@tendrilapp/cli 0.1.41 → 0.1.43

package/dist/tendril.js

@@ -1980,8 +1980,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path54) {
-  return `--${path54.join("-")}`;
+function tokenPathToCssVar(path56) {
+  return `--${path56.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -2025,11 +2025,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path54 = variableNameToPath(variable.name);
-    if (path54.length === 0) {
+    const path56 = variableNameToPath(variable.name);
+    if (path56.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path54 };
+    return { variable, path: path56 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -2050,21 +2050,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path54 } of entries) {
+  for (const { variable, path: path56 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path54.slice(0, -1)) {
+    for (const segment of path56.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path54[path54.length - 1];
+    const leaf = path56[path56.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path54.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path56.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path54.join("."),
-      cssVar: tokenPathToCssVar(path54),
+      path: path56.join("."),
+      cssVar: tokenPathToCssVar(path56),
       type: token.$type,
       value: token.$value
     });
@@ -2253,9 +2253,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path54 = ctx.pathById.get(id);
-  if (path54 === void 0) ctx.unresolved.add(id);
-  return path54;
+  const path56 = ctx.pathById.get(id);
+  if (path56 === void 0) ctx.unresolved.add(id);
+  return path56;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -2290,8 +2290,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path54 = resolveBinding(ctx, id);
-        if (path54 !== void 0) tokens.add(path54);
+        const path56 = resolveBinding(ctx, id);
+        if (path56 !== void 0) tokens.add(path56);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -2299,8 +2299,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path54 = resolveBinding(ctx, radiusId);
-    if (path54 !== void 0) tokens.add(path54);
+    const path56 = resolveBinding(ctx, radiusId);
+    if (path56 !== void 0) tokens.add(path56);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -2310,10 +2310,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path54 = resolveBinding(ctx, gapId);
-      if (path54 !== void 0) {
-        layout.gap = path54;
-        tokens.add(path54);
+      const path56 = resolveBinding(ctx, gapId);
+      if (path56 !== void 0) {
+        layout.gap = path56;
+        tokens.add(path56);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -2322,10 +2322,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path54 = resolveBinding(ctx, id);
-        if (path54 !== void 0) {
-          paddingPaths.push(path54);
-          tokens.add(path54);
+        const path56 = resolveBinding(ctx, id);
+        if (path56 !== void 0) {
+          paddingPaths.push(path56);
+          tokens.add(path56);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -4830,6 +4830,65 @@ var init_font_faces = __esm({
   }
 });
 
+// packages/verify/src/mount-error.ts
+function describeMountError(err) {
+  if (!(err instanceof Error)) return String(err);
+  const lines = err.message.split("\n").map((l) => l.trim()).filter((l) => l !== "" && l !== "Call log:" && l !== "=".repeat(l.length));
+  const headline = lines[0] ?? "unknown error";
+  if (lines.length <= 1) return headline;
+  const counts = /* @__PURE__ */ new Map();
+  for (const raw of lines.slice(1)) {
+    const line = raw.replace(/^[-\s]+/, "");
+    counts.set(line, (counts.get(line) ?? 0) + 1);
+  }
+  const distinct = [...counts.entries()];
+  const shown = distinct.slice(0, MAX_DISTINCT_LOG_LINES);
+  const condensed = shown.map(([line, n]) => n > 1 ? `${line} \xD7${n}` : line).join("; ");
+  const dropped = distinct.length - shown.length;
+  const tail = dropped > 0 ? `; (+${dropped} more distinct lines)` : "";
+  const out = `${headline} call log: ${condensed}${tail}`;
+  return out.length > MAX_DETAIL_CHARS ? `${out.slice(0, MAX_DETAIL_CHARS - 1)}\u2026` : out;
+}
+async function hoverWithBudget(page, selector, budgetMs) {
+  const started = Date.now();
+  try {
+    await page.hover(selector, { timeout: budgetMs });
+    return Date.now() - started;
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    if (err instanceof Error && /Timeout \d+ms exceeded/.test(err.message)) {
+      const callLog = err.message.split("\n").slice(1).join("\n");
+      throw new Error(
+        `hover on ${selector} blew its ${String(budgetMs)} ms budget (gave up after ${String(elapsed)} ms) \u2014 a blown DEADLINE, not proof the element cannot be hovered; the call log names the phase that never completed (raise the budget with --hover-timeout to diagnose a slow machine; the report records any non-default budget)
+${callLog}`,
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+}
+function capturePageConsole(page) {
+  const messages = [];
+  page.on("console", (m) => {
+    messages.push(`${m.type()}: ${m.text().slice(0, 200)}`);
+    if (messages.length > 8) messages.shift();
+  });
+  page.on("pageerror", (e) => {
+    messages.push(`pageerror: ${String(e.message ?? e).slice(0, 200)}`);
+    if (messages.length > 8) messages.shift();
+  });
+  return () => messages.join(" | ");
+}
+var DEFAULT_HOVER_BUDGET_MS, MAX_DISTINCT_LOG_LINES, MAX_DETAIL_CHARS;
+var init_mount_error = __esm({
+  "packages/verify/src/mount-error.ts"() {
+    "use strict";
+    DEFAULT_HOVER_BUDGET_MS = 2e3;
+    MAX_DISTINCT_LOG_LINES = 16;
+    MAX_DETAIL_CHARS = 900;
+  }
+});
+
 // packages/verify/src/admission.ts
 import { readFileSync as readFileSync9, readdirSync as readdirSync4, existsSync as existsSync11, writeFileSync as writeFileSync4 } from "node:fs";
 import path15 from "node:path";
@@ -4855,6 +4914,7 @@ var init_admission = __esm({
     init_font_faces();
     init_browser();
     init_font_resolve();
+    init_mount_error();
     init_mount_limits();
     FONT_WEIGHTS = fontWeightsByFamily();
   }
@@ -5166,7 +5226,7 @@ async function settle(page, ms = 150) {
   await page.waitForTimeout(ms);
   await freezeAnimations(page);
 }
-async function runSteps(page, spec, renderPose) {
+async function runSteps(page, spec, renderPose, hoverBudgetMs = DEFAULT_HOVER_BUDGET_MS) {
   for (const step of spec.steps) {
     try {
       if ("commitMatchesPose" in step) {
@@ -5215,7 +5275,7 @@ async function runSteps(page, spec, renderPose) {
         await page.click(`#root ${step.click}`, { timeout: 2e3 });
         await page.waitForTimeout(150);
       } else if ("hover" in step) {
-        await page.hover(`#root ${step.hover}`, { timeout: 2e3 });
+        await hoverWithBudget(page, `#root ${step.hover}`, hoverBudgetMs);
         await page.waitForTimeout(150);
       } else if ("key" in step) {
         await page.keyboard.press(step.key);
@@ -5447,7 +5507,7 @@ async function runSteps(page, spec, renderPose) {
         }
       } else if ("hoverChangesPixels" in step) {
         const before = await page.screenshot();
-        await page.hover(`#root ${step.hoverChangesPixels}`, { timeout: 2e3 });
+        await hoverWithBudget(page, `#root ${step.hoverChangesPixels}`, hoverBudgetMs);
         await page.waitForTimeout(200);
         const after = await page.screenshot();
         await page.mouse.move(0, 0);
@@ -5608,11 +5668,11 @@ body{margin:0;padding:20px}
             const why = pageErrors.length > 0 ? ` (runtime error: ${pageErrors[0]})` : "";
             return { id: spec.id, pass: false, detail: `${cfg.component} rendered nothing${why}` };
           }
-          return await runSteps(page, spec, renderPose);
+          return await runSteps(page, spec, renderPose, opts.hoverBudgetMs ?? DEFAULT_HOVER_BUDGET_MS);
         } finally {
           await page.close();
         }
-      })().catch((err) => ({ id: spec.id, pass: false, detail: `mount failed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` }));
+      })().catch((err) => ({ id: spec.id, pass: false, detail: `mount failed: ${describeMountError(err)}` }));
       const result = await raceMountDeadline(
         work,
         deadlineMs,
@@ -5647,7 +5707,7 @@ body{margin:0;padding:20px}
         } finally {
           await page.close();
         }
-      })().catch((err) => [{ id: "prelude:root", pass: false, detail: `mount failed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` }]);
+      })().catch((err) => [{ id: "prelude:root", pass: false, detail: `mount failed: ${describeMountError(err)}` }]);
       results.push(
         ...await raceMountDeadline(work, deadlineMs, () => [
           { id: "prelude:root", pass: false, detail: `mount deadline exceeded (${deadlineMs}ms) \u2014 hostile or hung candidate` }
@@ -5671,6 +5731,7 @@ var init_behavior = __esm({
     init_candidate_css();
     init_font_faces();
     init_image_diff();
+    init_mount_error();
     init_mount_limits();
     init_tasks();
     ANIMATED_PROBE = `(() => {
@@ -6178,33 +6239,43 @@ function classifyBundleSurface(files, opts) {
   const excluded = [];
   const unknown = [];
   for (const raw of files) {
-    const path54 = raw.replace(/\\/g, "/").replace(/^\.\//, "");
-    const inEvidence = path54.startsWith(`${EVIDENCE_DIR}/`);
-    const name = inEvidence ? path54.slice(EVIDENCE_DIR.length + 1) : path54;
+    const path56 = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+    const inEvidence = path56.startsWith(`${EVIDENCE_DIR}/`);
+    if (path56.startsWith("fonts/")) {
+      const fname = path56.slice("fonts/".length);
+      if (!fname.includes("/") && (/\.(woff2?|ttf|otf)$/i.test(fname) || /^(NOTICE|LICENSE|LICENCE)[^/]*\.txt$/i.test(fname))) {
+        excluded.push({ path: path56, reason: "font payload \u2014 not published (fonts policy pending); faces are sha-pinned in component.json requiredFonts" });
+        continue;
+      }
+      unknown.push(path56);
+      continue;
+    }
+    const name = inEvidence ? path56.slice(EVIDENCE_DIR.length + 1) : path56;
     if (name.includes("/")) {
-      unknown.push(path54);
+      unknown.push(path56);
       continue;
     }
     if (inEvidence) {
-      if (name === "verify-report.json") published.push({ path: path54, role: "verify-report" });
-      else if (name === "diff-legend.txt") published.push({ path: path54, role: "diff-legend" });
-      else if (name === "inspect.html") published.push({ path: path54, role: "inspect-sheet" });
+      if (name === "verify-report.json") published.push({ path: path56, role: "verify-report" });
+      else if (name === "diff-legend.txt") published.push({ path: path56, role: "diff-legend" });
+      else if (name === "inspect.html") published.push({ path: path56, role: "inspect-sheet" });
+      else if (/-mount-failure\.png$/.test(name)) excluded.push({ path: path56, reason: "harness failure diagnostic (regenerated every verify run, never published)" });
       else {
         const hit = EVIDENCE_PATTERNS.find((p) => p.re.test(name));
-        if (hit !== void 0) published.push({ path: path54, role: hit.role });
-        else unknown.push(path54);
+        if (hit !== void 0) published.push({ path: path56, role: hit.role });
+        else unknown.push(path56);
       }
       continue;
     }
-    if (name === opts.entry) published.push({ path: path54, role: "entry" });
-    else if (name === "styles.css") published.push({ path: path54, role: "styles" });
-    else if (name === "tokens.css") published.push({ path: path54, role: "tokens" });
-    else if (name === "fonts.css") published.push({ path: path54, role: "fonts" });
-    else if (name === "component.json") published.push({ path: path54, role: "manifest" });
+    if (name === opts.entry) published.push({ path: path56, role: "entry" });
+    else if (name === "styles.css") published.push({ path: path56, role: "styles" });
+    else if (name === "tokens.css") published.push({ path: path56, role: "tokens" });
+    else if (name === "fonts.css") published.push({ path: path56, role: "fonts" });
+    else if (name === "component.json") published.push({ path: path56, role: "manifest" });
     else {
       const skip = EXCLUDED.find((e) => e.test(name));
-      if (skip !== void 0) excluded.push({ path: path54, reason: skip.reason });
-      else unknown.push(path54);
+      if (skip !== void 0) excluded.push({ path: path56, reason: skip.reason });
+      else unknown.push(path56);
     }
   }
   const roles = new Set(published.map((p) => p.role));
@@ -6214,8 +6285,8 @@ function missingInspectCrops(sheetText, publishedPaths) {
   const held = new Set(publishedPaths);
   const missing = /* @__PURE__ */ new Set();
   for (const [, name] of sheetText.matchAll(/src="\.\/([^"]+)"/g)) {
-    const path54 = `${EVIDENCE_DIR}/${name}`;
-    if (!held.has(path54)) missing.add(path54);
+    const path56 = `${EVIDENCE_DIR}/${name}`;
+    if (!held.has(path56)) missing.add(path56);
   }
   return [...missing].sort();
 }
@@ -6323,10 +6394,10 @@ function readScoredFiles(report) {
   const entries = Object.entries(value);
   if (entries.length === 0) return void 0;
   const out = {};
-  for (const [path54, digest] of entries) {
-    if (path54 === "" || path54.startsWith("/") || path54.includes("..")) return void 0;
+  for (const [path56, digest] of entries) {
+    if (path56 === "" || path56.startsWith("/") || path56.includes("..")) return void 0;
     if (!isSetHash(digest)) return void 0;
-    out[path54] = digest;
+    out[path56] = digest;
   }
   return out;
 }
@@ -6334,11 +6405,11 @@ function compareScoredFiles(recorded, actual) {
   const missing = [];
   const unscored = [];
   const changed = [];
-  for (const [path54, digest] of Object.entries(recorded)) {
-    if (!(path54 in actual)) missing.push(path54);
-    else if (actual[path54] !== digest) changed.push(path54);
+  for (const [path56, digest] of Object.entries(recorded)) {
+    if (!(path56 in actual)) missing.push(path56);
+    else if (actual[path56] !== digest) changed.push(path56);
   }
-  for (const path54 of Object.keys(actual)) if (!(path54 in recorded)) unscored.push(path54);
+  for (const path56 of Object.keys(actual)) if (!(path56 in recorded)) unscored.push(path56);
   return { missing: missing.sort(), unscored: unscored.sort(), changed: changed.sort() };
 }
 function scoredRecordingSetHash(report) {
@@ -7317,7 +7388,7 @@ body{margin:0;background:rgb(${backdrop.join(",")})}
           inkRecall: 0,
           exact: { similarity: 0, inkRecall: 0 },
           pass: false,
-          error: `mount failed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`
+          error: `mount failed: ${describeMountError(err)}`
         })
       );
       const deadlineMs = timeoutMs + 1e4;
@@ -7361,6 +7432,7 @@ var init_bundle_score = __esm({
     init_effect_geometry();
     init_image_diff();
     init_font_faces();
+    init_mount_error();
     init_mount_limits();
     init_tasks();
     BAR = { sim: 0.95, ink: 0.95 };
@@ -7401,6 +7473,8 @@ var init_prelude = __esm({
 });
 
 // packages/verify/src/parity.ts
+import { writeFileSync as writeFileSync7 } from "node:fs";
+import path22 from "node:path";
 import { chromium as chromium6 } from "playwright-core";
 function getFontFaces3() {
   _fontFaces3 ??= fontFaceCss();
@@ -7445,6 +7519,8 @@ async function checkHoverParity(task, bundleDir, authority, opts = {}) {
       const rootCss = box === void 0 ? "#root{position:static;display:inline-block}" : `#root{width:${box.w}px;height:${box.h}px;position:absolute;left:20px;top:20px}
 #root > *{min-width:${box.w}px;min-height:${box.h}px}`;
       const viewport = box === void 0 ? { width: 900, height: 700 } : { width: box.w + 48, height: box.h + 48 };
+      let consoleTail = "";
+      let failureShot;
       const shoot = async (component, props, realHover) => {
         const html = `<!doctype html><html><head><meta charset="utf-8"><style>
 ${getFontFaces3()}
@@ -7456,13 +7532,23 @@ ${rootCss}
         const page = await browser.newPage({ viewport });
         try {
           page.setDefaultTimeout(timeoutMs);
+          const consoleOf = capturePageConsole(page);
           await page.route("**/*", (route) => route.request().url().startsWith("data:") ? route.continue() : route.abort());
           await page.setContent(html, { waitUntil: "load" });
           await page.waitForTimeout(250);
           const rendered = await page.evaluate("document.querySelector('#root > *') !== null");
           if (rendered !== true) return { error: `${cfg.component} rendered nothing` };
           if (realHover) {
-            await page.hover("#root > *", { timeout: 2e3 });
+            try {
+              await hoverWithBudget(page, "#root > *", opts.hoverBudgetMs ?? DEFAULT_HOVER_BUDGET_MS);
+            } catch (err) {
+              consoleTail = consoleOf();
+              try {
+                failureShot = await page.screenshot();
+              } catch {
+              }
+              throw err;
+            }
             await page.waitForTimeout(400);
           } else {
             await page.waitForTimeout(400);
@@ -7501,7 +7587,19 @@ ${rootCss}
           };
         }
         return { id: `parity:${cfg.rep}`, pass: true };
-      })().catch((err) => ({ id: `parity:${cfg.rep}`, pass: false, detail: `mount failed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` }));
+      })().catch((err) => {
+        let detail = `mount failed: ${describeMountError(err)}`;
+        if (consoleTail !== "") detail += ` | browser console: ${consoleTail}`;
+        if (failureShot !== void 0 && opts.failureShotDir !== void 0) {
+          const name = `parity-${cfg.rep}-mount-failure.png`;
+          try {
+            writeFileSync7(path22.join(opts.failureShotDir, name), failureShot);
+            detail += ` | failure screenshot: ${name}`;
+          } catch {
+          }
+        }
+        return { id: `parity:${cfg.rep}`, pass: false, detail };
+      });
       const result = await raceMountDeadline(
         work,
         deadlineMs,
@@ -7531,6 +7629,7 @@ var init_parity = __esm({
     init_candidate_css();
     init_behavior();
     init_font_faces();
+    init_mount_error();
     init_mount_limits();
     init_bundle_score();
   }
@@ -7538,8 +7637,8 @@ var init_parity = __esm({
 
 // packages/verify/src/composition.ts
 import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync16 } from "node:fs";
-import path22 from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import path23 from "node:path";
 import { build as build6 } from "esbuild";
 import { chromium as chromium7 } from "playwright-core";
 function getFontFaces4() {
@@ -7547,21 +7646,21 @@ function getFontFaces4() {
   return _fontFaces4;
 }
 async function compileInstrumentedMount(task, bundleDir, composedParts = []) {
-  const entryTsx = path22.join(bundleDir, task.entry);
-  if (!existsSync16(entryTsx)) return { error: `${task.entry} missing` };
-  const requireFromVerify = createRequire2(path22.join(VERIFY_PKG_DIR, "package.json"));
+  const entryTsx = path23.join(bundleDir, task.entry);
+  if (!existsSync17(entryTsx)) return { error: `${task.entry} missing` };
+  const requireFromVerify = createRequire2(path23.join(VERIFY_PKG_DIR, "package.json"));
   let realJsxPath;
   try {
     realJsxPath = requireFromVerify.resolve("react/jsx-runtime");
   } catch (err) {
-    return { error: `cannot resolve react/jsx-runtime: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` };
+    return { error: `cannot resolve react/jsx-runtime: ${describeMountError(err)}` };
   }
   const mountSrc = `
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
 import { __registerParts } from "react/jsx-runtime";
-import * as B from ${JSON.stringify(path22.resolve(entryTsx))};
-${composedParts.map((p, i) => `import * as CP${i} from ${JSON.stringify(path22.resolve(bundleDir, p.modulePath))};`).join("\n")}
+import * as B from ${JSON.stringify(path23.resolve(entryTsx))};
+${composedParts.map((p, i) => `import * as CP${i} from ${JSON.stringify(path23.resolve(bundleDir, p.modulePath))};`).join("\n")}
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown>; partComponents: string[] } }).__cfg;
 const pairs: Array<[unknown, string]> = [];
 for (const name of cfg.partComponents) {
@@ -7600,7 +7699,7 @@ if (root && Main) createRoot(root).render(createElement(Main, cfg.props));
     });
     return bundle.outputFiles[0]?.text ?? "";
   } catch (err) {
-    return { error: `does not compile: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` };
+    return { error: `does not compile: ${describeMountError(err)}` };
   }
 }
 function expectedParts(task, roles, mainSlug) {
@@ -7617,7 +7716,7 @@ function expectedParts(task, roles, mainSlug) {
 }
 function interiorRegions(setDir, roles) {
   const mains = roles.main;
-  const withInterior = mains.filter((m) => existsSync16(path22.join(setDir, m, "get_metadata_interior.json")));
+  const withInterior = mains.filter((m) => existsSync17(path23.join(setDir, m, "get_metadata_interior.json")));
   if (withInterior.length === 0) {
     return { unavailable: "no interior geometry recorded for any main (pre-obligation set) \u2014 re-record with `tendril record` to enable crop checks" };
   }
@@ -7681,7 +7780,7 @@ async function checkCropComposition(task, bundleDir, regions, opts = {}) {
         }
         return out;
       })().catch(
-        (err) => mainRegions.map((r) => ({ id: cropId(r), pass: false, similarity: 0, inkRecall: 0, detail: `mount failed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` }))
+        (err) => mainRegions.map((r) => ({ id: cropId(r), pass: false, similarity: 0, inkRecall: 0, detail: `mount failed: ${describeMountError(err)}` }))
       );
       const mainResults = await raceMountDeadline(
         work,
@@ -7788,7 +7887,7 @@ body{margin:0;padding:20px}
         } finally {
           await page.close();
         }
-      })().catch((err) => ({ id: `composition:${mainSlug}`, pass: false, detail: `mount failed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` }));
+      })().catch((err) => ({ id: `composition:${mainSlug}`, pass: false, detail: `mount failed: ${describeMountError(err)}` }));
       const result = await raceMountDeadline(
         work,
         deadlineMs,
@@ -7849,7 +7948,7 @@ body{margin:0;padding:20px}
         } finally {
           await page.close();
         }
-      })().catch((err) => ({ id: `composition:${exp.pairKey}:renders`, pass: false, detail: `mount failed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}` }));
+      })().catch((err) => ({ id: `composition:${exp.pairKey}:renders`, pass: false, detail: `mount failed: ${describeMountError(err)}` }));
       results.push(
         await raceMountDeadline(work, deadlineMs, () => ({ id: `composition:${exp.pairKey}:renders`, pass: false, detail: `mount deadline exceeded (${deadlineMs}ms)` }))
       );
@@ -7871,6 +7970,7 @@ var init_composition = __esm({
     init_candidate_css();
     init_font_faces();
     init_image_diff();
+    init_mount_error();
     init_mount_limits();
     init_paths();
     REAL_JSX_SPEC = "__tendril_real_jsx__";
@@ -7890,17 +7990,17 @@ export const jsxs = (t, p, k) => real.jsxs(t, inject(t, p), k);
 });
 
