@vibgrate/cli 2026.817.2 → 2026.818.2

package/dist/cli.js

@@ -1,63 +1,72 @@
 #!/usr/bin/env node
-import { fetchCatalog, resolveProviders } from './chunk-C3LMWZKF.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-EXV4QSAD.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-6K3XK7C5.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, ProgressBar, printLogo, runBuild } from './chunk-LHKQGVRF.js';
-export { runBuild } from './chunk-LHKQGVRF.js';
-import { restartVgdIfRunning, stopVgd, registerDaemon, rootOf, requireGraph } from './chunk-KNGAZDGF.js';
-import { readGlobal, applyGlobalOptions } from './chunk-OZ3IFXRD.js';
-import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import './chunk-GOGMS3ST.js';
-import './chunk-IS7VTH2Q.js';
+import { fetchCatalog, resolveProviders } from './chunk-FFXGWFAE.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-BMOFJIMG.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-6ABMV74F.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, LiveStatus, ProgressBar, printLogo, runBuild } from './chunk-HF6R73UC.js';
+export { runBuild } from './chunk-HF6R73UC.js';
+import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-JFE7XCAE.js';
-import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
-import { runCodeSession } from './chunk-3NJUOIZQ.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-K6DXETMC.js';
+import { runCodeSession } from './chunk-AEJYA6HZ.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-JGA63RGF.js';
 import './chunk-543E6WDJ.js';
-import './chunk-Q3M6K3HY.js';
-import './chunk-TVDMNIUT.js';
-import './chunk-RBIRXQR6.js';
-import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
+import './chunk-ZUOBPKVK.js';
+import './chunk-O5IJDMTB.js';
 import { parseReasoningEffort, summarizeDiffs, ScriptedProvider } from './chunk-74UBGF4P.js';
 import './chunk-7AVYKZEM.js';
 import { buildModelInstallPlan } from './chunk-I5LP55B6.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-3HNPVXUK.js';
+import { vgdVersionSkew, restartVgdIfRunning, stopVgd, registerDaemon, rootOf, requireGraph } from './chunk-E3O5UKNA.js';
+import { readGlobal, applyGlobalOptions } from './chunk-YENM3HT7.js';
+import { ActivityLog } from './chunk-H5Q4JUY4.js';
+import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-FJG5AXKZ.js';
-import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
+import { isManifest, isDependencyFile, manifestHash, loadScanCache, writeScanCache, manifestKind, findPackageLine, endOfLine, findRuntimeLine } from './chunk-VQ5KMHW6.js';
+import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
+import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
+import './chunk-IS7VTH2Q.js';
 import './chunk-IZDH67DX.js';
-import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-M7IO3DXH.js';
-import { refreshIfStale } from './chunk-O2DL2Q55.js';
-import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-E2FAQREZ.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-DVW3SVCW.js';
+import { DaemonSemanticSession, serveStdio, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-X2MQ7UFL.js';
+import { refreshIfStale } from './chunk-B4EXD5LK.js';
+import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, assistantById, SMALL_REPO_FILES } from './chunk-6PFHDHOL.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-NKLYDSB7.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, refineArchitectureWithGraph, refineArchitectureWithAstRoles, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-WAKP7SK7.js';
-import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, refineArchitectureWithAstRoles, refineArchitectureWithGraph, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift, boundaryProfileRules } from './chunk-V2UGRUTL.js';
 import './chunk-VIWZ4QT7.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-3H3SVJUY.js';
-import { resolveOne } from './chunk-J7LKEB2R.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-KJT2R6WW.js';
-import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-Q4G2BWE3.js';
+import { catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-RHKOUPWT.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-YF54UMOU.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
-import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-3FMRFECC.js';
-import './chunk-5I4VSBWQ.js';
+import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js';
+import { attachVgd } from './chunk-NJQZRM55.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-NG4KIJW6.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
+import './chunk-5IQBIXHS.js';
 import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-EZ7UC5Y5.js';
-import { resolvedGrammarFiles, TOOLCHAIN_GRAMMARS, resolveToolchainGrammar, grammarSetVersion, fileRolesFromParseCache } from './chunk-XLXJC7H3.js';
+import { publishGraphToVgd } from './chunk-LJSJX6U4.js';
+import { isRelevantChange } from './chunk-DBX3DL27.js';
+import { discover, SKIP_DIRS } from './chunk-POOL355F.js';
+import { inventory, enrichOnline, ECOSYSTEMS } from './chunk-6BEBJCK4.js';
+import { resolveOne } from './chunk-J7LKEB2R.js';
+import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-MRZHNUN7.js';
+import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-KU7FI5EV.js';
+import './chunk-E53WBVUQ.js';
+import './chunk-NDNNOAS6.js';
+import './chunk-5I4VSBWQ.js';
+import { resolvedGrammarFiles, TOOLCHAIN_GRAMMARS, resolveToolchainGrammar, grammarSetVersion, fileRolesFromParseCache } from './chunk-PRHH4DVO.js';
 import './chunk-T7RSQ5WD.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-AXZZ5CCG.js';
-import { resetRelevanceProviderCache, loadRelevanceProvider, relevanceModuleDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-WVMOGIPC.js';
+import './chunk-6WRG7VDO.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-2C33WR5O.js';
+import { resetRelevanceProviderCache, loadRelevanceProvider, relevanceModuleDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-VMAIDM4K.js';
 import { cacheDir } from './chunk-MVPRPSXU.js';
 import { serializeGraph, stableStringify, parseGraph } from './chunk-O3LABX6I.js';
-import { VERSION } from './chunk-PRG2ULPK.js';
+import { VERSION } from './chunk-4NTNMT6T.js';
 import './chunk-BWPBB45M.js';
-import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
+import { canonicalize, hashString } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
-import * as fs14 from 'fs';
-import fs14__default, { realpathSync } from 'fs';
+import * as fs13 from 'fs';
+import fs13__default, { realpathSync } from 'fs';
 import * as path46 from 'path';
 import path46__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -71,7 +80,7 @@ import * as zlib from 'zlib';
 import * as crypto3 from 'crypto';
 import { randomUUID, createHash } from 'crypto';
 import chalk7 from 'chalk';
-import * as fs28 from 'fs/promises';
+import * as fs27 from 'fs/promises';
 import { parse, stringify } from 'yaml';
 
 init_cli_invocation();
@@ -85,7 +94,7 @@ async function runStatus(global) {
   const root3 = path46.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root3, global.graph);
   const graph = loadGraph(root3, graphPath);
-  const hasCache = fs14.existsSync(path46.join(cacheDir(root3), "parse-cache.json"));
+  const hasCache = fs13.existsSync(path46.join(cacheDir(root3), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -158,6 +167,21 @@ function registerAsk(program) {
       }
     }
     const { graph } = requireGraph(global);
+    const activity = new ActivityLog();
+    const live = !global.json ? new LiveStatus() : null;
+    live?.start("attaching to vgd\u2026");
+    const attached = await activity.time(
+      "attach",
+      () => attachVgd(root3, {
+        graphPath: global.graph,
+        disabled: global.daemon === false,
+        // Skip the republish when the daemon already holds this exact map:
+        // a publish drops the slot's vectors, so doing it on every ask
+        // churned the index for nothing.
+        corpusHash: graph.provenance?.corpusHash
+      }),
+      (a) => describeAttach(a)
+    );
     const budget = Number(opts.budget) || 2e3;
     const q = question.join(" ");
     const wantSemantic = opts.semantic !== false && !global.local;
@@ -166,34 +190,64 @@ function registerAsk(program) {
     let note = "";
     const relevance = await analyzeQuestion(q);
     const topicTags = relevance ? await loadTopicTags(graph, root3, resolveGraphPath(root3, global.graph)) : null;
-    if (wantSemantic) {
-      const firstRun = !embeddingsCached(root3, resolveEmbedModel());
-      if (!global.json && firstRun) {
-        info(c.dim("  preparing semantic search (first use embeds the map; cached, resumable & offline after)\u2026"));
-      }
-      let reason;
-      let detail;
-      const embedder = await loadEmbedder({
-        local: global.local,
-        onUnavailable: (r, d) => {
-          reason = r;
-          detail = d;
+    try {
+      if (wantSemantic) {
+        live?.set("asking the daemon\u2026");
+        const ranked = attached.status === "attached" && attached.repositoryId ? await activity.time(
+          "semantic",
+          // The attach above already resolved (and, if needed, published)
+          // the slot — this session only sends the question.
+          () => new DaemonSemanticSession(root3, { socketPath: attached.socketPath, publish: false }).rank(q, void 0, {
+            onProgress: (p) => live?.set(p.detail)
+          }),
+          (r) => r ? { outcome: "ok", detail: `ranked in the daemon \xB7 ${r.ranked.length} of ${r.vectors} vector(s)${r.model ? ` \xB7 ${r.model}` : ""}` } : { outcome: "skip", detail: "daemon index unavailable \u2014 embedding in this process" }
+        ) : null;
+        if (ranked) {
+          live?.set("answering from the daemon index\u2026");
+          result = await queryGraphSemantic(graph, q, {
+            budget,
+            semanticRanked: ranked.ranked,
+            relevance,
+            topicTags
+          });
+          mode = `semantic (vgd${ranked.model ? `, ${ranked.model}` : ""})`;
+          activity.add("answer", "ok", "answered from the daemon index \u2014 no local model load");
+        } else {
+          const firstRun = !embeddingsCached(root3, resolveEmbedModel());
+          live?.set(
+            firstRun ? "loading the embedding model (first use; then cached and offline)\u2026" : "embedding the map in this process\u2026"
+          );
+          let reason;
+          let detail;
+          const embedder = await loadEmbedder({
+            local: global.local,
+            onUnavailable: (r, d) => {
+              reason = r;
+              detail = d;
+            }
+          });
+          if (embedder) {
+            live?.stop();
+            const bar = !global.json ? new ProgressBar(c.dim("embedding")) : void 0;
+            const vectors = await getNodeEmbeddings(graph, embedder, root3, bar ? (d, t) => bar.update(d, t) : void 0);
+            bar?.done();
+            result = await queryGraphSemantic(graph, q, { budget, embedder, nodeVectors: vectors, relevance, topicTags });
+            mode = `semantic (${embedder.id})`;
+            activity.add("answer", "ok", `answered in this process \xB7 ${embedder.id} \xB7 ${vectors.size} vector(s)`);
+          } else {
+            result = queryGraph(graph, q, { budget, relevance, topicTags });
+            note = reason ? unavailableMessage(reason) : "semantic unavailable; used lexical";
+            if (detail) note += ` (${detail})`;
+            activity.add("answer", "warn", `lexical only \u2014 ${note}`);
+          }
         }
-      });
-      if (embedder) {
-        const bar = !global.json && firstRun ? new ProgressBar(c.dim("embedding")) : void 0;
-        const vectors = await getNodeEmbeddings(graph, embedder, root3, bar ? (d, t) => bar.update(d, t) : void 0);
