           fileIssue = `${rel}: partner file ${name} exceeds the pin size cap (${bytes.byteLength} bytes)`;
           break;
         }
-        moduleFiles.push({ name, content: bytes.toString("utf8"), sha256: createHash6("sha256").update(bytes).digest("hex") });
+        moduleFiles.push({ name, content: bytes.toString("utf8"), sha256: createHash7("sha256").update(bytes).digest("hex") });
       }
       if (fileIssue !== void 0) {
         failures.push(fileIssue);
@@ -11820,14 +12307,14 @@ function composedChecks(candidateDir, hostEntry, pins) {
   const checks = [];
   let entrySource = "";
   try {
-    entrySource = readFileSync23(path33.join(candidateDir, hostEntry), "utf8");
+    entrySource = readFileSync26(path35.join(candidateDir, hostEntry), "utf8");
   } catch {
   }
-  const candidateRoot = path33.resolve(candidateDir);
+  const candidateRoot = path35.resolve(candidateDir);
   for (const pin of pins) {
     const dir = composedModuleDir(pin.partnerName);
-    const resolvedDir = path33.resolve(candidateDir, dir);
-    if (!resolvedDir.startsWith(candidateRoot + path33.sep)) {
+    const resolvedDir = path35.resolve(candidateDir, dir);
+    if (!resolvedDir.startsWith(candidateRoot + path35.sep)) {
       checks.push({ id: `composition:${pin.pairKey}:module-verbatim`, pass: false, detail: `pin path ${dir}/ escapes the candidate directory \u2014 refused` });
       checks.push({ id: `composition:${pin.pairKey}:imported`, pass: false, detail: `pin path ${dir}/ escapes the candidate directory \u2014 refused` });
       continue;
@@ -11838,12 +12325,12 @@ function composedChecks(candidateDir, hostEntry, pins) {
         wrong.push(`${f.name} refused (not a plain path segment)`);
         continue;
       }
-      const target = path33.join(candidateDir, dir, f.name);
-      if (!existsSync27(target)) {
+      const target = path35.join(candidateDir, dir, f.name);
+      if (!existsSync28(target)) {
         wrong.push(`${f.name} missing`);
         continue;
       }
-      const sha = createHash6("sha256").update(readFileSync23(target)).digest("hex");
+      const sha = createHash7("sha256").update(readFileSync26(target)).digest("hex");
       if (sha !== f.sha256) wrong.push(`${f.name} differs from the pinned partner bytes`);
     }
     checks.push({
@@ -11868,10 +12355,10 @@ function rootClassesFor(emission, nodeId) {
 }
 function regionOverrides(hostSet, partnerSet, instances) {
   const read = (setDir, rep) => {
-    const f = path33.join(setDir, rep, "get_design_context.json");
-    if (!existsSync27(f)) return void 0;
+    const f = path35.join(setDir, rep, "get_design_context.json");
+    if (!existsSync28(f)) return void 0;
     try {
-      return envelopeFirstTextPart(JSON.parse(readFileSync23(f, "utf8")));
+      return envelopeFirstTextPart(JSON.parse(readFileSync26(f, "utf8")));
     } catch {
       return void 0;
     }
@@ -11901,7 +12388,7 @@ var init_compose_pins = __esm({
     init_src4();
     init_brief();
     init_bundle_emit();
-    composedModuleDir = (partnerName) => path33.posix.join("composed", partnerName);
+    composedModuleDir = (partnerName) => path35.posix.join("composed", partnerName);
     safeSegment = (s) => /^[A-Za-z0-9][A-Za-z0-9._ -]*$/.test(s) && !s.includes("..");
     MAX_PINNED_FILE_BYTES = 1024 * 1024;
     CONTEXT_LAYOUT_TOKENS = /* @__PURE__ */ new Set(["shrink-0", "grow", "flex-1", "basis-0", "self-stretch", "w-full", "h-full"]);
@@ -11909,8 +12396,8 @@ var init_compose_pins = __esm({
 });
 
 // packages/generate/src/motion.ts
-import { existsSync as existsSync28, readFileSync as readFileSync24, readdirSync as readdirSync12, statSync as statSync4 } from "node:fs";
-import path34 from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync27, readdirSync as readdirSync13, statSync as statSync5 } from "node:fs";
+import path36 from "node:path";
 function springProgress(u, bounce) {
   const decay = Math.log(100);
   if (bounce <= 0) {
@@ -11981,10 +12468,10 @@ function reportsNoMotion(text) {
   });
 }
 function motionTruthFor(setDir) {
-  const file = path34.join(setDir, "get_motion_context.json");
-  if (existsSync28(file) && usableEnvelope(file, "get_motion_context").ok) {
+  const file = path36.join(setDir, "get_motion_context.json");
+  if (existsSync29(file) && usableEnvelope(file, "get_motion_context").ok) {
     try {
-      const text = envelopeTextContent(JSON.parse(readFileSync24(file, "utf8")));
+      const text = envelopeTextContent(JSON.parse(readFileSync27(file, "utf8")));
       if (text.trim() === "") return { state: "recorded-empty" };
       return reportsNoMotion(text) ? { state: "recorded-no-motion", text } : { state: "recorded", text };
     } catch {
@@ -11997,21 +12484,21 @@ function motionTruthFor(setDir) {
   }
 }
 function motionDisclosure(bundleDir, setDir) {
-  const sheets = ["styles.css", "tokens.css"].map((f) => path34.join(bundleDir, f));
-  const composedRoot = path34.join(bundleDir, "composed");
+  const sheets = ["styles.css", "tokens.css"].map((f) => path36.join(bundleDir, f));
+  const composedRoot = path36.join(bundleDir, "composed");
   try {
-    for (const entry of readdirSync12(composedRoot).sort()) {
-      const dir = path34.join(composedRoot, entry);
+    for (const entry of readdirSync13(composedRoot).sort()) {
+      const dir = path36.join(composedRoot, entry);
       try {
-        if (!statSync4(dir).isDirectory()) continue;
+        if (!statSync5(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      sheets.push(path34.join(dir, "styles.css"), path34.join(dir, "tokens.css"));
+      sheets.push(path36.join(dir, "styles.css"), path36.join(dir, "tokens.css"));
     }
   } catch {
   }
-  const css = sheets.filter((f) => existsSync28(f)).map((f) => readFileSync24(f, "utf8")).join("\n");
+  const css = sheets.filter((f) => existsSync29(f)).map((f) => readFileSync27(f, "utf8")).join("\n");
   if (!MOTION_CSS_PATTERN.test(scannableCss(css))) return { present: false };
   return {
     present: true,
@@ -12378,12 +12865,12 @@ var init_components = __esm({
 
 // packages/generate/src/codebase/walk.ts
 import fs2 from "node:fs";
-import path35 from "node:path";
+import path37 from "node:path";
 function resolvedPathIsExcluded(real, roots) {
-  if (isNeverRead(path35.basename(real))) return true;
+  if (isNeverRead(path37.basename(real))) return true;
   for (const root of roots) {
-    if (real !== root && !real.startsWith(root + path35.sep)) continue;
-    for (const segment of path35.relative(root, real).split(path35.sep).slice(0, -1)) {
+    if (real !== root && !real.startsWith(root + path37.sep)) continue;
+    for (const segment of path37.relative(root, real).split(path37.sep).slice(0, -1)) {
       if (segment.startsWith(".") || EXCLUDED_DIRS.has(segment)) return true;
     }
   }
@@ -12397,7 +12884,7 @@ function containedRealpath(abs, roots) {
     return null;
   }
   for (const root of roots) {
-    if (real === root || real.startsWith(root + path35.sep)) return real;
+    if (real === root || real.startsWith(root + path37.sep)) return real;
   }
   return null;
 }
@@ -12430,7 +12917,7 @@ function walkRepo(roots, limits, accept) {
         continue;
       }
       for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-        const abs = path35.join(frame.dir, entry.name);
+        const abs = path37.join(frame.dir, entry.name);
         if (EXCLUDED_DIRS.has(entry.name)) continue;
         if (isNeverRead(entry.name)) continue;
         const real = containedRealpath(abs, realRoots);
@@ -12518,18 +13005,18 @@ var init_walk = __esm({
       /^\.netrc$/i
     ];
     isNeverRead = (basename) => NEVER_READ.some((re) => re.test(basename));
-    toRel = (root, abs) => path35.relative(root, abs).split(path35.sep).join(path35.posix.sep);
+    toRel = (root, abs) => path37.relative(root, abs).split(path37.sep).join(path37.posix.sep);
   }
 });
 
 // packages/generate/src/codebase/scan.ts
 import crypto2 from "node:crypto";
 import fs3 from "node:fs";
-import path36 from "node:path";
+import path38 from "node:path";
 import postcss3 from "postcss";
 function scanCodebase(options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const roots = options.roots.map((r) => path36.resolve(r));
+  const roots = options.roots.map((r) => path38.resolve(r));
   const walk2 = walkRepo(
     roots,
     {
@@ -12549,7 +13036,7 @@ function scanCodebase(options) {
   let bytesRead = 0;
   let filesRead = 0;
   for (const file of walk2.files) {
-    const base = path36.posix.basename(file.rel);
+    const base = path38.posix.basename(file.rel);
     configFiles.add(file.rel);
     if (/^tailwind\.config\./.test(base) || file.rel === "babel.config.js") continue;
     const text = readTextFile(file.abs);
@@ -12565,7 +13052,7 @@ function scanCodebase(options) {
   }
   const css = extractCssCustomProperties(cssFiles.filter((f) => !f.rel.includes("..")));
   const components = scanComponents(componentFiles);
-  const packages = manifests.filter((m) => path36.posix.basename(m.rel) === "package.json");
+  const packages = manifests.filter((m) => path38.posix.basename(m.rel) === "package.json");
   const styling = detectStyling(configFiles, cssFiles, componentFiles, manifests);
   const classNameStyle = representativeClassNames(cssFiles, css.unparsed.length);
   const disclosures = buildDisclosures(
@@ -12608,13 +13095,13 @@ function scanCodebase(options) {
     },
     components: {
       entries: components.entries.slice(0, PROFILE_LIMITS.maxComponents),
-      fileNaming: buildHistogram(componentFiles.map((f) => classifyFileName(path36.posix.basename(f.rel)))),
+      fileNaming: buildHistogram(componentFiles.map((f) => classifyFileName(path38.posix.basename(f.rel)))),
       directoryLayout: buildHistogram(componentFiles.map((f) => classifyDirectoryLayout(f.rel))),
       exportStyle: buildHistogram(components.entries.map((e) => e.exportStyle)),
       classNameStyle,
       colocation: buildHistogram(collectColocation(componentFiles, cssFiles)),
       barrelFiles: componentFiles.filter(
-        (f) => /^index\.[tj]sx?$/.test(path36.posix.basename(f.rel)) && isReExportOnly(f.text)
+        (f) => /^index\.[tj]sx?$/.test(path38.posix.basename(f.rel)) && isReExportOnly(f.text)
       ).length,
       refForwarding: {
         forwardRef: componentFiles.filter((f) => /\bforwardRef\s*[(<]/.test(f.text)).length,
@@ -12637,7 +13124,7 @@ function detectStyling(configFiles, cssFiles, componentFiles, manifests) {
   };
   const deps = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
-    if (path36.posix.basename(manifest.rel) !== "package.json") continue;
+    if (path38.posix.basename(manifest.rel) !== "package.json") continue;
     try {
       const parsed = JSON.parse(manifest.text);
       for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
@@ -12649,7 +13136,7 @@ function detectStyling(configFiles, cssFiles, componentFiles, manifests) {
     }
   }
   for (const cfg of configFiles) {
-    const base = path36.posix.basename(cfg);
+    const base = path38.posix.basename(cfg);
     if (/^tailwind\.config\./.test(base)) add("tailwind-v3", "file", cfg);
     if (base === "components.json") add("shadcn-style", "file", cfg);
   }
@@ -12707,8 +13194,8 @@ function collectClassNames(cssFiles) {
   return [...distinct].sort().map(classifyClassName);
 }
 function classifyDirectoryLayout(rel) {
-  const base = path36.posix.basename(rel).replace(/\.[^.]+$/, "");
-  const dir = path36.posix.basename(path36.posix.dirname(rel));
+  const base = path38.posix.basename(rel).replace(/\.[^.]+$/, "");
+  const dir = path38.posix.basename(path38.posix.dirname(rel));
   if (base === "index") return "component-dir";
   if (base === dir) return "component-dir";
   return "flat-file";
@@ -12732,7 +13219,7 @@ function detectFormatting(manifests, componentFiles) {
     (a, b) => a.rel.split("/").length - b.rel.split("/").length || a.rel.localeCompare(b.rel)
   );
   for (const manifest of byDepth) {
-    const base = path36.posix.basename(manifest.rel);
+    const base = path38.posix.basename(manifest.rel);
     if (!/^\.prettierrc/.test(base) && base !== "package.json") continue;
     try {
       const parsed = JSON.parse(manifest.text);
@@ -12750,7 +13237,7 @@ function detectFormatting(manifests, componentFiles) {
     }
   }
   for (const manifest of byDepth) {
-    if (path36.posix.basename(manifest.rel) !== ".editorconfig") continue;
+    if (path38.posix.basename(manifest.rel) !== ".editorconfig") continue;
     const style = /indent_style\s*=\s*(tab|space)/.exec(manifest.text)?.[1];
     const width = /indent_size\s*=\s*(\d+)/.exec(manifest.text)?.[1];
     if (style || width) {
@@ -12821,12 +13308,12 @@ function buildDisclosures(detected, css, cappedOut, unrepresentativeClassNames)
   return out;
 }
 function outPathIsGitIgnored(outPath) {
-  const dir = path36.dirname(outPath);
+  const dir = path38.dirname(outPath);
   try {
-    const ignoreFile = path36.join(path36.dirname(dir), ".gitignore");
+    const ignoreFile = path38.join(path38.dirname(dir), ".gitignore");
     if (!fs3.existsSync(ignoreFile)) return false;
     const patterns = fs3.readFileSync(ignoreFile, "utf8").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
-    const base = path36.basename(dir);
+    const base = path38.basename(dir);
     return patterns.some((p) => p === base || p === `${base}/` || p === `/${base}` || p === `/${base}/`);
   } catch {
     return false;
@@ -12973,8 +13460,8 @@ __export(profile_exports, {
   PROFILE_DESCRIPTION: () => PROFILE_DESCRIPTION,
   runProfile: () => runProfile
 });
-import { closeSync, constants, existsSync as existsSync29, mkdirSync as mkdirSync8, openSync, realpathSync as realpathSync4, writeFileSync as writeFileSync11 } from "node:fs";
-import path37 from "node:path";
+import { closeSync, constants, existsSync as existsSync30, mkdirSync as mkdirSync9, openSync, realpathSync as realpathSync4, writeFileSync as writeFileSync12 } from "node:fs";
+import path39 from "node:path";
 function escapesScanRoot(outPath, scanRoot) {
   const resolveExisting = (target) => {
     let cursor = target;
@@ -12982,23 +13469,23 @@ function escapesScanRoot(outPath, scanRoot) {
       try {
         return realpathSync4(cursor);
       } catch {
-        const parent = path37.dirname(cursor);
+        const parent = path39.dirname(cursor);
         if (parent === cursor) return cursor;
         cursor = parent;
       }
     }
   };
   const root = resolveExisting(scanRoot);
-  const dir = resolveExisting(path37.dirname(outPath));
-  return dir !== root && !dir.startsWith(root + path37.sep);
+  const dir = resolveExisting(path39.dirname(outPath));
+  return dir !== root && !dir.startsWith(root + path39.sep);
 }
 function runProfile(options) {
   if (options.describe) {
     printDescription(PROFILE_DESCRIPTION);
     return;
   }
-  const dir = path37.resolve(options.dir ?? ".");
-  if (!existsSync29(dir)) {
+  const dir = path39.resolve(options.dir ?? ".");
+  if (!existsSync30(dir)) {
     fail(options, ExitCode.InputValidation, {
       error: `no such directory: ${dir}`,
       code: "profile_dir_missing",
@@ -13006,7 +13493,7 @@ function runProfile(options) {
     });
   }
   const profile = scanCodebase({ roots: [dir], ...options.now ? { now: options.now } : {} });
-  const outPath = path37.resolve(options.out ?? path37.join(dir, "tendril-out", "codebase-profile.json"));
+  const outPath = path39.resolve(options.out ?? path39.join(dir, "tendril-out", "codebase-profile.json"));
   if (!options.dryRun) {
     if (options.out === void 0 && escapesScanRoot(outPath, dir)) {
       fail(options, ExitCode.InputValidation, {
@@ -13015,10 +13502,10 @@ function runProfile(options) {
         remediation: `\`tendril-out\` in that project is a symlink pointing outside it, so writing the profile there could overwrite an unrelated file. Remove the symlink, or choose an explicit destination: \`${tendrilCommand(`profile --dir ${quoteArg(dir)} --out ./codebase-profile.json`)}\`.`
       });
     }
-    mkdirSync8(path37.dirname(outPath), { recursive: true });
+    mkdirSync9(path39.dirname(outPath), { recursive: true });
     const handle = openSync(outPath, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 420);
     try {
-      writeFileSync11(handle, `${JSON.stringify(profile, null, 2)}
+      writeFileSync12(handle, `${JSON.stringify(profile, null, 2)}
 `, "utf8");
     } finally {
       closeSync(handle);
@@ -13080,7 +13567,7 @@ Written to ${outPath}
 `);
     if (!ignored) {
       process.stdout.write(
-        `  NOTE: ${path37.basename(path37.dirname(outPath))}/ is not gitignored here \u2014 add it to .gitignore, or this profile will show up in your next commit.