 // packages/verify/src/occlusion.ts
-import { existsSync as existsSync17 } from "node:fs";
-import path23 from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import path24 from "node:path";
 import { build as build7 } from "esbuild";
 import { chromium as chromium8 } from "playwright-core";
 async function compileTwoUp(task, bundleDir) {
-  const entryTsx = path23.join(bundleDir, task.entry);
-  if (!existsSync17(entryTsx)) return { error: `${task.entry} missing` };
+  const entryTsx = path24.join(bundleDir, task.entry);
+  if (!existsSync18(entryTsx)) return { error: `${task.entry} missing` };
   const src = `
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
-import * as B from ${JSON.stringify(path23.resolve(entryTsx))};
+import * as B from ${JSON.stringify(path24.resolve(entryTsx))};
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown> } }).__cfg;
 const C = (B as Record<string, unknown>)[cfg.component] as Parameters<typeof createElement>[0] | undefined;
 for (const id of ["first", "second"]) {
@@ -8137,6 +8237,7 @@ var init_src5 = __esm({
     init_tasks();
     init_prelude();
     init_mount_limits();
+    init_mount_error();
     init_font_collection();
     init_font_discovery();
     init_font_faces();
@@ -8151,23 +8252,23 @@ var init_src5 = __esm({
 });
 
 // packages/cli/src/environment.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "node:fs";
-import path24 from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "node:fs";
+import path25 from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function cliVersion() {
   try {
-    return JSON.parse(readFileSync16(path24.join(path24.dirname(fileURLToPath5(import.meta.url)), "..", "package.json"), "utf8")).version ?? "dev";
+    return JSON.parse(readFileSync17(path25.join(path25.dirname(fileURLToPath5(import.meta.url)), "..", "package.json"), "utf8")).version ?? "dev";
   } catch {
     return "dev";
   }
 }
 function environmentStamp(taskFamilies) {
-  const manifestPath2 = path24.join(fontCacheDir(), "manifest.json");
+  const manifestPath2 = path25.join(fontCacheDir(), "manifest.json");
   let fontsHash = null;
-  if (existsSync18(manifestPath2)) {
+  if (existsSync19(manifestPath2)) {
     try {
-      const entries = JSON.parse(readFileSync16(manifestPath2, "utf8"));
+      const entries = JSON.parse(readFileSync17(manifestPath2, "utf8"));
       const scoped = taskFamilies === void 0 || taskFamilies === null ? entries : entries.filter((f) => taskFamilies.some((fam) => fam.toLowerCase() === f.family.toLowerCase()));
       const faces = scoped.map((f) => `${f.family}:${f.weight}:${f.sha256}`).sort();
       fontsHash = faces.length === 0 ? null : createHash5("sha256").update(faces.join("\n")).digest("hex").slice(0, 16);
@@ -8211,8 +8312,8 @@ var init_describe = __esm({
 });
 
 // packages/cli/src/env.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17 } from "node:fs";
-import path25 from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync18 } from "node:fs";
+import path26 from "node:path";
 function parseEnv(content) {
   const entries = /* @__PURE__ */ new Map();
   for (const line of content.split("\n")) {
@@ -8224,9 +8325,9 @@ function parseEnv(content) {
 function resolveCredential(name) {
   const fromProcess = process.env[name];
   if (fromProcess) return fromProcess;
-  const envPath = path25.resolve(process.env["INIT_CWD"] ?? process.cwd(), ".env");
-  if (!existsSync19(envPath)) return void 0;
-  return parseEnv(readFileSync17(envPath, "utf8")).get(name);
+  const envPath = path26.resolve(process.env["INIT_CWD"] ?? process.cwd(), ".env");
+  if (!existsSync20(envPath)) return void 0;
+  return parseEnv(readFileSync18(envPath, "utf8")).get(name);
 }
 var init_env = __esm({
   "packages/cli/src/env.ts"() {
@@ -8286,16 +8387,16 @@ var init_output = __esm({
 });
 
 // packages/cli/src/publish-client.ts
-import { chmodSync, existsSync as existsSync20, mkdirSync as mkdirSync4, readFileSync as readFileSync18, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync, existsSync as existsSync21, mkdirSync as mkdirSync4, readFileSync as readFileSync19, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import os4 from "node:os";
-import path26 from "node:path";
+import path27 from "node:path";
 function sessionPath() {
-  return process.env["TENDRIL_SESSION_PATH"] ?? path26.join(os4.homedir(), ".tendril", "session.json");
+  return process.env["TENDRIL_SESSION_PATH"] ?? path27.join(os4.homedir(), ".tendril", "session.json");
 }
 function readStoredSession(file = sessionPath()) {
-  if (!existsSync20(file)) return void 0;
+  if (!existsSync21(file)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync18(file, "utf8"));
+    const parsed = JSON.parse(readFileSync19(file, "utf8"));
     if (typeof parsed.origin !== "string" || typeof parsed.token !== "string") return void 0;
     return { origin: parsed.origin, token: parsed.token };
   } catch {
@@ -8303,13 +8404,13 @@ function readStoredSession(file = sessionPath()) {
   }
 }
 function writeStoredSession(session, file = sessionPath()) {
-  mkdirSync4(path26.dirname(file), { recursive: true });
-  writeFileSync7(file, `${JSON.stringify(session, null, 2)}
+  mkdirSync4(path27.dirname(file), { recursive: true });
+  writeFileSync8(file, `${JSON.stringify(session, null, 2)}
 `, { mode: 384 });
   chmodSync(file, 384);
 }
 function clearStoredSession(file = sessionPath()) {
-  if (existsSync20(file)) rmSync3(file);
+  if (existsSync21(file)) rmSync3(file);
 }
 function tokenFor(origin, file = sessionPath()) {
   const fromEnv = process.env["TENDRIL_TOKEN"];
@@ -8361,8 +8462,11 @@ var init_publish_client = __esm({
         this.token = options.token;
         this.send = options.fetch ?? globalThis.fetch;
       }
-      acceptTerms(input) {
-        return this.json("POST", "/api/consent", input);
+      requestApproval(input) {
+        return this.json("POST", "/api/publish-approvals", input);
+      }
+      pollApproval(input) {
+        return this.json("GET", `/api/publish-approvals/${encodeURIComponent(input.approvalId)}`, null, true);
       }
       begin(input) {
         return this.json("POST", "/api/publications", input, true);
@@ -8456,7 +8560,6 @@ var init_publish_client = __esm({
           refusal: typeof record["refusal"] === "string" ? record["refusal"] : `the portal refused with ${String(response.status)}`,
           ...Array.isArray(record["detail"]) ? { detail: record["detail"] } : {},
           ...Array.isArray(record["missing"]) ? { missing: record["missing"] } : {},
-          ...isRecord(record["needsConsent"]) ? { needsConsent: record["needsConsent"] } : {},
           ...isRecord(record["needsConfirmation"]) ? { needsConfirmation: record["needsConfirmation"] } : {}
         };
       }
@@ -8468,17 +8571,17 @@ var init_publish_client = __esm({
 });
 
 // packages/cli/src/entitlement.ts
-import { chmodSync as chmodSync2, existsSync as existsSync21, mkdirSync as mkdirSync5, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync22, mkdirSync as mkdirSync5, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "node:fs";
 import crypto from "node:crypto";
 import os5 from "node:os";
-import path27 from "node:path";
+import path28 from "node:path";
 function entitlementPath() {
-  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path27.join(os5.homedir(), ".tendril", "entitlement.json");
+  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path28.join(os5.homedir(), ".tendril", "entitlement.json");
 }
 function readStoredEntitlement(file = entitlementPath()) {
-  if (!existsSync21(file)) return void 0;
+  if (!existsSync22(file)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync19(file, "utf8"));
+    const parsed = JSON.parse(readFileSync20(file, "utf8"));
     if (typeof parsed.token !== "string" || typeof parsed.lastRefreshAt !== "number") return void 0;
     return { token: parsed.token, lastRefreshAt: parsed.lastRefreshAt };
   } catch {
@@ -8486,8 +8589,8 @@ function readStoredEntitlement(file = entitlementPath()) {
   }
 }
 function writeStoredEntitlement(stored, file = entitlementPath()) {
-  mkdirSync5(path27.dirname(file), { recursive: true });
-  writeFileSync8(file, `${JSON.stringify(stored, null, 2)}
+  mkdirSync5(path28.dirname(file), { recursive: true });
+  writeFileSync9(file, `${JSON.stringify(stored, null, 2)}
 `);
   chmodSync2(file, 384);
 }
@@ -8571,9 +8674,9 @@ var init_entitlement = __esm({
 
 // packages/cli/src/commands/doctor.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync20, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync21, readdirSync as readdirSync8 } from "node:fs";
 import os6 from "node:os";
-import path28 from "node:path";
+import path29 from "node:path";
 function withDeadline(work, ms) {
   return Promise.race([
     work,
@@ -8633,17 +8736,17 @@ async function runDoctorChecks(options) {
       remediation: "Install Google Chrome (or Chromium), or set CHROME_PATH to a Chromium-family browser binary."
     });
   }
-  const fontManifest = path28.join(fontCacheDir(), "manifest.json");
+  const fontManifest = path29.join(fontCacheDir(), "manifest.json");
   checks.push(
-    existsSync22(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync20(fontManifest, "utf8")).length} faces)` } : {
+    existsSync23(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync21(fontManifest, "utf8")).length} faces)` } : {
       name: "font-cache",
       ok: true,
       detail: `font cache empty at ${fontCacheDir()} \u2014 normal on a fresh machine; faces resolve per design system at first use`,
       remediation: `Nothing to do now: \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` fetches exactly what a recording declares, and generate/verify name that command \u2014 with the set filled in \u2014 when they need it.`
     }
   );
-  const pluginRoot = path28.join(os6.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
-  if (existsSync22(pluginRoot)) {
+  const pluginRoot = path29.join(os6.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
+  if (existsSync23(pluginRoot)) {
     try {
       const versions = readdirSync8(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
       const newest = versions.sort((a, b) => versionIsNewer(a, b) ? 1 : -1)[0];
@@ -9915,8 +10018,8 @@ var init_engine_curated = __esm({
 });
 
 // packages/generate/src/loop.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync7, readFileSync as readFileSync22, renameSync, writeFileSync as writeFileSync10 } from "node:fs";
-import path31 from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync7, readFileSync as readFileSync23, renameSync, writeFileSync as writeFileSync11 } from "node:fs";
+import path32 from "node:path";
 import { z as z13 } from "zod";
 function objective(scores, behaviors) {
   const vals = scores.map((s) => Math.min(s.similarity, s.inkRecall));
@@ -9958,9 +10061,9 @@ ${absentLines.join("\n")}` : ""}
 Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink credits a recorded pixel when ANY render ink lands within 1px of it, so ink=1 proves coverage \u2014 not presence, shape, or colour. A wrong-shaped mark over the right region, or a wrong-coloured one that is still ink, scores 1.000; and a recorded mark within ~30 channel-sum of the backdrop (#f6f6f6 on white is 27) is not ink at all, so it can be absent at ink 1.000 with no MISSING line. With ink=1 AND low sim, coverage held while pixels differ, so start with the TWO causes below \u2014 but never read ink=1 as "nothing is missing": confirm every faint or small recorded mark (hairlines, dividers, low-contrast controls) exists in your render. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
-  if (!existsSync24(path31.join(outDir, "run-log.json")) && !existsSync24(path31.join(outDir, "loop-state.json"))) return void 0;
+  if (!existsSync25(path32.join(outDir, "run-log.json")) && !existsSync25(path32.join(outDir, "loop-state.json"))) return void 0;
   let n = 1;
-  while (existsSync24(`${outDir}-prev-${n}`)) n += 1;
+  while (existsSync25(`${outDir}-prev-${n}`)) n += 1;
   renameSync(outDir, `${outDir}-prev-${n}`);
   return `${outDir}-prev-${n}`;
 }
@@ -9969,14 +10072,14 @@ async function runEngineLoop(opts) {
   const plateau = opts.plateau ?? 2;
   const progress = opts.onProgress ?? (() => {
   });
-  const statePath = path31.join(opts.outDir, "loop-state.json");
-  const resuming = opts.resume === true && existsSync24(statePath);
+  const statePath = path32.join(opts.outDir, "loop-state.json");
+  const resuming = opts.resume === true && existsSync25(statePath);
   if (!resuming) {
     const archived = archivePriorRun(opts.outDir);
     if (archived !== void 0) progress(`previous run archived to ${archived}`);
   }
   mkdirSync7(opts.outDir, { recursive: true });
-  const scratch = path31.join(opts.outDir, ".candidate");
+  const scratch = path32.join(opts.outDir, ".candidate");
   let attempts = [];
   let log = [];
   let best;
@@ -9984,7 +10087,7 @@ async function runEngineLoop(opts) {
   let nonAccepted = 0;
   let stopReason = "max-iterations";
   if (resuming) {
-    const restored = LoopStateSchema.parse(JSON.parse(readFileSync22(statePath, "utf8")));
+    const restored = LoopStateSchema.parse(JSON.parse(readFileSync23(statePath, "utf8")));
     attempts = restored.attempts;
     log = restored.iterations;
     spentUsd = restored.spentUsd;
@@ -9999,12 +10102,12 @@ async function runEngineLoop(opts) {
     progress(`resumed: ${log.length} iteration(s), $${spentUsd.toFixed(3)} spent, best pass=${best?.objective[0] ?? 0}`);
   }
   const persist = () => {
-    writeFileSync10(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
+    writeFileSync11(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
 `);
   };
   const writeCandidate = (files) => {
     mkdirSync7(scratch, { recursive: true });
-    for (const [name, content] of Object.entries(files)) writeFileSync10(path31.join(scratch, name), content);
+    for (const [name, content] of Object.entries(files)) writeFileSync11(path32.join(scratch, name), content);
   };
   const scoreCandidate = async (candidate, iter, usd, modelMs) => {
     writeCandidate(candidate.files);
@@ -10062,8 +10165,8 @@ async function runEngineLoop(opts) {
       const usd = candidate.usage?.usd ?? 0;
       spentUsd += usd;
       if (candidate.raw !== void 0) {
-        mkdirSync7(path31.join(opts.outDir, "responses"), { recursive: true });
-        writeFileSync10(path31.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
+        mkdirSync7(path32.join(opts.outDir, "responses"), { recursive: true });
+        writeFileSync11(path32.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
       }
       if (candidate.files[opts.entry] === void 0 || candidate.files["styles.css"] === void 0) {
         const finish = candidate.usage?.finishReason ?? "?";
@@ -10089,10 +10192,10 @@ async function runEngineLoop(opts) {
       }
     }
   }
-  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync10(path31.join(opts.outDir, name), content);
+  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync11(path32.join(opts.outDir, name), content);
   const final = best !== void 0 ? await opts.score(opts.outDir) : { scores: [], behaviors: [] };
-  writeFileSync10(
-    path31.join(opts.outDir, "run-log.json"),
+  writeFileSync11(
+    path32.join(opts.outDir, "run-log.json"),
     `${JSON.stringify(
       {
         ...opts.meta,
@@ -10159,8 +10262,8 @@ var init_loop2 = __esm({
 });
 