-        bar?.done();
-        result = await queryGraphSemantic(graph, q, { budget, embedder, nodeVectors: vectors, relevance, topicTags });
-        mode = `semantic (${embedder.id})`;
       } else {
         result = queryGraph(graph, q, { budget, relevance, topicTags });
-        note = reason ? unavailableMessage(reason) : "semantic unavailable; used lexical";
-        if (detail) note += ` (${detail})`;
+        if (global.local) note = "semantic skipped under --local; used lexical";
+        activity.add("answer", "skip", global.local ? "lexical only (--local)" : "lexical only (--no-semantic)");
       }
-    } else {
-      result = queryGraph(graph, q, { budget, relevance, topicTags });
-      if (global.local) note = "semantic skipped under --local; used lexical";
+    } finally {
+      live?.stop();
     }
     if (global.client) {
       const files = new Set(result.matches.map((m) => m.node.file).filter(Boolean));
@@ -214,6 +268,7 @@ function registerAsk(program) {
         question: result.question,
         mode,
         note: note || void 0,
+        activity: activity.toJSON(),
         tokensEstimate: result.tokensEstimate,
         matches: result.matches.map((m) => ({
           name: m.node.qualifiedName,
@@ -231,9 +286,25 @@ function registerAsk(program) {
     info("");
     info(c.dim(`vg \xB7 ${result.matches.length} match(es) \xB7 ~${result.tokensEstimate} tokens (budget ${budget}) \xB7 ${mode}`));
     if (note) info(c.yellow(`  ${note}`));
+    for (const line of activity.render()) info(line);
   });
   applyGlobalOptions(cmd);
 }
+function describeAttach(a) {
+  if (a.status === "disabled") return { outcome: "skip", detail: `${a.reason} \u2014 running in this process` };
+  if (a.status === "unavailable") return { outcome: "skip", detail: `${a.reason} \u2014 running in this process` };
+  const started = a.started ? "started vgd" : "attached to vgd";
+  if (a.published?.status === "current") {
+    return { outcome: "ok", detail: `${started} \xB7 already holds this map (${a.published.gitRef})` };
+  }
+  if (a.published?.status === "published") {
+    return { outcome: "ok", detail: `${started} \xB7 map published ${a.published.gitRef} \xB7 ${a.published.nodeCount} nodes` };
+  }
+  if (a.published?.status === "failed") {
+    return { outcome: "warn", detail: `${started} \xB7 map not published (${a.published.error})` };
+  }
+  return { outcome: "ok", detail: started };
+}
 function crashedMessage(signal) {
   const envPrefix = process.platform === "linux" ? "ONNXRUNTIME_NODE_INSTALL=skip " : "";
   return `semantic search is disabled: its native backend (onnxruntime-node, via the vendored fastembed path) crashed with ${signal} \u2014 using fast lexical search instead. This usually means the installed native binaries are broken (an interrupted install, or a platform without prebuilt CPU binaries). Reinstall to repair \u2014 ${envPrefix}npm install -g --allow-scripts=@vibgrate/cli,onnxruntime-node,msgpackr-extract @vibgrate/cli \u2014 or run with --local to stay lexical quietly.`;
@@ -247,7 +318,7 @@ function verdictPath(dir) {
 }
 function readVerdict(dir) {
   try {
-    const raw = JSON.parse(fs14.readFileSync(verdictPath(dir), "utf8"));
+    const raw = JSON.parse(fs13.readFileSync(verdictPath(dir), "utf8"));
     if (raw?.status !== "ok" && raw?.status !== "crashed") return null;
     if (raw.version !== VERSION) return null;
     return raw;
@@ -257,8 +328,8 @@ function readVerdict(dir) {
 }
 function writeVerdict(dir, verdict) {
   try {
-    fs14.mkdirSync(dir, { recursive: true });
-    fs14.writeFileSync(verdictPath(dir), JSON.stringify(verdict, null, 2) + "\n", "utf8");
+    fs13.mkdirSync(dir, { recursive: true });
+    fs13.writeFileSync(verdictPath(dir), JSON.stringify(verdict, null, 2) + "\n", "utf8");
   } catch {
   }
 }
@@ -266,7 +337,7 @@ function probeModuleUrl(from = import.meta.url) {
   const dir = path46.dirname(fileURLToPath(from));
   for (const name of ["embeddings.js", "index.js"]) {
     const candidate = path46.join(dir, name);
-    if (fs14.existsSync(candidate)) return pathToFileURL(candidate).href;
+    if (fs13.existsSync(candidate)) return pathToFileURL(candidate).href;
   }
   return pathToFileURL(path46.join(dir, "index.js")).href;
 }
@@ -343,7 +414,7 @@ async function embedderHealth(options = {}) {
 }
 function clearEmbedderHealth(cacheDir2) {
   try {
-    fs14.unlinkSync(verdictPath(cacheDir2 ?? defaultCacheDir()));
+    fs13.unlinkSync(verdictPath(cacheDir2 ?? defaultCacheDir()));
   } catch {
   }
 }
@@ -370,6 +441,7 @@ function registerEmbed(program) {
       return;
     }
     if (countPending(graph, root3, modelId) === 0) {
+      await warmDaemonIndex(root3, global.graph);
       if (global.json) json({ embedded: 0, pending: 0, upToDate: true, model: modelId, semantic: true });
       else if (speak) info(`${c.cyan("vg embed")} \xB7 semantic index already up to date`);
       return;
@@ -406,11 +478,15 @@ function registerEmbed(program) {
     const bar = speak ? new ProgressBar(c.dim("embedding")) : void 0;
     await getNodeEmbeddings(graph, embedder, root3, bar ? (d, t) => bar.update(d, t) : void 0);
     bar?.done();
+    await warmDaemonIndex(root3, global.graph);
     if (global.json) json({ embedded: pending, model: modelId, semantic: true });
     else if (speak) info(`${c.green("\u2714")} vg embed \xB7 semantic index ready (~${pending} node(s) \xB7 model ${modelId})`);
   });
   applyGlobalOptions(cmd);
 }
+async function warmDaemonIndex(root3, graphPath) {
+  await publishGraphToVgd(root3, { graphPath, warmSemantic: true });
+}
 function showWhere(root3, modelId, asJson) {
   const m = modelCacheInfo(modelId);
   const repoCached = embeddingsCached(root3, modelId);
@@ -1018,7 +1094,7 @@ function liveStatsDir(root3) {
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
   try {
-    entries = fs14.readdirSync(dir);
+    entries = fs13.readdirSync(dir);
   } catch {
     return [];
   }
@@ -1027,7 +1103,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs14.readFileSync(path46.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs13.readFileSync(path46.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1081,10 +1157,10 @@ var LiveStatsBus = class {
     this.lastWriteAt = now;
     const body = { pid: this.pid, updatedAt: now, version: VERSION, snapshot: snap };
     try {
-      fs14.mkdirSync(this.dir, { recursive: true });
+      fs13.mkdirSync(this.dir, { recursive: true });
       const tmp = `${this.file}.tmp`;
-      fs14.writeFileSync(tmp, JSON.stringify(body));
-      fs14.renameSync(tmp, this.file);
+      fs13.writeFileSync(tmp, JSON.stringify(body));
+      fs13.renameSync(tmp, this.file);
     } catch {
     }
   }
@@ -1095,7 +1171,7 @@ var LiveStatsBus = class {
   siblings(now = Date.now()) {
     let entries;
     try {
-      entries = fs14.readdirSync(this.dir);
+      entries = fs13.readdirSync(this.dir);
     } catch {
       return [];
     }
@@ -1105,14 +1181,14 @@ var LiveStatsBus = class {
       const file = path46.join(this.dir, name);
       let parsed;
       try {
-        parsed = JSON.parse(fs14.readFileSync(file, "utf8"));
+        parsed = JSON.parse(fs13.readFileSync(file, "utf8"));
       } catch {
         continue;
       }
       if (typeof parsed?.pid !== "number" || typeof parsed.updatedAt !== "number" || !parsed.snapshot?.totals) continue;
       if (now - parsed.updatedAt > STALE_MS) {
         try {
-          fs14.unlinkSync(file);
+          fs13.unlinkSync(file);
         } catch {
         }
         continue;
@@ -1124,7 +1200,7 @@ var LiveStatsBus = class {
   }
   unlinkOwn = () => {
     try {
-      fs14.unlinkSync(this.file);
+      fs13.unlinkSync(this.file);
     } catch {
     }
   };
@@ -1437,12 +1513,12 @@ var LedgerTail = class {
     if (size === this.offset) return;
     let chunk;
     try {
-      const fd = fs14.openSync(this.file, "r");
+      const fd = fs13.openSync(this.file, "r");
       try {
         chunk = Buffer.alloc(size - this.offset);
-        fs14.readSync(fd, chunk, 0, chunk.length, this.offset);
+        fs13.readSync(fd, chunk, 0, chunk.length, this.offset);
       } finally {
-        fs14.closeSync(fd);
+        fs13.closeSync(fd);
       }
     } catch {
       return;
@@ -1455,7 +1531,7 @@ var LedgerTail = class {
   }
   sizeOf() {
     try {
-      return fs14.statSync(this.file).size;
+      return fs13.statSync(this.file).size;
     } catch {
       return 0;
     }
@@ -1511,6 +1587,7 @@ function registerServe(program) {
       dedup: opts.dedup === true,
       refresh,
       watch: opts.watch !== false,
+      daemon: global.daemon,
       root: root3,
       stats,
       // Listing surface: flags win over env; unknown values fall back to the
@@ -1745,171 +1822,26 @@ var Connection = class {
     }
   }
 };
-
-// src/lsp/manifest-positions.ts
-function manifestKind(filePath) {
-  const base = (filePath.split(/[\\/]/).pop() ?? "").toLowerCase();
-  if (base === "package.json") return "package.json";
-  if (base === "go.mod") return "go.mod";
-  if (base === "requirements.txt" || /^requirements.*\.txt$/.test(base)) return "requirements.txt";
-  if (base === "pyproject.toml") return "pyproject.toml";
-  if (base === "cargo.toml") return "Cargo.toml";
-  if (base === "pom.xml") return "pom.xml";
-  if (base === "build.gradle" || base === "build.gradle.kts") return "build.gradle";
-  if (base === "gemfile") return "Gemfile";
-  if (base === "composer.json") return "composer.json";
-  if (base === "pubspec.yaml") return "pubspec.yaml";
-  if (base === "mix.exs") return "mix.exs";
-  if (base.endsWith(".csproj") || base.endsWith(".fsproj") || base.endsWith(".vbproj")) return "csproj";
-  if (base === "dockerfile" || base.startsWith("dockerfile.")) return "Dockerfile";
-  return "unknown";
+function projectDir(root3, projectPath) {
+  const rel = projectPath === "" || projectPath === "." ? "" : projectPath;
+  return rel ? path46.resolve(root3, rel) : path46.resolve(root3);
 }
-function isManifest(filePath) {
-  return manifestKind(filePath) !== "unknown";
-}
-function esc(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function findPackageLine(text, pkg, kind) {
-  const lines = text.split(/\r?\n/);
-  const p = esc(pkg);
-  const patterns = (() => {
-    switch (kind) {
-      case "package.json":
-      case "composer.json":
-        return [new RegExp(`^\\s*"${p}"\\s*:`)];
-      case "go.mod":
-        return [new RegExp(`^\\s*(?:require\\s+)?${p}\\s+v?\\d`)];
-      case "requirements.txt":
-        return [new RegExp(`^\\s*${p}\\s*(?:\\[[^\\]]*\\])?\\s*(?:[=<>!~]|$)`, "i")];
-      case "pyproject.toml":
-      case "Cargo.toml":
-        return [
-          new RegExp(`^\\s*${p}\\s*=`),
-          new RegExp(`^\\s*"${p}\\s*(?:[=<>!~\\[]|")`)
-        ];
-      case "pom.xml":
-        return [new RegExp(`<artifactId>\\s*${p}\\s*</artifactId>`)];
-      case "build.gradle":
-        return [new RegExp(`["']${p}(?:["':])`)];
-      case "Gemfile":
-        return [new RegExp(`^\\s*gem\\s+["']${p}["']`)];
-      case "pubspec.yaml":
-        return [new RegExp(`^\\s*${p}\\s*:`)];
-      case "mix.exs":
-        return [new RegExp(`\\{\\s*:${p}\\s*,`)];
-      case "csproj":
-        return [new RegExp(`Include\\s*=\\s*"${p}"`, "i")];
-      case "Dockerfile":
-        return [new RegExp(`^\\s*FROM\\s+.*${p}`, "i")];
-      default:
-        return [];
-    }
-  })();
-  for (const re of patterns) {
-    for (let i = 0; i < lines.length; i++) {
-      if (re.test(lines[i])) return i;
-    }
-  }
-  return -1;
-}
-function findRuntimeLine(text, kind) {
-  const lines = text.split(/\r?\n/);
-  const patterns = (() => {
-    switch (kind) {
-      case "package.json":
-        return [/^\s*"node"\s*:/, /^\s*"engines"\s*:/];