+        `  NOTE: ${path39.basename(path39.dirname(outPath))}/ is not gitignored here \u2014 add it to .gitignore, or this profile will show up in your next commit.
 `
       );
     }
@@ -13219,11 +13706,11 @@ __export(compose_exports, {
   compositionPairsFor: () => compositionPairsFor,
   runCompose: () => runCompose
 });
-import { createHash as createHash7 } from "node:crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync25 } from "node:fs";
-import path38 from "node:path";
+import { createHash as createHash8 } from "node:crypto";
+import { existsSync as existsSync31, readFileSync as readFileSync28 } from "node:fs";
+import path40 from "node:path";
 function compositionPairsFor(hostSet, roots) {
-  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path38.dirname(hostSet)])];
+  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path40.dirname(hostSet)])];
   const edges = composeReport(buildComposeIndex(scanRoots));
   const pairs = substitutionPairs(edges, hostSet);
   const { raw } = readManifestFile(hostSet);
@@ -13255,7 +13742,7 @@ function substitutionPairs(edges, hostSet) {
       });
     }
     const pair = pairs.get(key);
-    const poseDisplay = e.pose.reps.map((r) => `${path38.basename(r.dir)}:${r.slug}`).join(", ");
+    const poseDisplay = e.pose.reps.map((r) => `${path40.basename(r.dir)}:${r.slug}`).join(", ");
     pair.instances.push({ hostRep: e.hostRep, instanceId: e.instanceId, poseVariantNodeId: e.pose.variantNodeId, ...poseDisplay !== "" ? { poseDisplay } : {} });
     for (const d of e.disclosures) if (!pair.disclosures.includes(d)) pair.disclosures.push(d);
   }
@@ -13267,7 +13754,7 @@ function runCompose(flags) {
     return;
   }
   const base = process.env["INIT_CWD"] ?? process.cwd();
-  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path38.resolve(base, d)) : [base];
+  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path40.resolve(base, d)) : [base];
   if (flags.set === void 0 && (flags.confirmCompositions === true || flags.decline !== void 0 && flags.decline.length > 0)) {
     fail(flags, ExitCode.InputValidation, {
       error: "--confirm-compositions/--decline require --set <host> \u2014 a decision needs the host set it decides for",
@@ -13276,7 +13763,7 @@ function runCompose(flags) {
     });
   }
   if (flags.set !== void 0) {
-    runComposeConfirm(flags, path38.resolve(base, flags.set), roots);
+    runComposeConfirm(flags, path40.resolve(base, flags.set), roots);
     return;
   }
   const index = buildComposeIndex(roots);
@@ -13294,7 +13781,7 @@ function runCompose(flags) {
     }
     let lastHost = "";
     for (const e of edges) {
-      const host = `${path38.basename(e.hostSet)}`;
+      const host = `${path40.basename(e.hostSet)}`;
       if (host !== lastHost) {
         process.stdout.write(`
 ${host}
@@ -13302,7 +13789,7 @@ ${host}
         lastHost = host;
       }
       const partners = e.partners.map((p) => p.displayName).join(" / ") || "\u2014";
-      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path38.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
+      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path40.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
       process.stdout.write(`  ${e.kind.toUpperCase().padEnd(12)} ${e.hostRep}/${e.instanceId} "${e.instanceName}" \u2192 ${partners}${pose}
 `);
       for (const d of e.disclosures) process.stdout.write(`    \xB7 ${d}
@@ -13314,14 +13801,14 @@ ${NOTE}
   });
 }
 function runComposeConfirm(flags, hostSet, roots) {
-  if (!existsSync30(path38.join(hostSet, "recording-set.json"))) {
+  if (!existsSync31(path40.join(hostSet, "recording-set.json"))) {
     fail(flags, ExitCode.InputValidation, {
       error: `no recording-set.json in ${hostSet}`,
       code: "no-recording-set",
       remediation: "Point --set at a recorded host set (the directory holding recording-set.json)."
     });
   }
-  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path38.dirname(hostSet)])];
+  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path40.dirname(hostSet)])];
   const index = buildComposeIndex(scanRoots);
   const edges = composeReport(index);
   const pairs = substitutionPairs(edges, hostSet);
@@ -13404,7 +13891,7 @@ PAIR ${p.displayName}${p.figmaFile !== void 0 ? ` (file ${p.figmaFile})` : " \u2
       // full recording-set hash join lands with pin authoring, where
       // task configs exist.)
       manifestSha256: Object.fromEntries(
-        p.partnerDirs.map((d) => [path38.relative(hostSet, d), createHash7("sha256").update(readFileSync25(path38.join(d, "recording-set.json"))).digest("hex")])
+        p.partnerDirs.map((d) => [path40.relative(hostSet, d), createHash8("sha256").update(readFileSync28(path40.join(d, "recording-set.json"))).digest("hex")])
       )
     },
     // Schema shape ONLY (review: the display-side poseDisplay field
@@ -13483,10 +13970,10 @@ __export(record_exports, {
   runRecordPlan: () => runRecordPlan,
   runRecordStatus: () => runRecordStatus
 });
-import { existsSync as existsSync31, mkdtempSync as mkdtempSync2, readFileSync as readFileSync26, readdirSync as readdirSync13 } from "node:fs";
-import os6 from "node:os";
-import path39 from "node:path";
-import { writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync32, mkdtempSync as mkdtempSync2, readFileSync as readFileSync29, readdirSync as readdirSync14 } from "node:fs";
+import os7 from "node:os";
+import path41 from "node:path";
+import { writeFileSync as writeFileSync13 } from "node:fs";
 function recordsInteractionState(reports) {
   const evident = (s) => stateTokens(s).some((t) => INTERACTION_TREATMENT_VALUES.has(t));
   return reports.some((r) => evident(r.axis) || r.domain.some(evident));
@@ -13508,7 +13995,7 @@ function interactionDisclosure(component, reports) {
   };
 }
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
-  const env = JSON.parse(readFileSync26(file, "utf8"));
+  const env = JSON.parse(readFileSync29(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
   const symbols = [];
   const walk2 = (node, ancestor) => {
@@ -13566,8 +14053,8 @@ function runRecordPlan(opts) {
   if (rawFile !== void 0) {
     try {
       const envelope = rawEnvelopeFromFile(rawFile, opts.metadataRawPartsFile !== void 0);
-      const tmp = path39.join(mkdtempSync2(path39.join(os6.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
-      writeFileSync12(tmp, JSON.stringify(envelope));
+      const tmp = path41.join(mkdtempSync2(path41.join(os7.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
+      writeFileSync13(tmp, JSON.stringify(envelope));
       metadataEntries.push({ file: tmp });
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
@@ -13588,7 +14075,7 @@ function runRecordPlan(opts) {
   let metadataTruncated = false;
   for (const { file, frame } of metadataEntries) {
     try {
-      const parsed = symbolsFromMetadataEnvelope(path39.resolve(file), frame);
+      const parsed = symbolsFromMetadataEnvelope(path41.resolve(file), frame);
       symbols.push(...parsed.symbols);
       if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
@@ -13622,7 +14109,7 @@ function runRecordPlan(opts) {
   if (symbols.length === 0) {
     const leads = metadataEntries.flatMap(({ file }) => {
       try {
-        const env = JSON.parse(readFileSync26(path39.resolve(file), "utf8"));
+        const env = JSON.parse(readFileSync29(path41.resolve(file), "utf8"));
         return instanceLeads(env.content.map((c) => c.text ?? "").join("\n"));
       } catch {
         return [];
@@ -13715,7 +14202,7 @@ function runRecordPlan(opts) {
         // a CLI flag and the MCP surface has no parameter for it.
         decidedBy: "HUMAN ONLY \u2014 offer it, never choose it, and you cannot run it",
         text: "Record a reduced pose set (anchor + one-factor sweeps + conflict crosses) instead of the full variant matrix. This buys calls with coverage \u2014 sampling is blind to multi-axis interactions and the report discloses the poses it skipped \u2014 so only the user may accept that trade. There is no tool parameter for it; the user runs it themselves in their own terminal, before any pose is recorded.",
-        userRuns: [`rm ${quoteArg(path39.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
+        userRuns: [`rm ${quoteArg(path41.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
       },
       {
         id: "larger-allowance",
@@ -13913,7 +14400,7 @@ function runRecordNext(opts) {
     const progress = payload["progress"];
     process.stdout.write(`[${progress.recordedReps}/${progress.totalReps} reps] ${payload["tool"]} for ${payload["slug"]} (node ${payload["nodeId"]})
   \u2192 ${payload["note"]}
-  \u2192 then: ${tendrilCommand(`record ingest --set ${path39.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
+  \u2192 then: ${tendrilCommand(`record ingest --set ${path41.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
 `);
   });
 }
@@ -13987,7 +14474,7 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
   const skipped = [];
   const failed = [];
   for (const { url, name } of assetUrlsFromEnvelopeText(envelopeText2)) {
-    if (existsSync31(path39.join(setDir, rep, name))) {
+    if (existsSync32(path41.join(setDir, rep, name))) {
       skipped.push(name);
       continue;
     }
@@ -14009,16 +14496,16 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 }
 function rawEnvelopeFromFile(file, parts) {
   if (parts) {
-    const blocks = JSON.parse(readFileSync26(path39.resolve(file), "utf8"));
+    const blocks = JSON.parse(readFileSync29(path41.resolve(file), "utf8"));
     if (!Array.isArray(blocks) || blocks.length === 0 || blocks.some((p) => typeof p !== "string")) throw new Error("parts file must be a non-empty JSON array of strings");
     return { content: blocks.map((text) => ({ type: "text", text })) };
   }
-  return { content: [{ type: "text", text: readFileSync26(path39.resolve(file), "utf8") }] };
+  return { content: [{ type: "text", text: readFileSync29(path41.resolve(file), "utf8") }] };
 }
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync26(path39.resolve(opts.file), "utf8"));
+    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync29(path41.resolve(opts.file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -14030,7 +14517,7 @@ async function runRecordIngest(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "--raw is for text tool responses; screenshots are binary",
       code: "envelope-invalid",
-      remediation: `Use \`${tendrilCommand(`record fetch --set ${path39.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
+      remediation: `Use \`${tendrilCommand(`record fetch --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
     });
   }
   if (opts.rep === "__set__" && opts.tool === "get_variable_defs") {
@@ -14050,7 +14537,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync12(path39.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync13(path41.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_variable_defs ingested\n");
@@ -14074,7 +14561,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync12(path39.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync13(path41.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_motion_context", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_motion_context ingested\n");
@@ -14090,7 +14577,7 @@ async function runRecordIngest(opts) {
       if (assets !== void 0) {
         for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path39.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
       }
     });
@@ -14163,15 +14650,15 @@ async function runRecordIngestRep(opts) {
     if (assets !== void 0) {
       for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path39.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
     }
   });
 }
 function runRecordAsset(opts) {
   if (opts.dir !== void 0) {
-    const dir = path39.resolve(opts.dir);
-    const names = readdirSync13(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
+    const dir = path41.resolve(opts.dir);
+    const names = readdirSync14(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
     if (names.length === 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `no asset-*.<ext> files found in ${dir}`,
@@ -14182,7 +14669,7 @@ function runRecordAsset(opts) {
     const ingested = [];
     try {
       for (const name of names) {
-        ingestAsset(opts.setDir, opts.rep, name, readFileSync26(path39.join(dir, name)));
+        ingestAsset(opts.setDir, opts.rep, name, readFileSync29(path41.join(dir, name)));
         ingested.push(name);
       }
     } catch (err) {
@@ -14202,11 +14689,11 @@ function runRecordAsset(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "pass --name and --file for a single asset, or --dir for a batch",
       code: "asset-rejected",
-      remediation: tendrilCommand(`record asset --set ${path39.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
+      remediation: tendrilCommand(`record asset --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
     });
   }
   try {
-    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync26(path39.resolve(opts.file)));
+    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync29(path41.resolve(opts.file)));
     emitData(opts, { rep: opts.rep, asset: opts.name }, () => {
       process.stdout.write(`ingested ${opts.rep}/${opts.name}
 `);
@@ -14223,8 +14710,8 @@ function runRecordStatus(opts) {
   const status = sessionStatus(opts.setDir);
   const composition = (() => {
     try {
-      const setDir = path39.resolve(opts.setDir);
-      const { open, standing, invalid } = compositionPairsFor(setDir, [path39.dirname(setDir)]);
+      const setDir = path41.resolve(opts.setDir);
+      const { open, standing, invalid } = compositionPairsFor(setDir, [path41.dirname(setDir)]);
       return {
         openPairs: open.map((p) => ({ displayName: p.displayName, pairKey: p.key, instances: p.instances.length })),
         confirmed: standing.filter((s) => s.status === "confirmed").length,
@@ -14245,7 +14732,7 @@ function runRecordStatus(opts) {
       }
     }
     process.stdout.write(
-      status.motion.recorded ? motionTruthFor(path39.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
+      status.motion.recorded ? motionTruthFor(path41.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
 ` : "MOTION set-level motion context not yet recorded \u2014 `record next` names the call once the reps and token map are done\n" : "MOTION never asked \u2014 this set predates the motion-capture obligation (fresh plans record it; briefs prescribe default motion doctrine only)\n"
     );
     if ("unavailable" in composition) {
@@ -14253,7 +14740,7 @@ function runRecordStatus(opts) {
 `);
     } else if (composition.openPairs.length > 0) {
       process.stdout.write(
-        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path39.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
+        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path41.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
 `
       );
     } else if (composition.confirmed > 0) {
@@ -14293,7 +14780,7 @@ function narrowedRoles(derived, override) {
 function rolesFromFile(opts, file, derived) {
   let json;
   try {
-    json = JSON.parse(readFileSync26(path39.resolve(file), "utf8"));