 // packages/generate/src/brief.ts
-import { existsSync as existsSync25, readFileSync as readFileSync23 } from "node:fs";
-import path32 from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync24 } from "node:fs";
+import path33 from "node:path";
 import { PNG as PNG3 } from "pngjs";
 function singleAxes2(name) {
   const parsed = parseVariantAxes(name);
@@ -10600,15 +10703,15 @@ function authorBehaviors(api, extras = {}) {
   };
 }
 function envelopeText(file) {
-  return envelopeFirstTextPart(JSON.parse(readFileSync23(file, "utf8")));
+  return envelopeFirstTextPart(JSON.parse(readFileSync24(file, "utf8")));
 }
 function metadataText(file) {
-  return envelopeTextContent(JSON.parse(readFileSync23(file, "utf8")));
+  return envelopeTextContent(JSON.parse(readFileSync24(file, "utf8")));
 }
 function dismissEvidence(setDir, repSlugs) {
   for (const slug of repSlugs) {
-    const f = path32.join(setDir, slug, "get_design_context.json");
-    if (!existsSync25(f)) continue;
+    const f = path33.join(setDir, slug, "get_design_context.json");
+    if (!existsSync26(f)) continue;
     const text = envelopeText(f);
     const propHit = /[{,]\s*(\w*dismiss\w*)\s*=\s*true\b/i.exec(text);
     if (propHit !== null) return { evidence: `emission prop "${propHit[1]}"`, visibleReps: [] };
@@ -10635,9 +10738,9 @@ function dismissEvidence(setDir, repSlugs) {
       const glyphIsTheComponent = (() => {
         const slugToCheck = vis.visibleIn[0];
         if (slugToCheck === void 0) return false;
-        const metaFile = path32.join(setDir, slugToCheck, "get_metadata.json");
+        const metaFile = path33.join(setDir, slugToCheck, "get_metadata.json");
         try {
-          const root = parseMetadataStructure(envelopeTextContent(JSON.parse(readFileSync23(metaFile, "utf8"))));
+          const root = parseMetadataStructure(envelopeTextContent(JSON.parse(readFileSync24(metaFile, "utf8"))));
           if (root.children.length !== 1) return false;
           const contains = (n) => normalizedLayerName(n.name) === norm2 || n.children.some(contains);
           return contains(root.children[0]);
@@ -10657,10 +10760,10 @@ function dismissEvidence(setDir, repSlugs) {
   return void 0;
 }
 function recordedReferencePng(setDir, slug) {
-  const f = path32.join(setDir, slug, "get_screenshot.json");
-  if (!existsSync25(f)) return void 0;
+  const f = path33.join(setDir, slug, "get_screenshot.json");
+  if (!existsSync26(f)) return void 0;
   try {
-    const env = JSON.parse(readFileSync23(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync24(f, "utf8")).content.find((c) => c.type === "image");
     return env?.data === void 0 ? void 0 : Uint8Array.from(Buffer.from(env.data, "base64"));
   } catch {
     return void 0;
@@ -10740,13 +10843,13 @@ function recordedFontNeeds(setDir, opts = {}) {
     }
   }
   const manifest = loadManifest(setDir);
-  const setDefs = path32.join(setDir, "get_variable_defs.json");
-  if (existsSync25(setDefs)) fromDefs(envelopeText(setDefs));
+  const setDefs = path33.join(setDir, "get_variable_defs.json");
+  if (existsSync26(setDefs)) fromDefs(envelopeText(setDefs));
   for (const rep of manifest.reps) {
-    const ctx = path32.join(setDir, rep.slug, "get_design_context.json");
-    if (existsSync25(ctx)) fromEmission(envelopeText(ctx));
-    const defs = path32.join(setDir, rep.slug, "get_variable_defs.json");
-    if (existsSync25(defs)) fromDefs(envelopeText(defs));
+    const ctx = path33.join(setDir, rep.slug, "get_design_context.json");
+    if (existsSync26(ctx)) fromEmission(envelopeText(ctx));
+    const defs = path33.join(setDir, rep.slug, "get_variable_defs.json");
+    if (existsSync26(defs)) fromDefs(envelopeText(defs));
   }
   return [...byFamily.entries()].map(([family, paired]) => {
     const weights = /* @__PURE__ */ new Set([...paired, ...opts.pairedOnly === true ? [] : unpaired]);
@@ -10757,10 +10860,10 @@ function symbolFontGlyphCount(setDir, reps) {
   const PUA = /[\uE000-\uF8FF\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}]/u;
   const glyphs = /* @__PURE__ */ new Set();
   for (const rep of reps) {
-    const file = path32.join(setDir, rep, "get_metadata.json");
-    if (!existsSync25(file)) continue;
+    const file = path33.join(setDir, rep, "get_metadata.json");
+    if (!existsSync26(file)) continue;
     try {
-      const text = JSON.parse(readFileSync23(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
+      const text = JSON.parse(readFileSync24(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
       for (const m of text.matchAll(/<text\s[^>]*name="([^"]*)"/g)) {
         const name = decodeXmlEntities(m[1]).replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16))).replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number(d)));
         if (PUA.test(name)) glyphs.add(name);
@@ -10786,8 +10889,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const propRep = [];
   const perRep = [];
   for (const slug of repSlugs) {
-    const f = path32.join(setDir, slug, "get_design_context.json");
-    if (!existsSync25(f)) continue;
+    const f = path33.join(setDir, slug, "get_design_context.json");
+    if (!existsSync26(f)) continue;
     const code = envelopeText(f);
     const props = /* @__PURE__ */ new Map();
     for (const m of code.matchAll(/[{,]\s*(\w+)\s*=\s*"((?:[^"\\]|\\.)*)"/g)) {
@@ -10813,8 +10916,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const axisValuesBySlug = /* @__PURE__ */ new Map();
   const valuesByAxis = /* @__PURE__ */ new Map();
   for (const slug of repSlugs) {
-    const metaFile = path32.join(setDir, slug, "get_metadata.json");
-    if (!existsSync25(metaFile)) continue;
+    const metaFile = path33.join(setDir, slug, "get_metadata.json");
+    if (!existsSync26(metaFile)) continue;
     const name = symbolName(metadataText(metaFile));
     if (name === void 0) continue;
     const values = /* @__PURE__ */ new Set();
@@ -10929,8 +11032,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   const poses = [];
   const missing = [];
   for (const rep of manifest.reps) {
-    const metaFile = path32.join(setDir, rep.slug, "get_metadata.json");
-    if (!existsSync25(metaFile)) {
+    const metaFile = path33.join(setDir, rep.slug, "get_metadata.json");
+    if (!existsSync26(metaFile)) {
       missing.push(rep.slug);
       continue;
     }
@@ -10944,8 +11047,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   if (missing.length > 0) {
     throw new Error(`recording set ${setDir} is missing metadata for ${missing.length} rep(s): ${missing.slice(0, 5).join(", ")}${missing.length > 5 ? ", \u2026" : ""}`);
   }
-  const setMeta = path32.join(setDir, "get_metadata.json");
-  const latticeNames = manifest.latticeNames ?? (existsSync25(setMeta) ? [...metadataText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
+  const setMeta = path33.join(setDir, "get_metadata.json");
+  const latticeNames = manifest.latticeNames ?? (existsSync26(setMeta) ? [...metadataText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
   const defaults = { ...manifest.defaults ?? {}, ...opts.defaults ?? {} };
   const recordedFonts = recordedFontFamilies(setDir);
   const textSlots = recordedTextSlots(setDir, manifest.reps.map((r) => r.slug));
@@ -11146,17 +11249,17 @@ var init_brief = __esm({
 });
 
 // packages/generate/src/segments.ts
-import { existsSync as existsSync26, readFileSync as readFileSync24, readdirSync as readdirSync10 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync25, readdirSync as readdirSync10 } from "node:fs";
+import path34 from "node:path";
 function repText(set, rep, tool) {
-  const env = JSON.parse(readFileSync24(path33.join(set, rep, `${tool}.json`), "utf8"));
+  const env = JSON.parse(readFileSync25(path34.join(set, rep, `${tool}.json`), "utf8"));
   return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function refPngDims(set, rep) {
-  const f = path33.join(set, rep, "get_screenshot.json");
-  if (!existsSync26(f)) return void 0;
+  const f = path34.join(set, rep, "get_screenshot.json");
+  if (!existsSync27(f)) return void 0;
   try {
-    const env = JSON.parse(readFileSync24(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync25(f, "utf8")).content.find((c) => c.type === "image");
     if (env?.data === void 0) return void 0;
     const buf = Buffer.from(env.data, "base64");
     if (buf.length < 24 || buf.readUInt32BE(0) !== 2303741511) return void 0;
@@ -11222,20 +11325,20 @@ DROPPED from the map, untrustworthy in the source export \u2014 for these, each
 }
 function buildSegments(task, mode = "fenced") {
   const SET = task.set;
-  let defsRecorded = existsSync26(path33.join(SET, "get_variable_defs.json"));
+  let defsRecorded = existsSync27(path34.join(SET, "get_variable_defs.json"));
   let rawDefs = {};
-  if (existsSync26(path33.join(SET, "get_variable_defs.json"))) {
-    const text = envelopeFirstTextPart(JSON.parse(readFileSync24(path33.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
+  if (existsSync27(path34.join(SET, "get_variable_defs.json"))) {
+    const text = envelopeFirstTextPart(JSON.parse(readFileSync25(path34.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
     try {
       rawDefs = JSON.parse(text);
     } catch {
     }
   } else {
     for (const cfg of task.configs) {
-      const f = path33.join(SET, cfg.rep, "get_variable_defs.json");
-      if (!existsSync26(f)) continue;
+      const f = path34.join(SET, cfg.rep, "get_variable_defs.json");
+      if (!existsSync27(f)) continue;
       defsRecorded = true;
-      const text = envelopeFirstTextPart(JSON.parse(readFileSync24(f, "utf8"))) || "{}";
+      const text = envelopeFirstTextPart(JSON.parse(readFileSync25(f, "utf8"))) || "{}";
       try {
         for (const [k, v] of Object.entries(JSON.parse(text))) rawDefs[k] ??= v;
       } catch {
@@ -11243,8 +11346,8 @@ function buildSegments(task, mode = "fenced") {
     }
   }
   const emissionTexts = task.configs.map((cfg) => {
-    const f = path33.join(SET, cfg.rep, "get_design_context.json");
-    return existsSync26(f) ? envelopeFirstTextPart(JSON.parse(readFileSync24(f, "utf8"))) : "";
+    const f = path34.join(SET, cfg.rep, "get_design_context.json");
+    return existsSync27(f) ? envelopeFirstTextPart(JSON.parse(readFileSync25(f, "utf8"))) : "";
   });
   const { map, note } = cleanTokenMap(rawDefs, emissionTexts);
   const defs = JSON.stringify(map, null, 1);
@@ -11262,9 +11365,9 @@ TOKEN MAP NEVER RECORDED: this set holds no get_variable_defs envelope, so wheth
   for (const cfg of task.configs) {
     const meta = stripFigmaInstructions(repText(SET, cfg.rep, "get_metadata"));
     const emission = stripFigmaInstructions(repText(SET, cfg.rep, "get_design_context"));
-    const assets = readdirSync10(path33.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
+    const assets = readdirSync10(path34.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
 \`\`\`svg
-${readFileSync24(path33.join(SET, cfg.rep, f), "utf8")}
+${readFileSync25(path34.join(SET, cfg.rep, f), "utf8")}
 \`\`\``).join("\n");
     const refNote = (() => {
       const dims = refPngDims(SET, cfg.rep);
@@ -11300,7 +11403,7 @@ Optionally a third block with \`/* FILE: tokens.css */\`.`);
   } else {
     parts.push(`
 ## Output format
-Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path33.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
+Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path34.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
   }
   return parts.join("\n");
 }
@@ -11368,8 +11471,8 @@ var init_adapter = __esm({
 
 // packages/generate/src/bundle-emit.ts
 import { createHash as createHash6 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync27, mkdirSync as mkdirSync8, readFileSync as readFileSync25, readdirSync as readdirSync11, rmSync as rmSync4, writeFileSync as writeFileSync11 } from "node:fs";
-import path34 from "node:path";
+import { copyFileSync, existsSync as existsSync28, mkdirSync as mkdirSync8, readFileSync as readFileSync26, readdirSync as readdirSync11, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
+import path35 from "node:path";
 function pinFromConfigs(configs) {
   const domains = /* @__PURE__ */ new Map();
   const kinds = /* @__PURE__ */ new Map();
@@ -11438,9 +11541,9 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   const notices = [];
   const licenseTexts = /* @__PURE__ */ new Map();
   for (const face of faces) {
-    const src = path34.join(cacheDir, path34.basename(face.file));
-    const target = `./fonts/${path34.basename(face.file)}`;
-    const format = FONT_FORMATS[path34.extname(face.file).toLowerCase()] ?? "truetype";
+    const src = path35.join(cacheDir, path35.basename(face.file));
+    const target = `./fonts/${path35.basename(face.file)}`;
+    const format = FONT_FORMATS[path35.extname(face.file).toLowerCase()] ?? "truetype";
     const family = face.family.replace(/['\\]/g, "").replace(/\*\//g, "");
     const decl = `@font-face { font-family: '${family}'; font-weight: ${face.weight}; font-style: normal; src: url(${target}) format('${format}'); }`;
     const license = normalizeFontLicense(face.license);
@@ -11478,14 +11581,14 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
           `/* ${decl} */`
         );
       }
-    } else if (existsSync27(src) && createHash6("sha256").update(readFileSync25(src)).digest("hex") === face.sha256) {
-      mkdirSync8(path34.join(bundleDir, "fonts"), { recursive: true });
-      copyFileSync(src, path34.join(bundleDir, "fonts", path34.basename(face.file)));
+    } else if (existsSync28(src) && createHash6("sha256").update(readFileSync26(src)).digest("hex") === face.sha256) {
+      mkdirSync8(path35.join(bundleDir, "fonts"), { recursive: true });
+      copyFileSync(src, path35.join(bundleDir, "fonts", path35.basename(face.file)));
       licenseTexts.set(terms.file, terms.text);
       const upstream = upstreamAttribution(face);
       notices.push(
         "",
-        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path34.basename(face.file)}`,
+        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path35.basename(face.file)}`,
         `  licence:   ${terms.title} \u2014 full text in ./${terms.file}`,
         `  source:    ${face.source}`,
         `  sha256:    ${face.sha256}`,
@@ -11499,9 +11602,9 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   }
   if (lines.length === 0) return null;
   if (notices.length > 0) {
-    const fontsDir = path34.join(bundleDir, "fonts");
-    for (const [file, text] of licenseTexts) writeFileSync11(path34.join(fontsDir, file), text);
-    writeFileSync11(path34.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
+    const fontsDir = path35.join(bundleDir, "fonts");
+    for (const [file, text] of licenseTexts) writeFileSync12(path35.join(fontsDir, file), text);
+    writeFileSync12(path35.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
 `);
     header.push(
       "/* REDISTRIBUTION: the face files in ./fonts/ are redistributed under the licences",
@@ -11513,10 +11616,10 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
 `;
 }
 function countLatticeSymbols(setDir) {
-  const manifestFile = path34.join(setDir, "recording-set.json");
-  if (existsSync27(manifestFile)) {
+  const manifestFile = path35.join(setDir, "recording-set.json");
+  if (existsSync28(manifestFile)) {
     try {
-      const stored = JSON.parse(readFileSync25(manifestFile, "utf8"));
+      const stored = JSON.parse(readFileSync26(manifestFile, "utf8"));
       if (stored.variantScope !== "component-set") return null;
       const lattice = stored.latticeNames;
       if (lattice !== void 0 && lattice.length > 0) return lattice.length;
@@ -11524,13 +11627,13 @@ function countLatticeSymbols(setDir) {
     }
   }
   const files = [
-    path34.join(setDir, "get_metadata.json"),
-    ...existsSync27(setDir) ? readdirSync11(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path34.join(setDir, f)) : []
-  ].filter((f) => existsSync27(f));
+    path35.join(setDir, "get_metadata.json"),
+    ...existsSync28(setDir) ? readdirSync11(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path35.join(setDir, f)) : []
+  ].filter((f) => existsSync28(f));
   if (files.length === 0) return null;
   let count = 0;
   for (const f of files) {
-    const text = envelopeTextContent(JSON.parse(readFileSync25(f, "utf8")));
+    const text = envelopeTextContent(JSON.parse(readFileSync26(f, "utf8")));
     count += [...text.matchAll(/name="([^"]*)"/g)].filter((m) => m[1].includes("=")).length;
   }
   return count > 0 ? count : null;
@@ -11538,21 +11641,21 @@ function countLatticeSymbols(setDir) {
 function recordingSetHash(setDir, configs) {
   const relPaths = [];
   for (const name of ["recording-set.json", "completeness-manifest.json", "get_variable_defs.json", "get_metadata.json"]) {
-    if (existsSync27(path34.join(setDir, name))) relPaths.push(name);
+    if (existsSync28(path35.join(setDir, name))) relPaths.push(name);
   }
   for (const cfg of configs) {
     for (const f of ["get_design_context.json", "get_metadata.json", "get_screenshot.json", "get_variable_defs.json"]) {
-      if (existsSync27(path34.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
+      if (existsSync28(path35.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
     }
-    if (existsSync27(path34.join(setDir, cfg.rep))) {
-      for (const asset of readdirSync11(path34.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
+    if (existsSync28(path35.join(setDir, cfg.rep))) {
+      for (const asset of readdirSync11(path35.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
         relPaths.push(`${cfg.rep}/${asset}`);
       }
     }
   }
   return hashRecordingSet(
     relPaths,
-    (p) => new Uint8Array(readFileSync25(path34.join(setDir, p))),
+    (p) => new Uint8Array(readFileSync26(path35.join(setDir, p))),
     (chunks) => {
       const h = createHash6("sha256");
       for (const c of chunks) h.update(c);
@@ -11593,8 +11696,8 @@ function emitBundleV1(opts) {
   const prelude = opts.behaviors.filter((b) => b.id.startsWith("prelude:"));
   const parity = opts.behaviors.filter((b) => b.id.startsWith("parity:"));
   const contract = opts.behaviors.filter((b) => CONTRACT_CHECK_IDS.has(b.id));
-  const cssFiles = ["styles.css", "tokens.css"].map((f) => path34.join(opts.bundleDir, f)).filter((f) => existsSync27(f));
-  const families = cssFontFamilies(cssFiles.map((f) => readFileSync25(f, "utf8")).join("\n"));
+  const cssFiles = ["styles.css", "tokens.css"].map((f) => path35.join(opts.bundleDir, f)).filter((f) => existsSync28(f));
+  const families = cssFontFamilies(cssFiles.map((f) => readFileSync26(f, "utf8")).join("\n"));
   const requiredFonts = requiredFontsManifest(families, opts.fontCacheDir).map((f) => ({
     family: f.family,
     weight: f.weight,
@@ -11623,7 +11726,7 @@ function emitBundleV1(opts) {
         // resolvable via verify's --set override).
         path: (() => {
           const base = process.env["INIT_CWD"] ?? process.cwd();
-          const rel = path34.relative(base, opts.task.set);
+          const rel = path35.relative(base, opts.task.set);
           return rel !== "" && !rel.startsWith("..") ? rel : opts.task.set;
         })(),
         component: opts.componentName,
@@ -11660,25 +11763,25 @@ function emitBundleV1(opts) {
     })
   };
   const written = [];
-  const manifestPath2 = path34.join(opts.bundleDir, "component.json");
-  writeFileSync11(manifestPath2, `${JSON.stringify(manifest, null, 2)}
+  const manifestPath2 = path35.join(opts.bundleDir, "component.json");
+  writeFileSync12(manifestPath2, `${JSON.stringify(manifest, null, 2)}
 `);
   written.push(manifestPath2);
-  const stylesPath = path34.join(opts.bundleDir, "styles.css");
-  if (existsSync27(stylesPath)) {
+  const stylesPath = path35.join(opts.bundleDir, "styles.css");
+  if (existsSync28(stylesPath)) {
     const comment = cssProvenanceComment({ pass, scored: statuses.length, certified, latticeConfigs: lattice });
-    const current = readFileSync25(stylesPath, "utf8");
+    const current = readFileSync26(stylesPath, "utf8");
     const stripped = current.replace(/^\/\* tendril bundle v\d+ [^]*?\*\/\n/, "");
-    writeFileSync11(stylesPath, `${comment}
+    writeFileSync12(stylesPath, `${comment}
 ${stripped}`);
     written.push(stylesPath);
   }
-  const fontsCssPath = path34.join(opts.bundleDir, "fonts.css");
-  rmSync4(path34.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
+  const fontsCssPath = path35.join(opts.bundleDir, "fonts.css");
+  rmSync4(path35.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
   rmSync4(fontsCssPath, { force: true });
   const fontsCss = fontsCssFor(requiredFontsManifest(families, opts.fontCacheDir), opts.bundleDir, opts.fontCacheDir, opts.substitutedFamilies ?? []);
   if (fontsCss !== null) {
-    writeFileSync11(fontsCssPath, fontsCss);
+    writeFileSync12(fontsCssPath, fontsCss);
     written.push(fontsCssPath);
   }
   const unrecorded = lattice === null ? null : Math.max(0, lattice - statuses.length);
@@ -12107,8 +12210,8 @@ DEALINGS IN THE FONT SOFTWARE.
 