-      case "go.mod":
-        return [/^\s*go\s+\d/];
-      case "pyproject.toml":
-        return [/^\s*(?:requires-python|python)\s*=/];
-      case "pom.xml":
-        return [/<(?:java\.version|maven\.compiler\.(?:source|target|release))>/];
-      case "build.gradle":
-        return [/(?:sourceCompatibility|targetCompatibility|JavaVersion)/];
-      case "csproj":
-        return [/<TargetFrameworks?>/i];
-      case "Dockerfile":
-        return [/^\s*FROM\s+/i];
-      default:
-        return [];
-    }
-  })();
-  for (const re of patterns) {
-    for (let i = 0; i < lines.length; i++) {
-      if (re.test(lines[i])) return i;
-    }
+function projectForFile(root3, projects, filePath) {
+  const dir = path46.dirname(path46.resolve(filePath));
+  for (const proj of projects) {
+    if (projectDir(root3, proj.path) === dir) return proj;
   }
-  return -1;
-}
-function endOfLine(text, line) {
-  const lines = text.split(/\r?\n/);
-  return (lines[line] ?? "").length;
-}
-var CACHE_VERSION = "vg-lsp-scan-cache/2";
-function cachePath(root3) {
-  return path46.join(cacheDir(root3), "lsp-scan.json");
-}
-function manifestHash(root3) {
-  const files = [];
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = fs14.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const abs = path46.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (isSkippedDirName(entry.name)) continue;
-        walk2(abs);
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      const base = entry.name.toLowerCase();
-      if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
-      try {
-        const rel = path46.relative(root3, abs).split(path46.sep).join("/");
-        files.push({ rel, hash: hashBytes(fs14.readFileSync(abs)) });
-      } catch {
-      }
-    }
-  };
-  walk2(root3);
-  files.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
-  return hashString(canonicalize(files));
-}
-function isDependencyFile(root3, filePath) {
-  const rel = path46.relative(path46.resolve(root3), path46.resolve(filePath));
-  if (rel === "" || rel.startsWith("..") || path46.isAbsolute(rel)) return false;
-  const parts = rel.split(path46.sep);
-  if (parts.slice(0, -1).some((dir) => isSkippedDirName(dir))) return false;
-  const base = parts[parts.length - 1].toLowerCase();
-  return isManifest(filePath) || SKIP_FILES.has(base);
-}
-function loadScanCache(root3, key2) {
-  try {
-    const raw = JSON.parse(fs14.readFileSync(cachePath(root3), "utf8"));
-    if (raw.version === CACHE_VERSION && raw.manifestHash === key2.manifestHash && raw.toolVersion === key2.toolVersion && raw.offline === key2.offline && raw.artifact) {
-      return { manifestHash: raw.manifestHash, artifact: raw.artifact };
+  if (isManifest(filePath)) return void 0;
+  let best;
+  let bestLen = -1;
+  for (const proj of projects) {
+    const projDir = projectDir(root3, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path46.sep)) && projDir.length > bestLen) {
+      best = proj;
+      bestLen = projDir.length;
     }
-  } catch {
-  }
-  return null;
-}
-function writeScanCache(root3, key2, artifact) {
-  try {
-    fs14.mkdirSync(cacheDir(root3), { recursive: true });
-    fs14.writeFileSync(
-      cachePath(root3),
-      stableStringify(
-        { version: CACHE_VERSION, manifestHash: key2.manifestHash, toolVersion: key2.toolVersion, offline: key2.offline, artifact },
-        0
-      )
-    );
-  } catch {
   }
+  return best;
 }
 var MAX_ENTRIES = 1e3;
 var KEEP_ENTRIES = 500;
@@ -1928,7 +1860,7 @@ function parseLine(line) {
 }
 function readHistory(root3) {
   try {
-    return fs14.readFileSync(historyPath(root3), "utf8").split("\n").filter((l) => l.trim()).map(parseLine).filter((e) => e !== null);
+    return fs13.readFileSync(historyPath(root3), "utf8").split("\n").filter((l) => l.trim()).map(parseLine).filter((e) => e !== null);
   } catch {
     return [];
   }
@@ -1955,14 +1887,14 @@ function recordScore(root3, entry) {
       }
     }
     const file = historyPath(root3);
-    fs14.mkdirSync(path46.dirname(file), { recursive: true });
+    fs13.mkdirSync(path46.dirname(file), { recursive: true });
     ensureVibgrateGitignore(root3);
-    fs14.appendFileSync(file, `${JSON.stringify(entry)}
+    fs13.appendFileSync(file, `${JSON.stringify(entry)}
 `);
     const all = readHistory(root3);
     if (all.length > MAX_ENTRIES) {
       const kept = all.slice(-KEEP_ENTRIES);
-      fs14.writeFileSync(file, kept.map((e) => JSON.stringify(e)).join("\n") + "\n");
+      fs13.writeFileSync(file, kept.map((e) => JSON.stringify(e)).join("\n") + "\n");
     }
   } catch {
   }
@@ -1985,7 +1917,7 @@ function readIgnores(root3, now = Date.now()) {
   const out2 = /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = fs14.readFileSync(ignoreFilePath(root3), "utf8");
+    raw = fs13.readFileSync(ignoreFilePath(root3), "utf8");
   } catch {
     return out2;
   }
@@ -2012,7 +1944,7 @@ function inventoryKey(projectPath, pkg) {
 }
 function readInventory(root3) {
   try {
-    const parsed = JSON.parse(fs14.readFileSync(inventoryPath(root3), "utf8"));
+    const parsed = JSON.parse(fs13.readFileSync(inventoryPath(root3), "utf8"));
     if (typeof parsed.ts === "string" && typeof parsed.methodology === "string" && Array.isArray(parsed.drifted) && parsed.drifted.every((d) => typeof d === "string")) {
       return parsed;
     }
@@ -2023,7 +1955,7 @@ function readInventory(root3) {
 function recordInventory(root3, snap) {
   try {
     ensureVibgrateGitignore(root3);
-    fs14.writeFileSync(inventoryPath(root3), `${JSON.stringify(snap)}
+    fs13.writeFileSync(inventoryPath(root3), `${JSON.stringify(snap)}
 `);
   } catch {
   }
@@ -2075,7 +2007,23 @@ async function runAsk(graph, params, ctx) {
   let result = null;
   let mode = "lexical";
   let note;
-  if (wantSemantic) {
+  if (wantSemantic && ctx.semanticSession) {
+    try {
+      const ranked = await withTimeout(
+        ctx.semanticSession.rank(question, graph.provenance?.corpusHash),
+        semanticBudgetMs(),
+        "daemon ranking over budget"
+      );
+      if (ranked) {
+        log(`ask: ranked by vgd against ${ranked.vectors} vector(s) \u2014 no local model load`);
+        result = await queryGraphSemantic(graph, question, { budget, semanticRanked: ranked.ranked });
+        mode = `semantic (vgd${ranked.model ? `, ${ranked.model}` : ""})`;
+      }
+    } catch {
+      log("ask: vgd ranking unavailable \u2014 trying the in-process semantic path");
+    }
+  }
+  if (wantSemantic && !result) {
     const budgetMs = semanticBudgetMs();
     log(`ask: trying the semantic path (budget ${Math.round(budgetMs / 1e3)}s)`);
     let reason;
@@ -2556,7 +2504,11 @@ function architectureWire(arch) {
   if (arch.workspaceEdgesCapped) out2.workspaceEdgesCapped = true;
   if (arch.violations) out2.violations = arch.violations;
   if (arch.violationsCapped) out2.violationsCapped = true;
-  if (arch.boundaryProfile) out2.boundaryProfile = arch.boundaryProfile;
+  if (arch.boundaryProfile) {
+    out2.boundaryProfile = arch.boundaryProfile;
+    const rules = boundaryProfileRules(arch.boundaryProfile);
+    if (rules.length > 0) out2.boundaryRules = rules;
+  }
   if (arch.structure) out2.structure = arch.structure;
   if (arch.generated) out2.generated = true;
   if (arch.generatedBy) out2.generatedBy = arch.generatedBy;
@@ -2586,6 +2538,7 @@ var VibgrateLanguageServer = class {
   constructor(opts, output = process.stdout) {
     this.opts = opts;
     this.conn = new Connection(process.stdin, output);
+    this.semanticSession = new DaemonSemanticSession(opts.root, { disabled: opts.daemon === false });
     this.refresher = new RefreshScheduler({
       root: opts.root,
       graphPath: () => resolveGraphPath(opts.root),
@@ -2623,6 +2576,32 @@ var VibgrateLanguageServer = class {
    * single Ask block for over a minute. See engine/refresh-scheduler.ts.
    */
   refresher;
+  /**
+   * Open while the daemon is pushing map changes for this workspace. Closing
+   * it (or losing it) puts this server back in charge of its own freshness.
+   */
+  slotSubscription = null;
+  /**
+   * True only while the daemon is confirmed to hold *this* map and to be
+   * pushing changes for it. While set, `graphForQuery` stops probing: the
+   * daemon already watches the tree and rebuilds, and two processes doing it
+   * means two stat-walks over one corpus and two rebuilds racing for one lock.
+   *
+   * Never assumed — see `deferFreshnessToDaemon`. A daemon that dies degrades
+   * this server to watching for itself, never to nothing watching.
+   */
+  daemonOwnsFreshness = false;
+  /**
+   * The local runtime's semantic index, held for the life of the server.
+   * Ranking there means the native embedding backend is never loaded into this
+   * process — the failure this server has the least tolerance for, since a
+   * SIGTRAP from the addon kills it outright mid-request.
+   */
+  semanticSession;
+  /** In-flight on-demand scans of open manifests the workspace scan skipped. */
+  openManifestScans = /* @__PURE__ */ new Set();
+  /** Failed on-demand scans — retry only after the next workspace scan. */
+  openManifestFailed = /* @__PURE__ */ new Set();
   register() {
     this.conn.onRequest("initialize", () => ({
       capabilities: {
@@ -2680,6 +2659,7 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
     this.conn.onRequest("vibgrate/score/forProject", (_m, params) => this.onScoreForProject(params));
     this.conn.onRequest("vibgrate/architecture", (_m, params) => this.onArchitecture(params));
+    this.conn.onRequest("vibgrate/architecture/projects", () => this.onArchitectureProjects());
     this.conn.onRequest("vibgrate/score/history", (_m, params) => {
       const p = params;
       const days = typeof p?.days === "number" && p.days > 0 && p.days <= 365 ? p.days : 90;
@@ -2698,6 +2678,9 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("shutdown", () => {
       this.shuttingDown = true;
       if (this.debounce) clearTimeout(this.debounce);
+      this.slotSubscription?.close();
+      this.slotSubscription = null;
+      this.daemonOwnsFreshness = false;
       return null;
     });
     this.conn.onNotification("exit", () => {
@@ -2718,8 +2701,13 @@ var VibgrateLanguageServer = class {
     this.scanning = true;
     const force = this.forceNextScan;
     this.forceNextScan = false;
+    this.openManifestFailed.clear();
     try {
-      const cacheKey = { manifestHash: manifestHash(this.opts.root), toolVersion: VERSION, offline: this.opts.offline };
+      const cacheKey = {
+        manifestHash: await this.sharedManifestHash() ?? manifestHash(this.opts.root),
+        toolVersion: VERSION,
+        offline: this.opts.offline
+      };
       const cached2 = force ? null : loadScanCache(this.opts.root, cacheKey);
       let fromCache = false;
       if (cached2) {
@@ -2845,7 +2833,10 @@ var VibgrateLanguageServer = class {
     if (!a || text === void 0) return;
     const filePath = uriToPath(uri);
     const kind = manifestKind(filePath);
-    const project = projectForFile(this.opts.root, a, filePath);
+    const project = projectForFile2(this.opts.root, a, filePath);
+    if (!project && isManifest(filePath)) {
+      void this.scanOpenManifest(uri, filePath);
+    }
     const items = [];
     for (const dep of project?.dependencies ?? []) {
       if (dep.drift === "current" || dep.drift === "unknown") continue;
@@ -2890,6 +2881,58 @@ var VibgrateLanguageServer = class {
     });
     this.conn.notify("textDocument/publishDiagnostics", { uri, diagnostics });
   }
+  /**
+   * Workspace scan skipped this package (auto-exclude / timeout). Score it
+   * alone so the open editor can show overlays; do not write the result into
+   * the workspace scan cache (billing / repo score stay on the official scan).
