@vibgrate/cli 2026.825.2 → 2026.829.1

package/dist/cli.js

@@ -1,45 +1,46 @@
 #!/usr/bin/env node
-import { fetchCatalog, resolveProviders } from './chunk-SIXWWQ6S.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-BICZR6UJ.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-QLNJ3VWO.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, LiveStatus, ProgressBar, printLogo, runBuild } from './chunk-27TS2AUJ.js';
-export { runBuild } from './chunk-27TS2AUJ.js';
+import { fetchCatalog, resolveProviders } from './chunk-WBDRBP22.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-D3SV3JWB.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-RRSUNTZI.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, LiveStatus, ProgressBar, printLogo, runBuild } from './chunk-K7QR7U3V.js';
+export { runBuild } from './chunk-K7QR7U3V.js';
 import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-OLIMW4PQ.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-IASO2HCI.js';
-import { runCodeSession } from './chunk-GWSJYDK7.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-GR7SFCQJ.js';
+import { runCodeSession } from './chunk-MMIIVRQC.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-NQQT75AN.js';
 import './chunk-543E6WDJ.js';
-import './chunk-E3XVIFSH.js';
-import './chunk-JAEHLTVX.js';
-import { parseReasoningEffort, summarizeDiffs, ScriptedProvider } from './chunk-SHD5TCZ5.js';
+import './chunk-FKCN653F.js';
+import './chunk-5RW5PIBH.js';
+import { parseReasoningEffort, summarizeDiffs, ScriptedProvider } from './chunk-R2FX4USU.js';
 import './chunk-NV7XNBX4.js';
 import { buildModelInstallPlan } from './chunk-W44THEXF.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-3HNPVXUK.js';
-import { vgdVersionSkew, restartVgdIfRunning, stopVgd, registerDaemon, rootOf, requireGraph } from './chunk-DIZ5KI5Q.js';
-import { readGlobal, applyGlobalOptions } from './chunk-YENM3HT7.js';
+import { vgdVersionSkew, restartVgdIfRunning, stopVgd, registerDaemon, rootOf, requireGraph } from './chunk-FHSEK64W.js';
+import { readGlobal, applyGlobalOptions } from './chunk-N6R4XPLX.js';
 import { ActivityLog } from './chunk-H5Q4JUY4.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-WUFIXAEJ.js';
 import { fmt, estimateModelBytes } from './chunk-YJYEPYB2.js';
-import { isManifest, isDependencyFile, manifestHash, loadScanCache, writeScanCache, manifestKind, findPackageLine, endOfLine, findRuntimeLine } from './chunk-KYM55VZX.js';
+import { isManifest, isDependencyFile, manifestHash, loadScanCache, writeScanCache, manifestKind, findPackageLine, endOfLine, findRuntimeLine } from './chunk-VOEEYCR3.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
 import './chunk-IS7VTH2Q.js';
 import './chunk-IZDH67DX.js';
-import { moduleInstalled, removeRelevanceModule, installRelevanceModule, DISCLOSURE, RELEVANCE_MODULE_NAME, moduleInstalledAt, removeModule, installModule, kickRelevanceReadiness, modulesBaseDir, ensureRelevanceModule, DaemonSemanticSession, serveStdio, kernelDisabled, writeConsent, readConsent, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-3E7QT4NE.js';
-import { refreshIfStale } from './chunk-VMPKOMHG.js';
-import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, assistantById, SMALL_REPO_FILES } from './chunk-NS4DL3QR.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-TT2J2TB6.js';
+import { moduleInstalled, removeRelevanceModule, installRelevanceModule, DISCLOSURE, RELEVANCE_MODULE_NAME, moduleInstalledAt, removeModule, installModule, kickRelevanceReadiness, modulesBaseDir, ensureRelevanceModule, DaemonSemanticSession, serveStdio, kernelDisabled, writeConsent, readConsent, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-BODXEZEY.js';
+import { refreshIfStale } from './chunk-B5VCPIKT.js';
+import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, assistantById, SMALL_REPO_FILES } from './chunk-HHMWE52J.js';