 // packages/generate/src/compose-pins.ts
 import { createHash as createHash7 } from "node:crypto";
-import { existsSync as existsSync28, readFileSync as readFileSync26, readdirSync as readdirSync12, realpathSync as realpathSync3, statSync as statSync4 } from "node:fs";
-import path35 from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync27, readdirSync as readdirSync12, realpathSync as realpathSync3, statSync as statSync4 } from "node:fs";
+import path36 from "node:path";
 function bundleDirs(roots, depth = 4) {
   const found = [];
   const seen = /* @__PURE__ */ new Set();
@@ -12117,11 +12220,11 @@ function bundleDirs(roots, depth = 4) {
     try {
       key = realpathSync3(dir);
     } catch {
-      key = path35.resolve(dir);
+      key = path36.resolve(dir);
     }
     if (seen.has(key)) return;
     seen.add(key);
-    if (existsSync28(path35.join(dir, "component.json"))) {
+    if (existsSync29(path36.join(dir, "component.json"))) {
       found.push(key);
       return;
     }
@@ -12134,14 +12237,14 @@ function bundleDirs(roots, depth = 4) {
     }
     for (const e of entries) {
       if (e === "node_modules" || e.startsWith(".")) continue;
-      const full = path35.join(dir, e);
+      const full = path36.join(dir, e);
       try {
         if (statSync4(full).isDirectory()) walk2(full, remaining - 1);
       } catch {
       }
     }
   };
-  for (const r of roots) walk2(path35.resolve(r), depth);
+  for (const r of roots) walk2(path36.resolve(r), depth);
   return found;
 }
 function composedPins(hostSet, libraryRoots) {
@@ -12160,7 +12263,7 @@ function composedPins(hostSet, libraryRoots) {
     let pinned = false;
     const failures = [];
     for (const rel of partnerRels) {
-      const partnerSet = path35.resolve(hostSet, rel);
+      const partnerSet = path36.resolve(hostSet, rel);
       let partnerTask;
       let partnerManifest;
       try {
@@ -12189,7 +12292,7 @@ function composedPins(hostSet, libraryRoots) {
       const wantHash = recordingSetHash(partnerSet, partnerTask.configs);
       const matches = candidates.filter((dir) => {
         try {
-          const parsed = readBundleManifest(readFileSync26(path35.join(dir, "component.json"), "utf8"));
+          const parsed = readBundleManifest(readFileSync27(path36.join(dir, "component.json"), "utf8"));
           return parsed.manifest?.provenance.recordingSet.hash === wantHash;
         } catch {
           return false;
@@ -12202,13 +12305,13 @@ function composedPins(hostSet, libraryRoots) {
         continue;
       }
       if (matches.length > 1) {
-        failures.push(`${rel}: ${matches.length} bundles join the same recording hash (${matches.map((m) => path35.basename(m)).join(", ")}) \u2014 ambiguous; remove or point --library away from the duplicates`);
+        failures.push(`${rel}: ${matches.length} bundles join the same recording hash (${matches.map((m) => path36.basename(m)).join(", ")}) \u2014 ambiguous; remove or point --library away from the duplicates`);
         continue;
       }
       const bundleDir = matches[0];
       let manifest;
       try {
-        manifest = readBundleManifest(readFileSync26(path35.join(bundleDir, "component.json"), "utf8")).manifest;
+        manifest = readBundleManifest(readFileSync27(path36.join(bundleDir, "component.json"), "utf8")).manifest;
       } catch {
         manifest = void 0;
       }
@@ -12225,8 +12328,8 @@ function composedPins(hostSet, libraryRoots) {
       const moduleFiles = [];
       let fileIssue;
       for (const name of [manifest.entry, "styles.css", "tokens.css", "fonts.css"]) {
-        const file = path35.join(bundleDir, name);
-        if (!existsSync28(file)) {
+        const file = path36.join(bundleDir, name);
+        if (!existsSync29(file)) {
           if (name === manifest.entry || name === "styles.css") {
             fileIssue = `${rel}: partner bundle is missing ${name}`;
             break;
@@ -12235,7 +12338,7 @@ function composedPins(hostSet, libraryRoots) {
         }
         let bytes;
         try {
-          bytes = readFileSync26(file);
+          bytes = readFileSync27(file);
         } catch {
           fileIssue = `${rel}: partner file ${name} at ${bundleDir} is unreadable`;
           break;
@@ -12307,14 +12410,14 @@ function composedChecks(candidateDir, hostEntry, pins) {
   const checks = [];
   let entrySource = "";
   try {
-    entrySource = readFileSync26(path35.join(candidateDir, hostEntry), "utf8");
+    entrySource = readFileSync27(path36.join(candidateDir, hostEntry), "utf8");
   } catch {
   }
-  const candidateRoot = path35.resolve(candidateDir);
+  const candidateRoot = path36.resolve(candidateDir);
   for (const pin of pins) {
     const dir = composedModuleDir(pin.partnerName);
-    const resolvedDir = path35.resolve(candidateDir, dir);
-    if (!resolvedDir.startsWith(candidateRoot + path35.sep)) {
+    const resolvedDir = path36.resolve(candidateDir, dir);
+    if (!resolvedDir.startsWith(candidateRoot + path36.sep)) {
       checks.push({ id: `composition:${pin.pairKey}:module-verbatim`, pass: false, detail: `pin path ${dir}/ escapes the candidate directory \u2014 refused` });
       checks.push({ id: `composition:${pin.pairKey}:imported`, pass: false, detail: `pin path ${dir}/ escapes the candidate directory \u2014 refused` });
       continue;
@@ -12325,12 +12428,12 @@ function composedChecks(candidateDir, hostEntry, pins) {
         wrong.push(`${f.name} refused (not a plain path segment)`);
         continue;
       }
-      const target = path35.join(candidateDir, dir, f.name);
-      if (!existsSync28(target)) {
+      const target = path36.join(candidateDir, dir, f.name);
+      if (!existsSync29(target)) {
         wrong.push(`${f.name} missing`);
         continue;
       }
-      const sha = createHash7("sha256").update(readFileSync26(target)).digest("hex");
+      const sha = createHash7("sha256").update(readFileSync27(target)).digest("hex");
       if (sha !== f.sha256) wrong.push(`${f.name} differs from the pinned partner bytes`);
     }
     checks.push({
@@ -12355,10 +12458,10 @@ function rootClassesFor(emission, nodeId) {
 }
 function regionOverrides(hostSet, partnerSet, instances) {
   const read = (setDir, rep) => {
-    const f = path35.join(setDir, rep, "get_design_context.json");
-    if (!existsSync28(f)) return void 0;
+    const f = path36.join(setDir, rep, "get_design_context.json");
+    if (!existsSync29(f)) return void 0;
     try {
-      return envelopeFirstTextPart(JSON.parse(readFileSync26(f, "utf8")));
+      return envelopeFirstTextPart(JSON.parse(readFileSync27(f, "utf8")));
     } catch {
       return void 0;
     }
@@ -12388,7 +12491,7 @@ var init_compose_pins = __esm({
     init_src4();
     init_brief();
     init_bundle_emit();
-    composedModuleDir = (partnerName) => path35.posix.join("composed", partnerName);
+    composedModuleDir = (partnerName) => path36.posix.join("composed", partnerName);
     safeSegment = (s) => /^[A-Za-z0-9][A-Za-z0-9._ -]*$/.test(s) && !s.includes("..");
     MAX_PINNED_FILE_BYTES = 1024 * 1024;
     CONTEXT_LAYOUT_TOKENS = /* @__PURE__ */ new Set(["shrink-0", "grow", "flex-1", "basis-0", "self-stretch", "w-full", "h-full"]);
@@ -12396,8 +12499,8 @@ var init_compose_pins = __esm({
 });
 
 // packages/generate/src/motion.ts
-import { existsSync as existsSync29, readFileSync as readFileSync27, readdirSync as readdirSync13, statSync as statSync5 } from "node:fs";
-import path36 from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync28, readdirSync as readdirSync13, statSync as statSync5 } from "node:fs";
+import path37 from "node:path";
 function springProgress(u, bounce) {
   const decay = Math.log(100);
   if (bounce <= 0) {
@@ -12468,10 +12571,10 @@ function reportsNoMotion(text) {
   });
 }
 function motionTruthFor(setDir) {
-  const file = path36.join(setDir, "get_motion_context.json");
-  if (existsSync29(file) && usableEnvelope(file, "get_motion_context").ok) {
+  const file = path37.join(setDir, "get_motion_context.json");
+  if (existsSync30(file) && usableEnvelope(file, "get_motion_context").ok) {
     try {
-      const text = envelopeTextContent(JSON.parse(readFileSync27(file, "utf8")));
+      const text = envelopeTextContent(JSON.parse(readFileSync28(file, "utf8")));
       if (text.trim() === "") return { state: "recorded-empty" };
       return reportsNoMotion(text) ? { state: "recorded-no-motion", text } : { state: "recorded", text };
     } catch {
@@ -12484,21 +12587,21 @@ function motionTruthFor(setDir) {
   }
 }
 function motionDisclosure(bundleDir, setDir) {
-  const sheets = ["styles.css", "tokens.css"].map((f) => path36.join(bundleDir, f));
-  const composedRoot = path36.join(bundleDir, "composed");
+  const sheets = ["styles.css", "tokens.css"].map((f) => path37.join(bundleDir, f));
+  const composedRoot = path37.join(bundleDir, "composed");
   try {
     for (const entry of readdirSync13(composedRoot).sort()) {
-      const dir = path36.join(composedRoot, entry);
+      const dir = path37.join(composedRoot, entry);
       try {
         if (!statSync5(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      sheets.push(path36.join(dir, "styles.css"), path36.join(dir, "tokens.css"));
+      sheets.push(path37.join(dir, "styles.css"), path37.join(dir, "tokens.css"));
     }
   } catch {
   }
-  const css = sheets.filter((f) => existsSync29(f)).map((f) => readFileSync27(f, "utf8")).join("\n");
+  const css = sheets.filter((f) => existsSync30(f)).map((f) => readFileSync28(f, "utf8")).join("\n");
   if (!MOTION_CSS_PATTERN.test(scannableCss(css))) return { present: false };
   return {
     present: true,
@@ -12865,12 +12968,12 @@ var init_components = __esm({
 
 // packages/generate/src/codebase/walk.ts
 import fs2 from "node:fs";
-import path37 from "node:path";
+import path38 from "node:path";
 function resolvedPathIsExcluded(real, roots) {
-  if (isNeverRead(path37.basename(real))) return true;
+  if (isNeverRead(path38.basename(real))) return true;
   for (const root of roots) {
-    if (real !== root && !real.startsWith(root + path37.sep)) continue;
-    for (const segment of path37.relative(root, real).split(path37.sep).slice(0, -1)) {
+    if (real !== root && !real.startsWith(root + path38.sep)) continue;
+    for (const segment of path38.relative(root, real).split(path38.sep).slice(0, -1)) {
       if (segment.startsWith(".") || EXCLUDED_DIRS.has(segment)) return true;
     }
   }
@@ -12884,7 +12987,7 @@ function containedRealpath(abs, roots) {
     return null;
   }
   for (const root of roots) {
-    if (real === root || real.startsWith(root + path37.sep)) return real;
+    if (real === root || real.startsWith(root + path38.sep)) return real;
   }
   return null;
 }
@@ -12917,7 +13020,7 @@ function walkRepo(roots, limits, accept) {
         continue;
       }
       for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-        const abs = path37.join(frame.dir, entry.name);
+        const abs = path38.join(frame.dir, entry.name);
         if (EXCLUDED_DIRS.has(entry.name)) continue;
         if (isNeverRead(entry.name)) continue;
         const real = containedRealpath(abs, realRoots);
@@ -13005,18 +13108,18 @@ var init_walk = __esm({
       /^\.netrc$/i
     ];
     isNeverRead = (basename) => NEVER_READ.some((re) => re.test(basename));
-    toRel = (root, abs) => path37.relative(root, abs).split(path37.sep).join(path37.posix.sep);
+    toRel = (root, abs) => path38.relative(root, abs).split(path38.sep).join(path38.posix.sep);
   }
 });
 
 // packages/generate/src/codebase/scan.ts
 import crypto2 from "node:crypto";
 import fs3 from "node:fs";
-import path38 from "node:path";
+import path39 from "node:path";
 import postcss3 from "postcss";
 function scanCodebase(options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const roots = options.roots.map((r) => path38.resolve(r));
+  const roots = options.roots.map((r) => path39.resolve(r));
   const walk2 = walkRepo(
     roots,
     {
@@ -13036,7 +13139,7 @@ function scanCodebase(options) {
   let bytesRead = 0;
   let filesRead = 0;
   for (const file of walk2.files) {
-    const base = path38.posix.basename(file.rel);
+    const base = path39.posix.basename(file.rel);
     configFiles.add(file.rel);
     if (/^tailwind\.config\./.test(base) || file.rel === "babel.config.js") continue;
     const text = readTextFile(file.abs);
@@ -13052,7 +13155,7 @@ function scanCodebase(options) {
   }
   const css = extractCssCustomProperties(cssFiles.filter((f) => !f.rel.includes("..")));
   const components = scanComponents(componentFiles);
-  const packages = manifests.filter((m) => path38.posix.basename(m.rel) === "package.json");
+  const packages = manifests.filter((m) => path39.posix.basename(m.rel) === "package.json");
   const styling = detectStyling(configFiles, cssFiles, componentFiles, manifests);
   const classNameStyle = representativeClassNames(cssFiles, css.unparsed.length);
   const disclosures = buildDisclosures(
@@ -13095,13 +13198,13 @@ function scanCodebase(options) {
     },
     components: {
       entries: components.entries.slice(0, PROFILE_LIMITS.maxComponents),
-      fileNaming: buildHistogram(componentFiles.map((f) => classifyFileName(path38.posix.basename(f.rel)))),
+      fileNaming: buildHistogram(componentFiles.map((f) => classifyFileName(path39.posix.basename(f.rel)))),
       directoryLayout: buildHistogram(componentFiles.map((f) => classifyDirectoryLayout(f.rel))),
       exportStyle: buildHistogram(components.entries.map((e) => e.exportStyle)),
       classNameStyle,
       colocation: buildHistogram(collectColocation(componentFiles, cssFiles)),
       barrelFiles: componentFiles.filter(
-        (f) => /^index\.[tj]sx?$/.test(path38.posix.basename(f.rel)) && isReExportOnly(f.text)
+        (f) => /^index\.[tj]sx?$/.test(path39.posix.basename(f.rel)) && isReExportOnly(f.text)
       ).length,
       refForwarding: {
         forwardRef: componentFiles.filter((f) => /\bforwardRef\s*[(<]/.test(f.text)).length,
@@ -13124,7 +13227,7 @@ function detectStyling(configFiles, cssFiles, componentFiles, manifests) {
   };
   const deps = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
-    if (path38.posix.basename(manifest.rel) !== "package.json") continue;
+    if (path39.posix.basename(manifest.rel) !== "package.json") continue;
     try {
       const parsed = JSON.parse(manifest.text);
       for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
@@ -13136,7 +13239,7 @@ function detectStyling(configFiles, cssFiles, componentFiles, manifests) {
     }
   }
   for (const cfg of configFiles) {
-    const base = path38.posix.basename(cfg);
+    const base = path39.posix.basename(cfg);
     if (/^tailwind\.config\./.test(base)) add("tailwind-v3", "file", cfg);
     if (base === "components.json") add("shadcn-style", "file", cfg);
   }
@@ -13194,8 +13297,8 @@ function collectClassNames(cssFiles) {
   return [...distinct].sort().map(classifyClassName);
 }
 function classifyDirectoryLayout(rel) {
-  const base = path38.posix.basename(rel).replace(/\.[^.]+$/, "");
-  const dir = path38.posix.basename(path38.posix.dirname(rel));
+  const base = path39.posix.basename(rel).replace(/\.[^.]+$/, "");
+  const dir = path39.posix.basename(path39.posix.dirname(rel));
   if (base === "index") return "component-dir";
   if (base === dir) return "component-dir";
   return "flat-file";
@@ -13219,7 +13322,7 @@ function detectFormatting(manifests, componentFiles) {
     (a, b) => a.rel.split("/").length - b.rel.split("/").length || a.rel.localeCompare(b.rel)
   );
   for (const manifest of byDepth) {
-    const base = path38.posix.basename(manifest.rel);
+    const base = path39.posix.basename(manifest.rel);
     if (!/^\.prettierrc/.test(base) && base !== "package.json") continue;
     try {
       const parsed = JSON.parse(manifest.text);
@@ -13237,7 +13340,7 @@ function detectFormatting(manifests, componentFiles) {
     }
   }
   for (const manifest of byDepth) {
-    if (path38.posix.basename(manifest.rel) !== ".editorconfig") continue;
+    if (path39.posix.basename(manifest.rel) !== ".editorconfig") continue;
     const style = /indent_style\s*=\s*(tab|space)/.exec(manifest.text)?.[1];
     const width = /indent_size\s*=\s*(\d+)/.exec(manifest.text)?.[1];
     if (style || width) {
@@ -13308,12 +13411,12 @@ function buildDisclosures(detected, css, cappedOut, unrepresentativeClassNames)
   return out;
 }
 function outPathIsGitIgnored(outPath) {
-  const dir = path38.dirname(outPath);
+  const dir = path39.dirname(outPath);
   try {
-    const ignoreFile = path38.join(path38.dirname(dir), ".gitignore");
+    const ignoreFile = path39.join(path39.dirname(dir), ".gitignore");
     if (!fs3.existsSync(ignoreFile)) return false;
     const patterns = fs3.readFileSync(ignoreFile, "utf8").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
-    const base = path38.basename(dir);
+    const base = path39.basename(dir);
     return patterns.some((p) => p === base || p === `${base}/` || p === `/${base}` || p === `/${base}/`);
   } catch {
     return false;
@@ -13460,8 +13563,8 @@ __export(profile_exports, {
   PROFILE_DESCRIPTION: () => PROFILE_DESCRIPTION,
   runProfile: () => runProfile
 });
-import { closeSync, constants, existsSync as existsSync30, mkdirSync as mkdirSync9, openSync, realpathSync as realpathSync4, writeFileSync as writeFileSync12 } from "node:fs";
-import path39 from "node:path";
+import { closeSync, constants, existsSync as existsSync31, mkdirSync as mkdirSync9, openSync, realpathSync as realpathSync4, writeFileSync as writeFileSync13 } from "node:fs";
+import path40 from "node:path";
 function escapesScanRoot(outPath, scanRoot) {
   const resolveExisting = (target) => {
     let cursor = target;
@@ -13469,23 +13572,23 @@ function escapesScanRoot(outPath, scanRoot) {
       try {
         return realpathSync4(cursor);
       } catch {
-        const parent = path39.dirname(cursor);
+        const parent = path40.dirname(cursor);
         if (parent === cursor) return cursor;
         cursor = parent;
       }
     }
   };
   const root = resolveExisting(scanRoot);
-  const dir = resolveExisting(path39.dirname(outPath));
-  return dir !== root && !dir.startsWith(root + path39.sep);
+  const dir = resolveExisting(path40.dirname(outPath));
+  return dir !== root && !dir.startsWith(root + path40.sep);
 }
 function runProfile(options) {
   if (options.describe) {
     printDescription(PROFILE_DESCRIPTION);
     return;
   }
-  const dir = path39.resolve(options.dir ?? ".");
-  if (!existsSync30(dir)) {
+  const dir = path40.resolve(options.dir ?? ".");
+  if (!existsSync31(dir)) {
     fail(options, ExitCode.InputValidation, {
       error: `no such directory: ${dir}`,
       code: "profile_dir_missing",
@@ -13493,7 +13596,7 @@ function runProfile(options) {
     });
   }
   const profile = scanCodebase({ roots: [dir], ...options.now ? { now: options.now } : {} });
-  const outPath = path39.resolve(options.out ?? path39.join(dir, "tendril-out", "codebase-profile.json"));
+  const outPath = path40.resolve(options.out ?? path40.join(dir, "tendril-out", "codebase-profile.json"));
   if (!options.dryRun) {
     if (options.out === void 0 && escapesScanRoot(outPath, dir)) {
       fail(options, ExitCode.InputValidation, {
@@ -13502,10 +13605,10 @@ function runProfile(options) {
         remediation: `\`tendril-out\` in that project is a symlink pointing outside it, so writing the profile there could overwrite an unrelated file. Remove the symlink, or choose an explicit destination: \`${tendrilCommand(`profile --dir ${quoteArg(dir)} --out ./codebase-profile.json`)}\`.`
       });
     }
-    mkdirSync9(path39.dirname(outPath), { recursive: true });
+    mkdirSync9(path40.dirname(outPath), { recursive: true });
     const handle = openSync(outPath, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 420);
     try {
-      writeFileSync12(handle, `${JSON.stringify(profile, null, 2)}
+      writeFileSync13(handle, `${JSON.stringify(profile, null, 2)}
 `, "utf8");
     } finally {
       closeSync(handle);
@@ -13567,7 +13670,7 @@ Written to ${outPath}
 `);
     if (!ignored) {
       process.stdout.write(
-        `  NOTE: ${path39.basename(path39.dirname(outPath))}/ is not gitignored here \u2014 add it to .gitignore, or this profile will show up in your next commit.
+        `  NOTE: ${path40.basename(path40.dirname(outPath))}/ is not gitignored here \u2014 add it to .gitignore, or this profile will show up in your next commit.
 `
       );
     }
@@ -13699,18 +13802,98 @@ var init_activate = __esm({
   }
 });
 