+   */
+  async scanOpenManifest(uri, filePath) {
+    const relDir = path46.relative(this.opts.root, path46.dirname(path46.resolve(filePath)));
+    const key2 = relDir === "" ? "." : relDir;
+    if (this.openManifestScans.has(key2) || this.openManifestFailed.has(key2)) return;
+    if (key2 === "." || key2.startsWith("..")) return;
+    this.openManifestScans.add(key2);
+    try {
+      this.conn.notify("window/logMessage", {
+        type: 3,
+        message: `Vibgrate: scoring open package ${key2} (not in the workspace scan) so editor overlays can render.`
+      });
+      const advanced = await loadAdvancedScanHook();
+      const scanOpts = {
+        format: "json",
+        concurrency: 8,
+        offline: this.opts.offline,
+        noLocalArtifacts: true,
+        noGraph: true,
+        quiet: true,
+        vibgrateVersion: VERSION
+      };
+      const sub = await runCoreScanSilently(path46.dirname(filePath), scanOpts, advanced);
+      const proj = (sub.projects ?? []).find((p) => p.path === "." || p.path === "") ?? sub.projects?.[0];
+      if (!proj || !this.artifact) {
+        this.openManifestFailed.add(key2);
+        return;
+      }
+      proj.path = key2;
+      this.artifact.projects = [...(this.artifact.projects ?? []).filter((p) => p.path !== key2), proj];
+      for (const f of sub.findings ?? []) {
+        if (f.location === "." || f.location === "" || f.location === key2) {
+          this.artifact.findings = [...(this.artifact.findings ?? []).filter((x) => !(x.ruleId === f.ruleId && x.location === key2)), { ...f, location: key2 }];
+        }
+      }
+      this.publishScore();
+      this.publishForDoc(uri);
+    } catch (err) {
+      this.openManifestFailed.add(key2);
+      const message = err instanceof Error ? err.message : String(err);
+      this.conn.notify("window/logMessage", {
+        type: 3,
+        message: `Vibgrate: could not score open package ${key2}: ${message}`
+      });
+    } finally {
+      this.openManifestScans.delete(key2);
+    }
+  }
   // ── Requests ─────────────────────────────────────────────────────────────
   onHover(params) {
     const p = params;
@@ -2900,7 +2943,7 @@ var VibgrateLanguageServer = class {
     if (!uri || line === void 0 || !a || text === void 0) return null;
     const filePath = uriToPath(uri);
     const kind = manifestKind(filePath);
-    const project = projectForFile(this.opts.root, a, filePath);
+    const project = projectForFile2(this.opts.root, a, filePath);
     const dep = (project?.dependencies ?? []).find(
       (d) => findPackageLine(text, d.package, kind) === line
     );
@@ -2923,18 +2966,31 @@ var VibgrateLanguageServer = class {
     const uri = p.textDocument?.uri;
     const a = this.artifact;
     if (!uri || !a || !this.docs.has(uri)) return [];
-    const behind = (a.projects ?? []).reduce(
-      (n, proj) => n + (proj.dependencies ?? []).filter(
-        (d) => d.drift === "major-behind" || d.drift === "minor-behind"
-      ).length,
-      0
-    );
+    const filePath = uriToPath(uri);
+    const project = projectForFile2(this.opts.root, a, filePath);
+    if (!project) {
+      return [
+        {
+          range: { start: { line: 0, character: 0 }, end: { line: 0, character: 0 } },
+          command: {
+            title: "Vibgrate \xB7 this package is not in the workspace scan",
+            command: "vibgrate.openPanel",
+            arguments: []
+          }
+        }
+      ];
+    }
+    const behind = (project.dependencies ?? []).filter(
+      (d) => d.drift === "major-behind" || d.drift === "minor-behind"
+    ).length;
     const eol = (a.findings ?? []).filter(
-      (f) => f.ruleId === "vibgrate/runtime-eol" || f.ruleId === "vibgrate/eol"
+      (f) => sameProject(f.location, project.path) && (f.ruleId === "vibgrate/runtime-eol" || f.ruleId === "vibgrate/eol")
     ).length;
-    const estimated = (a.drift.mode ?? (hasReleaseDates(a) ? "verified" : "estimated")) === "estimated";
+    const estimated = (project.drift?.mode ?? a.drift.mode ?? (hasReleaseDates(a) ? "verified" : "estimated")) === "estimated";
     const mode = estimated ? "~" : "";
-    const title = `Vibgrate \xB7 drift ${mode}${a.drift.score} (${a.drift.riskLevel}) \xB7 ${behind} behind \xB7 ${eol} EOL`;
+    const score = project.drift?.score ?? a.drift.score;
+    const band = project.drift?.riskLevel ?? a.drift.riskLevel;
+    const title = `Vibgrate \xB7 drift ${mode}${score} (${band}) \xB7 ${behind} behind \xB7 ${eol} EOL`;
     return [
       {
         range: { start: { line: 0, character: 0 }, end: { line: 0, character: 0 } },
@@ -2963,6 +3019,7 @@ var VibgrateLanguageServer = class {
         this.fileRoles = fileRolesFromParseCache(this.opts.root);
         this.refineAndPublishArchitecture();
         this.conn.notify("vibgrate/graph/status", { state: "ready" });
+        void this.deferFreshnessToDaemon();
         return;
       }
       this.conn.notify("vibgrate/graph/status", { state: "building" });
@@ -2973,6 +3030,7 @@ var VibgrateLanguageServer = class {
       this.fileRoles = result.fileRoles;
       this.refineAndPublishArchitecture();
       this.conn.notify("vibgrate/graph/status", { state: "ready" });
+      void this.deferFreshnessToDaemon();
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       this.conn.notify("window/logMessage", { type: 3, message: `Vibgrate graph build failed: ${message}` });
@@ -2981,6 +3039,55 @@ var VibgrateLanguageServer = class {
       this.graphBuilding = false;
     }
   }
+  /**
+   * Hand freshness to the daemon, but only once it is actually holding this
+   * map and pushing changes for it.
+   *
+   * The daemon watches a repository the moment it holds its slot — and not
+   * before. Registration is not enough; this server has historically been one
+   * of the roots vgd knew about but never had a map for. So the order matters:
+   * publish the map we just loaded or built, take the repository id the daemon
+   * answers with, and subscribe to *that* repository. Only a confirmed
+   * subscription retires the local probe.
+   *
+   * Every failure mode lands on "keep watching for ourselves": no daemon, a
+   * daemon that will not take the map, a subscription it does not confirm, or
+   * a connection that later drops. None of them are errors — a machine with no
+   * vgd is a supported configuration.
+   */
+  async deferFreshnessToDaemon() {
+    if (this.opts.daemon === false || !this.opts.graph) return;
+    if (this.daemonOwnsFreshness || this.slotSubscription || this.shuttingDown) return;
+    try {
+      const [{ publishGraphToVgd: publishGraphToVgd2 }, { subscribeToSlots }] = await Promise.all([
+        import('./publish-7YHRTBRA.js'),
+        import('./slot-subscription-25GOARW5.js')
+      ]);
+      const published = await publishGraphToVgd2(this.opts.root);
+      if (published.status !== "published" && published.status !== "current") return;
+      const { repositoryId } = published;
+      const subscription = await subscribeToSlots({
+        repositoryId,
+        onChange: () => this.reloadGraphFromDisk(),
+        onDetach: () => {
+          this.daemonOwnsFreshness = false;
+          this.slotSubscription = null;
+        }
+      });
+      if (!subscription.active) return;
+      if (this.shuttingDown) {
+        subscription.close();
+        return;
+      }
+      this.slotSubscription = subscription;
+      this.daemonOwnsFreshness = true;
+      this.conn.notify("window/logMessage", {
+        type: 3,
+        message: `Vibgrate graph: freshness deferred to the local runtime (${repositoryId}).`
+      });
+    } catch {
+    }
+  }
   /**
    * The graph for a query. The first call still builds the map (there is
    * nothing to answer from otherwise), but a *refresh* is only ever kicked off
@@ -2991,7 +3098,7 @@ var VibgrateLanguageServer = class {
   async graphForQuery() {
     await this.ensureGraph();
     if (!this.graph) return null;
-    await this.refresher.maybeRefresh();
+    if (!this.daemonOwnsFreshness) await this.refresher.maybeRefresh();
     return this.graph;
   }
   /**
@@ -3001,13 +3108,20 @@ var VibgrateLanguageServer = class {
    */
   onRefreshSettled(outcome) {
     if (outcome?.status !== "refreshed" || !outcome.wrote) return;
+    this.reloadGraphFromDisk();
+  }
+  /**
+   * Re-read the map we already have on disk. Shared by the local refresher and
+   * by the daemon's `slot-changed` push, which are the only two things that
+   * ever rewrite it — and never both at once.
+   */
+  reloadGraphFromDisk() {
     const graphPath = resolveGraphPath(this.opts.root);
     const reloaded = loadGraphPreferIndex(this.opts.root, graphPath)?.graph ?? loadGraph(this.opts.root);
-    if (reloaded) {
-      this.graph = reloaded;
-      this.fileRoles = fileRolesFromParseCache(this.opts.root);
-      this.refineAndPublishArchitecture();
-    }
+    if (!reloaded) return;
+    this.graph = reloaded;
+    this.fileRoles = fileRolesFromParseCache(this.opts.root);
+    this.refineAndPublishArchitecture();
   }
   /**
    * Graph / AST-role refine can land after the first `publishScore()`. The
@@ -3040,9 +3154,23 @@ var VibgrateLanguageServer = class {
       root: this.opts.root,
       offline: this.opts.offline,
       semantic: this.opts.semantic,
+      semanticSession: this.semanticSession,
       log: trace
     });
   }
+  /**
+   * The daemon's manifest digest for this workspace, or null when there is no
+   * daemon (or it has not been told about this repo yet) — in which case the
+   * caller computes it locally, exactly as before.
+   */
+  async sharedManifestHash() {
+    try {
+      const deps = await this.semanticSession.depContext();
+      return deps?.manifestHash ?? null;
+    } catch {
+      return null;
+    }
+  }
   /**
    * `vibgrate/enrich` — lazy vulnerability enrichment for one expanded package,
    * straight from OSV.dev (never our API). Honours the server's offline flag.
@@ -3090,7 +3218,7 @@ var VibgrateLanguageServer = class {
       const absManifest = path46.resolve(this.opts.root, relManifest);
       let text = null;
       try {
-        if (fs14.existsSync(absManifest)) text = fs14.readFileSync(absManifest, "utf8");
+        if (fs13.existsSync(absManifest)) text = fs13.readFileSync(absManifest, "utf8");
       } catch {
         text = null;
       }
@@ -3140,7 +3268,7 @@ var VibgrateLanguageServer = class {
     const p = params;
     const a = this.artifact;
     if (!a || !p.uri) return null;
-    const project = projectForFile(this.opts.root, a, uriToPath(p.uri));
+    const project = projectForFile2(this.opts.root, a, uriToPath(p.uri));
     return project ? scoreForProject(this.opts.root, a, project) : null;
   }
   /**
@@ -3181,6 +3309,37 @@ var VibgrateLanguageServer = class {
       lockfilePath: lockfileRelativePath(this.opts.root, project)
     };
   }
+  /**
+   * `vibgrate/architecture/projects` — the workspace-scope Projects view.
+   * One row per scanned project that produced architecture data, so a client
+   * can render the whole portfolio without N round trips. Projects the
+   * scanner never classified are omitted rather than shown as empty rows.
+   */
+  onArchitectureProjects() {
+    const a = this.artifact;
+    if (!a) return null;
+    const rows = [];
+    for (const project of a.projects ?? []) {
+      const arch = project.architecture;
+      if (!arch) continue;
+      const row = {
+        path: project.path,
+        name: project.name,
+        // `violations` absent means "no graph was available to check against",
+        // which is not the same as "checked and clean" — keep them distinct.