+    json = JSON.parse(readFileSync29(path41.resolve(file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read roles file ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -14331,11 +14818,11 @@ function rolesFromFile(opts, file, derived) {
   };
 }
 function runRecordFinish(opts) {
-  if (!existsSync31(path39.join(opts.setDir, "recording-set.json"))) {
+  if (!existsSync32(path41.join(opts.setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `no recording-set.json in ${opts.setDir}`,
       code: "no-recording-set",
-      remediation: `Run \`${tendrilCommand(`record plan --set ${path39.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
+      remediation: `Run \`${tendrilCommand(`record plan --set ${path41.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
     });
   }
   const { manifest, raw } = readManifestFile(opts.setDir);
@@ -14363,17 +14850,17 @@ function runRecordFinish(opts) {
     fail(opts, ExitCode.ConfirmationRequired, {
       error: "--confirm-roles (and --roles-file) require an interactive terminal \u2014 this confirmation is human-only",
       code: "roles-confirmation-not-interactive",
-      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path39.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
+      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path41.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
     });
   }
   const merged = { ...raw, roles };
-  const { issues } = validateRecordingSet(merged, (rel) => existsSync31(path39.join(opts.setDir, rel)));
+  const { issues } = validateRecordingSet(merged, (rel) => existsSync32(path41.join(opts.setDir, rel)));
   const errors = issues.filter((i) => i.severity === "error");
   if (errors.length > 0) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set rejected \u2014 roles NOT written: ${errors.map((e) => e.message).join("; ")}`,
       code: "recording-set-invalid",
-      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path39.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
+      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path41.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
     });
   }
   for (const issue of issues) if (issue.severity === "warning") warn(opts, issue.message);
@@ -14423,9 +14910,9 @@ var init_record = __esm({
 });
 
 // packages/cli/src/font-guidance.ts
-import path40 from "node:path";
+import path42 from "node:path";
 function fontsUnprovenRemediation(setDir) {
-  const set = setDir === void 0 ? void 0 : path40.resolve(setDir);
+  const set = setDir === void 0 ? void 0 : path42.resolve(setDir);
   if (set !== void 0) {
     try {
       const needs = recordedFontNeeds(set);
@@ -14500,8 +14987,8 @@ __export(fonts_exports, {
   runFontsResolveSet: () => runFontsResolveSet,
   runFontsStatus: () => runFontsStatus
 });
-import { existsSync as existsSync32, readFileSync as readFileSync27 } from "node:fs";
-import path41 from "node:path";
+import { existsSync as existsSync33, readFileSync as readFileSync30 } from "node:fs";
+import path43 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
   const queryRefusal = systemFaceRefusal(opts.family.trim());
@@ -14522,7 +15009,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path41.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path43.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -14573,7 +15060,10 @@ async function runFontsResolveSet(opts) {
     }
   }
   const refusals = [...new Set(failures.map((f) => f.family))].map((family) => ({ family, reason: systemFaceRefusal(family.trim()) })).filter((r) => r.reason !== void 0);
-  emitData(opts, { set: setDir, needs, cached: cached2, resolved, relicensed, unlicensed, failures, ...refusals.length > 0 ? { refusals } : {} }, () => {
+  const withAFace = new Set([...cached2, ...resolved, ...relicensed].map((f) => f.family.toLowerCase()));
+  const familyMisses = failures.filter((f) => !withAFace.has(f.family.toLowerCase()));
+  const weightMisses = failures.filter((f) => withAFace.has(f.family.toLowerCase()));
+  emitData(opts, { set: setDir, needs, cached: cached2, resolved, relicensed, unlicensed, failures, familyMisses, weightMisses, ...refusals.length > 0 ? { refusals } : {} }, () => {
     process.stdout.write(`set declares: ${needs.map((n) => `${n.family} (${n.weights.join(", ")})`).join(" \xB7 ")}
 `);
     for (const f of cached2) process.stdout.write(`cached   ${f.family} ${f.weight}
@@ -14599,22 +15089,31 @@ async function runFontsResolveSet(opts) {
   if (byteDrift.length > 0) {
     warn(opts, `${byteDrift.map((f) => `${f.family} ${f.weight}`).join(", ")}: the foundry now serves different bytes than the cache held \u2014 the faces were re-fetched to record their licence, so re-pin any font lock deliberately`);
   }
-  if (failures.length > 0) {
-    warn(opts, `${failures.length} face(s) unresolved \u2014 verification will refuse to score under substitution`);
+  if (weightMisses.length > 0) {
+    const byFamily = [...new Set(weightMisses.map((f) => f.family))].map(
+      (fam) => `"${fam}" ${weightMisses.filter((f) => f.family === fam).map((f) => f.weight).join(", ")}`
+    );
+    warn(
+      opts,
+      `weight instance(s) unavailable: ${byFamily.join("; ")} \u2014 the FAMILY is provisioned, so the mount renders these at the nearest cached weight. Verify reports that as an advisory and never gates on it, so this run is not a failure. If the exact instance matters, register a file you licence: ${tendrilCommand('fonts add "<Family>" <weight> <file>')}.`
+    );
+  }
+  if (familyMisses.length > 0) {
+    warn(opts, `${familyMisses.length} face(s) unresolved with NO cached face for the family \u2014 verification will refuse to certify under substitution`);
     process.exitCode = ExitCode.FontsUnproven;
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path41.join(opts.cacheDir, "manifest.json");
-  if (!existsSync32(manifestPath2)) {
+  const manifestPath2 = path43.join(opts.cacheDir, "manifest.json");
+  if (!existsSync33(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
       code: "fonts-unresolved",
       remediation: `Run \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` (or \`${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}\`) first.`
     });
   }
-  const faces = JSON.parse(readFileSync27(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path41.resolve(opts.lock), opts.cacheDir) : null;
+  const faces = JSON.parse(readFileSync30(manifestPath2, "utf8"));
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path43.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -14658,13 +15157,13 @@ function familyMismatch(family, declared) {
 }
 function runFontsAdd(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path41.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path43.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. Adding it under this name would cache a face the mount never matches, and scoring would keep refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path41.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path43.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
       });
     }
   } else {
@@ -14723,13 +15222,13 @@ cache them: ${tendrilCommand(`fonts add-system ${quoteArg(opts.family)}`)}
 }
 function runFontsAddSystem(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path41.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path43.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. A face cached under a name the mount never matches leaves scoring refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path41.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path43.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
       });
     }
   } else {
@@ -14779,12 +15278,12 @@ var init_fonts = __esm({
 });
 
 // packages/cli/src/profile-input.ts
-import { existsSync as existsSync33, readFileSync as readFileSync28 } from "node:fs";
-import path42 from "node:path";
+import { existsSync as existsSync34, readFileSync as readFileSync31 } from "node:fs";
+import path44 from "node:path";
 function loadCodebaseProfile(flags, profilePath) {
   if (profilePath === void 0) return null;
-  const abs = path42.resolve(profilePath);
-  if (!existsSync33(abs)) {
+  const abs = path44.resolve(profilePath);
+  if (!existsSync34(abs)) {
     fail(flags, ExitCode.InputValidation, {
       error: `no profile at ${abs}`,
       code: "profile_missing",
@@ -14792,7 +15291,7 @@ function loadCodebaseProfile(flags, profilePath) {
     });
   }
   try {
-    return readCodebaseProfile(readFileSync28(abs, "utf8"));
+    return readCodebaseProfile(readFileSync31(abs, "utf8"));
   } catch (error) {
     fail(flags, ExitCode.InputValidation, {
       error: `profile at ${abs} is not a valid codebase profile: ${error instanceof Error ? error.message : String(error)}`,
@@ -14834,8 +15333,8 @@ __export(verify_exports, {
   runVerify: () => runVerify,
   verdictCaveatsFor: () => verdictCaveatsFor
 });
-import { existsSync as existsSync34, readFileSync as readFileSync29 } from "node:fs";
-import path43 from "node:path";
+import { existsSync as existsSync35, readFileSync as readFileSync32, rmSync as rmSync5, writeFileSync as writeFileSync14 } from "node:fs";
+import path45 from "node:path";
 function interactionCoverage(behaviors) {
   const parity = behaviors.filter((b) => b.id.startsWith("parity:"));
   const content = behaviors.filter((b) => b.id.startsWith("content-prop-renders("));
@@ -14912,7 +15411,6 @@ function operabilityLine(state) {
   return void 0;
 }
 function foldConfigStatus(s, failDemotions, substitutedFamilies) {
-  const { exact: _exact, ...reported } = s;
   let status = tierOf(s, BARS2.cert);
   const certDemote = [];
   let absentInkDemoted = false;
@@ -14935,7 +15433,7 @@ function foldConfigStatus(s, failDemotions, substitutedFamilies) {
     status = "pass";
     certDemote.push(`substituted fonts: cache lacks ${substitutedFamilies.map((f) => `"${f}"`).join(", ")} \u2014 certification never measures a substitute face`);
   }
-  const base = certDemote.length > 0 ? { ...reported, status, demotedBy: certDemote } : { ...reported, status };
+  const base = certDemote.length > 0 ? { ...s, status, demotedBy: certDemote } : { ...s, status };
   return {
     row: failDemotions === void 0 ? base : { ...base, status: "fail", demotedBy: [...certDemote, ...failDemotions] },
     absentInkDemoted
@@ -15077,10 +15575,26 @@ function compositionReport(input) {
 function eyeCheck(bundleDir) {
   return {
     command: tendrilCommand(`inspect "${bundleDir}"`),
-    sheetPath: path43.join(bundleDir, "verify-evidence", "inspect.html"),
+    sheetPath: path45.join(bundleDir, "verify-evidence", "inspect.html"),
     note: "magnified recorded-vs-rendered crops of every small node; scores cannot see shape. The command WRITES/refreshes the sheet at sheetPath \u2014 re-run it after every verify; an existing sheet may show stale crops."
   };
 }
+function evidenceArtifacts(evidenceDir, reps) {
+  const named = (name) => existsSync35(path45.join(evidenceDir, name)) ? name : null;
+  return {
+    legend: named("diff-legend.txt"),
+    configs: reps.map((rep) => {
+      const absentInk = [];
+      for (let i = 0; ; i += 1) {
+        const ref = named(`${rep}-absent-${i}-ref.png`);
+        const render = named(`${rep}-absent-${i}-render.png`);
+        if (ref === null || render === null) break;
+        absentInk.push({ ref, render });
+      }
+      return { rep, render: named(`${rep}-render.png`), ref: named(`${rep}-ref.png`), diff: named(`${rep}-diff.png`), absentInk };
+    })
+  };
+}
 function failureTally(t) {
   return `${t.configs.length} config(s), ${t.behaviors.length} behavior(s), ${t.structural.length + t.crops.length} composition check(s), ${t.occlusion.length} occlusion check(s) below the ${t.bar} bar${t.evidenceUnverified ? "; PLUS the interaction-evidence instrument gate failed (operability could not be verified \u2014 see FAIL interaction-evidence above)" : ""} \u2014 bundle written, verdict honest (Q4)`;
 }
@@ -15114,7 +15628,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path43.resolve(t.set) === path43.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path45.resolve(t.set) === path45.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -15174,19 +15688,19 @@ function verdictCaveatsFor(input) {
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   let recordingSetDrift;
-  const setOverride = opts.set !== void 0 ? path43.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path43.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync34(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path45.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path45.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync35(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path43.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path45.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync34(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync29(manifestPath2, "utf8"));
+  if (existsSync35(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync32(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -15217,21 +15731,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path43.isAbsolute(p)) return p;
-      const fromRepo = path43.resolve(REPO_ROOT, p);
-      if (existsSync34(fromRepo)) return fromRepo;
-      return path43.resolve(callerCwd, p);
+      if (path45.isAbsolute(p)) return p;
+      const fromRepo = path45.resolve(REPO_ROOT, p);
+      if (existsSync35(fromRepo)) return fromRepo;
+      return path45.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync34(path43.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path43.resolve(t.set) === path43.resolve(setDir))) {
+    if (!existsSync35(path45.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path45.resolve(t.set) === path45.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path43.resolve(t.set) === path43.resolve(setDir));
-    if (registry !== void 0 && !existsSync34(path43.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path45.resolve(t.set) === path45.resolve(setDir));
+    if (registry !== void 0 && !existsSync35(path45.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -15263,9 +15777,9 @@ async function runVerify(opts) {
       recordingSetDrift = { stamped: manifest.provenance.recordingSet.hash, current: hash };
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path43.join(opts.bundleDir, name);
-      if (!existsSync34(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync29(p)));
+      const p = path45.join(opts.bundleDir, name);
+      if (!existsSync35(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync32(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -15303,7 +15817,7 @@ async function runVerify(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync34(path43.join(task.set, c.rep, "get_screenshot.json")) || !existsSync34(path43.join(task.set, c.rep, "get_metadata.json"))
+    (c) => !existsSync35(path45.join(task.set, c.rep, "get_screenshot.json")) || !existsSync35(path45.join(task.set, c.rep, "get_metadata.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -15313,7 +15827,8 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path43.join(opts.bundleDir, "verify-evidence");
+  const evidenceDir = path45.join(opts.bundleDir, "verify-evidence");
+  rmSync5(evidenceDir, { recursive: true, force: true });
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(
     opts.bundleDir,
@@ -15330,7 +15845,7 @@ async function runVerify(opts) {
     // ASKED, never "follows every convention".