+// packages/cli/src/run-presence.ts
+import { createHash as createHash8 } from "node:crypto";
+import { existsSync as existsSync32, mkdirSync as mkdirSync10, readFileSync as readFileSync29, rmSync as rmSync5, writeFileSync as writeFileSync14 } from "node:fs";
+import path41 from "node:path";
+function presenceDir() {
+  return path41.join(path41.dirname(sessionPath()), "runs");
+}
+function presenceFile(componentName) {
+  return path41.join(presenceDir(), `${createHash8("sha256").update(componentName).digest("hex").slice(0, 16)}.json`);
+}
+function readCached(componentName) {
+  const file = presenceFile(componentName);
+  if (!existsSync32(file)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync29(file, "utf8"));
+    return typeof parsed.runId === "string" && typeof parsed.origin === "string" ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function post(origin, token, pathname, body, method = "POST") {
+  const response = await fetch(`${origin}${pathname}`, {
+    method,
+    headers: { authorization: `Bearer ${token}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) },
+    signal: AbortSignal.timeout(PRESENCE_TIMEOUT_MS)
+  });
+  if (!response.ok) throw new Error(String(response.status));
+  return response.json();
+}
+async function reportRunPresence(componentName, phase) {
+  try {
+    const session = readStoredSession();
+    if (session === void 0) return;
+    const cached2 = readCached(componentName);
+    if (cached2 !== void 0 && cached2.origin === session.origin) {
+      const beat = await post(session.origin, session.token, `/api/runs/${encodeURIComponent(cached2.runId)}`, { phase });
+      if (beat.alive === true) return;
+    }
+    const started = await post(session.origin, session.token, "/api/runs", { componentName, phase });
+    if (typeof started.runId !== "string") return;
+    mkdirSync10(presenceDir(), { recursive: true });
+    writeFileSync14(presenceFile(componentName), `${JSON.stringify({ runId: started.runId, origin: session.origin })}
+`, { mode: 384 });
+  } catch {
+  }
+}
+async function endRunPresence(componentName) {
+  try {
+    const session = readStoredSession();
+    const cached2 = readCached(componentName);
+    rmSync5(presenceFile(componentName), { force: true });
+    if (session === void 0 || cached2 === void 0 || cached2.origin !== session.origin) return;
+    await post(session.origin, session.token, `/api/runs/${encodeURIComponent(cached2.runId)}`, void 0, "DELETE");
+  } catch {
+  }
+}
+var PRESENCE_TIMEOUT_MS;
+var init_run_presence = __esm({
+  "packages/cli/src/run-presence.ts"() {
+    "use strict";
+    init_publish_client();
+    PRESENCE_TIMEOUT_MS = 1500;
+  }
+});
+
 // packages/cli/src/commands/compose.ts
 var compose_exports = {};
 __export(compose_exports, {
   COMPOSE_DESCRIPTION: () => COMPOSE_DESCRIPTION,
+  IMPLICIT_PARENT_SCAN_MAX_ENTRIES: () => IMPLICIT_PARENT_SCAN_MAX_ENTRIES,
   compositionPairsFor: () => compositionPairsFor,
   runCompose: () => runCompose
 });
-import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync31, readFileSync as readFileSync28 } from "node:fs";
-import path40 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+import { existsSync as existsSync33, readFileSync as readFileSync30, readdirSync as readdirSync14 } from "node:fs";
+import path42 from "node:path";
 function compositionPairsFor(hostSet, roots) {
-  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path40.dirname(hostSet)])];
+  const parent = path42.dirname(hostSet);
+  const explicitRoots = [...new Set(roots)];
+  let skippedParent;
+  let parentRoot = [];
+  if (!explicitRoots.some((r) => path42.resolve(r) === path42.resolve(parent))) {
+    let parentEntries = 0;
+    try {
+      parentEntries = readdirSync14(parent).length;
+    } catch {
+    }
+    if (parentEntries > IMPLICIT_PARENT_SCAN_MAX_ENTRIES) skippedParent = { dir: parent, entries: parentEntries };
+    else parentRoot = [parent];
+  }
+  const scanRoots = [.../* @__PURE__ */ new Set([...explicitRoots, ...parentRoot])];
   const edges = composeReport(buildComposeIndex(scanRoots));
   const pairs = substitutionPairs(edges, hostSet);
   const { raw } = readManifestFile(hostSet);
@@ -13723,7 +13906,7 @@ function compositionPairsFor(hostSet, roots) {
     else invalid++;
   }
   const decidedKeys = new Set(standing.map((c) => fromStoredRel(c.partner.key)));
-  return { open: pairs.filter((p) => !decidedKeys.has(p.key)), standing, invalid };
+  return { open: pairs.filter((p) => !decidedKeys.has(p.key)), standing, invalid, ...skippedParent !== void 0 ? { skippedParent } : {} };
 }
 function substitutionPairs(edges, hostSet) {
   const pairs = /* @__PURE__ */ new Map();
@@ -13742,7 +13925,7 @@ function substitutionPairs(edges, hostSet) {
       });
     }
     const pair = pairs.get(key);
-    const poseDisplay = e.pose.reps.map((r) => `${path40.basename(r.dir)}:${r.slug}`).join(", ");
+    const poseDisplay = e.pose.reps.map((r) => `${path42.basename(r.dir)}:${r.slug}`).join(", ");
     pair.instances.push({ hostRep: e.hostRep, instanceId: e.instanceId, poseVariantNodeId: e.pose.variantNodeId, ...poseDisplay !== "" ? { poseDisplay } : {} });
     for (const d of e.disclosures) if (!pair.disclosures.includes(d)) pair.disclosures.push(d);
   }
@@ -13754,7 +13937,7 @@ function runCompose(flags) {
     return;
   }
   const base = process.env["INIT_CWD"] ?? process.cwd();
-  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path40.resolve(base, d)) : [base];
+  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path42.resolve(base, d)) : [base];
   if (flags.set === void 0 && (flags.confirmCompositions === true || flags.decline !== void 0 && flags.decline.length > 0)) {
     fail(flags, ExitCode.InputValidation, {
       error: "--confirm-compositions/--decline require --set <host> \u2014 a decision needs the host set it decides for",
@@ -13763,7 +13946,7 @@ function runCompose(flags) {
     });
   }
   if (flags.set !== void 0) {
-    runComposeConfirm(flags, path40.resolve(base, flags.set), roots);
+    runComposeConfirm(flags, path42.resolve(base, flags.set), roots);
     return;
   }
   const index = buildComposeIndex(roots);
@@ -13781,7 +13964,7 @@ function runCompose(flags) {
     }
     let lastHost = "";
     for (const e of edges) {
-      const host = `${path40.basename(e.hostSet)}`;
+      const host = `${path42.basename(e.hostSet)}`;
       if (host !== lastHost) {
         process.stdout.write(`
 ${host}
@@ -13789,7 +13972,7 @@ ${host}
         lastHost = host;
       }
       const partners = e.partners.map((p) => p.displayName).join(" / ") || "\u2014";
-      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path40.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
+      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path42.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
       process.stdout.write(`  ${e.kind.toUpperCase().padEnd(12)} ${e.hostRep}/${e.instanceId} "${e.instanceName}" \u2192 ${partners}${pose}
 `);
       for (const d of e.disclosures) process.stdout.write(`    \xB7 ${d}
@@ -13801,14 +13984,14 @@ ${NOTE}
   });
 }
 function runComposeConfirm(flags, hostSet, roots) {
-  if (!existsSync31(path40.join(hostSet, "recording-set.json"))) {
+  if (!existsSync33(path42.join(hostSet, "recording-set.json"))) {
     fail(flags, ExitCode.InputValidation, {
       error: `no recording-set.json in ${hostSet}`,
       code: "no-recording-set",
       remediation: "Point --set at a recorded host set (the directory holding recording-set.json)."
     });
   }
-  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path40.dirname(hostSet)])];
+  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path42.dirname(hostSet)])];
   const index = buildComposeIndex(scanRoots);
   const edges = composeReport(index);
   const pairs = substitutionPairs(edges, hostSet);
@@ -13891,7 +14074,7 @@ PAIR ${p.displayName}${p.figmaFile !== void 0 ? ` (file ${p.figmaFile})` : " \u2
       // full recording-set hash join lands with pin authoring, where
       // task configs exist.)
       manifestSha256: Object.fromEntries(
-        p.partnerDirs.map((d) => [path40.relative(hostSet, d), createHash8("sha256").update(readFileSync28(path40.join(d, "recording-set.json"))).digest("hex")])
+        p.partnerDirs.map((d) => [path42.relative(hostSet, d), createHash9("sha256").update(readFileSync30(path42.join(d, "recording-set.json"))).digest("hex")])
       )
     },
     // Schema shape ONLY (review: the display-side poseDisplay field
@@ -13915,7 +14098,7 @@ PAIR ${p.displayName}${p.figmaFile !== void 0 ? ` (file ${p.figmaFile})` : " \u2
 `);
   });
 }
-var COMPOSE_DESCRIPTION, NOTE;
+var COMPOSE_DESCRIPTION, NOTE, IMPLICIT_PARENT_SCAN_MAX_ENTRIES;
 var init_compose2 = __esm({
   "packages/cli/src/commands/compose.ts"() {
     "use strict";
@@ -13947,6 +14130,7 @@ var init_compose2 = __esm({
       examples: ["tendril compose --list", "tendril compose --list --library ./recordings --json", "tendril compose --set ./recordings/dialog --confirm-compositions"]
     };
     NOTE = "Discovery only: these are PROPOSALS under the audited join rule (id evidence decides; name evidence only proposes). Confirm a pair with `compose --set <host>` (human-only, in your own terminal) and generation composes it: the partner's module ships under composed/ and the host imports it. Verified at that point is MODULE IDENTITY (pinned bytes + declared import) \u2014 not that the host renders it, and not pixel-neutrality: instance overrides are measured-real and a per-region check is still future work.";
+    IMPLICIT_PARENT_SCAN_MAX_ENTRIES = 64;
   }
 });
 
@@ -13970,10 +14154,10 @@ __export(record_exports, {
   runRecordPlan: () => runRecordPlan,
   runRecordStatus: () => runRecordStatus
 });
-import { existsSync as existsSync32, mkdtempSync as mkdtempSync2, readFileSync as readFileSync29, readdirSync as readdirSync14 } from "node:fs";
+import { existsSync as existsSync34, mkdtempSync as mkdtempSync2, readFileSync as readFileSync31, readdirSync as readdirSync15 } from "node:fs";
 import os7 from "node:os";
-import path41 from "node:path";
-import { writeFileSync as writeFileSync13 } from "node:fs";
+import path43 from "node:path";
+import { writeFileSync as writeFileSync15 } from "node:fs";
 function recordsInteractionState(reports) {
   const evident = (s) => stateTokens(s).some((t) => INTERACTION_TREATMENT_VALUES.has(t));
   return reports.some((r) => evident(r.axis) || r.domain.some(evident));
@@ -13995,7 +14179,7 @@ function interactionDisclosure(component, reports) {
   };
 }
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
-  const env = JSON.parse(readFileSync29(file, "utf8"));
+  const env = JSON.parse(readFileSync31(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
   const symbols = [];
   const walk2 = (node, ancestor) => {
@@ -14053,8 +14237,8 @@ function runRecordPlan(opts) {
   if (rawFile !== void 0) {
     try {
       const envelope = rawEnvelopeFromFile(rawFile, opts.metadataRawPartsFile !== void 0);
-      const tmp = path41.join(mkdtempSync2(path41.join(os7.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
-      writeFileSync13(tmp, JSON.stringify(envelope));
+      const tmp = path43.join(mkdtempSync2(path43.join(os7.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
+      writeFileSync15(tmp, JSON.stringify(envelope));
       metadataEntries.push({ file: tmp });
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
@@ -14075,7 +14259,7 @@ function runRecordPlan(opts) {
   let metadataTruncated = false;
   for (const { file, frame } of metadataEntries) {
     try {
-      const parsed = symbolsFromMetadataEnvelope(path41.resolve(file), frame);
+      const parsed = symbolsFromMetadataEnvelope(path43.resolve(file), frame);
       symbols.push(...parsed.symbols);
       if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
@@ -14109,7 +14293,7 @@ function runRecordPlan(opts) {
   if (symbols.length === 0) {
     const leads = metadataEntries.flatMap(({ file }) => {
       try {
-        const env = JSON.parse(readFileSync29(path41.resolve(file), "utf8"));
+        const env = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
         return instanceLeads(env.content.map((c) => c.text ?? "").join("\n"));
       } catch {
         return [];
@@ -14202,7 +14386,7 @@ function runRecordPlan(opts) {
         // a CLI flag and the MCP surface has no parameter for it.
         decidedBy: "HUMAN ONLY \u2014 offer it, never choose it, and you cannot run it",
         text: "Record a reduced pose set (anchor + one-factor sweeps + conflict crosses) instead of the full variant matrix. This buys calls with coverage \u2014 sampling is blind to multi-axis interactions and the report discloses the poses it skipped \u2014 so only the user may accept that trade. There is no tool parameter for it; the user runs it themselves in their own terminal, before any pose is recorded.",
-        userRuns: [`rm ${quoteArg(path41.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
+        userRuns: [`rm ${quoteArg(path43.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
       },
       {
         id: "larger-allowance",
@@ -14212,6 +14396,7 @@ function runRecordPlan(opts) {
     ],
     limitHintIfWhoamiIsSilent: LIMIT_HINT
   };
+  void reportRunPresence(opts.component, "recording");
   emitData(
     opts,
     {
@@ -14400,7 +14585,7 @@ function runRecordNext(opts) {
     const progress = payload["progress"];
     process.stdout.write(`[${progress.recordedReps}/${progress.totalReps} reps] ${payload["tool"]} for ${payload["slug"]} (node ${payload["nodeId"]})
   \u2192 ${payload["note"]}
-  \u2192 then: ${tendrilCommand(`record ingest --set ${path41.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
+  \u2192 then: ${tendrilCommand(`record ingest --set ${path43.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
 `);
   });
 }
@@ -14474,7 +14659,7 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
   const skipped = [];
   const failed = [];
   for (const { url, name } of assetUrlsFromEnvelopeText(envelopeText2)) {
-    if (existsSync32(path41.join(setDir, rep, name))) {
+    if (existsSync34(path43.join(setDir, rep, name))) {
       skipped.push(name);
       continue;
     }
@@ -14496,16 +14681,16 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 }
 function rawEnvelopeFromFile(file, parts) {
   if (parts) {
-    const blocks = JSON.parse(readFileSync29(path41.resolve(file), "utf8"));
+    const blocks = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
     if (!Array.isArray(blocks) || blocks.length === 0 || blocks.some((p) => typeof p !== "string")) throw new Error("parts file must be a non-empty JSON array of strings");
     return { content: blocks.map((text) => ({ type: "text", text })) };
   }
-  return { content: [{ type: "text", text: readFileSync29(path41.resolve(file), "utf8") }] };
+  return { content: [{ type: "text", text: readFileSync31(path43.resolve(file), "utf8") }] };
 }
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync29(path41.resolve(opts.file), "utf8"));
+    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync31(path43.resolve(opts.file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -14517,7 +14702,7 @@ async function runRecordIngest(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "--raw is for text tool responses; screenshots are binary",
       code: "envelope-invalid",
-      remediation: `Use \`${tendrilCommand(`record fetch --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
+      remediation: `Use \`${tendrilCommand(`record fetch --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
     });
   }
   if (opts.rep === "__set__" && opts.tool === "get_variable_defs") {
@@ -14537,7 +14722,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync13(path41.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync15(path43.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_variable_defs ingested\n");
@@ -14561,7 +14746,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync13(path41.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync15(path43.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_motion_context", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_motion_context ingested\n");
@@ -14577,7 +14762,7 @@ async function runRecordIngest(opts) {
       if (assets !== void 0) {
         for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
       }
     });
@@ -14650,15 +14835,15 @@ async function runRecordIngestRep(opts) {
     if (assets !== void 0) {
       for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
     }
   });
 }
 function runRecordAsset(opts) {
   if (opts.dir !== void 0) {
-    const dir = path41.resolve(opts.dir);
-    const names = readdirSync14(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
+    const dir = path43.resolve(opts.dir);
+    const names = readdirSync15(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
     if (names.length === 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `no asset-*.<ext> files found in ${dir}`,
@@ -14669,7 +14854,7 @@ function runRecordAsset(opts) {
     const ingested = [];
     try {
       for (const name of names) {
-        ingestAsset(opts.setDir, opts.rep, name, readFileSync29(path41.join(dir, name)));
+        ingestAsset(opts.setDir, opts.rep, name, readFileSync31(path43.join(dir, name)));
         ingested.push(name);
       }
     } catch (err) {
@@ -14689,11 +14874,11 @@ function runRecordAsset(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "pass --name and --file for a single asset, or --dir for a batch",
       code: "asset-rejected",
-      remediation: tendrilCommand(`record asset --set ${path41.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
+      remediation: tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
     });
   }
   try {
-    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync29(path41.resolve(opts.file)));
+    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync31(path43.resolve(opts.file)));
     emitData(opts, { rep: opts.rep, asset: opts.name }, () => {
       process.stdout.write(`ingested ${opts.rep}/${opts.name}
 `);
@@ -14710,8 +14895,8 @@ function runRecordStatus(opts) {
   const status = sessionStatus(opts.setDir);
   const composition = (() => {
     try {
-      const setDir = path41.resolve(opts.setDir);
-      const { open, standing, invalid } = compositionPairsFor(setDir, [path41.dirname(setDir)]);
+      const setDir = path43.resolve(opts.setDir);
+      const { open, standing, invalid } = compositionPairsFor(setDir, [path43.dirname(setDir)]);
       return {
         openPairs: open.map((p) => ({ displayName: p.displayName, pairKey: p.key, instances: p.instances.length })),
         confirmed: standing.filter((s) => s.status === "confirmed").length,
@@ -14732,7 +14917,7 @@ function runRecordStatus(opts) {
       }
     }
     process.stdout.write(
-      status.motion.recorded ? motionTruthFor(path41.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
+      status.motion.recorded ? motionTruthFor(path43.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
 ` : "MOTION set-level motion context not yet recorded \u2014 `record next` names the call once the reps and token map are done\n" : "MOTION never asked \u2014 this set predates the motion-capture obligation (fresh plans record it; briefs prescribe default motion doctrine only)\n"
     );
     if ("unavailable" in composition) {
@@ -14740,7 +14925,7 @@ function runRecordStatus(opts) {
 `);
     } else if (composition.openPairs.length > 0) {
       process.stdout.write(
-        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path41.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
+        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path43.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
 `
       );
     } else if (composition.confirmed > 0) {
@@ -14780,7 +14965,7 @@ function narrowedRoles(derived, override) {
 function rolesFromFile(opts, file, derived) {
   let json;
   try {
-    json = JSON.parse(readFileSync29(path41.resolve(file), "utf8"));
+    json = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read roles file ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -14818,11 +15003,11 @@ function rolesFromFile(opts, file, derived) {
   };
 }
 function runRecordFinish(opts) {
-  if (!existsSync32(path41.join(opts.setDir, "recording-set.json"))) {
+  if (!existsSync34(path43.join(opts.setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `no recording-set.json in ${opts.setDir}`,
       code: "no-recording-set",
-      remediation: `Run \`${tendrilCommand(`record plan --set ${path41.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
+      remediation: `Run \`${tendrilCommand(`record plan --set ${path43.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
     });
   }
   const { manifest, raw } = readManifestFile(opts.setDir);
@@ -14850,17 +15035,17 @@ function runRecordFinish(opts) {
     fail(opts, ExitCode.ConfirmationRequired, {
       error: "--confirm-roles (and --roles-file) require an interactive terminal \u2014 this confirmation is human-only",
       code: "roles-confirmation-not-interactive",
-      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path41.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
+      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path43.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
     });
   }
   const merged = { ...raw, roles };
-  const { issues } = validateRecordingSet(merged, (rel) => existsSync32(path41.join(opts.setDir, rel)));
+  const { issues } = validateRecordingSet(merged, (rel) => existsSync34(path43.join(opts.setDir, rel)));
   const errors = issues.filter((i) => i.severity === "error");
   if (errors.length > 0) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set rejected \u2014 roles NOT written: ${errors.map((e) => e.message).join("; ")}`,
       code: "recording-set-invalid",
-      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path41.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
+      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path43.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
     });
   }
   for (const issue of issues) if (issue.severity === "warning") warn(opts, issue.message);
@@ -14879,6 +15064,7 @@ var init_record = __esm({
     init_src();
     init_src4();
     init_output();
+    init_run_presence();
     init_entitlement();
     init_invocation();
     init_compose2();
@@ -14910,9 +15096,9 @@ var init_record = __esm({
 });
 
 // packages/cli/src/font-guidance.ts
-import path42 from "node:path";
+import path44 from "node:path";
 function fontsUnprovenRemediation(setDir) {
-  const set = setDir === void 0 ? void 0 : path42.resolve(setDir);
+  const set = setDir === void 0 ? void 0 : path44.resolve(setDir);
   if (set !== void 0) {
     try {
       const needs = recordedFontNeeds(set);
@@ -14987,8 +15173,8 @@ __export(fonts_exports, {
   runFontsResolveSet: () => runFontsResolveSet,
   runFontsStatus: () => runFontsStatus
 });
-import { existsSync as existsSync33, readFileSync as readFileSync30 } from "node:fs";
-import path43 from "node:path";
+import { existsSync as existsSync35, readFileSync as readFileSync32 } from "node:fs";
+import path45 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
   const queryRefusal = systemFaceRefusal(opts.family.trim());
@@ -15009,7 +15195,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path43.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path45.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -15104,16 +15290,16 @@ async function runFontsResolveSet(opts) {
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path43.join(opts.cacheDir, "manifest.json");
-  if (!existsSync33(manifestPath2)) {
+  const manifestPath2 = path45.join(opts.cacheDir, "manifest.json");
+  if (!existsSync35(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
       code: "fonts-unresolved",
       remediation: `Run \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` (or \`${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}\`) first.`
     });
   }
-  const faces = JSON.parse(readFileSync30(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path43.resolve(opts.lock), opts.cacheDir) : null;
+  const faces = JSON.parse(readFileSync32(manifestPath2, "utf8"));
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path45.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -15157,13 +15343,13 @@ function familyMismatch(family, declared) {
 }
 function runFontsAdd(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path43.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path45.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. Adding it under this name would cache a face the mount never matches, and scoring would keep refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path43.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path45.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
       });
     }
   } else {
@@ -15222,13 +15408,13 @@ cache them: ${tendrilCommand(`fonts add-system ${quoteArg(opts.family)}`)}
 }
 function runFontsAddSystem(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path43.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path45.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. A face cached under a name the mount never matches leaves scoring refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path43.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path45.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
       });
     }
   } else {
@@ -15278,12 +15464,12 @@ var init_fonts = __esm({
 });
 