+        violations: arch.violations ? arch.violations.length : null,
+        layerCount: arch.layers.filter((l) => l.fileCount > 0).length,
+        fileCount: arch.totalClassified
+      };
+      if (arch.projectKind) row.projectKind = arch.projectKind;
+      if (arch.artifactKind) row.artifactKind = arch.artifactKind;
+      if (arch.structure) row.structure = arch.structure.primary;
+      if (arch.supportLevel !== void 0) row.supportLevel = arch.supportLevel;
+      if (arch.packIds && arch.packIds.length > 0) row.packIds = arch.packIds;
+      rows.push(row);
+    }
+    return rows;
+  }
 };
 function uriToPath(uri) {
   try {
@@ -3292,18 +3451,8 @@ function buildProjectRefs(rootDir, projects) {
   refs.sort((a, b) => a.path.localeCompare(b.path));
   return refs.length > 0 ? refs : void 0;
 }
-function projectForFile(root3, a, filePath) {
-  const dir = path46.dirname(path46.resolve(filePath));
-  let best;
-  let bestLen = -1;
-  for (const proj of a.projects ?? []) {
-    const projDir = path46.resolve(root3, proj.path);
-    if ((dir === projDir || dir.startsWith(projDir + path46.sep)) && projDir.length > bestLen) {
-      best = proj;
-      bestLen = projDir.length;
-    }
-  }
-  return best;
+function projectForFile2(root3, a, filePath) {
+  return projectForFile(root3, a.projects ?? [], filePath);
 }
 function sameProject(location, projectPath) {
   return path46.normalize(location) === path46.normalize(projectPath);
@@ -3379,7 +3528,7 @@ function buildBreakdown(rootDir, projects) {
     const absManifest = path46.resolve(rootDir, relManifest);
     let text = null;
     try {
-      if (fs14.existsSync(absManifest)) text = fs14.readFileSync(absManifest, "utf8");
+      if (fs13.existsSync(absManifest)) text = fs13.readFileSync(absManifest, "utf8");
     } catch {
       text = null;
     }
@@ -3444,34 +3593,34 @@ function buildBreakdown(rootDir, projects) {
 }
 function manifestRelativePath(proj) {
   const base = proj.path === "." || proj.path === "" ? "" : proj.path;
-  const join36 = (name) => base ? path46.join(base, name) : name;
+  const join35 = (name) => base ? path46.join(base, name) : name;
   switch (proj.type) {
     case "node":
     case "typescript":
-      return join36("package.json");
+      return join35("package.json");
     case "python":
-      return join36("pyproject.toml");
+      return join35("pyproject.toml");
     case "go":
-      return join36("go.mod");
+      return join35("go.mod");
     case "rust":
-      return join36("Cargo.toml");
+      return join35("Cargo.toml");
     case "ruby":
-      return join36("Gemfile");
+      return join35("Gemfile");
     case "php":
-      return join36("composer.json");
+      return join35("composer.json");
     case "java":
     case "kotlin":
     case "scala":
     case "groovy":
-      return join36("pom.xml");
+      return join35("pom.xml");
     case "dotnet":
-      return join36(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
+      return join35(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
     case "dart":
-      return join36("pubspec.yaml");
+      return join35("pubspec.yaml");
     case "elixir":
-      return join36("mix.exs");
+      return join35("mix.exs");
     default:
-      return join36("package.json");
+      return join35("package.json");
   }
 }
 function lockfileRelativePath(rootDir, proj) {
@@ -3504,7 +3653,7 @@ function lockfileRelativePath(rootDir, proj) {
     for (const name of candidateNames) {
       const rel = dir ? path46.join(dir, name) : name;
       try {
-        if (fs14.existsSync(path46.join(rootDir, rel))) return rel;
+        if (fs13.existsSync(path46.join(rootDir, rel))) return rel;
       } catch {
       }
     }
@@ -3576,9 +3725,9 @@ function lookupImportFiles(map, pkg) {
 function firstPackageMentionLine(root3, relFile, pkg) {
   try {
     const abs = path46.resolve(root3, relFile);
-    const stat2 = fs14.statSync(abs);
+    const stat2 = fs13.statSync(abs);
     if (!stat2.isFile() || stat2.size > 256 * 1024) return null;
-    const text = fs14.readFileSync(abs, "utf8");
+    const text = fs13.readFileSync(abs, "utf8");
     const tokens = [pkg];
     if (pkg.startsWith("@")) {
       const parts = pkg.split("/");
@@ -3774,7 +3923,7 @@ function hoverMarkdown(dep, contribution, state) {
   return lines.join("\n");
 }
 function startLanguageServer(opts) {
-  if (!fs14.existsSync(opts.root)) {
+  if (!fs13.existsSync(opts.root)) {
     process.stderr.write(`vg lsp: root does not exist: ${opts.root}
 `);
     process.exit(1);
@@ -3809,7 +3958,8 @@ function registerLsp(program) {
       offline: global.local === true,
       diagnostics: opts.diagnostics === true,
       graph: opts.graph !== false,
-      semantic: opts.semantic !== false
+      semantic: opts.semantic !== false,
+      daemon: global.daemon
     });
     await new Promise(() => {
     });
@@ -3826,9 +3976,9 @@ function installClaudeHooks(root3, vgBin = "vg") {
   const file = path46.join(root3, ".claude", "settings.json");
   const rel = path46.join(".claude", "settings.json");
   let settings = {};
-  if (fs14.existsSync(file)) {
+  if (fs13.existsSync(file)) {
     try {
-      const parsed = JSON.parse(fs14.readFileSync(file, "utf8"));
+      const parsed = JSON.parse(fs13.readFileSync(file, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         return { file: rel, status: "skipped", note: "settings.json is not a JSON object \u2014 left untouched" };
       }
@@ -3867,10 +4017,10 @@ function installClaudeHooks(root3, vgBin = "vg") {
 function uninstallClaudeHooks(root3) {
   const file = path46.join(root3, ".claude", "settings.json");
   const rel = path46.join(".claude", "settings.json");
-  if (!fs14.existsSync(file)) return { file: rel, status: "unchanged" };
+  if (!fs13.existsSync(file)) return { file: rel, status: "unchanged" };
   let settings;
   try {
-    settings = JSON.parse(fs14.readFileSync(file, "utf8"));
+    settings = JSON.parse(fs13.readFileSync(file, "utf8"));
   } catch {
     return { file: rel, status: "skipped", note: "settings.json is not parseable JSON \u2014 left untouched" };
   }
@@ -3892,8 +4042,8 @@ function uninstallClaudeHooks(root3) {
   return { file: rel, status: "written" };
 }
 function writeSettings(file, settings) {
-  fs14.mkdirSync(path46.dirname(file), { recursive: true });
-  fs14.writeFileSync(file, `${JSON.stringify(settings, null, 2)}
+  fs13.mkdirSync(path46.dirname(file), { recursive: true });
+  fs13.writeFileSync(file, `${JSON.stringify(settings, null, 2)}
 `);
 }
 
@@ -4020,15 +4170,15 @@ function stateFile() {
 }
 function readConsent() {
   try {
-    return JSON.parse(fs14.readFileSync(stateFile(), "utf8"));
+    return JSON.parse(fs13.readFileSync(stateFile(), "utf8"));
   } catch {
     return {};
   }
 }
 function writeConsent(state) {
   try {
-    fs14.mkdirSync(path46.dirname(stateFile()), { recursive: true });
-    fs14.writeFileSync(stateFile(), JSON.stringify(state));
+    fs13.mkdirSync(path46.dirname(stateFile()), { recursive: true });
+    fs13.writeFileSync(stateFile(), JSON.stringify(state));
   } catch {
   }
 }
@@ -4038,8 +4188,8 @@ function kernelDisabled() {
 }
 function moduleInstalledAt(dir) {
   try {
-    const meta = JSON.parse(fs14.readFileSync(path46.join(dir, ".module.json"), "utf8"));
-    if (fs14.existsSync(path46.join(dir, "index.js"))) {
+    const meta = JSON.parse(fs13.readFileSync(path46.join(dir, ".module.json"), "utf8"));
+    if (fs13.existsSync(path46.join(dir, "index.js"))) {
       return { installed: true, version: meta.version };
     }
   } catch {
@@ -4113,8 +4263,8 @@ async function installModule(mod, opts = {}) {
     verifyIntegrity(gz, dist.integrity, dist.shasum);
     const entries = untar(zlib.gunzipSync(gz));
     const dir = mod.dir();
-    fs14.rmSync(dir, { recursive: true, force: true });
-    fs14.mkdirSync(dir, { recursive: true });
+    fs13.rmSync(dir, { recursive: true, force: true });
+    fs13.mkdirSync(dir, { recursive: true });
     let wrote = 0;
     for (const e of entries) {
       let rel = null;
@@ -4123,15 +4273,15 @@ async function installModule(mod, opts = {}) {
       if (!rel) continue;
       const target = path46.join(dir, rel);
       if (!target.startsWith(dir + path46.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
-      fs14.mkdirSync(path46.dirname(target), { recursive: true });
-      fs14.writeFileSync(target, e.body);
+      fs13.mkdirSync(path46.dirname(target), { recursive: true });
+      fs13.writeFileSync(target, e.body);
       wrote += 1;
     }
-    if (!wrote || !fs14.existsSync(path46.join(dir, "index.js"))) {
-      fs14.rmSync(dir, { recursive: true, force: true });
+    if (!wrote || !fs13.existsSync(path46.join(dir, "index.js"))) {
+      fs13.rmSync(dir, { recursive: true, force: true });
       return { status: "unavailable", detail: "package layout not recognized (no dist/index.js)" };
     }
-    fs14.writeFileSync(path46.join(dir, ".module.json"), JSON.stringify({ name: mod.npmName, version }));
+    fs13.writeFileSync(path46.join(dir, ".module.json"), JSON.stringify({ name: mod.npmName, version }));
     mod.onChanged?.();
     return { status: "installed", version };
   } catch (e) {
@@ -4139,7 +4289,7 @@ async function installModule(mod, opts = {}) {
   }
 }
 function removeModule(mod) {
-  fs14.rmSync(mod.dir(), { recursive: true, force: true });
+  fs13.rmSync(mod.dir(), { recursive: true, force: true });
   mod.onChanged?.();
 }
 
@@ -4184,7 +4334,7 @@ function candidatePaths() {
   if (custom) {
     const p = path46.resolve(custom);
     try {
-      if (fs14.statSync(p).isDirectory()) return [path46.join(p, "index.js")];
+      if (fs13.statSync(p).isDirectory()) return [path46.join(p, "index.js")];
     } catch {
     }
     return [p];
@@ -4200,7 +4350,7 @@ async function loadHcsEngine() {
   cached = null;
   if (disabled()) return cached;
   for (const p of candidatePaths()) {
-    if (!fs14.existsSync(p)) continue;
+    if (!fs13.existsSync(p)) continue;
     try {
       const mod = await import(pathToFileURL(p).href);
       const engine = await mod.createHcsEngine?.();
@@ -4367,7 +4517,7 @@ function hookContext(payloadText, root3, graphOverride) {
   let graph;
   try {
     const preferred = loadGraphPreferIndex(root3, graphPath);
-    graph = preferred ? preferred.graph : parseGraph(fs14.readFileSync(graphPath, "utf8"));
+    graph = preferred ? preferred.graph : parseGraph(fs13.readFileSync(graphPath, "utf8"));
   } catch {
     return null;
   }
@@ -4389,7 +4539,7 @@ function registerHook(program) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
     try {
-      const stdin = fs14.readFileSync(0, "utf8");
+      const stdin = fs13.readFileSync(0, "utf8");
       const context = hookContext(stdin, root3, global.graph);
       if (context) {
         process.stdout.write(
@@ -4410,7 +4560,7 @@ function registerShare(program) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
     const gitDir = path46.join(root3, ".git");
-    if (!fs14.existsSync(gitDir)) {
+    if (!fs13.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -4432,22 +4582,22 @@ function registerShare(program) {
 }
 function writeVibgrateGitignore(root3, reports) {
   const dir = path46.join(root3, ".vibgrate");
-  fs14.mkdirSync(dir, { recursive: true });
+  fs13.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs14.writeFileSync(path46.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs13.writeFileSync(path46.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root3) {
   const file = path46.join(root3, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs14.existsSync(file) ? fs14.readFileSync(file, "utf8") : "";
+  let content = fs13.existsSync(file) ? fs13.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs14.writeFileSync(file, content);
+    fs13.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root3) {
@@ -4456,7 +4606,7 @@ function configureMergeDriver(root3) {
 }
 function installPreCommitHook(root3) {
   const hooksDir = hookDir(root3);
-  fs14.mkdirSync(hooksDir, { recursive: true });
+  fs13.mkdirSync(hooksDir, { recursive: true });
   const file = path46.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
@@ -4466,7 +4616,7 @@ function installPreCommitHook(root3) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs14.existsSync(file) ? fs14.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs13.existsSync(file) ? fs13.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -4475,21 +4625,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs14.writeFileSync(file, content);
-  fs14.chmodSync(file, 493);
+  fs13.writeFileSync(file, content);
+  fs13.chmodSync(file, 493);
 }
 function undo(root3) {
   const hookFile = path46.join(hookDir(root3), "pre-commit");
-  if (fs14.existsSync(hookFile)) {
+  if (fs13.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs14.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs14.rmSync(hookFile);