     loadCodebaseProfile(opts, opts.profile) ?? void 0
   );
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path43.join(opts.bundleDir, f)).filter((f) => existsSync34(f)).map((f) => readFileSync29(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path45.join(opts.bundleDir, f)).filter((f) => existsSync35(f)).map((f) => readFileSync32(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss, { ...authorityConfigs !== void 0 ? { authority: authorityConfigs } : {} });
   const parity = await checkHoverParity(task, opts.bundleDir, authorityConfigs ?? task.configs);
   const framing = checkAdapterFraming(
@@ -15346,10 +15861,10 @@ async function runVerify(opts) {
     warn(opts, `compositions extension REJECTED (${crossComposition.malformed}) \u2014 the cross-bundle backstop did NOT run over it; repair the manifest entry and re-verify. This is an instrument failure, not a clean bill.`);
   }
   const verifyCallerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path43.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
+  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path45.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
   const staticComposedChecks = composedChecks(opts.bundleDir, task.entry, verifyPins.pins);
   const renderExpectations = verifyPins.pins.map((pin) => ({
-    modulePath: path43.join(composedModuleDir(pin.partnerName), pin.entryComponent),
+    modulePath: path45.join(composedModuleDir(pin.partnerName), pin.entryComponent),
     component: pin.entryComponent,
     stampName: `${pin.pairKey}:${pin.entryComponent}`,
     hostReps: [...new Set(pin.instances.map((i) => i.hostRep))],
@@ -15407,8 +15922,10 @@ async function runVerify(opts) {
     }
   })();
   const compositionBlock = compositionReport({ availability, structural, crops, regions: regionsOut, composedPairs: composedPairs.size });
+  const scoredFiles = digestScoredFiles(opts.bundleDir, manifest !== void 0 ? manifest.entry : task.entry);
   const report = {
     bundle: opts.bundleDir,
+    scoredFiles,
     ...opts.task !== void 0 ? { task: opts.task } : {},
     ...manifest !== void 0 ? { bundleManifest: { name: manifest.name, bundleVersion: manifest.bundleVersion, recordingSetHash: manifest.provenance.recordingSet.hash } } : {},
     targetBar: opts.bar,
@@ -15473,7 +15990,7 @@ async function runVerify(opts) {
     } : {},
     configs: statuses,
     behaviors,
-    evidence: { dir: evidenceDir, files: "per config: <rep>-render.png, <rep>-ref.png, <rep>-diff.png" },
+    evidence: { dir: evidenceDir, ...evidenceArtifacts(evidenceDir, statuses.map((s) => s.rep)) },
     composition: compositionBlock,
     verdict: ok ? "verified" : "verification-failed",
     // Run-23 R5: the one-word verdict printed beside "coverage
@@ -15634,7 +16151,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
-    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path43.join(opts.bundleDir, f)).filter((f) => existsSync34(f)).map((f) => readFileSync29(f, "utf8")).join("\n")));
+    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path45.join(opts.bundleDir, f)).filter((f) => existsSync35(f)).map((f) => readFileSync32(f, "utf8")).join("\n")));
     if (shippedFonts.length > 0 && substitutedFamilies.length === 0) {
       process.stdout.write(`fonts: scored with Tendril-cache faces \u2014 a consuming app must provision the same families (the bundle ships fonts.css when faces are shippable; sha-pinned list in component.json requiredFonts)
 `);
@@ -15686,8 +16203,27 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     );
     process.exitCode = ExitCode.VerificationFailed;
   }
+  persistReport(opts, report, evidenceDir);
 }
-var BARS2, NO_INTERACTIVE_POSES, NO_ROLE_MANIFEST, ROLES_NOT_RESOLVED, UNSTAMPED_ROLES, COMPOSE_ON_GENERATE_ARMED, NO_OVERLAY_DECLARED;
+function persistReport(opts, report, evidenceDir) {
+  if (!existsSync35(evidenceDir)) return;
+  const rulerExit = process.exitCode === void 0 ? 0 : Number(process.exitCode);
+  const withExit = {
+    ...report,
+    rulerExit,
+    ...rulerExit !== 0 ? { rulerRefusal: EXIT_REFUSALS[rulerExit] ?? `ruler exited ${rulerExit}` } : {}
+  };
+  try {
+    writeFileSync14(
+      path45.join(evidenceDir, VERIFY_REPORT_FILENAME),
+      `${JSON.stringify(verifyReportForTransport(withExit, path45.basename(opts.bundleDir)), null, 2)}
+`
+    );
+  } catch (e) {
+    warn(opts, `could not write ${VERIFY_REPORT_FILENAME} (${e instanceof Error ? e.message : String(e)}) \u2014 the verdict above stands, but this run left no persisted report beside its evidence.`);
+  }
+}
+var BARS2, NO_INTERACTIVE_POSES, NO_ROLE_MANIFEST, ROLES_NOT_RESOLVED, UNSTAMPED_ROLES, COMPOSE_ON_GENERATE_ARMED, NO_OVERLAY_DECLARED, EXIT_REFUSALS;
 var init_verify = __esm({
   "packages/cli/src/commands/verify.ts"() {
     "use strict";
@@ -15717,6 +16253,10 @@ var init_verify = __esm({
     UNSTAMPED_ROLES = "unstamped";
     COMPOSE_ON_GENERATE_ARMED = false;
     NO_OVERLAY_DECLARED = "no overlay declared";
+    EXIT_REFUSALS = {
+      [ExitCode.VerificationFailed]: "the ruler refused this run: one or more checks fell below the requested bar",
+      [ExitCode.FontsUnproven]: "the ruler refused this run: required font faces were not provisioned, so scores measure a substitute"
+    };
   }
 });
 
@@ -15726,11 +16266,11 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { appendFileSync, existsSync as existsSync35, mkdirSync as mkdirSync9, readFileSync as readFileSync30, writeFileSync as writeFileSync13 } from "node:fs";
-import path44 from "node:path";
+import { appendFileSync, existsSync as existsSync36, mkdirSync as mkdirSync10, readFileSync as readFileSync33, writeFileSync as writeFileSync15 } from "node:fs";
+import path46 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path44.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync35(path44.join(asPath, "recording-set.json"));
+  const asPath = path46.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync36(path46.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
@@ -15739,7 +16279,7 @@ function resolveEngineTask(opts, callerCwd) {
       for (const d of authored.disclosures) warn(opts, d);
       return {
         task: authored.task,
-        name: path44.basename(asPath),
+        name: path46.basename(asPath),
         ref: asPath,
         disclosures: authored.disclosures,
         interactionEvidence: authored.api.interactionEvidence,
@@ -15767,13 +16307,13 @@ function runEngineBrief(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   const { task, name, ref, disclosures } = resolveEngineTask(opts, callerCwd);
   const bar = BARS3[opts.bar];
-  if (existsSync35(path44.join(task.set, "recording-set.json"))) {
+  if (existsSync36(path46.join(task.set, "recording-set.json"))) {
     try {
-      const { open } = compositionPairsFor(path44.resolve(task.set), [opts.library !== void 0 ? path44.resolve(callerCwd, opts.library) : callerCwd]);
+      const { open } = compositionPairsFor(path46.resolve(task.set), [opts.library !== void 0 ? path46.resolve(callerCwd, opts.library) : callerCwd]);
       if (open.length > 0) {
         const componentNames = [...new Set(open.map((p) => p.displayName))];
         disclosures.push(
-          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path44.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
+          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path46.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
         );
       }
     } catch (err) {
@@ -15790,9 +16330,9 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" }) + disclosureBlock + motionBriefSection(task.set) + conventions;
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path44.join(task.set, "recording-set.json");
-  if (existsSync35(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync30(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path46.join(task.set, "recording-set.json");
+  if (existsSync36(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync33(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -15800,7 +16340,7 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync35(manifestPath2)) {
+  if (existsSync36(manifestPath2)) {
     const missingFams = unprovisionedFamilies(task.set);
     const unprovided = unprovisionedFaces(task.set);
     const weightOnly = missingFams.length === 0;
@@ -15822,7 +16362,7 @@ ${notRecorded}` : "";
       };
     }
   }
-  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path44.resolve(callerCwd, opts.library) : callerCwd]);
+  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path46.resolve(callerCwd, opts.library) : callerCwd]);
   const jsxProp = ([k, v]) => typeof v === "string" ? `${k}=${JSON.stringify(v)}` : `${k}={${JSON.stringify(v)}}`;
   const composedBlock = pinsResult.pins.length === 0 && pinsResult.issues.length === 0 ? "" : (pinsResult.pins.length > 0 ? `
 
@@ -15858,10 +16398,10 @@ ${pinsResult.issues.map((i) => `- ${i}`).join("\n")}` : "");
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path44.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  const candidateDirSuggestion = path44.resolve(callerCwd, `tendril-out/${name}-candidate`);
-  mkdirSync9(path44.dirname(payloadFile), { recursive: true });
-  writeFileSync13(payloadFile, payload);
+  const payloadFile = path46.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  const candidateDirSuggestion = path46.resolve(callerCwd, `tendril-out/${name}-candidate`);
+  mkdirSync10(path46.dirname(payloadFile), { recursive: true });
+  writeFileSync15(payloadFile, payload);
   emitData(
     opts,
     {
@@ -15907,7 +16447,7 @@ ${segments}`;
         // command must search the same bundle roots the pins came
         // from, or the oracle and the brief describe different worlds.
         `Run \`${tendrilCommand(
-          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path44.resolve(callerCwd, opts.library))}` : ""} --json`
+          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path46.resolve(callerCwd, opts.library))}` : ""} --json`
         )}\` \u2014 the CLI is the sole judge, and it refuses to score an undeclared model. If you wrote the bundle elsewhere, pass that directory instead.`,
         "Apply the returned feedback and re-score. Stop when all checks pass. Two consecutive non-improving scores mean INSPECT the verify-evidence diffs before deciding \u2014 stop only when inspection yields no fix hypothesis (a measured run was byte-identical twice, then went 27/27 after reading the diffs).",
         "Never edit recording sets; never claim scores yourself \u2014 only the score command's output counts."
@@ -15922,8 +16462,8 @@ ${segments}`;
   );
 }
 function appendScoreHistory(candidateDir, entry) {
-  const file = path44.join(candidateDir, "score-history.jsonl");
-  const starts = existsSync35(file) ? readFileSync30(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
+  const file = path46.join(candidateDir, "score-history.jsonl");
+  const starts = existsSync36(file) ? readFileSync33(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
   const round = entry.event === "round-start" ? starts + 1 : Math.max(1, starts);
   appendFileSync(file, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), round, ...entry })}
 `);
@@ -15931,9 +16471,9 @@ function appendScoreHistory(candidateDir, entry) {
 async function runEngineScore(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path44.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path46.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin, interactionEvidence, unmappedInteractionEvidence: interactionEvidenceUnmapped, satisfiabilityDemoted, expertContract } = resolveEngineTask(opts, callerCwd);
-  if (!existsSync35(candidateDir)) {
+  if (!existsSync36(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -15958,10 +16498,10 @@ async function runEngineScore(opts) {
   for (const g of missingWeights(task.set)) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
-  if (opts.rebind !== true && existsSync35(path44.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync36(path46.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync30(path44.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync33(path46.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -15983,12 +16523,12 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path44.join(candidateDir, "verify-evidence");
+  const evidenceDir = path46.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
   const parity = await checkHoverParity(task, candidateDir, task.configs);
   const occlusionRows = await checkSiblingOcclusion(task, candidateDir, candidateCss(candidateDir), { authority: task.configs });
   const occlusionFailures = occlusionRows.filter((o) => !o.pass);
-  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path44.resolve(callerCwd, opts.library) : callerCwd]);
+  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path46.resolve(callerCwd, opts.library) : callerCwd]);
   const composition = composedChecks(candidateDir, task.entry, scorePins.pins);
   const behaviors = [...await checkBehaviors(task, candidateDir), ...parity, ...composition];
   const parityCoverage = parity.length > 0 ? `${parity.filter((p) => p.pass).length}/${parity.length} hover-forced configs` : "not applicable (no hover-forced configs in this set)";
@@ -16206,11 +16746,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync36, readFileSync as readFileSync31, writeFileSync as writeFileSync14 } from "node:fs";
-import path45 from "node:path";
+import { existsSync as existsSync37, readFileSync as readFileSync34, writeFileSync as writeFileSync16 } from "node:fs";
+import path47 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path45.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path47.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -16226,7 +16766,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync31(path45.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync34(path47.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -16236,8 +16776,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path45.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync36(path45.join(setDir, "recording-set.json"))) {
+  const setDir = path47.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync37(path47.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -16258,10 +16798,10 @@ function runCodeConnect(opts) {
   const component = api.component;
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
-    const meta = path45.join(setDir, r.slug, "get_metadata.json");
-    if (!existsSync36(meta)) return void 0;
+    const meta = path47.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync37(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync31(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync34(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -16326,7 +16866,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path45.relative(callerCwd, path45.join(bundleDir, manifest.entry));
+  const entryRel = path47.relative(callerCwd, path47.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -16350,8 +16890,8 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path45.resolve(callerCwd, opts.out ?? path45.join(bundleDir, `${component}.figma.ts`));
-  writeFileSync14(outFile, lines);
+  const outFile = path47.resolve(callerCwd, opts.out ?? path47.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync16(outFile, lines);
   emitData(
     opts,
     {
@@ -16389,18 +16929,18 @@ var init_codeconnect = __esm({
 });
 
 // packages/mcp/src/server.ts
-import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync37, mkdtempSync as mkdtempSync3, readFileSync as readFileSync32, readdirSync as readdirSync14, writeFileSync as writeFileSync15 } from "node:fs";
-import os7 from "node:os";
-import path46 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+import { existsSync as existsSync38, mkdtempSync as mkdtempSync3, readFileSync as readFileSync35, readdirSync as readdirSync15, writeFileSync as writeFileSync17 } from "node:fs";
+import os8 from "node:os";
+import path48 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { z as z14 } from "zod";
 function sourceHash() {
-  const dir = path46.dirname(fileURLToPath6(import.meta.url));
-  const h = createHash8("sha256");
-  for (const f of readdirSync14(dir).filter((n) => n.endsWith(".ts")).sort()) {
+  const dir = path48.dirname(fileURLToPath6(import.meta.url));
+  const h = createHash9("sha256");
+  for (const f of readdirSync15(dir).filter((n) => n.endsWith(".ts")).sort()) {
     h.update(f);
-    h.update(readFileSync32(path46.join(dir, f)));
+    h.update(readFileSync35(path48.join(dir, f)));
   }
   return h.digest("hex").slice(0, 16);
 }
@@ -16408,10 +16948,10 @@ var REPO_ROOT3, CLI_BIN, BUNDLED_CLI, CLI_SPAWN, str, optStr, TOOLS, BOOT_HASH;
 var init_server = __esm({
   "packages/mcp/src/server.ts"() {
     "use strict";
-    REPO_ROOT3 = path46.resolve(path46.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
-    CLI_BIN = path46.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
-    BUNDLED_CLI = path46.join(path46.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
-    CLI_SPAWN = existsSync37(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
+    REPO_ROOT3 = path48.resolve(path48.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