+import './chunk-EGMBHPXV.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, rejectPushWhenOffline, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, isGitRepo, collectChangeSet, fileRecencyDays, readDeclaredIntent, readBaseFileTexts, SimilarityIndex, isComparable, FINDINGS_SCHEMA, digest, repoKey, receiptId, receiptDigest, CAPSULE_SCHEMA, REVIEW_POLICY_VERSION, RECEIPT_SCHEMA, buildEnvelope, collectSpans, pushReceipt, readStoredCredentials, projectCredentialsPath, MAX_ROLE_PEERS, classifyDataAccess, MIN_GROUP_SIZE, voteAll, CAPSULE_BUDGETS, digestString, routesForFile, classifyRoute, voteAllAuth, isRegression, describePattern, homeCredentialsPath, TARGET_ALIGNMENTS, defaultRun } from './chunk-65YN3BG3.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, refineArchitectureWithAstRoles, refineArchitectureWithGraph, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift, boundaryProfileRules } from './chunk-5UG4UHKU.js';
-import './chunk-L7GCJNDT.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, refineArchitectureWithAstRoles, refineArchitectureWithGraph, classifyFile, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, boundaryProfileRules, evaluateLayerBoundary, perDependencyDrift, parseToml } from './chunk-HUJZO4K5.js';
+import './chunk-QMROD7MI.js';
 import './chunk-VIWZ4QT7.js';
-import { catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-NZES47ST.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-SYMJSRYF.js';
+import { catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-TWFPHXPN.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-OAYSRM7J.js';
 import { discoverModels } from './chunk-WNKGRXUA.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-57ZRSCHY.js';
 import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js';
-import { attachVgd } from './chunk-IJVWKZRS.js';
+import { attachVgd } from './chunk-KCKG3EEJ.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-PVNALGTG.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import './chunk-5IQBIXHS.js';
@@ -48,27 +49,27 @@ import { publishGraphToVgd } from './chunk-A3WWRW7U.js';
 import { isRelevantChange } from './chunk-DBX3DL27.js';
 import { inventory, enrichOnline, ECOSYSTEMS } from './chunk-6BEBJCK4.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-K3SXWOTT.js';
-import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-7M4E7UGX.js';
+import { rankingAskFrom, queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-YL332BU2.js';
+import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-RL7JYG3D.js';
 import './chunk-VHRSG6CF.js';
 import './chunk-6H2QV5DR.js';
-import { discover, isSkippedDirName } from './chunk-RTURQXQL.js';
-import { resolvedGrammarFiles, TOOLCHAIN_GRAMMARS, resolveToolchainGrammar, grammarSetVersion, fileRolesFromParseCache } from './chunk-6MIJLO5B.js';
+import { discover, mergeExcludes, isSkippedDirName } from './chunk-RTURQXQL.js';
+import { resolvedGrammarFiles, TOOLCHAIN_GRAMMARS, resolveToolchainGrammar, grammarSetVersion, fileRolesFromParseCache } from './chunk-NSC7ZK62.js';
 import './chunk-T7RSQ5WD.js';
 import './chunk-6WRG7VDO.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-FQHWPOTS.js';
-import { resetRelevanceProviderCache, loadRelevanceProvider, resolveGraphPath, loadTopicTags, rankQuestion, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-OIUVWCKM.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, acquireLock, releaseLock, withTimeout } from './chunk-BA6YBVNT.js';
+import { resetRelevanceProviderCache, loadRelevanceProvider, resolveGraphPath, loadTopicTags, rankQuestion, renderReport, loadGraphFileWithSnapshot, writeArtifacts, displayGraphPath, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-FPIMNVLI.js';
 import { cacheDir } from './chunk-MVPRPSXU.js';
 import { serializeGraph, stableStringify, parseGraph } from './chunk-O3LABX6I.js';
-import { VERSION } from './chunk-G3ACLBMG.js';
+import { VERSION } from './chunk-UGRUG2FA.js';
 import './chunk-XP6UUCZZ.js';
 import { canonicalize, hashString } from './chunk-JFGYT6BI.js';
 import './chunk-XQNKCA2J.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
 import * as fs12 from 'fs';