-    else fs14.writeFileSync(hookFile, next2);
+    const next2 = fs13.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs13.rmSync(hookFile);
+    else fs13.writeFileSync(hookFile, next2);
   }
   const attr = path46.join(root3, ".gitattributes");
-  if (fs14.existsSync(attr)) {
-    const next2 = fs14.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs14.writeFileSync(attr, next2);
+  if (fs13.existsSync(attr)) {
+    const next2 = fs13.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs13.writeFileSync(attr, next2);
   }
   try {
     git(root3, ["config", "--remove-section", "merge.vg"]);
@@ -4518,7 +4668,7 @@ function registerWatch(program) {
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
     const watchRoots = (paths.length ? paths : ["."]).map((p) => path46.resolve(root3, p));
     for (const w of watchRoots) {
-      if (!fs14.existsSync(w)) {
+      if (!fs13.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
       }
     }
@@ -4571,7 +4721,7 @@ function registerWatch(program) {
     const watchers = [];
     for (const w of watchRoots) {
       try {
-        const watcher = fs14.watch(w, { recursive: true }, (_event, filename) => {
+        const watcher = fs13.watch(w, { recursive: true }, (_event, filename) => {
           if (!filename) {
             schedule("change");
             return;
@@ -4920,7 +5070,7 @@ function loadStandards(root3) {
     const p = path46__default.join(root3, rel);
     let text;
     try {
-      text = fs14__default.readFileSync(p, "utf8");
+      text = fs13__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -6851,7 +7001,7 @@ function registerModels(program) {
         );
       }
     } else {
-      if (!target.path || !fs14.existsSync(target.path)) {
+      if (!target.path || !fs13.existsSync(target.path)) {
         throw new CliError(
           `model file not found at ${target.path || "(unknown path)"} \u2014 it may already be removed.`,
           ExitCode.NOT_FOUND
@@ -6865,7 +7015,7 @@ function registerModels(program) {
       }
       if (!global.json) info(c.dim(`  $ rm ${target.path}`));
       try {
-        fs14.unlinkSync(target.path);
+        fs13.unlinkSync(target.path);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         throw new CliError(`could not delete ${target.path}: ${msg}`, ExitCode.ERROR);
@@ -7004,8 +7154,8 @@ function registerModels(program) {
     });
     if (opts.out) {
       const outPath = path46.resolve(opts.out);
-      fs14.mkdirSync(path46.dirname(outPath), { recursive: true });
-      fs14.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
+      fs13.mkdirSync(path46.dirname(outPath), { recursive: true });
+      fs13.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
     }
@@ -7203,7 +7353,7 @@ function codeConfigPath(root3) {
 }
 function loadCodeConfig(root3) {
   try {
-    const raw = JSON.parse(fs14.readFileSync(codeConfigPath(root3), "utf8"));
+    const raw = JSON.parse(fs13.readFileSync(codeConfigPath(root3), "utf8"));
     return sanitize(raw);
   } catch {
     return {};
@@ -7270,7 +7420,7 @@ function contextBudgetFor(config, modelContextWindow) {
 var MCP_CONFIG_FILES = [".cursor/mcp.json", ".vscode/mcp.json", ".mcp.json"];
 function readMcpServersFile(file) {
   try {
-    const raw = JSON.parse(fs14.readFileSync(file, "utf8"));
+    const raw = JSON.parse(fs13.readFileSync(file, "utf8"));
     const map = raw.mcpServers ?? raw.servers;
     return map && typeof map === "object" ? parseMcpServers(map) : {};
   } catch {
@@ -7395,10 +7545,10 @@ function registerCode(program) {
           return;
         }
         const patchFile = pathMod.join(
-          fs14.mkdtempSync(pathMod.join(os7.tmpdir(), "vg-wt-")),
+          fs13.mkdtempSync(pathMod.join(os7.tmpdir(), "vg-wt-")),
           "delta.patch"
         );
-        fs14.writeFileSync(patchFile, diff2.patch);
+        fs13.writeFileSync(patchFile, diff2.patch);
         const outcome = wt.applyWorktreePatch(gitRunner, root4, patchFile, diff2.files);
         emitLine({ event: "worktree-applied", id: target.id, ...outcome });
         if (!opts.streamJson && !global.json) {
@@ -7464,7 +7614,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-6SNWKSA7.js');
-        const { loadGraph: loadGraph2 } = await import('./load-AYFECIQB.js');
+        const { loadGraph: loadGraph2 } = await import('./load-4R4HYMBB.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -7549,7 +7699,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-SR7TMF6M.js');
+      const { runInteractive } = await import('./interactive-2MK4TLRD.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -7579,7 +7729,7 @@ function registerCode(program) {
     }
     if (!instruction && !stdinFirstTurn) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
     {
-      const { ensureCodeMap } = await import('./ensure-map-342G2IV3.js');
+      const { ensureCodeMap } = await import('./ensure-map-FHDJTO7Y.js');
       const mapRoot = rootOf(global);
       try {
         await ensureCodeMap(mapRoot, global, {
@@ -7616,7 +7766,7 @@ function registerCode(program) {
     let mockReply;
     if (opts.mock) {
       try {
-        mockReply = fs14.readFileSync(opts.mock, "utf8");
+        mockReply = fs13.readFileSync(opts.mock, "utf8");
       } catch {
         throw new CliError(`couldn't read the --mock file: ${opts.mock}`, ExitCode.USAGE_ERROR);
       }
@@ -7664,20 +7814,20 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-YQQJG3LW.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-H5GVDDZJ.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-55YDNAFX.js');
-        const { nodeCodeFs } = await import('./session-H34HUV2Y.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-4WLSUF6I.js');
+        const { nodeCodeFs } = await import('./session-N5IU4K5Q.js');
         const readline6 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-CNJ4DAV5.js');
-        const { resolveGraphBackend } = await import('./graph-backend-RNWQBT3P.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-JBIHHH5N.js');
+        const { resolveGraphBackend } = await import('./graph-backend-W2D3HRRD.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest } = await import('./vgd-URUZQORN.js');
+        const { vgdRequest } = await import('./vgd-M7UOPWLB.js');
         const federation = loadOrDiscoverFederation(root3);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7735,7 +7885,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-2CNLHNEL.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-KDVYIMFX.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root3,
@@ -7759,7 +7909,7 @@ ${res.stderr}` : ""),
         const os7 = await import('os');
         const pathMod = await import('path');
         const checkpointIndex = pathMod.join(
-          fs14.mkdtempSync(pathMod.join(os7.tmpdir(), "vg-code-cp-")),
+          fs13.mkdtempSync(pathMod.join(os7.tmpdir(), "vg-code-cp-")),
           "index"
         );
         const gitRunner = (gitArgs, gitEnv) => {
@@ -7780,7 +7930,7 @@ ${res.stderr}` : ""),
           files,
           indexFile: checkpointIndex
         });
-        const { loadApprovalRules, addApprovalRule, ruleForAction, ruleLabel } = await import('./approvals-ASPJQUZK.js');
+        const { loadApprovalRules, addApprovalRule, ruleForAction, ruleLabel } = await import('./approvals-TPQFQSWG.js');
         const { loadProjectRules, nodeRulesReader } = await import('./rules-ASYEUNB5.js');
         const projectRules = loadProjectRules(nodeRulesReader(root3));
         if (projectRules.sources.length && !global.quiet) {
@@ -7838,8 +7988,8 @@ ${res.stderr}` : ""),
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession, STREAM_JSON_PROTOCOL_VERSION } = await import('./stream-json-55YDNAFX.js');
-            const { runAgent: runAgent2 } = await import('./agent-UQC7QN77.js');
+            const { runCodeStreamJsonSession, STREAM_JSON_PROTOCOL_VERSION } = await import('./stream-json-4WLSUF6I.js');
+            const { runAgent: runAgent2 } = await import('./agent-X6VYCE63.js');
             const {
               condenseSession,
               loadLatestSession,
@@ -7850,7 +8000,7 @@ ${res.stderr}` : ""),
               sessionsDir,
               summarizeSession
             } = await import('./session-store-AQUORKWB.js');
-            const { VERSION: VERSION2 } = await import('./version-WSE3QOPK.js');
+            const { VERSION: VERSION2 } = await import('./version-DTEU3SQD.js');
             const resumedRecord = typeof opts.continue === "string" ? loadSession(mainRoot, opts.continue) : opts.continue ? loadLatestSession(mainRoot) : void 0;
             if (typeof opts.continue === "string" && !resumedRecord) {
               emitStream({
@@ -8062,8 +8212,8 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-SR7TMF6M.js');
-      const { nodeCodeFs } = await import('./session-H34HUV2Y.js');
+      const { agentTask } = await import('./interactive-2MK4TLRD.js');
+      const { nodeCodeFs } = await import('./session-N5IU4K5Q.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       let priorInstruction;
@@ -8078,7 +8228,7 @@ ${res.stderr}` : ""),
         }
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-2CNLHNEL.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-KDVYIMFX.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root3,
@@ -8102,11 +8252,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-CNJ4DAV5.js');
-        const { resolveGraphBackend } = await import('./graph-backend-RNWQBT3P.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-JBIHHH5N.js');
+        const { resolveGraphBackend } = await import('./graph-backend-W2D3HRRD.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest } = await import('./vgd-URUZQORN.js');
+        const { vgdRequest } = await import('./vgd-M7UOPWLB.js');
         const federation = loadFederation(root3);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -8200,7 +8350,7 @@ ${res.stderr}` : ""),
       attribution: { client: "vg-code", provider: providerSlug, model: primary?.model }
     });
     if (opts.out) {
-      fs14.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
+      fs13.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
     }
     if (global.json) {
       json(result);
@@ -8389,8 +8539,9 @@ function listCatalog(root3, asJson) {
     return;
   }
   info(`${c.cyan("vg lib")} \xB7 ${libs.length} library(ies) in the catalog`);
+  const inv = inventory(root3);
   for (const l of libs) {
-    const d = driftFor(root3, l);
+    const d = driftFor(root3, l, inv);
     const tag = d.drift === "behind" ? c.yellow(" (docs behind your version)") : d.drift === "ahead" ? c.dim(" (docs ahead)") : "";
     info(`  ${c.bold(l.name)} ${c.dim(`@${l.version}`)} ${c.dim(`[${l.source.type}]`)}${tag}`);
   }
@@ -8413,7 +8564,7 @@ async function addCmd(root3, rest, opts, asJson) {
 }
 function readPackageVersion(root3) {
   try {
-    const pkg = JSON.parse(fs14__default.readFileSync(path46__default.join(root3, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs13__default.readFileSync(path46__default.join(root3, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -8421,7 +8572,7 @@ function readPackageVersion(root3) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs14__default.readFileSync(p, "utf8");
+    const t = fs13__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -8569,8 +8720,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs14.mkdirSync(path46.dirname(path46.resolve(file)), { recursive: true });
-    fs14.writeFileSync(file, content);
+    fs13.mkdirSync(path46.dirname(path46.resolve(file)), { recursive: true });
+    fs13.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -8593,36 +8744,36 @@ function registerBundle(program) {
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs14.mkdirSync(path46.join(outDir, "grammars"), { recursive: true });
+    fs13.mkdirSync(path46.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs14.copyFileSync(absPath, path46.join(outDir, "grammars", fileName));
+      fs13.copyFileSync(absPath, path46.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     for (const id of Object.keys(TOOLCHAIN_GRAMMARS).sort()) {
       const absPath = resolveToolchainGrammar(id);
       if (!absPath) continue;
-      fs14.copyFileSync(absPath, path46.join(outDir, "grammars", path46.basename(absPath)));
+      fs13.copyFileSync(absPath, path46.join(outDir, "grammars", path46.basename(absPath)));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root3, global.graph);
-    if (fs14.existsSync(graphSrc)) {
-      fs14.copyFileSync(graphSrc, path46.join(outDir, "graph.json"));
+    if (fs13.existsSync(graphSrc)) {
+      fs13.copyFileSync(graphSrc, path46.join(outDir, "graph.json"));
       included.push("graph.json");
     } else {
       const graph = loadGraphFileWithSnapshot(graphSrc);
       if (graph) {
-        fs14.writeFileSync(path46.join(outDir, "graph.json"), serializeGraph(graph));