 // packages/cli/src/profile-input.ts
-import { existsSync as existsSync34, readFileSync as readFileSync31 } from "node:fs";
-import path44 from "node:path";
+import { existsSync as existsSync36, readFileSync as readFileSync33 } from "node:fs";
+import path46 from "node:path";
 function loadCodebaseProfile(flags, profilePath) {
   if (profilePath === void 0) return null;
-  const abs = path44.resolve(profilePath);
-  if (!existsSync34(abs)) {
+  const abs = path46.resolve(profilePath);
+  if (!existsSync36(abs)) {
     fail(flags, ExitCode.InputValidation, {
       error: `no profile at ${abs}`,
       code: "profile_missing",
@@ -15291,7 +15477,7 @@ function loadCodebaseProfile(flags, profilePath) {
     });
   }
   try {
-    return readCodebaseProfile(readFileSync31(abs, "utf8"));
+    return readCodebaseProfile(readFileSync33(abs, "utf8"));
   } catch (error) {
     fail(flags, ExitCode.InputValidation, {
       error: `profile at ${abs} is not a valid codebase profile: ${error instanceof Error ? error.message : String(error)}`,
@@ -15333,8 +15519,8 @@ __export(verify_exports, {
   runVerify: () => runVerify,
   verdictCaveatsFor: () => verdictCaveatsFor
 });
-import { existsSync as existsSync35, readFileSync as readFileSync32, rmSync as rmSync5, writeFileSync as writeFileSync14 } from "node:fs";
-import path45 from "node:path";
+import { existsSync as existsSync37, readFileSync as readFileSync34, rmSync as rmSync6, writeFileSync as writeFileSync16 } from "node:fs";
+import path47 from "node:path";
 function interactionCoverage(behaviors) {
   const parity = behaviors.filter((b) => b.id.startsWith("parity:"));
   const content = behaviors.filter((b) => b.id.startsWith("content-prop-renders("));
@@ -15575,12 +15761,12 @@ function compositionReport(input) {
 function eyeCheck(bundleDir) {
   return {
     command: tendrilCommand(`inspect "${bundleDir}"`),
-    sheetPath: path45.join(bundleDir, "verify-evidence", "inspect.html"),
+    sheetPath: path47.join(bundleDir, "verify-evidence", "inspect.html"),
     note: "magnified recorded-vs-rendered crops of every small node; scores cannot see shape. The command WRITES/refreshes the sheet at sheetPath \u2014 re-run it after every verify; an existing sheet may show stale crops."
   };
 }
 function evidenceArtifacts(evidenceDir, reps) {
-  const named = (name) => existsSync35(path45.join(evidenceDir, name)) ? name : null;
+  const named = (name) => existsSync37(path47.join(evidenceDir, name)) ? name : null;
   return {
     legend: named("diff-legend.txt"),
     configs: reps.map((rep) => {
@@ -15628,7 +15814,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path45.resolve(t.set) === path45.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path47.resolve(t.set) === path47.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -15682,25 +15868,26 @@ function verdictCaveatsFor(input) {
     ...input.operability !== "verified" ? ["operability-unverified"] : [],
     ...(input.pixelOnlyInteractionPoses ?? 0) > 0 ? ["interaction-poses-unchecked"] : [],
     ...input.compositionUnavailable ? ["composition-not-checked"] : [],
-    ...input.fontsSubstituted ? ["fonts-substituted"] : []
+    ...input.fontsSubstituted ? ["fonts-substituted"] : [],
+    ...input.hoverBudgetNondefault === true ? ["hover-budget-nondefault"] : []
   ];
 }
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   let recordingSetDrift;
-  const setOverride = opts.set !== void 0 ? path45.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path45.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync35(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path47.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path47.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync37(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path45.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path47.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync35(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync32(manifestPath2, "utf8"));
+  if (existsSync37(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync34(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -15731,21 +15918,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path45.isAbsolute(p)) return p;
-      const fromRepo = path45.resolve(REPO_ROOT, p);
-      if (existsSync35(fromRepo)) return fromRepo;
-      return path45.resolve(callerCwd, p);
+      if (path47.isAbsolute(p)) return p;
+      const fromRepo = path47.resolve(REPO_ROOT, p);
+      if (existsSync37(fromRepo)) return fromRepo;
+      return path47.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync35(path45.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path45.resolve(t.set) === path45.resolve(setDir))) {
+    if (!existsSync37(path47.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path47.resolve(t.set) === path47.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path45.resolve(t.set) === path45.resolve(setDir));
-    if (registry !== void 0 && !existsSync35(path45.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path47.resolve(t.set) === path47.resolve(setDir));
+    if (registry !== void 0 && !existsSync37(path47.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -15777,9 +15964,9 @@ async function runVerify(opts) {
       recordingSetDrift = { stamped: manifest.provenance.recordingSet.hash, current: hash };
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path45.join(opts.bundleDir, name);
-      if (!existsSync35(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync32(p)));
+      const p = path47.join(opts.bundleDir, name);
+      if (!existsSync37(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync34(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -15817,7 +16004,7 @@ async function runVerify(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync35(path45.join(task.set, c.rep, "get_screenshot.json")) || !existsSync35(path45.join(task.set, c.rep, "get_metadata.json"))
+    (c) => !existsSync37(path47.join(task.set, c.rep, "get_screenshot.json")) || !existsSync37(path47.join(task.set, c.rep, "get_metadata.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -15827,8 +16014,8 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path45.join(opts.bundleDir, "verify-evidence");
-  rmSync5(evidenceDir, { recursive: true, force: true });
+  const evidenceDir = path47.join(opts.bundleDir, "verify-evidence");
+  rmSync6(evidenceDir, { recursive: true, force: true });
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(
     opts.bundleDir,
@@ -15845,14 +16032,19 @@ async function runVerify(opts) {
     // ASKED, never "follows every convention".
     loadCodebaseProfile(opts, opts.profile) ?? void 0
   );
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path45.join(opts.bundleDir, f)).filter((f) => existsSync35(f)).map((f) => readFileSync32(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path47.join(opts.bundleDir, f)).filter((f) => existsSync37(f)).map((f) => readFileSync34(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss, { ...authorityConfigs !== void 0 ? { authority: authorityConfigs } : {} });
-  const parity = await checkHoverParity(task, opts.bundleDir, authorityConfigs ?? task.configs);
+  const parity = await checkHoverParity(task, opts.bundleDir, authorityConfigs ?? task.configs, {
+    ...opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {},
+    // Run-27 diagnostics: a mount failure's screenshot lands beside the
+    // rest of the evidence (cleared with it on every fresh run).
+    failureShotDir: evidenceDir
+  });
   const framing = checkAdapterFraming(
     task.configs,
     adapterVocabulary ?? buildAdapterVocabulary({ authorityConfigs: authorityConfigs ?? task.configs })
   );
-  const behaviors = [...await checkBehaviors(task, opts.bundleDir), ...parity];
+  const behaviors = [...await checkBehaviors(task, opts.bundleDir, opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {}), ...parity];
   const structural = roles !== void 0 ? await checkStructuralComposition(task, opts.bundleDir, roles) : [];
   const regionsOut = roles !== void 0 ? interiorRegions(task.set, roles) : void 0;
   const crops = regionsOut !== void 0 && "regions" in regionsOut ? await checkCropComposition(task, opts.bundleDir, regionsOut.regions) : void 0;
@@ -15861,10 +16053,10 @@ async function runVerify(opts) {
     warn(opts, `compositions extension REJECTED (${crossComposition.malformed}) \u2014 the cross-bundle backstop did NOT run over it; repair the manifest entry and re-verify. This is an instrument failure, not a clean bill.`);
   }
   const verifyCallerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path45.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
+  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path47.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
   const staticComposedChecks = composedChecks(opts.bundleDir, task.entry, verifyPins.pins);
   const renderExpectations = verifyPins.pins.map((pin) => ({
-    modulePath: path45.join(composedModuleDir(pin.partnerName), pin.entryComponent),
+    modulePath: path47.join(composedModuleDir(pin.partnerName), pin.entryComponent),
     component: pin.entryComponent,
     stampName: `${pin.pairKey}:${pin.entryComponent}`,
     hostReps: [...new Set(pin.instances.map((i) => i.hostRep))],
@@ -15932,7 +16124,11 @@ async function runVerify(opts) {
     // Canonical mount semantics are VERSION-scoped (0.1.22 review: the
     // greyscale flip changed Windows pixels under an identical-looking
     // stamp) — the ruler version is part of the comparability key.
-    environment: { ...environmentStamp(taskFontFamilies(task.set)), ruler: cliVersion() },
+    // The hover budget is part of how the behavior numbers were
+    // produced (run 27), so it travels with the environment — always,
+    // not only when overridden, so a reader never has to know the
+    // default to interpret a report.
+    environment: { ...environmentStamp(taskFontFamilies(task.set)), ruler: cliVersion(), hoverBudgetMs: opts.hoverTimeoutMs ?? DEFAULT_HOVER_BUDGET_MS },
     coverage: {
       scoredConfigs: statuses.length,
       certified,
@@ -16006,7 +16202,8 @@ async function runVerify(opts) {
       operability: coverage.operability,
       compositionUnavailable: "unavailable" in compositionBlock,
       fontsSubstituted: substitutedFamilies.length > 0,
-      pixelOnlyInteractionPoses: unmappedInteractionEvidence.length
+      pixelOnlyInteractionPoses: unmappedInteractionEvidence.length,
+      hoverBudgetNondefault: opts.hoverTimeoutMs !== void 0 && opts.hoverTimeoutMs !== DEFAULT_HOVER_BUDGET_MS
     }),
     // Machine-readable cause (adversarial review): a cert-bar failure
     // with zero pixel/behavior/composition failures was only
@@ -16025,8 +16222,9 @@ async function runVerify(opts) {
   emitData(opts, report, () => {
     for (const s of statuses) {
       const demoted = "demotedBy" in s && Array.isArray(s.demotedBy) ? `  [demoted: ${s.demotedBy.join("; ")}]` : "";
+      const pixels = tierOf(s, BARS2.cert).toUpperCase();
       process.stdout.write(
-        `${s.status === "fail" ? "FAIL" : s.status.toUpperCase().padEnd(9)} ${s.rep.padEnd(24)} sim=${s.similarity} ink=${s.inkRecall}${s.error !== void 0 ? `  [${s.error}]` : ""}${demoted}
+        `${(s.status === "fail" ? "FAIL" : s.status.toUpperCase()).padEnd(9)} ${`pixels=${pixels}`.padEnd(17)} ${s.rep.padEnd(24)} sim=${s.similarity} ink=${s.inkRecall}${s.error !== void 0 ? `  [${s.error}]` : ""}${demoted}
 `
       );
     }
@@ -16151,7 +16349,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
-    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path45.join(opts.bundleDir, f)).filter((f) => existsSync35(f)).map((f) => readFileSync32(f, "utf8")).join("\n")));
+    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path47.join(opts.bundleDir, f)).filter((f) => existsSync37(f)).map((f) => readFileSync34(f, "utf8")).join("\n")));
     if (shippedFonts.length > 0 && substitutedFamilies.length === 0) {
       process.stdout.write(`fonts: scored with Tendril-cache faces \u2014 a consuming app must provision the same families (the bundle ships fonts.css when faces are shippable; sha-pinned list in component.json requiredFonts)
 `);
@@ -16206,7 +16404,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
   persistReport(opts, report, evidenceDir);
 }
 function persistReport(opts, report, evidenceDir) {
-  if (!existsSync35(evidenceDir)) return;
+  if (!existsSync37(evidenceDir)) return;
   const rulerExit = process.exitCode === void 0 ? 0 : Number(process.exitCode);
   const withExit = {
     ...report,
@@ -16214,9 +16412,9 @@ function persistReport(opts, report, evidenceDir) {
     ...rulerExit !== 0 ? { rulerRefusal: EXIT_REFUSALS[rulerExit] ?? `ruler exited ${rulerExit}` } : {}
   };
   try {
-    writeFileSync14(
-      path45.join(evidenceDir, VERIFY_REPORT_FILENAME),
-      `${JSON.stringify(verifyReportForTransport(withExit, path45.basename(opts.bundleDir)), null, 2)}
+    writeFileSync16(
+      path47.join(evidenceDir, VERIFY_REPORT_FILENAME),
+      `${JSON.stringify(verifyReportForTransport(withExit, path47.basename(opts.bundleDir)), null, 2)}
 `
     );
   } catch (e) {
@@ -16266,11 +16464,11 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { appendFileSync, existsSync as existsSync36, mkdirSync as mkdirSync10, readFileSync as readFileSync33, writeFileSync as writeFileSync15 } from "node:fs";
-import path46 from "node:path";
+import { appendFileSync, existsSync as existsSync38, mkdirSync as mkdirSync11, readFileSync as readFileSync35, writeFileSync as writeFileSync17 } from "node:fs";
+import path48 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path46.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync36(path46.join(asPath, "recording-set.json"));
+  const asPath = path48.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync38(path48.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
@@ -16279,7 +16477,7 @@ function resolveEngineTask(opts, callerCwd) {
       for (const d of authored.disclosures) warn(opts, d);
       return {
         task: authored.task,
-        name: path46.basename(asPath),
+        name: path48.basename(asPath),
         ref: asPath,
         disclosures: authored.disclosures,
         interactionEvidence: authored.api.interactionEvidence,
@@ -16306,14 +16504,20 @@ function runEngineBrief(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   const { task, name, ref, disclosures } = resolveEngineTask(opts, callerCwd);
+  void reportRunPresence(name, "implementing");
   const bar = BARS3[opts.bar];
-  if (existsSync36(path46.join(task.set, "recording-set.json"))) {
+  if (existsSync38(path48.join(task.set, "recording-set.json"))) {
     try {
-      const { open } = compositionPairsFor(path46.resolve(task.set), [opts.library !== void 0 ? path46.resolve(callerCwd, opts.library) : callerCwd]);
+      const { open, skippedParent } = compositionPairsFor(path48.resolve(task.set), [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
+      if (skippedParent !== void 0) {
+        disclosures.push(
+          `COMPOSITION DISCOVERY PARTIAL: the set's parent directory (${skippedParent.dir}) holds ${String(skippedParent.entries)} entries and was not scanned as a recordings library \u2014 sibling sets there are invisible to pairing. Pass --library <dir> to scan a specific library deliberately.`
+        );
+      }
       if (open.length > 0) {
         const componentNames = [...new Set(open.map((p) => p.displayName))];
         disclosures.push(
-          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path46.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
+          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path48.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
         );
       }
     } catch (err) {
@@ -16330,9 +16534,9 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" }) + disclosureBlock + motionBriefSection(task.set) + conventions;
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path46.join(task.set, "recording-set.json");
-  if (existsSync36(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync33(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path48.join(task.set, "recording-set.json");
+  if (existsSync38(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync35(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -16340,7 +16544,7 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync36(manifestPath2)) {
+  if (existsSync38(manifestPath2)) {
     const missingFams = unprovisionedFamilies(task.set);
     const unprovided = unprovisionedFaces(task.set);
     const weightOnly = missingFams.length === 0;
@@ -16362,7 +16566,7 @@ ${notRecorded}` : "";
       };
     }
   }
-  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path46.resolve(callerCwd, opts.library) : callerCwd]);
+  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
   const jsxProp = ([k, v]) => typeof v === "string" ? `${k}=${JSON.stringify(v)}` : `${k}={${JSON.stringify(v)}}`;
   const composedBlock = pinsResult.pins.length === 0 && pinsResult.issues.length === 0 ? "" : (pinsResult.pins.length > 0 ? `
 
@@ -16398,10 +16602,10 @@ ${pinsResult.issues.map((i) => `- ${i}`).join("\n")}` : "");
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path46.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  const candidateDirSuggestion = path46.resolve(callerCwd, `tendril-out/${name}-candidate`);
-  mkdirSync10(path46.dirname(payloadFile), { recursive: true });
-  writeFileSync15(payloadFile, payload);
+  const payloadFile = path48.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  const candidateDirSuggestion = path48.resolve(callerCwd, `tendril-out/${name}-candidate`);
+  mkdirSync11(path48.dirname(payloadFile), { recursive: true });
+  writeFileSync17(payloadFile, payload);
   emitData(
     opts,
     {
@@ -16447,7 +16651,7 @@ ${segments}`;
         // command must search the same bundle roots the pins came
         // from, or the oracle and the brief describe different worlds.
         `Run \`${tendrilCommand(
-          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path46.resolve(callerCwd, opts.library))}` : ""} --json`
+          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path48.resolve(callerCwd, opts.library))}` : ""} --json`
         )}\` \u2014 the CLI is the sole judge, and it refuses to score an undeclared model. If you wrote the bundle elsewhere, pass that directory instead.`,
         "Apply the returned feedback and re-score. Stop when all checks pass. Two consecutive non-improving scores mean INSPECT the verify-evidence diffs before deciding \u2014 stop only when inspection yields no fix hypothesis (a measured run was byte-identical twice, then went 27/27 after reading the diffs).",
         "Never edit recording sets; never claim scores yourself \u2014 only the score command's output counts."
@@ -16462,8 +16666,8 @@ ${segments}`;
   );
 }
 function appendScoreHistory(candidateDir, entry) {
-  const file = path46.join(candidateDir, "score-history.jsonl");
-  const starts = existsSync36(file) ? readFileSync33(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
+  const file = path48.join(candidateDir, "score-history.jsonl");
+  const starts = existsSync38(file) ? readFileSync35(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
   const round = entry.event === "round-start" ? starts + 1 : Math.max(1, starts);
   appendFileSync(file, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), round, ...entry })}
 `);
@@ -16471,9 +16675,10 @@ function appendScoreHistory(candidateDir, entry) {
 async function runEngineScore(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path46.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path48.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin, interactionEvidence, unmappedInteractionEvidence: interactionEvidenceUnmapped, satisfiabilityDemoted, expertContract } = resolveEngineTask(opts, callerCwd);
-  if (!existsSync36(candidateDir)) {
+  void reportRunPresence(name, "implementing");
+  if (!existsSync38(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -16498,10 +16703,10 @@ async function runEngineScore(opts) {
   for (const g of missingWeights(task.set)) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
-  if (opts.rebind !== true && existsSync36(path46.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync38(path48.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync33(path46.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync35(path48.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -16523,14 +16728,15 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path46.join(candidateDir, "verify-evidence");
+  const evidenceDir = path48.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
-  const parity = await checkHoverParity(task, candidateDir, task.configs);
+  const hoverOpts = opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {};
+  const parity = await checkHoverParity(task, candidateDir, task.configs, { ...hoverOpts, failureShotDir: evidenceDir });
   const occlusionRows = await checkSiblingOcclusion(task, candidateDir, candidateCss(candidateDir), { authority: task.configs });
   const occlusionFailures = occlusionRows.filter((o) => !o.pass);
-  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path46.resolve(callerCwd, opts.library) : callerCwd]);
+  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
   const composition = composedChecks(candidateDir, task.entry, scorePins.pins);
-  const behaviors = [...await checkBehaviors(task, candidateDir), ...parity, ...composition];
+  const behaviors = [...await checkBehaviors(task, candidateDir, hoverOpts), ...parity, ...composition];
   const parityCoverage = parity.length > 0 ? `${parity.filter((p) => p.pass).length}/${parity.length} hover-forced configs` : "not applicable (no hover-forced configs in this set)";
   const obj = objective(scores, behaviors);
   const total = scores.length + behaviors.length;
@@ -16733,6 +16939,7 @@ var init_engine2 = __esm({
     init_entitlement();
     init_verify();
     init_compose2();
+    init_run_presence();
     init_src5();
     BARS3 = {
       pass: { sim: 0.95, ink: 0.95 },
@@ -16746,11 +16953,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync37, readFileSync as readFileSync34, writeFileSync as writeFileSync16 } from "node:fs";
-import path47 from "node:path";
+import { existsSync as existsSync39, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "node:fs";
+import path49 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path47.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path49.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -16766,7 +16973,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync34(path47.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync36(path49.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -16776,8 +16983,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path47.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync37(path47.join(setDir, "recording-set.json"))) {
+  const setDir = path49.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync39(path49.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -16798,10 +17005,10 @@ function runCodeConnect(opts) {
   const component = api.component;
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
-    const meta = path47.join(setDir, r.slug, "get_metadata.json");
-    if (!existsSync37(meta)) return void 0;
+    const meta = path49.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync39(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync34(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync36(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -16866,7 +17073,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path47.relative(callerCwd, path47.join(bundleDir, manifest.entry));
+  const entryRel = path49.relative(callerCwd, path49.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -16890,8 +17097,8 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path47.resolve(callerCwd, opts.out ?? path47.join(bundleDir, `${component}.figma.ts`));
-  writeFileSync16(outFile, lines);
+  const outFile = path49.resolve(callerCwd, opts.out ?? path49.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync18(outFile, lines);
   emitData(
     opts,
     {
@@ -16929,18 +17136,18 @@ var init_codeconnect = __esm({
 });
 