 import fs12__default, { realpathSync } from 'fs';
-import * as path45 from 'path';
-import path45__default from 'path';
+import * as path51 from 'path';
+import path51__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
@@ -79,7 +80,7 @@ import * as readline from 'readline';
 import * as crypto3 from 'crypto';
 import { randomUUID } from 'crypto';
 import chalk7 from 'chalk';
-import * as fs26 from 'fs/promises';
+import * as fs32 from 'fs/promises';
 import { parse, stringify } from 'yaml';
 
 init_cli_invocation();
@@ -90,10 +91,10 @@ function registerStatus(program) {
   applyGlobalOptions(cmd);
 }
 async function runStatus(global) {
-  const root3 = path45.resolve(global.cwd ?? ".");
+  const root3 = path51.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root3, global.graph);
   const graph = loadGraph(root3, graphPath);
-  const hasCache = fs12.existsSync(path45.join(cacheDir(root3), "parse-cache.json"));
+  const hasCache = fs12.existsSync(path51.join(cacheDir(root3), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -113,8 +114,8 @@ async function runStatus(global) {
   }
   if (global.json) {
     json({
-      root: path45.relative(process.cwd(), root3) || ".",
-      graphPath: path45.relative(root3, graphPath),
+      root: path51.relative(process.cwd(), root3) || ".",
+      graphPath: displayGraphPath(root3, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       counts: graph?.meta.counts ?? null,
@@ -129,11 +130,11 @@ async function runStatus(global) {
     return;
   }
   if (!graph) {
-    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path45.relative(root3, graphPath))}`);
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(displayGraphPath(root3, graphPath))}`);
     info(`  run ${c.bold("vg")} to build one`);
     return;
   }
-  info(`${c.cyan("vg")} \xB7 ${path45.relative(root3, graphPath)}`);
+  info(`${c.cyan("vg")} \xB7 ${displayGraphPath(root3, graphPath)}`);
   info(`  generated ${graph.generatedAt}`);
   info(
     `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
@@ -183,13 +184,13 @@ function registerAsk(program) {
     );
     const budget = Number(opts.budget) || 2e3;
     const q = question.join(" ");
-    const wantSemantic = opts.semantic !== false && !global.local;
+    const wantSemantic = opts.semantic !== false && !global.offline;
     let result;
     let mode = "lexical";
     let note = "";
-    if (!global.local) await ensureRelevanceModule();
+    if (!global.offline) await ensureRelevanceModule();
     const topicTags = await loadTopicTags(graph, root3, resolveGraphPath(root3, global.graph));
-    const modRank = await rankQuestion(graph, q, { limit: 48, topicTags });
+    const modRank = await rankQuestion(graph, rankingAskFrom(q), { limit: 48, topicTags });
     try {
       if (wantSemantic) {
         live?.set("asking the daemon\u2026");
@@ -219,7 +220,7 @@ function registerAsk(program) {
           let reason;
           let detail;
           const embedder = await loadEmbedder({
-            local: global.local,
+            local: global.offline,
             onUnavailable: (r, d) => {
               reason = r;
               detail = d;
@@ -242,8 +243,8 @@ function registerAsk(program) {
         }
       } else {
         result = queryGraph(graph, q, { budget, ranked: modRank });
-        if (global.local) note = "semantic skipped under --local; used lexical";
-        activity.add("answer", "skip", global.local ? "lexical only (--local)" : "lexical only (--no-semantic)");
+        if (global.offline) note = "semantic skipped under --offline; used lexical";
+        activity.add("answer", "skip", global.offline ? "lexical only (--offline)" : "lexical only (--no-semantic)");
       }
     } finally {
       live?.stop();
@@ -309,11 +310,11 @@ function crashedMessage(signal) {