+    CLI_BIN = path48.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
+    BUNDLED_CLI = path48.join(path48.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
+    CLI_SPAWN = existsSync38(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
     str = (d) => z14.string().describe(d);
     optStr = (d) => z14.string().optional().describe(d);
     TOOLS = [
@@ -16442,13 +16982,13 @@ var init_server = __esm({
           const single = i["metadata"];
           const parts = i["metadataParts"];
           if (single !== void 0 || parts !== void 0) {
-            const tmp = path46.join(mkdtempSync3(path46.join(os7.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path48.join(mkdtempSync3(path48.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync15(tmp, single);
+              writeFileSync17(tmp, single);
               argvOut.push("--metadata-raw-file", tmp);
             } else {
               if (parts.length === 0) throw new Error("`metadataParts` must be a non-empty array of block texts");
-              writeFileSync15(tmp, JSON.stringify(parts));
+              writeFileSync17(tmp, JSON.stringify(parts));
               argvOut.push("--metadata-raw-parts-file", tmp);
             }
           }
@@ -16480,16 +17020,30 @@ var init_server = __esm({
       {
         name: "tendril_doctor",
         annotations: { readOnlyHint: true },
-        description: "Machine readiness + version status in one shot: installed vs latest version (with publish date and update remediation), browser identity, font-cache state, Figma desktop MCP reachability. Use to self-diagnose before recording/scoring, or whenever versions are in question. Exit 1 = something not ready; the report says exactly what and how to fix it.",
+        description: "Machine readiness + version status in one shot: installed vs latest version (with publish date and update remediation), browser identity, font-cache state, Figma desktop MCP reachability, and whether this machine holds a LIVE portal session (checked against the portal itself; informational \u2014 publishing needs it, verification never does; when absent, offer tendril_login). Use to self-diagnose before recording/scoring, or whenever versions are in question. Exit 1 = something not ready; the report says exactly what and how to fix it.",
         schema: z14.object({}),
         argv: () => ["doctor"]
       },
       {
-        name: "tendril_record_next",
-        annotations: { readOnlyHint: true },
-        description: "Get the next pending recording instruction (which Figma MCP tool to call for which node, and how to save it). RARELY NEEDED: every ingest/fetch response already carries `next` \u2014 use this only to resume an interrupted session. The full queue is known from plan, so independent reps may be recorded in any order (and in parallel).",
-        schema: z14.object({ setDir: str("recording set directory") }),
-        argv: (i) => ["record", "next", "--set", i["setDir"]]
+        name: "tendril_login",
+        description: "Connect this machine to the user's Tendril portal account WITHOUT the user touching a terminal \u2014 phase one of the browser-approve sign-in. Starts the handshake, opens their browser to the approve page, and returns a verification link plus a short code. RELAY BOTH to the user verbatim: they click Approve on the page, and they must check the page shows EXACTLY this code (that check is the phishing defence \u2014 an attacker can send someone else's approve link). Then call tendril_login_wait to finish. Offer this whenever tendril_doctor reports no portal session and the user wants to publish or share; publishing needs it, verification never does.",
+        schema: z14.object({
+          portal: optStr("portal origin override for self-hosted portals (defaults to https://app.trytendril.com)")
+        }),
+        argv: (i) => ["login", "--device-start", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
+      },
+      {
+        name: "tendril_login_wait",
+        description: "Phase two of the browser-approve sign-in: waits (up to ten minutes, with live progress) for the user to click Approve on the page tendril_login opened, then stores the session on this machine. Call it right after relaying the link and code. A denial, a lapse, and success each come back as their own sentence; confirm the result to the user, and on success they are ready to publish.",
+        schema: z14.object({}),
+        argv: () => ["login", "--device-wait"]
+      },
+      {
+        name: "tendril_record_next",
+        annotations: { readOnlyHint: true },
+        description: "Get the next pending recording instruction (which Figma MCP tool to call for which node, and how to save it). RARELY NEEDED: every ingest/fetch response already carries `next` \u2014 use this only to resume an interrupted session. The full queue is known from plan, so independent reps may be recorded in any order (and in parallel).",
+        schema: z14.object({ setDir: str("recording set directory") }),
+        argv: (i) => ["record", "next", "--set", i["setDir"]]
       },
       {
         name: "tendril_record_fetch",
@@ -16525,14 +17079,14 @@ var init_server = __esm({
           const bridge = (label, single, parts) => {
             if (single !== void 0 && parts !== void 0) throw new Error(`pass at most one of \`${label}\` and \`${label}Parts\``);
             if (single === void 0 && parts === void 0) return;
-            const tmp = path46.join(mkdtempSync3(path46.join(os7.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path48.join(mkdtempSync3(path48.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync15(tmp, single);
+              writeFileSync17(tmp, single);
               argvOut.push(`--${label}-file`, tmp);
             } else {
               const blocks = parts;
               if (blocks.length === 0) throw new Error(`\`${label}Parts\` must be a non-empty array of block texts`);
-              writeFileSync15(tmp, JSON.stringify(blocks));
+              writeFileSync17(tmp, JSON.stringify(blocks));
               argvOut.push(`--${label}-parts-file`, tmp);
             }
           };
@@ -16573,12 +17127,12 @@ var init_server = __esm({
           const file = i["file"];
           if ([text, texts, file].filter((x) => x !== void 0).length !== 1) throw new Error("pass exactly one of `text` (single-block response), `texts` (multi-block response), or `file` (a saved envelope)");
           if (file !== void 0) return [...base, "--file", file];
-          const tmp = path46.join(mkdtempSync3(path46.join(os7.tmpdir(), "tendril-envelope-")), "response.txt");
+          const tmp = path48.join(mkdtempSync3(path48.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
           if (text !== void 0) {
-            writeFileSync15(tmp, text);
+            writeFileSync17(tmp, text);
             return [...base, "--file", tmp, "--raw"];
           }
-          writeFileSync15(tmp, JSON.stringify(texts));
+          writeFileSync17(tmp, JSON.stringify(texts));
           return [...base, "--file", tmp, "--raw-parts"];
         }
       },
@@ -16735,13 +17289,13 @@ __export(permissions_exports, {
   runPermissions: () => runPermissions,
   writeSelection: () => writeSelection
 });
-import { existsSync as existsSync38, mkdirSync as mkdirSync10, readFileSync as readFileSync33, writeFileSync as writeFileSync16 } from "node:fs";
-import os8 from "node:os";
-import path47 from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync11, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "node:fs";
+import os9 from "node:os";
+import path49 from "node:path";
 function mergeAllowlist(file, entries, denyEntries = []) {
   let settings = {};
-  if (existsSync38(file) && readFileSync33(file, "utf8").trim() !== "") {
-    settings = JSON.parse(readFileSync33(file, "utf8"));
+  if (existsSync39(file) && readFileSync36(file, "utf8").trim() !== "") {
+    settings = JSON.parse(readFileSync36(file, "utf8"));
     if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw new Error("settings root is not an object");
   }
   const permissions = settings["permissions"] ??= {};
@@ -16761,8 +17315,8 @@ function mergeAllowlist(file, entries, denyEntries = []) {
   }
   if (added.length > 0 || denyAdded.length > 0) {
     allow.push(...added);
-    mkdirSync10(path47.dirname(file), { recursive: true });
-    writeFileSync16(file, `${JSON.stringify(settings, null, 2)}
+    mkdirSync11(path49.dirname(file), { recursive: true });
+    writeFileSync18(file, `${JSON.stringify(settings, null, 2)}
 `);
   }
   return { added, alreadyPresent, denyAdded };
@@ -16826,7 +17380,7 @@ async function runPermissions(flags) {
   }
   if (flags.write) {
     const base = process.env["INIT_CWD"] ?? process.cwd();
-    const file = flags.user ? path47.join(os8.homedir(), ".claude", "settings.json") : path47.join(base, ".claude", "settings.local.json");
+    const file = flags.user ? path49.join(os9.homedir(), ".claude", "settings.json") : path49.join(base, ".claude", "settings.local.json");
     const { entries, denyEntries } = writeSelection(result, flags.user === true);
     if (flags.dryRun) {
       emitData(flags, { file, wouldAdd: entries, wouldDeny: denyEntries }, () => {
@@ -16975,24 +17529,51 @@ __export(inspect_exports, {
   INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
   runInspect: () => runInspect
 });
-import { existsSync as existsSync39, readFileSync as readFileSync34, writeFileSync as writeFileSync17 } from "node:fs";
-import path48 from "node:path";
+import { existsSync as existsSync40, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
+import path50 from "node:path";
+function readVerifyReport(evidenceDir) {
+  const p = path50.join(evidenceDir, VERIFY_REPORT_FILENAME);
+  if (!existsSync40(p)) return void 0;
+  try {
+    return JSON.parse(readFileSync37(p, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function verdictBlock(report) {
+  if (report === void 0) {
+    return `<div class="verdict none"><h2>No verdict on file</h2><p>This evidence carries no <code>${VERIFY_REPORT_FILENAME}</code>, so these images are unlabelled pixels \u2014 nothing here says what passed. Re-run <code>tendril verify</code> to write one.</p></div>`;
+  }
+  const buckets = /* @__PURE__ */ new Map();
+  for (const c of report.configs) buckets.set(c.status, (buckets.get(c.status) ?? 0) + 1);
+  const split = [...buckets.entries()].map(([k, n]) => `<span class="tier t-${esc(k)}">${n} ${esc(k)}</span>`).join("");
+  const failed = report.behaviors.filter((b) => !b.pass);
+  return `<div class="verdict ${report.verdict === "verified" ? "ok" : "bad"}"><h2>${esc(report.verdict)} <small>at bar \u201C${esc(report.targetBar)}\u201D</small></h2><p class="tiers">${split}<span class="tier">${report.behaviors.length - failed.length}/${report.behaviors.length} behaviors</span></p>` + (failed.length > 0 ? `<ul class="fails">${failed.map((b) => `<li><code>${esc(b.id)}</code>${b.detail !== void 0 ? ` \u2014 ${esc(b.detail)}` : ""}</li>`).join("")}</ul>` : "") + (report.verdictCaveats.length > 0 ? `<h3>What was never asked</h3><ul class="caveats">${report.verdictCaveats.map((c) => `<li>${esc(c)}</li>`).join("")}</ul>` : `<p class="caveats">No caveats: every question this bar asks was answered.</p>`) + `</div>`;
+}
+function scoreLine(report, rep) {
+  const c = report?.configs.find((x) => x.rep === rep);
+  if (c === void 0) return "";
+  const ex = c.exact !== void 0 ? ` <span class="exact">measured ${c.exact.similarity.toFixed(6)} / ${c.exact.inkRecall.toFixed(6)}</span>` : "";
+  const why = Array.isArray(c.demotedBy) && c.demotedBy.length > 0 ? `<span class="demoted">demoted: ${esc(c.demotedBy.join("; "))}</span>` : "";
+  const err = typeof c.error === "string" ? `<span class="demoted">${esc(c.error)}</span>` : "";
+  return `<p class="scores"><span class="tier t-${esc(c.status)}">${esc(c.status)}</span> sim ${c.similarity} \xB7 ink ${c.inkRecall}${ex} ${why} ${err}</p>`;
+}
 async function runInspect(opts) {
   if (opts.describe) {
     printDescription(INSPECT_DESCRIPTION);
     return;
   }
-  const bundleDir = path48.resolve(opts.bundleDir);
-  const evidenceDir = path48.join(bundleDir, "verify-evidence");
-  const manifestPath2 = path48.join(bundleDir, "component.json");
-  if (!existsSync39(evidenceDir) || !existsSync39(manifestPath2)) {
+  const bundleDir = path50.resolve(opts.bundleDir);
+  const evidenceDir = path50.join(bundleDir, "verify-evidence");
+  const manifestPath2 = path50.join(bundleDir, "component.json");
+  if (!existsSync40(evidenceDir) || !existsSync40(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
-      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync39(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
+      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync40(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
       code: "no-evidence",
       remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync34(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync37(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -17000,8 +17581,9 @@ async function runInspect(opts) {
       remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
     });
   }
-  const setDir = path48.resolve(opts.set ?? manifest.provenance.recordingSet.path);
-  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync39(path48.join(evidenceDir, `${rep}-ref.png`)) && existsSync39(path48.join(evidenceDir, `${rep}-render.png`)));
+  const setDir = path50.resolve(opts.set ?? manifest.provenance.recordingSet.path);
+  const report = readVerifyReport(evidenceDir);
+  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync40(path50.join(evidenceDir, `${rep}-ref.png`)) && existsSync40(path50.join(evidenceDir, `${rep}-render.png`)));
   if (reps.length === 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "verify-evidence holds no ref/render pairs for this bundle's configs",
@@ -17012,15 +17594,15 @@ async function runInspect(opts) {
   let crops = 0;
   const sections = [];
   for (const rep of reps) {
-    const ref = new Uint8Array(readFileSync34(path48.join(evidenceDir, `${rep}-ref.png`)));
-    const render = new Uint8Array(readFileSync34(path48.join(evidenceDir, `${rep}-render.png`)));
+    const ref = new Uint8Array(readFileSync37(path50.join(evidenceDir, `${rep}-ref.png`)));
+    const render = new Uint8Array(readFileSync37(path50.join(evidenceDir, `${rep}-render.png`)));
     const nodes = smallSemanticNodes(setDir, rep, opts.maxArea ?? 1024).slice(0, 12);
     const cells = [];
     for (const [i, n] of nodes.entries()) {
       const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
       try {
-        writeFileSync17(path48.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
-        writeFileSync17(path48.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
+        writeFileSync19(path50.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
+        writeFileSync19(path50.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
       } catch {
         continue;
       }
@@ -17030,11 +17612,15 @@ async function runInspect(opts) {
       );
     }
     sections.push(
-      `<section><h2>${esc(rep)}</h2><div class="full"><span><em>recorded</em><img src="./${rep}-ref.png"></span><span><em>rendered</em><img src="./${rep}-render.png"></span><span><em>diff</em><img src="./${rep}-diff.png"></span></div>` + (cells.length > 0 ? `<div class="grid">${cells.join("")}</div>` : `<p class="none">no small recorded nodes in this config's sweep</p>`) + `</section>`
+      `<section><h2>${esc(rep)}</h2>` + scoreLine(report, rep) + `<div class="full"><span><em>recorded</em><img src="./${rep}-ref.png"></span><span><em>rendered</em><img src="./${rep}-render.png"></span><span><em>diff</em><img src="./${rep}-diff.png"></span></div>` + (cells.length > 0 ? `<div class="grid">${cells.join("")}</div>` : `<p class="none">no small recorded nodes in this config's sweep</p>`) + `</section>`
     );
   }
-  const sheet = path48.join(evidenceDir, "inspect.html");
-  writeFileSync17(
+  for (const c of report?.configs ?? []) {
+    if (reps.includes(c.rep)) continue;
+    sections.push(`<section class="missing"><h2>${esc(c.rep)}</h2>${scoreLine(report, c.rep)}<p class="none">No evidence images for this config \u2014 it was scored, but nothing was captured to look at.</p></section>`);
+  }
+  const sheet = path50.join(evidenceDir, "inspect.html");
+  writeFileSync19(
     sheet,
     `<!doctype html><meta charset="utf-8"><title>${esc(manifest.name)} \u2014 tendril inspect</title><style>
 body{font:14px/1.45 system-ui,sans-serif;margin:24px;background:#fff;color:#111}
@@ -17043,11 +17629,23 @@ h1{font-size:20px} h2{font-size:16px;border-top:1px solid #ddd;padding-top:16px}
 .full img{max-width:400px;border:1px solid #ccc} .pair img{border:1px solid #ccc;image-rendering:pixelated}
 figure{margin:0 0 16px} figcaption{margin-bottom:4px} em{display:block;color:#666;font-style:normal;font-size:12px}
 .grid{display:flex;flex-wrap:wrap;gap:20px;margin-top:12px} .none{color:#666}
-</style><h1>${esc(manifest.name)} \u2014 detail sheet (small recorded nodes, recorded vs rendered)</h1>
-<p>Every crop is a recorded node small enough that global metrics weight it as a rounding error.
