@uniqbit/mate-core 0.15.4-canary.9 → 0.15.4

package/src/tools/setup/__snapshots__/runtime-surface-golden.test.ts.snap

@@ -14,8 +14,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -36,10 +38,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -169,8 +173,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -188,7 +194,7 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -224,7 +230,7 @@ Write chunks to $GRAPHIFY_OUT and read $GRAPHIFY_OUT later.
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -315,8 +321,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -337,10 +345,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -397,7 +407,7 @@ Write chunks to $GRAPHIFY_OUT and read $GRAPHIFY_OUT later.
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -433,7 +443,7 @@ Write chunks to $GRAPHIFY_OUT and read $GRAPHIFY_OUT later.
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -579,8 +589,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -608,10 +620,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -748,8 +762,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -777,7 +793,7 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
       },
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -792,7 +808,7 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -880,8 +896,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -909,10 +927,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -989,7 +1009,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       },
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -1004,7 +1024,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -1144,8 +1164,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1166,10 +1188,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1237,7 +1261,7 @@ exports[`runtime surface golden fixtures setup context-mode × claude 2`] = `
     "--plugin-dir",
     "<claude-plugin>",
     "--plugin-dir",
-    "<root>/companion/.mate/dependencies/context-mode/node_modules/context-mode",
+    "<root>/companion/.mate/plugins/.local/node_modules/context-mode",
   ],
   "claudeEnv": {
     "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD": "1",
@@ -1259,8 +1283,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 
@@ -1286,7 +1312,7 @@ Canonical Mate policy and any more specific tool-routing instructions remain aut
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
       "context-mode@1.0.169",
     ],
     "references": {
@@ -1302,7 +1328,7 @@ Canonical Mate policy and any more specific tool-routing instructions remain aut
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
       "context-mode@1.0.169",
     ],
   },
@@ -1383,8 +1409,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 
@@ -1413,10 +1441,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1442,7 +1472,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
       "context-mode@1.0.169",
     ],
     "references": {
@@ -1458,7 +1488,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
       "context-mode@1.0.169",
     ],
   },
@@ -1508,7 +1538,7 @@ exports[`runtime surface golden fixtures setup context-mode × claude+opencode 2
     "--plugin-dir",
     "<claude-plugin>",
     "--plugin-dir",
-    "<root>/companion/.mate/dependencies/context-mode/node_modules/context-mode",
+    "<root>/companion/.mate/plugins/.local/node_modules/context-mode",
   ],
   "claudeEnv": {
     "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD": "1",
@@ -1585,8 +1615,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1609,10 +1641,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1729,8 +1763,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1748,7 +1784,7 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -1766,7 +1802,7 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -1846,8 +1882,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1870,10 +1908,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -1928,7 +1968,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -1946,7 +1986,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -2070,8 +2110,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2092,10 +2134,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2111,6 +2155,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
         "Edit(<root>/companion/**)",
         "Read(<root>/companion/**)",
         "Skill(mate-artifact-finish)",
+        "Skill(mate-openspec-backfill)",
         "Skill(openspec-apply-change)",
         "Skill(openspec-archive-change)",
         "Skill(openspec-explore)",
@@ -2162,7 +2207,7 @@ exports[`runtime surface golden fixtures setup openspec × claude 2`] = `
     <rule id="local-artifact-exception" severity="critical">Only write artifacts in <root>/working when the exact path is gitignored AND intentionally local-only; otherwise use <root>/companion.</rule>
     <rule id="guardrail" severity="critical">Bad artifact writes to <root>/working are rejected. Classify correctly first.</rule>
     <rule id="wrapper-only-cli-execution" severity="critical">For every CLI declared in cli-tools, invoke the exact path in its invokeAs attribute. Correct: <wrapper-bin>/openspec status ... . Incorrect: openspec status ... . Do not run bare openspec or graphify commands and do not rely on PATH, aliases, or shell functions. If the exact wrapper path is unavailable, stop and report it.</rule>
-    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes ONLY with: mate artifact finish "<name>" --json — never hand-commit or hand-tag a finish. Finishing a still-active change applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
+    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes by archiving them: the archive triggers a nudge directing you to run mate artifact finish "<name>" --json — if no nudge arrives, invoke that command yourself. It is the only sanctioned completion; never hand-commit or hand-tag a finish. Finishing a still-active change archives it and applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