   return `semantic search is disabled: its native backend (onnxruntime-node, via the vendored fastembed path) crashed with ${signal} \u2014 using fast lexical search instead. This usually means the installed native binaries are broken (an interrupted install, or a platform without prebuilt CPU binaries). Reinstall to repair \u2014 ${envPrefix}npm install -g --allow-scripts=@vibgrate/cli,onnxruntime-node,msgpackr-extract @vibgrate/cli \u2014 or run with --local to stay lexical quietly.`;
 }
 function defaultCacheDir() {
-  const base = process.env.XDG_CACHE_HOME || path45.join(os.homedir(), ".cache");
-  return path45.join(base, "vibgrate", "models");
+  const base = process.env.XDG_CACHE_HOME || path51.join(os.homedir(), ".cache");
+  return path51.join(base, "vibgrate", "models");
 }
 function verdictPath(dir) {
-  return path45.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
+  return path51.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
 }
 function readVerdict(dir) {
   try {
@@ -333,12 +334,12 @@ function writeVerdict(dir, verdict) {
   }
 }
 function probeModuleUrl(from = import.meta.url) {
-  const dir = path45.dirname(fileURLToPath(from));
+  const dir = path51.dirname(fileURLToPath(from));
   for (const name of ["embeddings.js", "index.js"]) {
-    const candidate = path45.join(dir, name);
+    const candidate = path51.join(dir, name);
     if (fs12.existsSync(candidate)) return pathToFileURL(candidate).href;
   }
-  return pathToFileURL(path45.join(dir, "index.js")).href;
+  return pathToFileURL(path51.join(dir, "index.js")).href;
 }
 function defaultRunProbe(timeoutMs) {
   const moduleUrl = probeModuleUrl();
@@ -357,7 +358,7 @@ function defaultRunProbe(timeoutMs) {
       })
       .catch(() => process.stdout.write('{"ok":false}'));
   `;
-  return new Promise((resolve23) => {
+  return new Promise((resolve25) => {
     const child = spawn(process.execPath, ["--input-type=module", "-e", script], {
       stdio: ["ignore", "pipe", "ignore"],
       // The probe must never inherit a debugger port or loader flags that would
@@ -373,7 +374,7 @@ function defaultRunProbe(timeoutMs) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve23({ signal, status, stdout });
+      resolve25({ signal, status, stdout });
     };
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
@@ -437,7 +438,7 @@ function registerEmbed(program) {
     const root3 = rootOf(global);
     const bg = opts.bg === true;
     const speak = !bg && !global.json;
-    if (global.local) {
+    if (global.offline) {
       if (global.json) json({ embedded: 0, model: modelId, semantic: false, reason: "local" });
       else if (speak) info(c.dim("vg embed \xB7 semantic is off (--local) \u2014 lexical search only"));
       return;
@@ -457,7 +458,7 @@ function registerEmbed(program) {
     let reason;
     let detail;
     const embedder = await loadEmbedder({
-      local: global.local,
+      local: global.offline,
       // Background warm-ups skip the download unless explicitly asked to fetch
       // (`--bg --download`, spawned by `vg build` so the model is ready by the
       // time `vg serve`/`vg ask` needs it).
@@ -1091,7 +1092,7 @@ var PUBLISH_INTERVAL_MS = 2e3;
 var KEEPALIVE_MS = 1e4;
 var STALE_MS = 6e4;
 function liveStatsDir(root3) {
-  return path45.join(cacheDir(root3), "serve-live");
+  return path51.join(cacheDir(root3), "serve-live");
 }
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
@@ -1105,7 +1106,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs12.readFileSync(path45.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs12.readFileSync(path51.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1127,7 +1128,7 @@ var LiveStatsBus = class {
     this.dir = dir;
     this.stats = stats;
     this.pid = pid;
-    this.file = path45.join(dir, `serve-${this.pid}.json`);
+    this.file = path51.join(dir, `serve-${this.pid}.json`);
   }
   dir;
   stats;
@@ -1180,7 +1181,7 @@ var LiveStatsBus = class {
     const out2 = [];
     for (const name of entries.sort()) {
       if (!/^serve-\d+\.json$/.test(name)) continue;
-      const file = path45.join(this.dir, name);
+      const file = path51.join(this.dir, name);
       let parsed;