+.verdict{border:1px solid #ddd;border-left-width:5px;padding:12px 16px;margin:16px 0;background:#fafafa}
+.verdict.ok{border-left-color:#1a7f37} .verdict.bad{border-left-color:#b35900} .verdict.none{border-left-color:#999}
+.verdict h2{border:0;padding:0;margin:0 0 8px} .verdict h3{font-size:13px;margin:12px 0 4px;color:#444}
+.verdict small{font-weight:400;color:#666}
+.tiers{margin:0;display:flex;gap:8px;flex-wrap:wrap}
+.tier{display:inline-block;padding:1px 8px;border:1px solid #ccc;border-radius:10px;font-size:12px;background:#fff}
+.t-certified{border-color:#1a7f37;color:#1a7f37} .t-pass{border-color:#8a6d00;color:#8a6d00} .t-fail{border-color:#b3261e;color:#b3261e}
+.caveats,.fails{margin:4px 0 0;padding-left:20px;color:#444} .caveats li,.fails li{margin:2px 0}
+.scores{margin:4px 0 10px;color:#333} .exact{color:#666;font-size:12px} .demoted{color:#b3261e;font-size:12px;margin-left:8px}
+.missing{opacity:.85} .legend{white-space:pre-wrap;font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;background:#fafafa;border:1px solid #ddd;padding:12px;overflow-x:auto}
+</style><h1>${esc(manifest.name)} \u2014 verdict and evidence</h1>
+${verdictBlock(report)}
+<p>Below, every crop is a recorded node small enough that global metrics weight it as a rounding error.
 Scan the pairs: anything present on the left and missing/invisible on the right is a defect,
 whatever the scores said. Verdicts come from <code>tendril verify</code> \u2014 this sheet only shows.</p>
 ${sections.join("\n")}
+<section><h2>Diff colours</h2><div class="legend">${esc(DIFF_LEGEND_TEXT)}</div></section>
 `
   );
   emitData(opts, { sheet, configs: reps.length, crops }, () => {
@@ -17087,6 +17685,694 @@ var init_inspect = __esm({
   }
 });
 
+// packages/cli/src/commands/login.ts
+var login_exports = {};
+__export(login_exports, {
+  DEFAULT_PORTAL_ORIGIN: () => DEFAULT_PORTAL_ORIGIN,
+  runLogin: () => runLogin,
+  runLogout: () => runLogout
+});
+import { spawn } from "node:child_process";
+import { existsSync as existsSync41, mkdirSync as mkdirSync12, readFileSync as readFileSync38, rmSync as rmSync6, writeFileSync as writeFileSync20 } from "node:fs";
+import path51 from "node:path";
+import { isCancel as isCancel3, password as password2 } from "@clack/prompts";
+async function runLogin(opts, deps) {
+  const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? DEFAULT_PORTAL_ORIGIN).replace(/\/+$/, "");
+  if (!isSecureOrigin(origin)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `${origin} is not https, so a session token sent there would travel in the clear`,
+      code: "portal-not-https",
+      remediation: "Use the https:// address of your portal. Only 127.0.0.1 and localhost are exempt, for local development."
+    });
+  }
+  if (opts.deviceStart === true) {
+    await deviceStartPhase(opts, origin, deps ?? realDeps());
+    return;
+  }
+  if (opts.deviceWait === true) {
+    await deviceWaitPhase(opts, deps ?? realDeps());
+    return;
+  }
+  if (process.stdin.isTTY === true && opts.paste !== true) {
+    await deviceLogin(opts, origin, deps ?? realDeps());
+    return;
+  }
+  await pasteLogin(opts, origin);
+}
+async function deviceLogin(opts, origin, deps) {
+  const started = await startHandshake(opts, origin, deps);
+  process.stderr.write(`
+  Open this link to approve the sign-in:
+
+    ${started.verificationUrl}
+
+`);
+  process.stderr.write(`  The page must show this code: ${started.userCode}
+`);
+  process.stderr.write(`  Approve it only if this terminal is yours.
+
+`);
+  deps.openBrowser(started.verificationUrl);
+  process.stderr.write(`  Waiting for the browser (about ten minutes before this code lapses) `);
+  const outcome = await waitForDecision(opts, origin, deps, started, () => process.stderr.write("."));
+  process.stderr.write("\n");
+  settleDecision(opts, origin, outcome);
+}
+async function waitForDecision(opts, origin, deps, started, onTick) {
+  const interval = Math.max(1, started.intervalSeconds);
+  const attempts = Math.ceil(660 / interval);
+  for (let n = 0; n < attempts; n += 1) {
+    await deps.sleep(interval);
+    const state = await pollHandshake(opts, origin, deps, started.deviceCode);
+    if (state.status === "pending") {
+      onTick();
+      continue;
+    }
+    if (state.status === "approved") return state;
+    return { status: state.status };
+  }
+  return { status: "gave-up" };
+}
+function settleDecision(opts, origin, outcome) {
+  switch (outcome.status) {
+    case "approved":
+      writeStoredSession({ origin, token: outcome.token });
+      emitData(opts, { origin, storedAt: sessionPath(), via: "device" }, () => {
+        process.stdout.write(`signed in to ${origin}
+`);
+        process.stdout.write(`  token stored at ${sessionPath()} (readable only by you)
+`);
+      });
+      return;
+    case "denied":
+      fail(opts, ExitCode.General, {
+        error: "the sign-in was denied in the browser",
+        code: "login-denied",
+        remediation: `If that was not you saying no, run ${tendrilCommand("login")} again and approve the fresh code.`
+      });
+      break;
+    case "expired":
+    case "gave-up":
+      fail(opts, ExitCode.General, {
+        error: outcome.status === "expired" ? "the sign-in code lapsed before anyone approved it \u2014 they live ten minutes" : "gave up waiting for the browser approval",
+        code: "login-expired",
+        remediation: `Run ${tendrilCommand("login")} again for a fresh code.`
+      });
+      break;
+    default:
+      fail(opts, ExitCode.General, {
+        error: "the portal no longer recognises this sign-in attempt",
+        code: "login-unknown",
+        remediation: `Run ${tendrilCommand("login")} again. If this repeats, the approval may be racing another terminal \u2014 approve only one at a time.`
+      });
+  }
+}
+function pendingLoginPath() {
+  return path51.join(path51.dirname(sessionPath()), "pending-login.json");
+}
+async function deviceStartPhase(opts, origin, deps) {
+  const started = await startHandshake(opts, origin, deps);
+  const file = pendingLoginPath();
+  mkdirSync12(path51.dirname(file), { recursive: true });
+  writeFileSync20(file, `${JSON.stringify({ origin, ...started }, null, 2)}
+`, { mode: 384 });
+  deps.openBrowser(started.verificationUrl);
+  emitData(
+    opts,
+    {
+      verificationUrl: started.verificationUrl,
+      userCode: started.userCode,
+      expiresAt: started.expiresAt,
+      origin,
+      next: "Show the user the link and the code \u2014 they approve in the browser, and must check the page shows this exact code. Then run login --device-wait (the tendril_login_wait tool) to finish."
+    },
+    () => {
+      process.stdout.write(`open ${started.verificationUrl}
+`);
+      process.stdout.write(`  the page must show: ${started.userCode}
+`);
+      process.stdout.write(`  then: ${tendrilCommand("login --device-wait")}
+`);
+    }
+  );
+}
+async function deviceWaitPhase(opts, deps) {
+  const file = pendingLoginPath();
+  let pending;
+  if (existsSync41(file)) {
+    try {
+      const parsed = JSON.parse(readFileSync38(file, "utf8"));
+      if (typeof parsed.origin === "string" && typeof parsed.deviceCode === "string" && typeof parsed.intervalSeconds === "number") {
+        pending = parsed;
+      }
+    } catch {
+    }
+  }
+  if (pending === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "there is no sign-in waiting to finish",
+      code: "no-pending-login",
+      remediation: `Start one first: ${tendrilCommand("login --device-start")} (the tendril_login tool).`
+    });
+  }
+  const done = () => rmSync6(file, { force: true });
+  const total = Math.ceil(660 / Math.max(1, pending.intervalSeconds));
+  let ticks = 0;
+  const outcome = await waitForDecision(opts, pending.origin, deps, pending, () => {
+    ticks += 1;
+    emitProgress(ticks, total, "waiting for the browser approval");
+  });
+  done();
+  settleDecision(opts, pending.origin, outcome);
+}
+async function startHandshake(opts, origin, deps) {
+  let response;
+  try {
+    response = await deps.fetch(`${origin}/api/device`, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+  } catch (error) {
+    return unreachable(opts, origin, error.message);
+  }
+  if (!response.ok) return unreachable(opts, origin, `the portal answered ${String(response.status)}`);
+  const body = await response.json();
+  if (typeof body.deviceCode !== "string" || typeof body.userCode !== "string" || typeof body.verificationUrl !== "string" || typeof body.intervalSeconds !== "number" || typeof body.expiresAt !== "string") {
+    return unreachable(opts, origin, "the portal's answer was not a device handshake");
+  }
+  return body;
+}
+async function pollHandshake(opts, origin, deps, deviceCode) {
+  let response;
+  try {
+    response = await deps.fetch(`${origin}/api/device/token`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ deviceCode })
+    });
+  } catch {
+    return { status: "pending" };
+  }
+  if (!response.ok) return { status: "pending" };
+  const body = await response.json();
+  if (body.status === "approved" && typeof body.token === "string") return { status: "approved", token: body.token };
+  if (body.status === "denied" || body.status === "expired" || body.status === "unknown") return { status: body.status };
+  return { status: "pending" };
+}
+function unreachable(opts, origin, detail) {
+  fail(opts, ExitCode.General, {
+    error: `could not start a sign-in with ${origin}: ${detail}`,
+    code: "portal-unreachable",
+    remediation: "Check your connection and try again. If your portal is self-hosted, confirm the --to URL."
+  });
+}
+function realDeps() {
+  return {
+    fetch: globalThis.fetch.bind(globalThis),
+    sleep: (seconds) => new Promise((resolve) => setTimeout(resolve, seconds * 1e3)),
+    openBrowser: (url) => {
+      const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+      try {
+        spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => void 0).unref();
+      } catch {
+      }
+    }
+  };
+}
+async function pasteLogin(opts, origin) {
+  const token = await readToken(opts);
+  if (token === void 0 || token.trim() === "") {
+    fail(opts, ExitCode.InputValidation, {
+      error: "no token was given",
+      code: "no-token",
+      remediation: `Paste the token when prompted, or pipe it: \`echo "<token>" | ${tendrilCommand(`login --to ${origin}`)}\`.`
+    });
+  }
+  const trimmed = token.trim();
+  if (!/^[A-Za-z0-9_-]{16,512}$/.test(trimmed)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "that does not look like a Tendril session token",
+      code: "malformed-token",
+      remediation: "Tokens are a single line of letters, digits, hyphens and underscores. Check for a stray space or a truncated paste."
+    });
+  }
+  writeStoredSession({ origin, token: trimmed });
+  emitData(opts, { origin, storedAt: sessionPath(), via: "paste" }, () => {
+    process.stdout.write(`signed in to ${origin}
+`);
+    process.stdout.write(`  token stored at ${sessionPath()} (readable only by you)
+`);
+  });
+}
+async function readToken(opts) {
+  if (process.stdin.isTTY === true) {
+    const entered = await password2({ message: "Paste your Tendril portal token (it will not be shown)" });
+    if (isCancel3(entered)) {
+      fail(opts, ExitCode.General, { error: "cancelled", code: "cancelled", remediation: "Run it again when you have the token." });
+    }
+    return entered;
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8").split("\n")[0];
+}
+function runLogout(opts) {
+  const stored = readStoredSession();
+  if (stored === void 0) {
+    emitData(opts, { signedOut: true, wasSignedIn: false }, () => process.stdout.write("you were not signed in\n"));
+    return;
+  }
+  clearStoredSession();
+  emitData(opts, { signedOut: true, wasSignedIn: true, origin: stored.origin }, () => {
+    process.stdout.write(`this machine has forgotten its session for ${stored.origin}
+`);
+    process.stdout.write("  the session itself is still valid \u2014 sign out everywhere from the portal to end it\n");
+  });
+}
+var DEFAULT_PORTAL_ORIGIN;
+var init_login = __esm({
+  "packages/cli/src/commands/login.ts"() {
+    "use strict";
+    init_src3();
+    init_invocation();
+    init_output();
+    init_publish_client();
+    DEFAULT_PORTAL_ORIGIN = "https://app.trytendril.com";
+  }
+});
+
+// packages/cli/src/commands/share.ts
+var share_exports = {};
+__export(share_exports, {
+  runShare: () => runShare
+});
+async function runShare(opts) {
+  const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  if (origin === "") {
+    fail(opts, ExitCode.InputValidation, {
+      error: "no portal to share from",
+      code: "no-portal-configured",
+      remediation: `Pass \`--to <url>\` or set TENDRIL_PORTAL_URL.`
+    });
+  }
+  if (!isSecureOrigin(origin)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `${origin} is not https, so a session token sent there would travel in the clear`,
+      code: "portal-not-https",
+      remediation: "Use the https:// address of your portal. Only 127.0.0.1 and localhost are exempt, for local development."