   </mandatory-rules>
 </companion-policy>"
 ,
@@ -2195,8 +2240,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2214,7 +2261,7 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -2234,7 +2281,7 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -2273,7 +2320,7 @@ exports[`runtime surface golden fixtures setup openspec × opencode 2`] = `
     <rule id="local-artifact-exception" severity="critical">Only write artifacts in $MATE_REPO_PATH when the exact path is gitignored AND intentionally local-only; otherwise use $MATE_ARTIFACT_PATH.</rule>
     <rule id="guardrail" severity="critical">Bad artifact writes to $MATE_REPO_PATH are rejected. Classify correctly first.</rule>
     <rule id="wrapper-only-cli-execution" severity="critical">For every CLI declared in cli-tools, invoke the exact path in its invokeAs attribute. Correct: $MATE_WRAPPER_BIN_PATH/openspec status ... . Incorrect: openspec status ... . Do not run bare openspec or graphify commands and do not rely on PATH, aliases, or shell functions. If the exact wrapper path is unavailable, stop and report it.</rule>
-    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes ONLY with: mate artifact finish "<name>" --json — never hand-commit or hand-tag a finish. Finishing a still-active change applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
+    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes by archiving them: the archive triggers a nudge directing you to run mate artifact finish "<name>" --json — if no nudge arrives, invoke that command yourself. It is the only sanctioned completion; never hand-commit or hand-tag a finish. Finishing a still-active change archives it and applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
   </mandatory-rules>
 </companion-policy>"
 ,
@@ -2315,8 +2362,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2337,10 +2386,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2356,6 +2407,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
         "Edit(<root>/companion/**)",
         "Read(<root>/companion/**)",
         "Skill(mate-artifact-finish)",
+        "Skill(mate-openspec-backfill)",
         "Skill(openspec-apply-change)",
         "Skill(openspec-archive-change)",
         "Skill(openspec-explore)",
@@ -2377,7 +2429,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -2397,7 +2449,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -2434,7 +2486,7 @@ exports[`runtime surface golden fixtures setup openspec × claude+opencode 2`] =
     <rule id="local-artifact-exception" severity="critical">Only write artifacts in <root>/working when the exact path is gitignored AND intentionally local-only; otherwise use <root>/companion.</rule>
     <rule id="guardrail" severity="critical">Bad artifact writes to <root>/working are rejected. Classify correctly first.</rule>
     <rule id="wrapper-only-cli-execution" severity="critical">For every CLI declared in cli-tools, invoke the exact path in its invokeAs attribute. Correct: <wrapper-bin>/openspec status ... . Incorrect: openspec status ... . Do not run bare openspec or graphify commands and do not rely on PATH, aliases, or shell functions. If the exact wrapper path is unavailable, stop and report it.</rule>
-    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes ONLY with: mate artifact finish "<name>" --json — never hand-commit or hand-tag a finish. Finishing a still-active change applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
+    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes by archiving them: the archive triggers a nudge directing you to run mate artifact finish "<name>" --json — if no nudge arrives, invoke that command yourself. It is the only sanctioned completion; never hand-commit or hand-tag a finish. Finishing a still-active change archives it and applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
   </mandatory-rules>
 </companion-policy>"
 ,
@@ -2481,7 +2533,7 @@ exports[`runtime surface golden fixtures setup openspec × claude+opencode 2`] =
     <rule id="local-artifact-exception" severity="critical">Only write artifacts in $MATE_REPO_PATH when the exact path is gitignored AND intentionally local-only; otherwise use $MATE_ARTIFACT_PATH.</rule>
     <rule id="guardrail" severity="critical">Bad artifact writes to $MATE_REPO_PATH are rejected. Classify correctly first.</rule>
     <rule id="wrapper-only-cli-execution" severity="critical">For every CLI declared in cli-tools, invoke the exact path in its invokeAs attribute. Correct: $MATE_WRAPPER_BIN_PATH/openspec status ... . Incorrect: openspec status ... . Do not run bare openspec or graphify commands and do not rely on PATH, aliases, or shell functions. If the exact wrapper path is unavailable, stop and report it.</rule>
-    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes ONLY with: mate artifact finish "<name>" --json — never hand-commit or hand-tag a finish. Finishing a still-active change applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
+    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes by archiving them: the archive triggers a nudge directing you to run mate artifact finish "<name>" --json — if no nudge arrives, invoke that command yourself. It is the only sanctioned completion; never hand-commit or hand-tag a finish. Finishing a still-active change archives it and applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
   </mandatory-rules>
 </companion-policy>"
 ,
@@ -2523,8 +2575,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 
@@ -2562,10 +2616,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2660,6 +2716,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
         "Skill(context-mode:context-mode)",
         "Skill(graphify)",
         "Skill(mate-artifact-finish)",
+        "Skill(mate-openspec-backfill)",
         "Skill(openspec-apply-change)",
         "Skill(openspec-archive-change)",
         "Skill(openspec-explore)",
@@ -2711,7 +2768,7 @@ Write chunks to $GRAPHIFY_OUT and read $GRAPHIFY_OUT later.