       try {
         parsed = JSON.parse(fs12.readFileSync(file, "utf8"));
@@ -1570,7 +1571,7 @@ function registerServe(program) {
     const root3 = rootOf(global);
     const graphPath = resolveGraphPath(root3, global.graph);
     const refresh = opts.refresh !== false && !global.graph;
-    const local = global.local === true;
+    const local = global.offline === true;
     const optOut = telemetryOptOut();
     const shareStats = opts.shareStats === true && !local && optOut === null;
     const quiet = global.quiet === true;
@@ -1713,7 +1714,7 @@ async function serveHttp(graphPath, host, port, opts, freshness, onReady) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve23) => httpServer.listen(port, host, resolve23));
+  await new Promise((resolve25) => httpServer.listen(port, host, resolve25));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   onReady?.();
   await new Promise(() => {
@@ -1826,10 +1827,10 @@ var Connection = class {
 };
 function projectDir(root3, projectPath) {
   const rel = projectPath === "" || projectPath === "." ? "" : projectPath;
-  return rel ? path45.resolve(root3, rel) : path45.resolve(root3);
+  return rel ? path51.resolve(root3, rel) : path51.resolve(root3);
 }
 function projectForFile(root3, projects, filePath) {
-  const dir = path45.dirname(path45.resolve(filePath));
+  const dir = path51.dirname(path51.resolve(filePath));
   for (const proj of projects) {
     if (projectDir(root3, proj.path) === dir) return proj;
   }
@@ -1838,7 +1839,7 @@ function projectForFile(root3, projects, filePath) {
   let bestLen = -1;
   for (const proj of projects) {
     const projDir = projectDir(root3, proj.path);
-    if ((dir === projDir || dir.startsWith(projDir + path45.sep)) && projDir.length > bestLen) {
+    if ((dir === projDir || dir.startsWith(projDir + path51.sep)) && projDir.length > bestLen) {
       best = proj;
       bestLen = projDir.length;
     }
@@ -1848,7 +1849,7 @@ function projectForFile(root3, projects, filePath) {
 var MAX_ENTRIES = 1e3;
 var KEEP_ENTRIES = 500;
 function historyPath(root3) {
-  return path45.join(root3, ".vibgrate", "score-history.jsonl");
+  return path51.join(root3, ".vibgrate", "score-history.jsonl");
 }
 function parseLine(line) {
   try {
@@ -1889,7 +1890,7 @@ function recordScore(root3, entry) {
       }
     }
     const file = historyPath(root3);
-    fs12.mkdirSync(path45.dirname(file), { recursive: true });
+    fs12.mkdirSync(path51.dirname(file), { recursive: true });
     ensureVibgrateGitignore(root3);
     fs12.appendFileSync(file, `${JSON.stringify(entry)}
 `);
@@ -1907,7 +1908,7 @@ function deltaFrom(prev, current) {
   return current.score - prev.score;
 }
 function ignoreFilePath(root3) {
-  return path45.join(root3, ".vibgrate", "ignore.json");
+  return path51.join(root3, ".vibgrate", "ignore.json");
 }
 function isActive(entry, now = Date.now()) {
   if (!entry.until) return true;
@@ -1939,7 +1940,7 @@ function readIgnores(root3, now = Date.now()) {
   return out2;
 }
 function inventoryPath(root3) {
-  return path45.join(root3, ".vibgrate", "inline-inventory.json");
+  return path51.join(root3, ".vibgrate", "inline-inventory.json");
 }
 function inventoryKey(projectPath, pkg) {
   return `${projectPath}::${pkg}`;
@@ -2492,6 +2493,9 @@ function architectureWire(arch) {
   };
   if (arch.folders) out2.folders = arch.folders;
   if (arch.unclassifiedFiles) out2.unclassifiedFiles = arch.unclassifiedFiles;
+  if (arch.coverage) out2.coverage = arch.coverage;
+  if (arch.unclassifiedFolders) out2.unclassifiedFolders = arch.unclassifiedFolders;
+  if (arch.unclassifiedFoldersCapped) out2.unclassifiedFoldersCapped = true;
   if (arch.classified) out2.classified = arch.classified;
   if (arch.workspaceShape) out2.workspaceShape = arch.workspaceShape;
   if (arch.supportLevel !== void 0) out2.supportLevel = arch.supportLevel;
@@ -2889,7 +2893,7 @@ var VibgrateLanguageServer = class {
    * the workspace scan cache (billing / repo score stay on the official scan).