 // packages/mcp/src/server.ts
-import { createHash as createHash9 } from "node:crypto";
-import { existsSync as existsSync38, mkdtempSync as mkdtempSync3, readFileSync as readFileSync35, readdirSync as readdirSync15, writeFileSync as writeFileSync17 } from "node:fs";
+import { createHash as createHash10 } from "node:crypto";
+import { existsSync as existsSync40, mkdtempSync as mkdtempSync3, readFileSync as readFileSync37, readdirSync as readdirSync16, writeFileSync as writeFileSync19 } from "node:fs";
 import os8 from "node:os";
-import path48 from "node:path";
+import path50 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { z as z14 } from "zod";
 function sourceHash() {
-  const dir = path48.dirname(fileURLToPath6(import.meta.url));
-  const h = createHash9("sha256");
-  for (const f of readdirSync15(dir).filter((n) => n.endsWith(".ts")).sort()) {
+  const dir = path50.dirname(fileURLToPath6(import.meta.url));
+  const h = createHash10("sha256");
+  for (const f of readdirSync16(dir).filter((n) => n.endsWith(".ts")).sort()) {
     h.update(f);
-    h.update(readFileSync35(path48.join(dir, f)));
+    h.update(readFileSync37(path50.join(dir, f)));
   }
   return h.digest("hex").slice(0, 16);
 }
@@ -16948,10 +17155,10 @@ var REPO_ROOT3, CLI_BIN, BUNDLED_CLI, CLI_SPAWN, str, optStr, TOOLS, BOOT_HASH;
 var init_server = __esm({
   "packages/mcp/src/server.ts"() {
     "use strict";
-    REPO_ROOT3 = path48.resolve(path48.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
-    CLI_BIN = path48.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
-    BUNDLED_CLI = path48.join(path48.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
-    CLI_SPAWN = existsSync38(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
+    REPO_ROOT3 = path50.resolve(path50.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
+    CLI_BIN = path50.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
+    BUNDLED_CLI = path50.join(path50.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
+    CLI_SPAWN = existsSync40(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
     str = (d) => z14.string().describe(d);
     optStr = (d) => z14.string().optional().describe(d);
     TOOLS = [
@@ -16982,13 +17189,13 @@ var init_server = __esm({
           const single = i["metadata"];
           const parts = i["metadataParts"];
           if (single !== void 0 || parts !== void 0) {
-            const tmp = path48.join(mkdtempSync3(path48.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync17(tmp, single);
+              writeFileSync19(tmp, single);
               argvOut.push("--metadata-raw-file", tmp);
             } else {
               if (parts.length === 0) throw new Error("`metadataParts` must be a non-empty array of block texts");
-              writeFileSync17(tmp, JSON.stringify(parts));
+              writeFileSync19(tmp, JSON.stringify(parts));
               argvOut.push("--metadata-raw-parts-file", tmp);
             }
           }
@@ -17038,6 +17245,24 @@ var init_server = __esm({
         schema: z14.object({}),
         argv: () => ["login", "--device-wait"]
       },
+      {
+        name: "tendril_publish",
+        description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim (they click Approve in the browser where they are signed in; when the page shows a terms checkbox, ticking it is part of their decision \u2014 never advise them to just tick it). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
+        schema: z14.object({
+          bundleDir: str("bundle directory (verified \u2014 carries component.json and verify-evidence)"),
+          portal: optStr("portal origin override for self-hosted portals (defaults to the stored session's portal)")
+        }),
+        argv: (i) => ["publish", i["bundleDir"], "--approve-start", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
+      },
+      {
+        name: "tendril_publish_wait",
+        description: "Phase two of the browser-approved publish: waits (with live progress) for the user's Approve click on the page tendril_publish returned, then uploads the bundle, commits it, and returns the live publication URL. Call it right after relaying the approve link. A denial, a lapse, and success each come back as their own sentence \u2014 report the outcome and the URL to the user.",
+        schema: z14.object({
+          bundleDir: str("the same bundle directory tendril_publish was called with"),
+          portal: optStr("portal origin override (must match tendril_publish's)")
+        }),
+        argv: (i) => ["publish", i["bundleDir"], "--approve-wait", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
+      },
       {
         name: "tendril_record_next",
         annotations: { readOnlyHint: true },
@@ -17079,14 +17304,14 @@ var init_server = __esm({
           const bridge = (label, single, parts) => {
             if (single !== void 0 && parts !== void 0) throw new Error(`pass at most one of \`${label}\` and \`${label}Parts\``);
             if (single === void 0 && parts === void 0) return;
-            const tmp = path48.join(mkdtempSync3(path48.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync17(tmp, single);
+              writeFileSync19(tmp, single);
               argvOut.push(`--${label}-file`, tmp);
             } else {
               const blocks = parts;
               if (blocks.length === 0) throw new Error(`\`${label}Parts\` must be a non-empty array of block texts`);
-              writeFileSync17(tmp, JSON.stringify(blocks));
+              writeFileSync19(tmp, JSON.stringify(blocks));
               argvOut.push(`--${label}-parts-file`, tmp);
             }
           };
@@ -17127,12 +17352,12 @@ var init_server = __esm({
           const file = i["file"];
           if ([text, texts, file].filter((x) => x !== void 0).length !== 1) throw new Error("pass exactly one of `text` (single-block response), `texts` (multi-block response), or `file` (a saved envelope)");
           if (file !== void 0) return [...base, "--file", file];
-          const tmp = path48.join(mkdtempSync3(path48.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+          const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
           if (text !== void 0) {
-            writeFileSync17(tmp, text);
+            writeFileSync19(tmp, text);
             return [...base, "--file", tmp, "--raw"];
           }
-          writeFileSync17(tmp, JSON.stringify(texts));
+          writeFileSync19(tmp, JSON.stringify(texts));
           return [...base, "--file", tmp, "--raw-parts"];
         }
       },
@@ -17289,13 +17514,13 @@ __export(permissions_exports, {
   runPermissions: () => runPermissions,
   writeSelection: () => writeSelection
 });
-import { existsSync as existsSync39, mkdirSync as mkdirSync11, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "node:fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync12, readFileSync as readFileSync38, writeFileSync as writeFileSync20 } from "node:fs";
 import os9 from "node:os";
-import path49 from "node:path";
+import path51 from "node:path";
 function mergeAllowlist(file, entries, denyEntries = []) {
   let settings = {};
-  if (existsSync39(file) && readFileSync36(file, "utf8").trim() !== "") {
-    settings = JSON.parse(readFileSync36(file, "utf8"));
+  if (existsSync41(file) && readFileSync38(file, "utf8").trim() !== "") {
+    settings = JSON.parse(readFileSync38(file, "utf8"));
     if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw new Error("settings root is not an object");
   }
   const permissions = settings["permissions"] ??= {};
@@ -17315,8 +17540,8 @@ function mergeAllowlist(file, entries, denyEntries = []) {
   }
   if (added.length > 0 || denyAdded.length > 0) {
     allow.push(...added);
-    mkdirSync11(path49.dirname(file), { recursive: true });
-    writeFileSync18(file, `${JSON.stringify(settings, null, 2)}
+    mkdirSync12(path51.dirname(file), { recursive: true });
+    writeFileSync20(file, `${JSON.stringify(settings, null, 2)}
 `);
   }
   return { added, alreadyPresent, denyAdded };
@@ -17380,7 +17605,7 @@ async function runPermissions(flags) {
   }
   if (flags.write) {
     const base = process.env["INIT_CWD"] ?? process.cwd();
-    const file = flags.user ? path49.join(os9.homedir(), ".claude", "settings.json") : path49.join(base, ".claude", "settings.local.json");
+    const file = flags.user ? path51.join(os9.homedir(), ".claude", "settings.json") : path51.join(base, ".claude", "settings.local.json");
     const { entries, denyEntries } = writeSelection(result, flags.user === true);
     if (flags.dryRun) {
       emitData(flags, { file, wouldAdd: entries, wouldDeny: denyEntries }, () => {
@@ -17529,13 +17754,13 @@ __export(inspect_exports, {
   INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
   runInspect: () => runInspect
 });
-import { existsSync as existsSync40, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
-import path50 from "node:path";
+import { existsSync as existsSync42, readFileSync as readFileSync39, writeFileSync as writeFileSync21 } from "node:fs";
+import path52 from "node:path";
 function readVerifyReport(evidenceDir) {
-  const p = path50.join(evidenceDir, VERIFY_REPORT_FILENAME);
-  if (!existsSync40(p)) return void 0;
+  const p = path52.join(evidenceDir, VERIFY_REPORT_FILENAME);
+  if (!existsSync42(p)) return void 0;
   try {
-    return JSON.parse(readFileSync37(p, "utf8"));
+    return JSON.parse(readFileSync39(p, "utf8"));
   } catch {
     return void 0;
   }
@@ -17563,17 +17788,17 @@ async function runInspect(opts) {
     printDescription(INSPECT_DESCRIPTION);
     return;
   }
-  const bundleDir = path50.resolve(opts.bundleDir);
-  const evidenceDir = path50.join(bundleDir, "verify-evidence");
-  const manifestPath2 = path50.join(bundleDir, "component.json");
-  if (!existsSync40(evidenceDir) || !existsSync40(manifestPath2)) {
+  const bundleDir = path52.resolve(opts.bundleDir);
+  const evidenceDir = path52.join(bundleDir, "verify-evidence");
+  const manifestPath2 = path52.join(bundleDir, "component.json");
+  if (!existsSync42(evidenceDir) || !existsSync42(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
-      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync40(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
+      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync42(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
       code: "no-evidence",
       remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync37(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync39(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -17581,9 +17806,9 @@ async function runInspect(opts) {
       remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
     });
   }
-  const setDir = path50.resolve(opts.set ?? manifest.provenance.recordingSet.path);
+  const setDir = path52.resolve(opts.set ?? manifest.provenance.recordingSet.path);
   const report = readVerifyReport(evidenceDir);
-  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync40(path50.join(evidenceDir, `${rep}-ref.png`)) && existsSync40(path50.join(evidenceDir, `${rep}-render.png`)));
+  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync42(path52.join(evidenceDir, `${rep}-ref.png`)) && existsSync42(path52.join(evidenceDir, `${rep}-render.png`)));
   if (reps.length === 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "verify-evidence holds no ref/render pairs for this bundle's configs",
@@ -17594,15 +17819,15 @@ async function runInspect(opts) {
   let crops = 0;
   const sections = [];
   for (const rep of reps) {
-    const ref = new Uint8Array(readFileSync37(path50.join(evidenceDir, `${rep}-ref.png`)));
-    const render = new Uint8Array(readFileSync37(path50.join(evidenceDir, `${rep}-render.png`)));
+    const ref = new Uint8Array(readFileSync39(path52.join(evidenceDir, `${rep}-ref.png`)));
+    const render = new Uint8Array(readFileSync39(path52.join(evidenceDir, `${rep}-render.png`)));
     const nodes = smallSemanticNodes(setDir, rep, opts.maxArea ?? 1024).slice(0, 12);
     const cells = [];
     for (const [i, n] of nodes.entries()) {
       const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
       try {
-        writeFileSync19(path50.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
-        writeFileSync19(path50.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
+        writeFileSync21(path52.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
+        writeFileSync21(path52.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
       } catch {
         continue;
       }
@@ -17619,8 +17844,8 @@ async function runInspect(opts) {
     if (reps.includes(c.rep)) continue;
     sections.push(`<section class="missing"><h2>${esc(c.rep)}</h2>${scoreLine(report, c.rep)}<p class="none">No evidence images for this config \u2014 it was scored, but nothing was captured to look at.</p></section>`);
   }
-  const sheet = path50.join(evidenceDir, "inspect.html");
-  writeFileSync19(
+  const sheet = path52.join(evidenceDir, "inspect.html");
+  writeFileSync21(
     sheet,
     `<!doctype html><meta charset="utf-8"><title>${esc(manifest.name)} \u2014 tendril inspect</title><style>
 body{font:14px/1.45 system-ui,sans-serif;margin:24px;background:#fff;color:#111}
@@ -17693,8 +17918,8 @@ __export(login_exports, {
   runLogout: () => runLogout
 });
 import { spawn } from "node:child_process";
-import { existsSync as existsSync41, mkdirSync as mkdirSync12, readFileSync as readFileSync38, rmSync as rmSync6, writeFileSync as writeFileSync20 } from "node:fs";
-import path51 from "node:path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync13, readFileSync as readFileSync40, rmSync as rmSync7, writeFileSync as writeFileSync22 } from "node:fs";
+import path53 from "node:path";
 import { isCancel as isCancel3, password as password2 } from "@clack/prompts";
 async function runLogin(opts, deps) {
   const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? DEFAULT_PORTAL_ORIGIN).replace(/\/+$/, "");
@@ -17788,13 +18013,13 @@ function settleDecision(opts, origin, outcome) {
   }
 }
 function pendingLoginPath() {
-  return path51.join(path51.dirname(sessionPath()), "pending-login.json");
+  return path53.join(path53.dirname(sessionPath()), "pending-login.json");
 }
 async function deviceStartPhase(opts, origin, deps) {
   const started = await startHandshake(opts, origin, deps);
   const file = pendingLoginPath();
-  mkdirSync12(path51.dirname(file), { recursive: true });
-  writeFileSync20(file, `${JSON.stringify({ origin, ...started }, null, 2)}
+  mkdirSync13(path53.dirname(file), { recursive: true });
+  writeFileSync22(file, `${JSON.stringify({ origin, ...started }, null, 2)}
 `, { mode: 384 });
   deps.openBrowser(started.verificationUrl);
   emitData(
@@ -17819,9 +18044,9 @@ async function deviceStartPhase(opts, origin, deps) {
 async function deviceWaitPhase(opts, deps) {
   const file = pendingLoginPath();
   let pending;
-  if (existsSync41(file)) {
+  if (existsSync43(file)) {
     try {
-      const parsed = JSON.parse(readFileSync38(file, "utf8"));
+      const parsed = JSON.parse(readFileSync40(file, "utf8"));
       if (typeof parsed.origin === "string" && typeof parsed.deviceCode === "string" && typeof parsed.intervalSeconds === "number") {
         pending = parsed;
       }
@@ -17835,7 +18060,7 @@ async function deviceWaitPhase(opts, deps) {
       remediation: `Start one first: ${tendrilCommand("login --device-start")} (the tendril_login tool).`
     });
   }
-  const done = () => rmSync6(file, { force: true });
+  const done = () => rmSync7(file, { force: true });
   const total = Math.ceil(660 / Math.max(1, pending.intervalSeconds));
   let ticks = 0;
   const outcome = await waitForDecision(opts, pending.origin, deps, pending, () => {
@@ -18072,10 +18297,10 @@ var publish_exports = {};
 __export(publish_exports, {
   runPublish: () => runPublish
 });
-import { existsSync as existsSync42, readFileSync as readFileSync39 } from "node:fs";
-import path52 from "node:path";
+import { existsSync as existsSync44, readFileSync as readFileSync41, rmSync as rmSync8, writeFileSync as writeFileSync23 } from "node:fs";
+import path54 from "node:path";
 async function runPublish(opts) {
-  const bundleDir = path52.resolve(opts.bundleDir);
+  const bundleDir = path54.resolve(opts.bundleDir);
   const bundle = readBundle(opts, bundleDir);
   const report = bundle.report;
   if (typeof report["rulerExit"] !== "number" || !Number.isInteger(report["rulerExit"])) {
@@ -18120,7 +18345,7 @@ async function runPublish(opts) {
   const sheetEntry = surface.published.find((p) => p.role === "inspect-sheet");
   if (sheetEntry !== void 0) {
     const missingCrops = missingInspectCrops(
-      readFileSync39(path52.join(bundleDir, sheetEntry.path), "utf8"),
+      readFileSync41(path54.join(bundleDir, sheetEntry.path), "utf8"),
       surface.published.map((p) => p.path)
     );
     if (missingCrops.length > 0) {
@@ -18187,46 +18412,40 @@ async function runPublish(opts) {
   }
   const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
   const client = opts.client ?? httpClient(opts, origin);
-  if (opts.confirmPublish === true && process.stdin.isTTY !== true) {
-    fail(opts, ExitCode.ConfirmationRequired, {
-      error: "--confirm-publish requires an interactive terminal \u2014 putting a component on the internet is a human-only decision",
-      code: "publish-confirmation-not-interactive",
-      remediation: `A human runs \`${tendrilCommand(`publish ${opts.bundleDir} --confirm-publish`)}\` in their own terminal. Agents: show this to your operator instead of confirming it.`
-    });
-  }
-  if (opts.acceptTerms === true) {
-    const accepted = await client.acceptTerms({ figmaFile });
-    if (!accepted.ok) refuse2(opts, accepted, "accept-terms-refused");
+  if (opts.approveWait === true) {
+    await approveWaitPhase(opts, client, bundleDir);
   }
-  const opened = await client.begin({
+  void reportRunPresence(componentName, "publishing");
+  let opened = await client.begin({
     componentName,
     figmaFile,
     entry: bundle.manifest.entry,
     files: bundle.files,
-    report: bundle.reportText,
-    confirmed: opts.confirmPublish === true
+    report: bundle.reportText
   });
+  if (!opened.ok && opened.needsConfirmation !== void 0 && opts.approveWait !== true) {
+    const flow = await runApprovalFlow(opts, client, bundleDir, {
+      componentName,
+      figmaFile,
+      begin: () => client.begin({ componentName, figmaFile, entry: bundle.manifest.entry, files: bundle.files, report: bundle.reportText })
+    });
+    if (flow === void 0) return;
+    opened = flow;
+  }
   if (!opened.ok) {
-    if (opened.needsConsent !== void 0) {
-      fail(opts, ExitCode.ConfirmationRequired, {
-        error: `publishing this design system needs an acceptance of the publishing terms (version ${opened.needsConsent.termsVersion}) first`,
-        code: "publishing-terms-not-accepted",
-        remediation: `Read the terms, then run \`${tendrilCommand(`publish ${opts.bundleDir} --accept-terms --confirm-publish`)}\`. The acceptance covers this design system only.`
-      });
-    }
     if (opened.needsConfirmation !== void 0) {
       fail(opts, ExitCode.ConfirmationRequired, {
         error: `publishing ${JSON.stringify(opened.needsConfirmation.componentName)} for the first time is a decision a person makes, not a build step`,
         code: "first-publish-unconfirmed",
-        remediation: `A human runs \`${tendrilCommand(`publish ${opts.bundleDir} --confirm-publish`)}\` in their own terminal. Later publishes of this component need no flag.`
+        remediation: "Approve it in your browser \u2014 run the publish again and open the link it prints."
       });
     }
     refuse2(opts, opened, "publish-refused");
   }
   const uploaded = [];
   for (const object of opened.value.plan.objects) {
-    const file = path52.join(bundleDir, object.relPath);
-    if (!existsSync42(file)) {
+    const file = path54.join(bundleDir, object.relPath);
+    if (!existsSync44(file)) {
       fail(opts, ExitCode.InputValidation, {
         error: `the portal expects ${object.relPath}, and it is not in ${opts.bundleDir}`,
         code: "planned-file-missing",
@@ -18236,12 +18455,15 @@ async function runPublish(opts) {
     const sent = await client.upload({
       publicationId: opened.value.publicationId,
       relPath: object.relPath,
-      bytes: new Uint8Array(readFileSync39(file))
+      bytes: new Uint8Array(readFileSync41(file))
     });
     if (!sent.ok) refuse2(opts, sent, "upload-refused");
     uploaded.push({ relPath: object.relPath, deduplicated: sent.value.deduplicated });
   }
   const committed = await client.commit({ publicationId: opened.value.publicationId });
+  if (committed.ok) {
+    await endRunPresence(componentName);
+  }
   if (!committed.ok) {
     if (committed.missing !== void 0 && committed.missing.length > 0) {
       fail(opts, ExitCode.General, {
@@ -18278,23 +18500,23 @@ async function runPublish(opts) {
   );
 }
 function readBundle(opts, bundleDir) {
-  const manifestPath2 = path52.join(bundleDir, "component.json");
-  const reportPath = path52.join(bundleDir, EVIDENCE_DIR, VERIFY_REPORT_FILENAME);
-  if (!existsSync42(manifestPath2)) {
+  const manifestPath2 = path54.join(bundleDir, "component.json");
+  const reportPath = path54.join(bundleDir, EVIDENCE_DIR, VERIFY_REPORT_FILENAME);
+  if (!existsSync44(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
       error: `there is no component.json in ${opts.bundleDir}, so this is not a bundle`,
       code: "not-a-bundle",
       remediation: `Point publish at a directory a Tendril run produced. \`${tendrilCommand("generate --help")}\` shows how one is made.`
     });
   }
-  if (!existsSync42(reportPath)) {
+  if (!existsSync44(reportPath)) {
     fail(opts, ExitCode.InputValidation, {
       error: `this bundle has never been verified \u2014 there is no ${EVIDENCE_DIR}/${VERIFY_REPORT_FILENAME}`,
       code: "bundle-not-verified",
       remediation: `Run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` first. Verification is free and needs no account; publishing without it would put a page up with no verdict on it.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync39(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync41(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -18302,7 +18524,7 @@ function readBundle(opts, bundleDir) {
       remediation: `Re-emit the bundle \u2014 \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` rewrites component.json \u2014 then publish.`
     });
   }
-  const reportText = readFileSync39(reportPath, "utf8");
+  const reportText = readFileSync41(reportPath, "utf8");
   let report;
   try {
     report = JSON.parse(reportText);
@@ -18362,6 +18584,96 @@ function refuse2(opts, sent, code) {
     remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${(opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "")}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 a retry rejoins this same unfinished publication.` : `Fix what is named above and run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one.`
   });
 }
+function pendingApprovalPath() {
+  return path54.join(path54.dirname(sessionPath()), "pending-publish.json");
+}
+async function runApprovalFlow(opts, client, bundleDir, input) {
+  const requested = await client.requestApproval({ componentName: input.componentName, figmaFile: input.figmaFile });
+  if (!requested.ok) refuse2(opts, requested, "approval-request-refused");
+  const approval = requested.value;
+  if (opts.approveStart === true) {
+    writeFileSync23(pendingApprovalPath(), `${JSON.stringify({ ...approval, bundleDir }, null, 2)}
+`, { mode: 384 });
+    emitData(
+      opts,
+      {
+        status: "approval-pending",
+        approveUrl: approval.approveUrl,
+        componentName: input.componentName,
+        expiresAt: approval.expiresAt,
+        next: "open the approve page in the signed-in browser, click Approve (tick the terms box if shown), then finish with --approve-wait"
+      },
+      () => {
+        process.stdout.write(`Approval requested for ${JSON.stringify(input.componentName)}.
+`);
+        process.stdout.write(`Approve it here: ${approval.approveUrl}
+`);
+        process.stdout.write(`Then finish with: ${tendrilCommand(`publish ${opts.bundleDir} --approve-wait`)}
+`);
+      }
+    );
+    return void 0;
+  }
+  process.stderr.write(`This component's FIRST publish needs your approval in the browser:
+  ${approval.approveUrl}
+`);
+  process.stderr.write(`Waiting for your decision (lapses at ${approval.expiresAt.slice(11, 16)} UTC)\u2026
+`);
+  const decided = await waitForApproval(opts, client, approval);
+  if (decided === "approved") return input.begin();
+  failDecision(opts, decided);
+}
+async function approveWaitPhase(opts, client, bundleDir) {
+  const file = pendingApprovalPath();
+  let pending;
+  if (existsSync44(file)) {
+    try {
+      const parsed = JSON.parse(readFileSync41(file, "utf8"));
+      if (typeof parsed.approvalId === "string" && typeof parsed.approveUrl === "string" && typeof parsed.expiresAt === "string") {
+        pending = { pollSeconds: 3, bundleDir, ...parsed };
+      }
+    } catch {
+    }
+  }
+  if (pending === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "there is no publish approval waiting to finish",
+      code: "no-pending-approval",
+      remediation: `Start one first: ${tendrilCommand(`publish ${opts.bundleDir} --approve-start`)} (the tendril_publish tool).`
+    });
+  }
+  const done = () => rmSync8(file, { force: true });
+  const decided = await waitForApproval(opts, client, pending);
+  done();
+  if (decided !== "approved") failDecision(opts, decided);
+}
+async function waitForApproval(opts, client, approval) {
+  const interval = Math.max(1, approval.pollSeconds) * 1e3;
+  const total = Math.ceil(APPROVAL_WAIT_CAP_MS / interval);
+  for (let tick = 1; tick <= total; tick += 1) {
+    const polled = await client.pollApproval({ approvalId: approval.approvalId });
+    if (!polled.ok) refuse2(opts, polled, "approval-poll-refused");
+    if (polled.value.status !== "pending") return polled.value.status;
+    emitProgress(tick, total, "waiting for the browser approval");
+    await new Promise((resolve) => setTimeout(resolve, interval));
+  }
+  return "expired";
+}
+function failDecision(opts, decided) {
+  if (decided === "denied") {
+    fail(opts, ExitCode.ConfirmationRequired, {
+      error: "the publish was DENIED in the browser \u2014 the human said no",
+      code: "publish-approval-denied",
+      remediation: "Nothing was published. If minds change, run the publish again \u2014 it makes a fresh request."
+    });
+  }
+  fail(opts, ExitCode.ConfirmationRequired, {
+    error: decided === "expired" ? "the approval request lapsed before anyone decided it" : "the approval request is gone \u2014 it lapsed and was cleaned up, or was already spent",
+    code: "publish-approval-lapsed",
+    remediation: "Run the publish again for a fresh request, and decide it within its 30-minute window."
+  });
+}
+var APPROVAL_WAIT_CAP_MS;
 var init_publish = __esm({
   "packages/cli/src/commands/publish.ts"() {
     "use strict";
@@ -18370,6 +18682,8 @@ var init_publish = __esm({
     init_invocation();
     init_output();
     init_publish_client();
+    init_run_presence();
+    APPROVAL_WAIT_CAP_MS = 31 * 6e4;
   }
 });
 