+    });
+  }
+  const found = tokenFor(origin);
+  if (!found.ok) {
+    fail(opts, ExitCode.Auth, {
+      error: found.reason === "origin-mismatch" ? `the session available here belongs to ${found.boundTo}, not ${origin}` : `no session for ${origin}`,
+      code: found.reason === "origin-mismatch" ? "session-belongs-to-another-portal" : "not-signed-in",
+      remediation: `Run \`${tendrilCommand(`login --to ${origin}`)}\`.`
+    });
+  }
+  const client = new HttpPublishClient({ origin, token: found.token });
+  if (opts.list === true) {
+    const listed = await client.listShareLinks({ publicationId: opts.publicationId });
+    if (!listed.ok) refuse(opts, listed);
+    emitData(opts, listed.value, () => {
+      if (listed.value.links.length === 0) {
+        process.stdout.write("no links have been issued for this publication\n");
+        return;
+      }
+      process.stdout.write(`${String(listed.value.links.length)} link(s) for this publication:
+`);
+      for (const link of listed.value.links) {
+        const ended = link.revoked_at !== null ? ` REVOKED ${link.revoked_at}` : link.expires_at !== null ? ` expires ${link.expires_at}` : " open-ended";
+        process.stdout.write(`  ${link.id}${ended}${link.recipient_email === null ? "" : ` \u2014 for ${link.recipient_email}`}
+`);
+      }
+      process.stdout.write("  (the links themselves are not stored \u2014 only their digests, so a lost link is a new link)\n");
+    });
+    return;
+  }
+  if (opts.revoke !== void 0) {
+    const revoked = await client.revokeShareLink({ publicationId: opts.publicationId, shareLinkId: opts.revoke });
+    if (!revoked.ok) refuse(opts, revoked);
+    emitData(opts, revoked.value, () => {
+      process.stdout.write(`revoked ${opts.revoke ?? ""}
+`);
+      process.stdout.write("  anyone holding that link now gets told it was revoked, not that it never existed\n");
+    });
+    return;
+  }
+  const expiresAt = resolveExpiry(opts);
+  const issued = await client.issueShareLink({
+    publicationId: opts.publicationId,
+    expiresAt,
+    recipientEmail: opts.recipient ?? null
+  });
+  if (!issued.ok) refuse(opts, issued);
+  emitData(opts, issued.value, () => {
+    process.stdout.write(`${issued.value.url}
+
+`);
+    process.stdout.write("  Anyone with this link can read this one publication and its evidence.\n");
+    process.stdout.write("  It is not tied to a person and needs no account.\n");
+    process.stdout.write(
+      issued.value.expiresAt === null ? "  It does not expire. Revoke it with --revoke when you are done.\n" : `  It stops working at ${issued.value.expiresAt}.
+`
+    );
+    process.stdout.write("  This is the only time the link is shown \u2014 only its digest is stored.\n");
+  });
+}
+function resolveExpiry(opts) {
+  if (opts.expires === void 0) return null;
+  const days = Number(opts.expires);
+  if (Number.isInteger(days) && days > 0) {
+    return new Date(Date.now() + days * 24 * 60 * 60 * 1e3).toISOString().replace(/\.\d{3}Z$/, (m) => m);
+  }
+  if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(opts.expires)) return opts.expires;
+  fail(opts, ExitCode.InputValidation, {
+    error: `--expires takes a number of days (e.g. 7) or an ISO-8601 UTC timestamp with milliseconds \u2014 got ${JSON.stringify(opts.expires)}`,
+    code: "bad-expiry",
+    remediation: "Try `--expires 7` for a week, or omit it for a link that does not expire."
+  });
+}
+function refuse(opts, sent) {
+  fail(opts, sent.status === 401 ? ExitCode.Auth : ExitCode.General, {
+    error: sent.refusal,
+    code: "share-refused",
+    remediation: sent.status === 404 ? "Check the publication id \u2014 only its owner can share it." : `Fix what is named above and run \`${tendrilCommand(`share ${opts.publicationId}`)}\` again.`
+  });
+}
+var init_share = __esm({
+  "packages/cli/src/commands/share.ts"() {
+    "use strict";
+    init_src3();
+    init_invocation();
+    init_output();
+    init_publish_client();
+  }
+});
+
+// packages/cli/src/commands/publish.ts
+var publish_exports = {};
+__export(publish_exports, {
+  runPublish: () => runPublish
+});
+import { existsSync as existsSync42, readFileSync as readFileSync39 } from "node:fs";
+import path52 from "node:path";
+async function runPublish(opts) {
+  const bundleDir = path52.resolve(opts.bundleDir);
+  const bundle = readBundle(opts, bundleDir);
+  const report = bundle.report;
+  if (typeof report["rulerExit"] !== "number" || !Number.isInteger(report["rulerExit"])) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `${VERIFY_REPORT_FILENAME} does not state the ruler's exit code, and an absent exit code is not a passing one`,
+      code: "report-has-no-exit-code",
+      remediation: `Re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` with a current CLI \u2014 this report predates the field.`
+    });
+  }
+  if (report["rulerExit"] !== 0) {
+    const why = typeof report["rulerRefusal"] === "string" ? ` \u2014 ${report["rulerRefusal"]}` : "";
+    fail(opts, ExitCode.VerificationFailed, {
+      error: `the ruler refused this run (exit ${String(report["rulerExit"])}), so it has nothing to publish${why}`,
+      code: "run-refused-by-ruler",
+      remediation: `Fix what the report names, re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` until it passes, then publish. A declined verdict never becomes a page.`
+    });
+  }
+  const undisclosed = undisclosedTrustFacts(report);
+  if (undisclosed.length > 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `this report carries a disclosure a published page cannot yet show, and a verdict shown without it is worse than no page: ${undisclosed.map((f) => `${f.pointer} \u2014 ${f.consequence}`).join("; ")}`,
+      code: "report-carries-an-unrenderable-disclosure",
+      remediation: "Resolve what the disclosure names \u2014 re-record so the set matches the bundle's stamp, or resolve the substituted font families \u2014 then re-verify and publish the clean run."
+    });
+  }
+  if (scoredRecordingSetHash(report) === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "this report does not name the recording set these scores were measured against",
+      code: "report-names-no-recording-set",
+      remediation: `Re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` with a current CLI \u2014 the set identity rides the report.`
+    });
+  }
+  const componentName = (opts.name ?? bundle.manifest.name).trim();
+  const surface = classifyBundleSurface(bundle.files, { entry: bundle.manifest.entry });
+  if (surface.unknown.length > 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `this bundle carries files a portal does not recognise, and publishing guesses at nothing: ${surface.unknown.join(", ")}`,
+      code: "bundle-carries-unrecognised-files",
+      remediation: `Remove them from ${opts.bundleDir}, or re-emit the bundle. Publishing them would ship something nobody reviewed; dropping them silently would ship evidence with a hole in it.`
+    });
+  }
+  const sheetEntry = surface.published.find((p) => p.role === "inspect-sheet");
+  if (sheetEntry !== void 0) {
+    const missingCrops = missingInspectCrops(
+      readFileSync39(path52.join(bundleDir, sheetEntry.path), "utf8"),
+      surface.published.map((p) => p.path)
+    );
+    if (missingCrops.length > 0) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `this bundle's inspect sheet references images it does not carry, and half a sheet reads as a broken component: ${missingCrops.join(", ")}`,
+        code: "inspect-sheet-without-its-crops",
+        remediation: `Re-run \`${tendrilCommand(`inspect ${opts.bundleDir}`)}\` to rebuild the sheet and its crops together, or delete the sheet and publish without it.`
+      });
+    }
+  }
+  if (surface.missingRequired.length > 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `this bundle is missing what a publishable bundle cannot be without: ${surface.missingRequired.join(", ")}`,
+      code: "bundle-missing-required-role",
+      remediation: `Run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` \u2014 the evidence a page shows is written by that run. Required: ${REQUIRED_ROLES.join(", ")}.`
+    });
+  }
+  const recorded = readScoredFiles(report);
+  if (recorded === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `${VERIFY_REPORT_FILENAME} does not record the files this run was scored beside, so nothing ties this bundle's bytes to its verdict`,
+      code: "report-records-no-file-digests",
+      remediation: `Re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` with a current CLI \u2014 this report predates the field.`
+    });
+  } else {
+    const delta = compareScoredFiles(recorded, digestScoredFiles(bundleDir, bundle.manifest.entry));
+    const disagreements = [
+      ...delta.changed.map((p) => `${p} (bytes differ from the scored run)`),
+      ...delta.missing.map((p) => `${p} (scored, no longer in the bundle)`),
+      ...delta.unscored.map((p) => `${p} (in the bundle, never scored)`)
+    ];
+    if (disagreements.length > 0) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `this bundle is not the one the ruler scored: ${disagreements.join("; ")}`,
+        code: "bundle-disagrees-with-scored-files",
+        remediation: `Re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` so the verdict describes these bytes. A page must never show code the ruler never saw.`
+      });
+    }
+  }
+  const figmaFile = bundle.manifest.provenance.recordingSet.figmaFile ?? null;
+  if (opts.dryRun) {
+    emitData(
+      opts,
+      {
+        bundleDir,
+        componentName,
+        figmaFile,
+        entry: bundle.manifest.entry,
+        publishes: surface.published,
+        excluded: surface.excluded,
+        rulerVersion: report["environment"]?.["ruler"] ?? null,
+        wouldPublish: true
+      },
+      () => {
+        process.stdout.write(`${componentName} would publish ${String(surface.published.length)} files:
+`);
+        for (const entry of surface.published) process.stdout.write(`  ${entry.path}  (${entry.role})
+`);
+        for (const left of surface.excluded) process.stdout.write(`  \u2014 leaving ${left.path} behind (${left.reason})
+`);
+      }
+    );
+    return;
+  }
+  const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  const client = opts.client ?? httpClient(opts, origin);
+  if (opts.confirmPublish === true && process.stdin.isTTY !== true) {
+    fail(opts, ExitCode.ConfirmationRequired, {
+      error: "--confirm-publish requires an interactive terminal \u2014 putting a component on the internet is a human-only decision",
+      code: "publish-confirmation-not-interactive",
+      remediation: `A human runs \`${tendrilCommand(`publish ${opts.bundleDir} --confirm-publish`)}\` in their own terminal. Agents: show this to your operator instead of confirming it.`
+    });
+  }
+  if (opts.acceptTerms === true) {
+    const accepted = await client.acceptTerms({ figmaFile });
+    if (!accepted.ok) refuse2(opts, accepted, "accept-terms-refused");
+  }
+  const opened = await client.begin({
+    componentName,
+    figmaFile,
+    entry: bundle.manifest.entry,
+    files: bundle.files,
+    report: bundle.reportText,
+    confirmed: opts.confirmPublish === true
+  });
+  if (!opened.ok) {
+    if (opened.needsConsent !== void 0) {
+      fail(opts, ExitCode.ConfirmationRequired, {
+        error: `publishing this design system needs an acceptance of the publishing terms (version ${opened.needsConsent.termsVersion}) first`,
+        code: "publishing-terms-not-accepted",
+        remediation: `Read the terms, then run \`${tendrilCommand(`publish ${opts.bundleDir} --accept-terms --confirm-publish`)}\`. The acceptance covers this design system only.`
+      });
+    }
+    if (opened.needsConfirmation !== void 0) {
+      fail(opts, ExitCode.ConfirmationRequired, {
+        error: `publishing ${JSON.stringify(opened.needsConfirmation.componentName)} for the first time is a decision a person makes, not a build step`,
+        code: "first-publish-unconfirmed",
+        remediation: `A human runs \`${tendrilCommand(`publish ${opts.bundleDir} --confirm-publish`)}\` in their own terminal. Later publishes of this component need no flag.`
+      });
+    }
+    refuse2(opts, opened, "publish-refused");
+  }
+  const uploaded = [];
+  for (const object of opened.value.plan.objects) {
+    const file = path52.join(bundleDir, object.relPath);
+    if (!existsSync42(file)) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `the portal expects ${object.relPath}, and it is not in ${opts.bundleDir}`,
+        code: "planned-file-missing",
+        remediation: `Re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` and publish again \u2014 a publication is refused rather than going live with a hole in its evidence.`
+      });
+    }
+    const sent = await client.upload({
+      publicationId: opened.value.publicationId,
+      relPath: object.relPath,
+      bytes: new Uint8Array(readFileSync39(file))
+    });
+    if (!sent.ok) refuse2(opts, sent, "upload-refused");
+    uploaded.push({ relPath: object.relPath, deduplicated: sent.value.deduplicated });
+  }
+  const committed = await client.commit({ publicationId: opened.value.publicationId });
+  if (!committed.ok) {
+    if (committed.missing !== void 0 && committed.missing.length > 0) {
+      fail(opts, ExitCode.General, {
+        error: `this publication is missing objects the bundle declared, and a verdict beside missing evidence is worse than no page: ${committed.missing.join(", ")}`,
+        code: "publication-incomplete",
+        remediation: `Run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication and re-sends only what is missing.`
+      });
+    }
+    refuse2(opts, committed, "commit-refused");
+  }
+  emitData(
+    opts,
+    {
+      publicationId: committed.value.publicationId,
+      url: committed.value.url,
+      componentName,
+      figmaFile: opened.value.figmaFile,
+      rulerVersion: opened.value.rulerVersion,
+      resumed: opened.value.resumed === true,
+      files: uploaded
+    },
+    () => {
+      const reused = uploaded.filter((u) => u.deduplicated).length;
+      if (opened.value.resumed === true) process.stdout.write(`resumed the unfinished publish of ${componentName}
+`);
+      process.stdout.write(`published ${componentName} \u2014 ${String(uploaded.length)} files`);
+      process.stdout.write(reused > 0 ? ` (${String(reused)} you already had)
+` : "\n");
+      process.stdout.write(`  ${committed.value.url}
+`);
+      process.stdout.write(`  verdict as scored by ruler ${opened.value.rulerVersion}
+`);
+    }
+  );
+}
+function readBundle(opts, bundleDir) {
+  const manifestPath2 = path52.join(bundleDir, "component.json");
+  const reportPath = path52.join(bundleDir, EVIDENCE_DIR, VERIFY_REPORT_FILENAME);
+  if (!existsSync42(manifestPath2)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `there is no component.json in ${opts.bundleDir}, so this is not a bundle`,
+      code: "not-a-bundle",
+      remediation: `Point publish at a directory a Tendril run produced. \`${tendrilCommand("generate --help")}\` shows how one is made.`
+    });
+  }
+  if (!existsSync42(reportPath)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `this bundle has never been verified \u2014 there is no ${EVIDENCE_DIR}/${VERIFY_REPORT_FILENAME}`,
+      code: "bundle-not-verified",
+      remediation: `Run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` first. Verification is free and needs no account; publishing without it would put a page up with no verdict on it.`
+    });
+  }
+  const { manifest } = readBundleManifest(readFileSync39(manifestPath2, "utf8"));
+  if (manifest === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "component.json did not parse as a bundle manifest",
+      code: "no-mount-contract",
+      remediation: `Re-emit the bundle \u2014 \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` rewrites component.json \u2014 then publish.`
+    });
+  }
+  const reportText = readFileSync39(reportPath, "utf8");
+  let report;
+  try {
+    report = JSON.parse(reportText);
+  } catch (error) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `${EVIDENCE_DIR}/${VERIFY_REPORT_FILENAME} is not parseable JSON: ${error.message}`,
+      code: "report-unparseable",
+      remediation: `Re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` \u2014 that file is written by the ruler and should never be edited by hand.`
+    });
+  }
+  if (report === null || typeof report !== "object" || Array.isArray(report)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `${EVIDENCE_DIR}/${VERIFY_REPORT_FILENAME} parses, but a verify report is a JSON object and this is not one`,
+      code: "report-not-an-object",
+      remediation: `Re-run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\`.`
+    });
+  }
+  return { manifest, report, reportText, files: bundleFiles(bundleDir) };
+}
+function httpClient(opts, origin) {
+  if (origin === "") {
+    fail(opts, ExitCode.InputValidation, {
+      error: "no portal to publish to",
+      code: "no-portal-configured",
+      remediation: `Pass \`--to <url>\` or set TENDRIL_PORTAL_URL. \`${tendrilCommand(`publish ${opts.bundleDir} --dry-run`)}\` shows exactly what would be published without needing one.`
+    });
+  }
+  if (!isSecureOrigin(origin)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `${origin} is not https, so a session token sent there would travel in the clear`,
+      code: "portal-not-https",
+      remediation: "Use the https:// address of your portal. Only 127.0.0.1 and localhost are exempt, for local development."