+        fs13.writeFileSync(path46.join(outDir, "graph.json"), serializeGraph(graph));
         included.push("graph.json");
       }
     }
     const cat = catalogPath(root3);
-    if (fs14.existsSync(cat)) {
-      fs14.copyFileSync(cat, path46.join(outDir, "vibgrate.lib.json"));
+    if (fs13.existsSync(cat)) {
+      fs13.copyFileSync(cat, path46.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs14.existsSync(libDir(root3))) {
-        fs14.cpSync(libDir(root3), path46.join(outDir, "lib"), { recursive: true });
+      if (fs13.existsSync(libDir(root3))) {
+        fs13.cpSync(libDir(root3), path46.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -8634,7 +8785,7 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs14.writeFileSync(path46.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs13.writeFileSync(path46.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
       json({ out: path46.relative(root3, outDir), ...manifest });
@@ -8660,7 +8811,7 @@ async function runDoctor(global) {
   const root3 = rootOf(global);
   const local = global.local === true;
   const graphPath = resolveGraphPath(root3, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs14.existsSync(path46.join(root3, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs13.existsSync(path46.join(root3, f))) ?? null;
   const graph = loadGraph(root3, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -8693,7 +8844,7 @@ async function runDoctor(global) {
     },
     libCatalog: {
       path: path46.relative(root3, catalogPath(root3)),
-      present: fs14.existsSync(catalogPath(root3)),
+      present: fs13.existsSync(catalogPath(root3)),
       libraries: libCount
     },
     credentials: creds,
@@ -8870,7 +9021,7 @@ function registerPolicy(program) {
     const global = readGlobal(this);
     let raw;
     try {
-      raw = fs14.readFileSync(file, "utf8");
+      raw = fs13.readFileSync(file, "utf8");
     } catch {
       throw new CliError(`cannot read ${file}`, ExitCode.NOT_FOUND);
     }
@@ -9058,8 +9209,8 @@ async function readStdin() {
 }
 function readFileOrThrow(file, label) {
   const p = path46.resolve(file);
-  if (!fs14.existsSync(p)) throw usageError(`${label} file not found: ${p}`);
-  return fs14.readFileSync(p, "utf-8");
+  if (!fs13.existsSync(p)) throw usageError(`${label} file not found: ${p}`);
+  return fs13.readFileSync(p, "utf-8");
 }
 async function readInput(file, label) {
   return file ? readFileOrThrow(file, label) : readStdin();
@@ -9071,8 +9222,8 @@ function writeOutput(outFile, content) {
   }
   const outPath = path46.resolve(outFile);
   const dir = path46.dirname(outPath);
-  if (!fs14.existsSync(dir)) throw usageError(`output directory does not exist: ${dir}`);
-  fs14.writeFileSync(outPath, content.endsWith("\n") ? content : content + "\n", "utf-8");
+  if (!fs13.existsSync(dir)) throw usageError(`output directory does not exist: ${dir}`);
+  fs13.writeFileSync(outPath, content.endsWith("\n") ? content : content + "\n", "utf-8");
   info(c.dim(`wrote ${outPath}`));
 }
 function requireChoice(value, valid2, flag) {
@@ -9106,7 +9257,7 @@ function registerHcs(program) {
     const statePath = opts.previous ?? opts.out;
     const useIncremental = canIncremental && statePath !== void 0;
     const root3 = path46.resolve(dir);
-    if (!fs14.existsSync(root3) || !fs14.statSync(root3).isDirectory()) {
+    if (!fs13.existsSync(root3) || !fs13.statSync(root3).isDirectory()) {
       throw usageError(`not a directory: ${root3}`);
     }
     const supported = new Set(
@@ -9124,7 +9275,7 @@ function registerHcs(program) {
     const walk2 = (abs, rel) => {
       let entries;
       try {
-        entries = fs14.readdirSync(abs, { withFileTypes: true });
+        entries = fs13.readdirSync(abs, { withFileTypes: true });
       } catch {
         return;
       }
@@ -9141,8 +9292,8 @@ function registerHcs(program) {
         const lang = extToLang.get(path46.extname(entry.name).toLowerCase());
         if (!lang) continue;
         try {
-          if (fs14.statSync(absChild).size > MAX_EXTRACT_FILE_BYTES) continue;
-          const content = fs14.readFileSync(absChild, "utf-8");
+          if (fs13.statSync(absChild).size > MAX_EXTRACT_FILE_BYTES) continue;
+          const content = fs13.readFileSync(absChild, "utf-8");
           let bucket = byLanguage.get(lang);
           if (!bucket) byLanguage.set(lang, bucket = []);
           bucket.push({ path: relChild, content });
@@ -9173,7 +9324,7 @@ function registerHcs(program) {
       return;
     }
     const previousPath = path46.resolve(statePath);
-    const previousNdjson = !opts.full && fs14.existsSync(previousPath) ? fs14.readFileSync(previousPath, "utf-8") : "";
+    const previousNdjson = !opts.full && fs13.existsSync(previousPath) ? fs13.readFileSync(previousPath, "utf-8") : "";
     if (opts.full) info(c.dim("running a full re-extraction (--full)"));
     else if (!previousNdjson) info(c.dim(`previous stream not found at ${previousPath} \u2014 running a full extraction`));
     const currentFilesJson = JSON.stringify(
@@ -9289,7 +9440,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-FIV6PR2M.js');
+    const { runBaseline } = await import('./baseline-DXI64VLW.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -9430,9 +9581,9 @@ function sitesFromImportFiles(files, limit = 10) {
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs28.stat(absPath);
+    const stat2 = await fs27.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs28.readFile(absPath, "utf8");
+    return await fs27.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -9820,6 +9971,36 @@ function reportStandards(rootDir) {
     console.log(`  ${chalk7.red("banned")} ${v.ecosystem}:${v.name}${v.installed ? chalk7.dim(` ${v.installed}`) : ""}${fix}${why}`);
   }
 }
+async function printRuntimeSnapshot(rootDir, opts, already) {
+  try {
+    const { attachVgd: attachVgd2 } = await import('./attach-G5JUIWIT.js');
+    const { vgdRequest } = await import('./client-UQIELEEZ.js');
+    const { formatSemanticProgress } = await import('./semantic-status-2JFLIQQJ.js');
+    let repositoryId = already?.repositoryId;
+    let socketPath = already?.socketPath;
+    if (!repositoryId || !socketPath) {
+      const attached = await attachVgd2(rootDir, {
+        disabled: opts.daemon === false,
+        autoStart: false,
+        publish: false
+      });
+      if (attached.status !== "attached" || !attached.repositoryId || !attached.socketPath) return;
+      repositoryId = attached.repositoryId;
+      socketPath = attached.socketPath;
+    }
+    const semantic = await vgdRequest({ op: "embed-status", repositoryId }, { socketPath });
+    if (!semantic.ok || !("semantic" in semantic)) return;
+    const slot = semantic.semantic.slots.find((s) => s.repositoryId === repositoryId) ?? semantic.semantic.slots[0];
+    if (!slot) {
+      if (semantic.semantic.worker === "unavailable" && semantic.semantic.reason) {
+        console.error(chalk7.dim(`  \xB7 semantic \xB7 ${semantic.semantic.reason}`));
+      }
+      return;
+    }
+    console.error(chalk7.dim(`  \xB7 ${formatSemanticProgress(slot)}`));
+  } catch {
+  }
+}
 function parseNonNegativeNumber(value, label) {
   if (value === void 0) return void 0;
   const parsed = Number(value);
@@ -9833,7 +10014,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   'Exclude paths matching a glob pattern. Repeatable, and a single value may list several patterns separated by commas or semicolons (e.g. --exclude "legacy/**,vendor/**"). Merged with excludes from the config file.',
   collectExcludes,
   []
-).option("--concurrency <n>", "Max concurrent registry lookups", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
+).option("--concurrency <n>", "Max concurrent registry lookups", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--no-daemon", "Never auto-start or use the local runtime (vgd) \u2014 run everything in this process").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
   const rootDir = path46.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
@@ -9918,6 +10099,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
               console.error(chalk7.red("Repository unchanged but no previous ingest id available."));
               process.exit(1);
             }
+            await printRuntimeSnapshot(rootDir, opts);
             return;
           }
         }
@@ -9985,20 +10167,49 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
       writeSnapshot(rootDir, result.graph.provenance.corpusHash, result.fileStats, {
         exclude: opts.exclude
       });
-      refineArchitectureWithGraph(
-        { projects: ctx.projects, solutions: ctx.solutions, extended: ctx.extended },
-        architectureGraphView2(result.graph)
-      );
       refineArchitectureWithAstRoles(
         { projects: ctx.projects, solutions: ctx.solutions, extended: ctx.extended },
         result.fileRoles
       );
+      refineArchitectureWithGraph(
+        { projects: ctx.projects, solutions: ctx.solutions, extended: ctx.extended },
+        architectureGraphView2(result.graph)
+      );
       const { counts } = result.graph.meta;
       return `${counts.nodes.toLocaleString()} nodes \xB7 ${counts.edges.toLocaleString()} edges`;
     };
   }
   const advanced = await loadAdvancedScanHook();
   const artifact = await runCoreScan(rootDir, scanOpts, advanced);
+  if (wantGraph && builtGraph) {
+    const { attachVgd: attachVgd2 } = await import('./attach-G5JUIWIT.js');
+    const { ActivityLog: ActivityLog2 } = await import('./activity-MF2GNYAI.js');
+    const activity = new ActivityLog2();
+    const attached = await activity.time(
+      "attach",
+      () => attachVgd2(rootDir, { disabled: opts.daemon === false }),
+      (a) => {
+        if (a.status !== "attached") return { outcome: "skip", detail: `${a.reason} \u2014 the map stays on disk only` };
+        const started = a.started ? "started vgd" : "attached to vgd";
+        if (a.published?.status === "published") {
+          return {
+            outcome: "ok",
+            detail: `${started} \xB7 map published ${a.published.gitRef} \xB7 ${a.published.nodeCount} nodes`
+          };
+        }
+        return { outcome: "ok", detail: started };
+      }
+    );
+    if (!opts.quiet && opts.format !== "json") {
+      for (const line of activity.render()) console.error(line);
+      if (attached.status === "attached") {
+        await printRuntimeSnapshot(rootDir, opts, {
+          repositoryId: attached.repositoryId,
+          socketPath: attached.socketPath
+        });
+      }
+    }
+  }
   emitDriftScoreLine(artifact.drift.score);
   if (opts.full) {
     reportStandards(rootDir);
@@ -10119,7 +10330,7 @@ var SKIP_DIRS3 = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs14.statSync(artifactPath).mtimeMs;
+    ref = fs13.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
@@ -10131,7 +10342,7 @@ function scanStaleness(rootDir, artifactPath) {
     if (depth > 8 || scanned > MAX_ENTRIES2) return;
     let entries;
     try {
-      entries = fs14.readdirSync(dir, { withFileTypes: true });
+      entries = fs13.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -10146,7 +10357,7 @@ function scanStaleness(rootDir, artifactPath) {
       const abs = path46.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs14.statSync(abs).mtimeMs;
+        mtimeMs = fs13.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
@@ -10283,7 +10494,7 @@ function analyzeTree(root3, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs14.readdirSync(dir, { withFileTypes: true });
+      entries = fs13.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -10301,8 +10512,8 @@ function analyzeTree(root3, packages) {
       const full = path46.join(dir, entry.name);
       let content;
       try {
-        if (fs14.statSync(full).size > MAX_FILE_BYTES2) continue;
-        content = fs14.readFileSync(full, "utf8");
+        if (fs13.statSync(full).size > MAX_FILE_BYTES2) continue;
+        content = fs13.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -10670,8 +10881,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs28.mkdir(CACHE_DIR, { recursive: true });
-    await fs28.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs27.mkdir(CACHE_DIR, { recursive: true });
+    await fs27.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -10709,7 +10920,7 @@ function scheduleDeferredUpdate(command, pid = process.pid, dir = os.tmpdir()) {
   const scriptPath = path46.join(dir, `vg-update-${stamp}.cmd`);
   const logPath = path46.join(dir, `vg-update-${stamp}.log`);
   try {
-    fs14.writeFileSync(scriptPath, buildDeferredUpdateScript({ pid, command, logPath }), "utf8");
+    fs13.writeFileSync(scriptPath, buildDeferredUpdateScript({ pid, command, logPath }), "utf8");
     const child = spawn(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", scriptPath], {
       detached: true,
       stdio: "ignore",