@@ -18397,17 +18711,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel4 } from "@clack/prompts";
-import { existsSync as existsSync43, readFileSync as readFileSync40 } from "node:fs";
-import path53 from "node:path";
+import { existsSync as existsSync45, readFileSync as readFileSync42 } from "node:fs";
+import path55 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path53.resolve(callerCwd, opts.out);
-  const recordedAsPath = path53.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path55.resolve(callerCwd, opts.out);
+  const recordedAsPath = path55.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync43(path53.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync45(path55.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -18416,7 +18730,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path53.basename(recordedAsPath);
+      taskName = path55.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -18450,7 +18764,7 @@ async function runGenerateRecorded(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync43(path53.join(task.set, c.rep, "get_screenshot.json")) || !existsSync43(path53.join(task.set, c.rep, "get_metadata.json")) || !existsSync43(path53.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync45(path55.join(task.set, c.rep, "get_screenshot.json")) || !existsSync45(path55.join(task.set, c.rep, "get_metadata.json")) || !existsSync45(path55.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -18520,8 +18834,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path53.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path53.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path55.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path55.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -18544,10 +18858,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path53.join(outDirAbs, taskName);
-  if (existsSync43(path53.join(bundleDir, "component.json"))) {
+  const bundleDir = path55.join(outDirAbs, taskName);
+  if (existsSync45(path55.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync40(path53.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync42(path55.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -18714,7 +19028,7 @@ init_invocation();
 init_output();
 import { intro, isCancel, outro, password } from "@clack/prompts";
 import fs from "node:fs";
-import path29 from "node:path";
+import path30 from "node:path";
 var INIT_DESCRIPTION = {
   name: "init",
   summary: "Configure the OpenRouter credential in .env, and optionally a Figma token (idempotent).",
@@ -18756,7 +19070,7 @@ async function runInit(flags) {
     printDescription(INIT_DESCRIPTION);
     return;
   }
-  const envPath = path29.resolve(process.cwd(), ".env");
+  const envPath = path30.resolve(process.cwd(), ".env");
   const existing = fs.existsSync(envPath) ? parseEnv(fs.readFileSync(envPath, "utf8")) : /* @__PURE__ */ new Map();
   let figmaToken = flags.figmaToken ?? existing.get(ENV_KEYS.figma);
   let openrouterKey = flags.openrouterKey ?? existing.get(ENV_KEYS.openrouter);
@@ -18777,7 +19091,7 @@ async function runInit(flags) {
   if (openrouterKey) next.set(ENV_KEYS.openrouter, openrouterKey);
   if (figmaToken) next.set(ENV_KEYS.figma, figmaToken);
   const changed = [...next].some(([key, value]) => existing.get(key) !== value);
-  const gitignorePath = path29.resolve(process.cwd(), ".gitignore");
+  const gitignorePath = path30.resolve(process.cwd(), ".gitignore");
   const gitignore = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
   const gitignoreCoversEnv = gitignore.split("\n").some((line) => [".env", ".env", ".env*"].includes(line.trim()));
   if (flags.dryRun) {
@@ -18833,14 +19147,14 @@ init_invocation();
 init_output();
 init_entitlement();
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
-import { readFileSync as readFileSync21, readdirSync as readdirSync9, existsSync as existsSync23 } from "node:fs";
+import { readFileSync as readFileSync22, readdirSync as readdirSync9, existsSync as existsSync24 } from "node:fs";
 
 // packages/cli/src/pipeline.ts
 init_src2();
 init_src5();
 init_src4();
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
-import path30 from "node:path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync10 } from "node:fs";
+import path31 from "node:path";
 
 // packages/cli/src/assets-module.ts
 init_src();
@@ -19176,7 +19490,7 @@ async function runGenerationPipeline(input) {
   });
   const written = [];
   if (!input.dryRun) {
-    const dir = path30.resolve(input.outDir, semantics.componentName);
+    const dir = path31.resolve(input.outDir, semantics.componentName);
     mkdirSync6(dir, { recursive: true });
     const files = {
       // Bundle-local tokens: THE emission the component's CSS resolves
@@ -19200,14 +19514,14 @@ async function runGenerationPipeline(input) {
 `
     };
     for (const [name, content] of Object.entries(files)) {
-      const filePath = path30.join(dir, name);
-      writeFileSync9(filePath, content);
+      const filePath = path31.join(dir, name);
+      writeFileSync10(filePath, content);
       written.push(filePath);
     }
     for (const artifact of emitTokenArtifacts(input.mapping)) {
-      const filePath = path30.resolve(input.outDir, artifact.path);
-      mkdirSync6(path30.dirname(filePath), { recursive: true });
-      writeFileSync9(filePath, artifact.content);
+      const filePath = path31.resolve(input.outDir, artifact.path);
+      mkdirSync6(path31.dirname(filePath), { recursive: true });
+      writeFileSync10(filePath, artifact.content);
       written.push(filePath);
     }
   }
@@ -19265,7 +19579,7 @@ var GENERATE_DESCRIPTION = {
 function resolveProvidedSource(flags, contextFile) {
   let raw;
   try {
-    raw = readFileSync21(contextFile, "utf8");
+    raw = readFileSync22(contextFile, "utf8");
   } catch {
     fail(flags, ExitCode.InputValidation, {
       error: `Cannot read context file "${contextFile}".`,
@@ -19385,11 +19699,11 @@ token mapping (${mapping.flat.length} variables):
   let initialCode;
   let initialSemantics;
   try {
-    if (existsSync23(flags.out)) {
+    if (existsSync24(flags.out)) {
       for (const entry of readdirSync9(flags.out)) {
         const cjPath = `${flags.out}/${entry}/component.json`;
-        if (!existsSync23(cjPath)) continue;
-        const cj = JSON.parse(readFileSync21(cjPath, "utf8"));
+        if (!existsSync24(cjPath)) continue;
+        const cj = JSON.parse(readFileSync22(cjPath, "utf8"));
         if (cj.name !== void 0 && Array.isArray(cj.props)) {
           previousApi = JSON.stringify({
             componentName: cj.name,
@@ -19397,14 +19711,14 @@ token mapping (${mapping.flat.length} variables):
           });
           const tsxPath = `${flags.out}/${entry}/${cj.name}.tsx`;
           const cssPath = `${flags.out}/${entry}/${cj.name}.css`;
-          if (flags.refine && existsSync23(tsxPath) && existsSync23(cssPath)) {
+          if (flags.refine && existsSync24(tsxPath) && existsSync24(cssPath)) {
             initialCode = {
-              tsx: readFileSync21(tsxPath, "utf8"),
-              css: readFileSync21(cssPath, "utf8")
+              tsx: readFileSync22(tsxPath, "utf8"),
+              css: readFileSync22(cssPath, "utf8")
             };
             const semPath = `${flags.out}/${entry}/semantics.json`;
-            if (existsSync23(semPath)) {
-              initialSemantics = JSON.parse(readFileSync21(semPath, "utf8"));
+            if (existsSync24(semPath)) {
+              initialSemantics = JSON.parse(readFileSync22(semPath, "utf8"));
             }
           }
           break;
@@ -19544,6 +19858,15 @@ bundle written to ${flags.out}/${result.semantics.componentName}/:
 
 // packages/cli/src/program.ts
 init_src5();
+function parseHoverTimeout(raw) {
+  const ms = Number(raw);
+  if (!Number.isInteger(ms) || ms < 100 || ms > 6e4) {
+    process.stderr.write(`--hover-timeout must be an integer between 100 and 60000 milliseconds, got "${raw}"
+`);
+    process.exit(2);
+  }
+  return ms;
+}
 function globalFlags(cmd) {
   const opts = cmd.optsWithGlobals();
   return {
@@ -19735,7 +20058,7 @@ function buildProgram() {
       ...local["profile"] !== void 0 ? { profile: local["profile"] } : {}
     });
   });
-  engine.command("score").argument("<taskOrSet>", "reference task name or recording-set directory").argument("<candidateDir>", "directory containing the proposed bundle files").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--host <name>", "self-reported host identity (recorded in provenance, labeled self-reported)").requiredOption("--model <id>", "proposer model, self-reported \u2014 required; a score without a declared model is not accepted").option("--rebind", "explicitly re-bind an already-bound bundle to a different recording set (refused otherwise \u2014 rebinding rewrites the bundle's verification identity)").option("--library <dir>", "workspace root holding confirmed partners generated bundles (ADR-013 composed pins; default: current directory)").action(async (taskOrSet, candidateDir, _o, cmd) => {
+  engine.command("score").argument("<taskOrSet>", "reference task name or recording-set directory").argument("<candidateDir>", "directory containing the proposed bundle files").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--host <name>", "self-reported host identity (recorded in provenance, labeled self-reported)").requiredOption("--model <id>", "proposer model, self-reported \u2014 required; a score without a declared model is not accepted").option("--rebind", "explicitly re-bind an already-bound bundle to a different recording set (refused otherwise \u2014 rebinding rewrites the bundle's verification identity)").option("--library <dir>", "workspace root holding confirmed partners generated bundles (ADR-013 composed pins; default: current directory)").option("--hover-timeout <ms>", "hover actionability budget in ms (default 2000) \u2014 loop feedback only here; a certifying verify run records any non-default budget as a caveat").action(async (taskOrSet, candidateDir, _o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
     const { runEngineScore: runEngineScore2 } = await Promise.resolve().then(() => (init_engine2(), engine_exports));
@@ -19747,7 +20070,8 @@ function buildProgram() {
       ...local["host"] !== void 0 ? { host: local["host"] } : {},
       model: local["model"],
       rebind: local["rebind"],
-      ...local["library"] !== void 0 ? { library: local["library"] } : {}
+      ...local["library"] !== void 0 ? { library: local["library"] } : {},
+      ...local["hoverTimeout"] !== void 0 ? { hoverTimeoutMs: parseHoverTimeout(local["hoverTimeout"]) } : {}
     });
   });
   program.command("codeconnect").description("Emit a Figma Code Connect template (.figma.ts) for a certified bundle \u2014 every variant\u2192prop mapping from recorded truth, stamped with the trust statement. Publishing stays yours (figma connect publish; Org/Enterprise plan).").argument("<bundleDir>", "bundle directory (must carry component.json)").requiredOption("--figma-url <url>", "figma.com /design/ URL of the COMPONENT SET (Copy link to selection)").option("--set <dir>", "recording set override (default: the bundle's provenance path)").option("--out <file>", "output file (default: <bundle>/<Component>.figma.ts)").action(async (bundleDir, _o, cmd) => {
@@ -19830,7 +20154,7 @@ function buildProgram() {
       ...local["revoke"] !== void 0 ? { revoke: local["revoke"] } : {}
     });
   });
-  program.command("publish").description("Put a verified bundle and its evidence on a page, at a URL you can send to someone. Refuses a run the ruler declined.").argument("<bundleDir>", "bundle directory that has already been verified").option("--to <url>", "the portal to publish to (or set TENDRIL_PORTAL_URL)").option("--name <name>", "library label for this component (default: the bundle manifest's own name)").option("--accept-terms", "accept the current publishing terms for this design system as part of this run").option("--confirm-publish", "you, a person, saying this component may be published \u2014 required the first time, and refused without an interactive terminal").action(async (bundleDir, _o, cmd) => {
+  program.command("publish").description("Put a verified bundle and its evidence on a page, at a URL you can send to someone. Refuses a run the ruler declined.").argument("<bundleDir>", "bundle directory that has already been verified").option("--to <url>", "the portal to publish to (or set TENDRIL_PORTAL_URL)").option("--name <name>", "library label for this component (default: the bundle manifest's own name)").option("--approve-start", "first publish only: request the browser approval, print the link, persist the pending state and exit \u2014 the tendril_publish tool's phase one").option("--approve-wait", "resume a pending approval: poll until the human decides in the browser, then publish \u2014 phase two").action(async (bundleDir, _o, cmd) => {
     const flags = globalFlags(cmd.parent);
     const local = cmd.opts();
     const { runPublish: runPublish2 } = await Promise.resolve().then(() => (init_publish(), publish_exports));
@@ -19839,11 +20163,11 @@ function buildProgram() {
       bundleDir,
       ...local["to"] !== void 0 ? { to: local["to"] } : {},
       ...local["name"] !== void 0 ? { name: local["name"] } : {},
-      ...local["acceptTerms"] !== void 0 ? { acceptTerms: local["acceptTerms"] } : {},
-      ...local["confirmPublish"] !== void 0 ? { confirmPublish: local["confirmPublish"] } : {}
+      ...local["approveStart"] !== void 0 ? { approveStart: local["approveStart"] } : {},
+      ...local["approveWait"] !== void 0 ? { approveWait: local["approveWait"] } : {}
     });
   });
-  program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--library <dir>", "workspace root holding confirmed partners generated bundles (ADR-013 composed pins; default: current directory)").option("--profile <file>", "a `tendril profile` artifact; reports whether the bundle followed your codebase conventions (never gates the verdict)").action(async (bundleDir, _opts, cmd) => {
+  program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--library <dir>", "workspace root holding confirmed partners generated bundles (ADR-013 composed pins; default: current directory)").option("--profile <file>", "a `tendril profile` artifact; reports whether the bundle followed your codebase conventions (never gates the verdict)").option("--hover-timeout <ms>", "hover actionability budget in ms (default 2000) \u2014 for diagnosing a slow machine; a non-default value is recorded in the report as a verdict caveat, never silently").action(async (bundleDir, _opts, cmd) => {
     const flags = globalFlags(cmd);
     const local = cmd.opts();
     const bar = local["bar"] === "cert" ? "cert" : "pass";
@@ -19855,7 +20179,8 @@ function buildProgram() {
       ...local["set"] !== void 0 ? { set: local["set"] } : {},
       ...local["library"] !== void 0 ? { library: local["library"] } : {},
       bar,
-      ...local["profile"] !== void 0 ? { profile: local["profile"] } : {}
+      ...local["profile"] !== void 0 ? { profile: local["profile"] } : {},
+      ...local["hoverTimeout"] !== void 0 ? { hoverTimeoutMs: parseHoverTimeout(local["hoverTimeout"]) } : {}
     });
   });
   program.command("generate").description(