+    });
+  }
+  const found = tokenFor(origin);
+  if (!found.ok && found.reason === "origin-mismatch") {
+    fail(opts, ExitCode.Auth, {
+      error: `the session available here belongs to ${found.boundTo}, and this would publish to ${origin}`,
+      code: "session-belongs-to-another-portal",
+      remediation: found.from === "env" ? `TENDRIL_TOKEN is pinned to TENDRIL_PORTAL_URL (${found.boundTo}). Publish to that portal, or set both to ${origin} together \u2014 a token is a credential for one host.` : `Sign in to ${origin}. The stored session is for ${found.boundTo}, and sending it elsewhere would hand that host a live credential.`
+    });
+  }
+  if (!found.ok) {
+    fail(opts, ExitCode.Auth, {
+      error: `no session for ${origin}`,
+      code: "not-signed-in",
+      remediation: `Run \`${tendrilCommand(`login --to ${origin}`)}\` and paste the token your portal operator gave you (or set TENDRIL_TOKEN and TENDRIL_PORTAL_URL together for this shell). Verification stays free and account-less; only publishing needs an account.`
+    });
+  }
+  return new HttpPublishClient({ origin, token: found.token });
+}
+function refuse2(opts, sent, code) {
+  const detail = sent.detail === void 0 || sent.detail.length === 0 ? "" : `: ${sent.detail.join(", ")}`;
+  fail(opts, sent.status === 401 ? ExitCode.Auth : ExitCode.General, {
+    error: `${sent.refusal}${detail}`,
+    code,
+    remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${(opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "")}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 a retry rejoins this same unfinished publication.` : `Fix what is named above and run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one.`
+  });
+}
+var init_publish = __esm({
+  "packages/cli/src/commands/publish.ts"() {
+    "use strict";
+    init_src3();
+    init_src4();
+    init_invocation();
+    init_output();
+    init_publish_client();
+  }
+});
+
 // packages/cli/src/commands/generate-route.ts
 var generate_route_exports = {};
 __export(generate_route_exports, {
@@ -17110,18 +18396,18 @@ var generate_recorded_exports = {};
 __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
-import { confirm as confirm3, isCancel as isCancel3 } from "@clack/prompts";
-import { existsSync as existsSync40, readFileSync as readFileSync35 } from "node:fs";
-import path49 from "node:path";
+import { confirm as confirm3, isCancel as isCancel4 } from "@clack/prompts";
+import { existsSync as existsSync43, readFileSync as readFileSync40 } from "node:fs";
+import path53 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path49.resolve(callerCwd, opts.out);
-  const recordedAsPath = path49.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path53.resolve(callerCwd, opts.out);
+  const recordedAsPath = path53.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync40(path49.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync43(path53.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -17130,7 +18416,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path49.basename(recordedAsPath);
+      taskName = path53.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -17164,7 +18450,7 @@ async function runGenerateRecorded(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync40(path49.join(task.set, c.rep, "get_screenshot.json")) || !existsSync40(path49.join(task.set, c.rep, "get_metadata.json")) || !existsSync40(path49.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync43(path53.join(task.set, c.rep, "get_screenshot.json")) || !existsSync43(path53.join(task.set, c.rep, "get_metadata.json")) || !existsSync43(path53.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -17234,8 +18520,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path49.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path49.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path53.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path53.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -17250,7 +18536,7 @@ async function runGenerateRecorded(opts) {
       });
     }
     const accepted = await confirm3({ message: `Proceed? (cap $${opts.capUsd.toFixed(2)}, ${opts.maxIterations} iterations max)` });
-    if (isCancel3(accepted) || accepted !== true) {
+    if (isCancel4(accepted) || accepted !== true) {
       fail(opts, ExitCode.ConfirmationRequired, {
         error: "Run was not confirmed.",
         code: "CONFIRMATION_DECLINED",
@@ -17258,10 +18544,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path49.join(outDirAbs, taskName);
-  if (existsSync40(path49.join(bundleDir, "component.json"))) {
+  const bundleDir = path53.join(outDirAbs, taskName);
+  if (existsSync43(path53.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync35(path49.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync40(path53.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -17428,7 +18714,7 @@ init_invocation();
 init_output();
 import { intro, isCancel, outro, password } from "@clack/prompts";
 import fs from "node:fs";
-import path27 from "node:path";
+import path29 from "node:path";
 var INIT_DESCRIPTION = {
   name: "init",
   summary: "Configure the OpenRouter credential in .env, and optionally a Figma token (idempotent).",
@@ -17470,7 +18756,7 @@ async function runInit(flags) {
     printDescription(INIT_DESCRIPTION);
     return;
   }
-  const envPath = path27.resolve(process.cwd(), ".env");
+  const envPath = path29.resolve(process.cwd(), ".env");
   const existing = fs.existsSync(envPath) ? parseEnv(fs.readFileSync(envPath, "utf8")) : /* @__PURE__ */ new Map();
   let figmaToken = flags.figmaToken ?? existing.get(ENV_KEYS.figma);
   let openrouterKey = flags.openrouterKey ?? existing.get(ENV_KEYS.openrouter);
@@ -17491,7 +18777,7 @@ async function runInit(flags) {
   if (openrouterKey) next.set(ENV_KEYS.openrouter, openrouterKey);
   if (figmaToken) next.set(ENV_KEYS.figma, figmaToken);
   const changed = [...next].some(([key, value]) => existing.get(key) !== value);
-  const gitignorePath = path27.resolve(process.cwd(), ".gitignore");
+  const gitignorePath = path29.resolve(process.cwd(), ".gitignore");
   const gitignore = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
   const gitignoreCoversEnv = gitignore.split("\n").some((line) => [".env", ".env", ".env*"].includes(line.trim()));
   if (flags.dryRun) {
@@ -17547,14 +18833,14 @@ init_invocation();
 init_output();
 init_entitlement();
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
-import { readFileSync as readFileSync18, readdirSync as readdirSync8, existsSync as existsSync22 } from "node:fs";
+import { readFileSync as readFileSync21, readdirSync as readdirSync9, existsSync as existsSync23 } from "node:fs";
 
 // packages/cli/src/pipeline.ts
 init_src2();
 init_src5();
 init_src4();
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import path28 from "node:path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import path30 from "node:path";
 
 // packages/cli/src/assets-module.ts
 init_src();
@@ -17890,8 +19176,8 @@ async function runGenerationPipeline(input) {
   });
   const written = [];
   if (!input.dryRun) {
-    const dir = path28.resolve(input.outDir, semantics.componentName);
-    mkdirSync5(dir, { recursive: true });
+    const dir = path30.resolve(input.outDir, semantics.componentName);
+    mkdirSync6(dir, { recursive: true });
     const files = {
       // Bundle-local tokens: THE emission the component's CSS resolves
       // against — the same artifact the verify harness injects. A preview
@@ -17914,14 +19200,14 @@ async function runGenerationPipeline(input) {
 `
     };
     for (const [name, content] of Object.entries(files)) {
-      const filePath = path28.join(dir, name);
-      writeFileSync8(filePath, content);
+      const filePath = path30.join(dir, name);
+      writeFileSync9(filePath, content);
       written.push(filePath);
     }
     for (const artifact of emitTokenArtifacts(input.mapping)) {
-      const filePath = path28.resolve(input.outDir, artifact.path);
-      mkdirSync5(path28.dirname(filePath), { recursive: true });
-      writeFileSync8(filePath, artifact.content);
+      const filePath = path30.resolve(input.outDir, artifact.path);
+      mkdirSync6(path30.dirname(filePath), { recursive: true });
+      writeFileSync9(filePath, artifact.content);
       written.push(filePath);
     }
   }
@@ -17979,7 +19265,7 @@ var GENERATE_DESCRIPTION = {
 function resolveProvidedSource(flags, contextFile) {
   let raw;
   try {
-    raw = readFileSync18(contextFile, "utf8");
+    raw = readFileSync21(contextFile, "utf8");
   } catch {
     fail(flags, ExitCode.InputValidation, {
       error: `Cannot read context file "${contextFile}".`,
@@ -18099,11 +19385,11 @@ token mapping (${mapping.flat.length} variables):
   let initialCode;
   let initialSemantics;
   try {
-    if (existsSync22(flags.out)) {
-      for (const entry of readdirSync8(flags.out)) {
+    if (existsSync23(flags.out)) {
+      for (const entry of readdirSync9(flags.out)) {
         const cjPath = `${flags.out}/${entry}/component.json`;
-        if (!existsSync22(cjPath)) continue;
-        const cj = JSON.parse(readFileSync18(cjPath, "utf8"));
+        if (!existsSync23(cjPath)) continue;
+        const cj = JSON.parse(readFileSync21(cjPath, "utf8"));
         if (cj.name !== void 0 && Array.isArray(cj.props)) {
           previousApi = JSON.stringify({
             componentName: cj.name,
@@ -18111,14 +19397,14 @@ token mapping (${mapping.flat.length} variables):
           });
           const tsxPath = `${flags.out}/${entry}/${cj.name}.tsx`;
           const cssPath = `${flags.out}/${entry}/${cj.name}.css`;
-          if (flags.refine && existsSync22(tsxPath) && existsSync22(cssPath)) {
+          if (flags.refine && existsSync23(tsxPath) && existsSync23(cssPath)) {
             initialCode = {
-              tsx: readFileSync18(tsxPath, "utf8"),
-              css: readFileSync18(cssPath, "utf8")
+              tsx: readFileSync21(tsxPath, "utf8"),
+              css: readFileSync21(cssPath, "utf8")
             };
             const semPath = `${flags.out}/${entry}/semantics.json`;
-            if (existsSync22(semPath)) {
-              initialSemantics = JSON.parse(readFileSync18(semPath, "utf8"));
+            if (existsSync23(semPath)) {
+              initialSemantics = JSON.parse(readFileSync21(semPath, "utf8"));
             }
           }
           break;
@@ -18513,6 +19799,50 @@ function buildProgram() {
       ...local["maxArea"] !== void 0 ? { maxArea: Number(local["maxArea"]) } : {}
     });
   });
+  program.command("login").description("Sign this machine in to the Tendril portal (approve in your browser), so `publish` and `share` can reach it. Verification never needs this.").option("--to <url>", "the portal to sign in to (defaults to the hosted portal; or set TENDRIL_PORTAL_URL)").option("--paste", "paste a token minted on the portal's Connect page instead of approving in the browser").option("--device-start", "agents: start the browser approval and return the link and code immediately").option("--device-wait", "agents: wait for the browser approval started by --device-start").action(async (_o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const local = cmd.opts();
+    const { runLogin: runLogin2 } = await Promise.resolve().then(() => (init_login(), login_exports));
+    await runLogin2({
+      ...flags,
+      ...local["to"] !== void 0 ? { to: local["to"] } : {},
+      ...local["paste"] !== void 0 ? { paste: local["paste"] } : {},
+      ...local["deviceStart"] !== void 0 ? { deviceStart: local["deviceStart"] } : {},
+      ...local["deviceWait"] !== void 0 ? { deviceWait: local["deviceWait"] } : {}
+    });
+  });
+  program.command("logout").description("Forget this machine's stored portal session. Does not end the session itself.").action(async (_o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const { runLogout: runLogout2 } = await Promise.resolve().then(() => (init_login(), login_exports));
+    runLogout2(flags);
+  });
+  program.command("share").description("Create a link that opens one publication's verdict and evidence for someone with no account. Anyone holding the link can read it.").argument("<publicationId>", "the publication to share, as `publish` printed it").option("--to <url>", "the portal (or set TENDRIL_PORTAL_URL)").option("--expires <days|timestamp>", "a number of days, or an ISO-8601 UTC timestamp; omit for a link that does not expire").option("--recipient <email>", "recorded so you can see who a link was for; never used to authenticate").option("--list", "show the links outstanding for this publication").option("--revoke <shareLinkId>", "stop a link working").action(async (publicationId, _o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const local = cmd.opts();
+    const { runShare: runShare2 } = await Promise.resolve().then(() => (init_share(), share_exports));
+    await runShare2({
+      ...flags,
+      publicationId,
+      ...local["to"] !== void 0 ? { to: local["to"] } : {},
+      ...local["expires"] !== void 0 ? { expires: String(local["expires"]) } : {},
+      ...local["recipient"] !== void 0 ? { recipient: local["recipient"] } : {},
+      ...local["list"] !== void 0 ? { list: local["list"] } : {},
+      ...local["revoke"] !== void 0 ? { revoke: local["revoke"] } : {}
+    });
+  });
+  program.command("publish").description("Put a verified bundle and its evidence on a page, at a URL you can send to someone. Refuses a run the ruler declined.").argument("<bundleDir>", "bundle directory that has already been verified").option("--to <url>", "the portal to publish to (or set TENDRIL_PORTAL_URL)").option("--name <name>", "library label for this component (default: the bundle manifest's own name)").option("--accept-terms", "accept the current publishing terms for this design system as part of this run").option("--confirm-publish", "you, a person, saying this component may be published \u2014 required the first time, and refused without an interactive terminal").action(async (bundleDir, _o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const local = cmd.opts();
+    const { runPublish: runPublish2 } = await Promise.resolve().then(() => (init_publish(), publish_exports));
+    await runPublish2({
+      ...flags,
+      bundleDir,
+      ...local["to"] !== void 0 ? { to: local["to"] } : {},
+      ...local["name"] !== void 0 ? { name: local["name"] } : {},
+      ...local["acceptTerms"] !== void 0 ? { acceptTerms: local["acceptTerms"] } : {},
+      ...local["confirmPublish"] !== void 0 ? { confirmPublish: local["confirmPublish"] } : {}
+    });
+  });
   program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--library <dir>", "workspace root holding confirmed partners generated bundles (ADR-013 composed pins; default: current directory)").option("--profile <file>", "a `tendril profile` artifact; reports whether the bundle followed your codebase conventions (never gates the verdict)").action(async (bundleDir, _opts, cmd) => {
     const flags = globalFlags(cmd);
     const local = cmd.opts();