@@ -10733,7 +10944,7 @@ function detectGlobalInstall(execPath = process.argv[1] || "", cwd = process.cwd
   if (!execPath) return null;
   let resolved = execPath;
   try {
-    resolved = fs14.realpathSync(execPath);
+    resolved = fs13.realpathSync(execPath);
   } catch {
   }
   const p = resolved.replace(/\\/g, "/");
@@ -10877,7 +11088,7 @@ ${String(err)}` }));
 async function releaseWindowsFileLocks(cwd, keepVersion) {
   reapAndReport(cwd, keepVersion);
   try {
-    const { vgdSocketPath } = await import('./vgd-URUZQORN.js');
+    const { vgdSocketPath } = await import('./vgd-M7UOPWLB.js');
     const result = await stopVgd(vgdSocketPath());
     if (result === "stopped") {
       console.log(chalk7.dim("Stopped the vgd daemon so its files can be replaced \u2014 it restarts on the next command."));
@@ -10930,6 +11141,7 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
     if (!semver4.gt(latest, VERSION)) {
       console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
       if (opts.reap !== false) reapAndReport(process.cwd(), VERSION);
+      if (opts.reap !== false) await reconcileVgdAndReport(process.cwd());
       return;
     }
     console.log(chalk7.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
@@ -10992,7 +11204,7 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
       process.exit(1);
     }
     if (opts.reap !== false) reapAndReport(cwd, latest);
-    if (opts.reap !== false) await restartVgdAndReport();
+    if (opts.reap !== false) await restartVgdAndReport({ force: true });
     try {
       clearEmbedderHealth();
     } catch {
@@ -11002,10 +11214,10 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
 );
 async function rewarmVgdAndReport(cwd) {
   try {
-    const { vgdIsRunning, vgdRequest } = await import('./vgd-URUZQORN.js');
+    const { vgdIsRunning, vgdRequest } = await import('./vgd-M7UOPWLB.js');
     if (!await vgdIsRunning()) return;
     const loaded = await vgdRequest({ op: "load-graph", root: cwd });
-    if (!loaded.ok || !("repositoryId" in loaded)) return;
+    if (!loaded.ok || !("stored" in loaded)) return;
     console.log(chalk7.dim("Re-published the code map into the restarted daemon."));
     const indexed = await vgdRequest({ op: "embed-index", repositoryId: loaded.repositoryId });
     if (indexed.ok && "vectors" in indexed && indexed.state === "ready") {
@@ -11014,10 +11226,30 @@ async function rewarmVgdAndReport(cwd) {
   } catch {
   }
 }
-async function restartVgdAndReport() {
+async function reconcileVgdAndReport(cwd) {
+  let skew;
+  try {
+    skew = await vgdVersionSkew();
+  } catch {
+    return;
+  }
+  if (!skew.running || skew.state === "match") return;
+  if (skew.state === "newer") {
+    console.log(chalk7.dim(`A newer vgd (${skew.version}) is running \u2014 left alone.`));
+    return;
+  }
+  console.log(
+    chalk7.yellow("Stale daemon: ") + chalk7.dim(
+      `vgd is running ${skew.version ?? "a build older than 2026.817"}, not ${VERSION} \u2014 restarting it on this build.`
+    )
+  );
+  await restartVgdAndReport({ force: true });
+  await rewarmVgdAndReport(cwd);
+}
+async function restartVgdAndReport(opts = {}) {
   let result;
   try {
-    result = await restartVgdIfRunning();
+    result = await restartVgdIfRunning(void 0, opts);
   } catch {
     return;
   }
@@ -11771,6 +12003,7 @@ function formatArchitectureDiagram(arch) {
   lines.push("");
   if (arch.layers.length > 0) {
     for (const layer of arch.layers) {
+      if (layer.fileCount === 0) continue;
       const risk = layer.riskLevel === "none" ? chalk7.dim("none") : layer.riskLevel === "low" ? chalk7.green("low") : layer.riskLevel === "moderate" ? chalk7.yellow("moderate") : chalk7.red("high");
       lines.push(`    ${chalk7.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
     }
@@ -11778,12 +12011,27 @@ function formatArchitectureDiagram(arch) {
   }
   if (arch.violations && arch.violations.length > 0) {
     const extra = arch.violationsCapped ? "+" : "";
-    lines.push(`  Boundary violations (${arch.violations.length}${extra})`);
-    for (const v of arch.violations.slice(0, 8)) {
-      lines.push(`    ${v.fromFile} \u2192 ${v.toFile}  ${v.rule}`);
+    const boundary = arch.violations.filter((v) => !v.rule.startsWith("graph-conflict:"));
+    const conflicts = arch.violations.filter((v) => v.rule.startsWith("graph-conflict:"));
+    if (boundary.length > 0) {
+      const cap = extra && conflicts.length === 0 ? extra : "";
+      lines.push(`  Boundary violations (${boundary.length}${cap})`);
+      for (const v of boundary.slice(0, 8)) {
+        lines.push(`    ${v.fromFile} \u2192 ${v.toFile}  ${v.rule}`);
+      }
+      if (boundary.length > 8) {
+        lines.push(chalk7.dim(`    + ${boundary.length - 8} more`));
+      }
     }
-    if (arch.violations.length > 8) {
-      lines.push(chalk7.dim(`    + ${arch.violations.length - 8} more`));
+    if (conflicts.length > 0) {
+      const cap = extra ? extra : "";
+      lines.push(`  Layer conflicts (${conflicts.length}${cap})`);
+      for (const v of conflicts.slice(0, 8)) {
+        lines.push(`    ${v.fromFile} \u2192 ${v.toFile}  ${v.rule}`);
+      }
+      if (conflicts.length > 8) {
+        lines.push(chalk7.dim(`    + ${conflicts.length - 8} more`));
+      }
     }
     lines.push("");
   }
@@ -12446,7 +12694,7 @@ var LOCALE_CONFIG_FILENAMES = ["vibgrate.locale.yaml", ".vibgrate/locale.yaml"];
 function findLocaleConfig(cwd) {
   for (const name of LOCALE_CONFIG_FILENAMES) {
     const candidate = path46.join(cwd, name);
-    if (fs14.existsSync(candidate)) return candidate;
+    if (fs13.existsSync(candidate)) return candidate;
   }
   return null;
 }
@@ -12474,7 +12722,7 @@ function loadLocaleConfig(cwd) {
   const file = findLocaleConfig(cwd);
   if (!file) return { config: {}, file: null };
   try {
-    return { config: parseLocaleConfig(fs14.readFileSync(file, "utf8")), file };
+    return { config: parseLocaleConfig(fs13.readFileSync(file, "utf8")), file };
   } catch (error) {
     throw new Error(
       `Could not parse ${path46.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`
@@ -12493,8 +12741,8 @@ function serializeLocaleConfig(config) {
 }
 function writeLocaleConfig(cwd, config, filename) {
   const target = filename ?? path46.join(cwd, LOCALE_CONFIG_FILENAMES[0]);
-  fs14.mkdirSync(path46.dirname(target), { recursive: true });
-  fs14.writeFileSync(target, serializeLocaleConfig(config), "utf8");
+  fs13.mkdirSync(path46.dirname(target), { recursive: true });
+  fs13.writeFileSync(target, serializeLocaleConfig(config), "utf8");
   return target;
 }
 function resolveLocaleSettings(config, flags) {
@@ -12652,14 +12900,14 @@ function resolveLocaleFiles(cwd, template, languages, namespaces) {
     for (const namespace of namespaces) {
       const relative13 = renderPath(template, language, namespace);
       const file = path46.resolve(cwd, relative13);
-      out2.push({ language, namespace, file, relative: relative13, exists: fs14.existsSync(file) });
+      out2.push({ language, namespace, file, relative: relative13, exists: fs13.existsSync(file) });
     }
   }
   return out2;
 }
 function readCatalog(file, format) {
-  if (!fs14.existsSync(file)) return {};
-  const text = fs14.readFileSync(file, "utf8");
+  if (!fs13.existsSync(file)) return {};
+  const text = fs13.readFileSync(file, "utf8");
   try {
     return codecFor(format).decode(text);
   } catch (error) {
@@ -12670,11 +12918,11 @@ function readCatalog(file, format) {
 }
 function writeCatalog(file, format, catalog, opts = {}) {
   const encoded = codecFor(format).encode(sortKeys(catalog));
-  const existing = fs14.existsSync(file) ? fs14.readFileSync(file, "utf8") : null;
+  const existing = fs13.existsSync(file) ? fs13.readFileSync(file, "utf8") : null;
   const changed = existing !== encoded;
   if (changed && !opts.dryRun) {
-    fs14.mkdirSync(path46.dirname(file), { recursive: true });
-    fs14.writeFileSync(file, encoded, "utf8");
+    fs13.mkdirSync(path46.dirname(file), { recursive: true });
+    fs13.writeFileSync(file, encoded, "utf8");
   }
   return { file, changed, bytes: Buffer.byteLength(encoded, "utf8") };
 }
@@ -14357,17 +14605,17 @@ function resolveSigningKey(root3, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
   const keyPath = chosen ? path46.resolve(chosen) : path46.join(root3, ".vibgrate", DEFAULT_KEY);
   let minted = false;
-  if (!fs14.existsSync(keyPath)) {
+  if (!fs13.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs14.mkdirSync(path46.dirname(keyPath), { recursive: true });
-    fs14.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs14.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs13.mkdirSync(path46.dirname(keyPath), { recursive: true });
+    fs13.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs13.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
   }
   let key2;
   try {
-    key2 = crypto3.createPrivateKey(fs14.readFileSync(keyPath, "utf8"));
+    key2 = crypto3.createPrivateKey(fs13.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${keyPath}`, ExitCode.USAGE_ERROR);
   }
@@ -14378,8 +14626,8 @@ function resolveSigningKey(root3, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs14.mkdirSync(path46.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs14.writeFileSync(path46.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs13.mkdirSync(path46.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs13.writeFileSync(path46.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
   write(path46.join("inputs", "advisory.json"), input.advisory);
@@ -14403,13 +14651,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs14.writeFileSync(path46.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs13.writeFileSync(path46.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs14.writeFileSync(path46.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs13.writeFileSync(path46.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs14.writeFileSync(path46.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs13.writeFileSync(path46.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -14752,7 +15000,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs14.writeFileSync(path46.resolve(rootDir, opts.out), md);
+    fs13.writeFileSync(path46.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -14795,19 +15043,19 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
   const abs = path46.resolve(bundlePath);
-  const envPath = fs14.statSync(abs).isDirectory() ? path46.join(abs, "evidence.intoto.jsonl") : abs;
-  if (!fs14.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
-  const envelope = JSON.parse(fs14.readFileSync(envPath, "utf8").trim().split("\n")[0]);
+  const envPath = fs13.statSync(abs).isDirectory() ? path46.join(abs, "evidence.intoto.jsonl") : abs;
+  if (!fs13.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
+  const envelope = JSON.parse(fs13.readFileSync(envPath, "utf8").trim().split("\n")[0]);
   const resultPath = path46.join(path46.dirname(envPath), "result.json");
-  const result = fs14.existsSync(resultPath) ? JSON.parse(fs14.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs14.readFileSync(path46.resolve(opts.pub), "utf8") : void 0;
+  const result = fs13.existsSync(resultPath) ? JSON.parse(fs13.readFileSync(resultPath, "utf8")) : void 0;
+  const publicKeyPem = opts.pub ? fs13.readFileSync(path46.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
   const tsrPath = path46.join(path46.dirname(envPath), "timestamp.tsr");
-  if (fs14.existsSync(tsrPath) && result) {
-    const t = verifyTimestamp(fs14.readFileSync(tsrPath), exposureSubjectDigest(result));
+  if (fs13.existsSync(tsrPath) && result) {
+    const t = verifyTimestamp(fs13.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
     console.log("  " + tcolor("TIMESTAMP") + `  ${t.reason}`);
   }
@@ -14906,9 +15154,9 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   let exposure;
   if (opts.result) {
     const raw = path46.resolve(rootDir, opts.result);
-    const resultPath = fs14.existsSync(raw) && fs14.statSync(raw).isDirectory() ? path46.join(raw, "result.json") : raw;
-    if (!fs14.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
-    exposure = JSON.parse(fs14.readFileSync(resultPath, "utf8"));
+    const resultPath = fs13.existsSync(raw) && fs13.statSync(raw).isDirectory() ? path46.join(raw, "result.json") : raw;
+    if (!fs13.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
+    exposure = JSON.parse(fs13.readFileSync(resultPath, "utf8"));
   }
   const payload = { schemaVersion: "evidence-push-1", regime: regime.id, generatedAt: nowIso(), signed: Boolean(opts.signed), products: productPayload, exposure };
   const body = JSON.stringify(payload);
@@ -15107,7 +15355,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs14.existsSync(path46.resolve(cwd, first))) {
+  if (fs13.existsSync(path46.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];