       },
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
       "context-mode@1.0.169",
     ],
     "references": {
@@ -2754,7 +2811,7 @@ Write chunks to $GRAPHIFY_OUT and read $GRAPHIFY_OUT later.
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
       "context-mode@1.0.169",
     ],
   },
@@ -2792,7 +2849,7 @@ exports[`runtime surface golden fixtures setup all capabilities × claude+openco
     <rule id="local-artifact-exception" severity="critical">Only write artifacts in <root>/working when the exact path is gitignored AND intentionally local-only; otherwise use <root>/companion.</rule>
     <rule id="guardrail" severity="critical">Bad artifact writes to <root>/working are rejected. Classify correctly first.</rule>
     <rule id="wrapper-only-cli-execution" severity="critical">For every CLI declared in cli-tools, invoke the exact path in its invokeAs attribute. Correct: <wrapper-bin>/openspec status ... . Incorrect: openspec status ... . Do not run bare openspec or graphify commands and do not rely on PATH, aliases, or shell functions. If the exact wrapper path is unavailable, stop and report it.</rule>
-    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes ONLY with: mate artifact finish "<name>" --json — never hand-commit or hand-tag a finish. Finishing a still-active change applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
+    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes by archiving them: the archive triggers a nudge directing you to run mate artifact finish "<name>" --json — if no nudge arrives, invoke that command yourself. It is the only sanctioned completion; never hand-commit or hand-tag a finish. Finishing a still-active change archives it and applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
   </mandatory-rules>
 </companion-policy>
 
@@ -2816,7 +2873,7 @@ exports[`runtime surface golden fixtures setup all capabilities × claude+openco
     "--plugin-dir",
     "<claude-plugin>",
     "--plugin-dir",
-    "<root>/companion/.mate/dependencies/context-mode/node_modules/context-mode",
+    "<root>/companion/.mate/plugins/.local/node_modules/context-mode",
   ],
   "claudeEnv": {
     "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD": "1",
@@ -2863,7 +2920,7 @@ exports[`runtime surface golden fixtures setup all capabilities × claude+openco
     <rule id="local-artifact-exception" severity="critical">Only write artifacts in $MATE_REPO_PATH when the exact path is gitignored AND intentionally local-only; otherwise use $MATE_ARTIFACT_PATH.</rule>
     <rule id="guardrail" severity="critical">Bad artifact writes to $MATE_REPO_PATH are rejected. Classify correctly first.</rule>
     <rule id="wrapper-only-cli-execution" severity="critical">For every CLI declared in cli-tools, invoke the exact path in its invokeAs attribute. Correct: $MATE_WRAPPER_BIN_PATH/openspec status ... . Incorrect: openspec status ... . Do not run bare openspec or graphify commands and do not rely on PATH, aliases, or shell functions. If the exact wrapper path is unavailable, stop and report it.</rule>
-    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes ONLY with: mate artifact finish "<name>" --json — never hand-commit or hand-tag a finish. Finishing a still-active change applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
+    <rule id="openspec-finish" severity="critical">Finish OpenSpec changes by archiving them: the archive triggers a nudge directing you to run mate artifact finish "<name>" --json — if no nudge arrives, invoke that command yourself. It is the only sanctioned completion; never hand-commit or hand-tag a finish. Finishing a still-active change archives it and applies its delta specs itself, so do not pre-apply them to openspec/specs right before finishing. Finishing an already-archived change resumes without re-applying delta specs, so an archive flow that already synced specs (e.g. openspec-sync-specs) composes fine with a finish afterwards.</rule>
   </mandatory-rules>
 </companion-policy>"
 ,
@@ -2905,8 +2962,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2927,10 +2986,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -2954,7 +3015,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -2969,7 +3030,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -2989,8 +3050,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3011,10 +3074,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3038,7 +3103,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -3053,7 +3118,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -3073,8 +3138,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 
@@ -3096,10 +3163,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3123,7 +3192,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -3138,7 +3207,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -3158,8 +3227,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3180,10 +3251,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3207,7 +3280,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -3222,7 +3295,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -3242,8 +3315,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3264,10 +3339,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3291,7 +3368,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
       "reserved": 15000,
     },
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
     "references": {
       "mate": "..",
@@ -3306,7 +3383,7 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
   "opencodeTui": {
     "$schema": "https://opencode.ai/tui.json",
     "plugin": [
-      "@uniqbit/mate-opencode-plugin@0.15.4-canary.8",
+      "@uniqbit/mate-opencode-plugin@0.15.4-canary.11",
     ],
   },
 }
@@ -3326,8 +3403,10 @@ This block is kept for AGENTS.md compatibility and must not restate that policy.
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3348,10 +3427,12 @@ This block is kept for Claude/AGENTS.md compatibility and must not restate that
 
 - Use absolute paths when a tool needs a file path. Do not create literal \`$MATE_REPO_PATH\` or \`$MATE_ARTIFACT_PATH\` directories.
 - When reporting information to me, be extremely concise and sacrifice grammar for the sake of concision. Apply this same preference to JSDoc.
+- Code comments: JSDoc format only (\`/** ... */\`), never \`//\`. Sparse — only non-obvious invariants or constraints, never restated artifact rationale.
 - Claude Code receives \`$MATE_ARTIFACT_PATH\` via \`--add-dir\`; if \`@\` autocomplete does not show companion artifacts, reference them by absolute path.
 - The root \`CLAUDE.md\` in the companion repo is intentional and loaded by Mate. Do not create another project-level \`CLAUDE.md\` in the working repo unless the user explicitly asks for one.
 - Never add a \`Co-Authored-By: <model>\` trailer or model-attribution footer to commit messages.
 - Never commit, push, or open a pull request in the working repo (\`$MATE_REPO_PATH\`) unless the user explicitly asks for it.
+- Never connect to a database (local or remote), touch live/external systems (deploys, infra), or take destructive/irreversible actions without asking the user first.
 
 <!-- MATE:COMPANION:END -->
 "
@@ -3486,15 +3567,44 @@ User notes.
 }
 `;
 
-exports[`working repo golden fixtures hub roots are refused before any runtime file is written 1`] = `
+exports[`working repo golden fixtures hub roots set up providers only without companion surfaces 1`] = `
 {
   "agentsMd": null,
   "claudeHooks": {},
-  "claudeMcpConfig": null,
+  "claudeMcpConfig": {
+    "mcpServers": {
+      "tokensave": {
+        "args": [
+          "serve",
+        ],
+        "command": "tokensave",
+      },
+    },
+  },
   "claudeMd": null,
-  "claudeSettingsLocal": null,
+  "claudeSettingsLocal": {
+    "autoMemoryEnabled": false,
+    "permissions": {
+      "allow": [
+        "Bash(mate:*)",
+        "Edit(<root>/companion/**)",
+        "Read(<root>/companion/**)",
+      ],
+    },
+  },
   "claudeSkills": {},
-  "opencodeConfig": null,
+  "opencodeConfig": {
+    "mcp": {
+      "tokensave": {
+        "command": [
+          "tokensave",
+          "serve",
+        ],
+        "enabled": true,
+        "type": "local",
+      },
+    },
+  },
   "opencodePlugins": {},
   "opencodeSkills": {},
   "opencodeTui": null,