    */
   async scanOpenManifest(uri, filePath) {
-    const relDir = path45.relative(this.opts.root, path45.dirname(path45.resolve(filePath)));
+    const relDir = path51.relative(this.opts.root, path51.dirname(path51.resolve(filePath)));
     const key2 = relDir === "" ? "." : relDir;
     if (this.openManifestScans.has(key2) || this.openManifestFailed.has(key2)) return;
     if (key2 === "." || key2.startsWith("..")) return;
@@ -2909,7 +2913,7 @@ var VibgrateLanguageServer = class {
         quiet: true,
         vibgrateVersion: VERSION
       };
-      const sub = await runCoreScanSilently(path45.dirname(filePath), scanOpts, advanced);
+      const sub = await runCoreScanSilently(path51.dirname(filePath), scanOpts, advanced);
       const proj = (sub.projects ?? []).find((p) => p.path === "." || p.path === "") ?? sub.projects?.[0];
       if (!proj || !this.artifact) {
         this.openManifestFailed.add(key2);
@@ -3217,7 +3221,7 @@ var VibgrateLanguageServer = class {
       const ecosystem = osvEcosystem(proj.type);
       if (!ecosystem) continue;
       const relManifest = manifestRelativePath(proj);
-      const absManifest = path45.resolve(this.opts.root, relManifest);
+      const absManifest = path51.resolve(this.opts.root, relManifest);
       let text = null;
       try {
         if (fs12.existsSync(absManifest)) text = fs12.readFileSync(absManifest, "utf8");
@@ -3410,7 +3414,7 @@ function pruneArtifactProjects(a) {
   return { ...a, projects, findings };
 }
 function projectByPath(a, projectPath) {
-  const norm = (p) => path45.normalize((p === "" ? "." : p).replace(/\\/g, "/"));
+  const norm = (p) => path51.normalize((p === "" ? "." : p).replace(/\\/g, "/"));
   const want = norm(projectPath);
   for (const proj of a.projects ?? []) {
     if (norm(proj.path) === want) return proj;
@@ -3452,7 +3456,7 @@ function projectForFile2(root3, a, filePath) {
   return projectForFile(root3, a.projects ?? [], filePath);
 }
 function sameProject(location, projectPath) {
-  return path45.normalize(location) === path45.normalize(projectPath);
+  return path51.normalize(location) === path51.normalize(projectPath);
 }
 function hasReleaseDates(a) {
   for (const proj of a.projects ?? []) {
@@ -3522,7 +3526,7 @@ function buildBreakdown(rootDir, projects) {
     const relManifest = manifestRelativePath(p);
     if (isPrunedWorkspacePath(p.path) || isPrunedWorkspacePath(relManifest)) continue;
     const ecosystem = osvEcosystem(p.type);
-    const absManifest = path45.resolve(rootDir, relManifest);
+    const absManifest = path51.resolve(rootDir, relManifest);
     let text = null;
     try {
       if (fs12.existsSync(absManifest)) text = fs12.readFileSync(absManifest, "utf8");
@@ -3590,34 +3594,34 @@ function buildBreakdown(rootDir, projects) {
 }
 function manifestRelativePath(proj) {
   const base = proj.path === "." || proj.path === "" ? "" : proj.path;
-  const join34 = (name) => base ? path45.join(base, name) : name;
+  const join39 = (name) => base ? path51.join(base, name) : name;
   switch (proj.type) {
     case "node":
     case "typescript":
-      return join34("package.json");
+      return join39("package.json");
     case "python":
-      return join34("pyproject.toml");
+      return join39("pyproject.toml");
     case "go":
-      return join34("go.mod");
+      return join39("go.mod");
     case "rust":
-      return join34("Cargo.toml");
+      return join39("Cargo.toml");
     case "ruby":
-      return join34("Gemfile");
+      return join39("Gemfile");
     case "php":
-      return join34("composer.json");
+      return join39("composer.json");
     case "java":
     case "kotlin":
     case "scala":
     case "groovy":
-      return join34("pom.xml");
+      return join39("pom.xml");
     case "dotnet":
-      return join34(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
+      return join39(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
     case "dart":
-      return join34("pubspec.yaml");
+      return join39("pubspec.yaml");
     case "elixir":
-      return join34("mix.exs");
+      return join39("mix.exs");
     default:
-      return join34("package.json");
+      return join39("package.json");
   }
 }
 function lockfileRelativePath(rootDir, proj) {
@@ -3648,9 +3652,9 @@ function lockfileRelativePath(rootDir, proj) {
   const dirsToTry = base ? [base, ""] : [""];
   for (const dir of dirsToTry) {
     for (const name of candidateNames) {
-      const rel = dir ? path45.join(dir, name) : name;
+      const rel = dir ? path51.join(dir, name) : name;
       try {
-        if (fs12.existsSync(path45.join(rootDir, rel))) return rel;
+        if (fs12.existsSync(path51.join(rootDir, rel))) return rel;
       } catch {
       }
     }
@@ -3721,7 +3725,7 @@ function lookupImportFiles(map, pkg) {
 }
 function firstPackageMentionLine(root3, relFile, pkg) {
   try {
-    const abs = path45.resolve(root3, relFile);
+    const abs = path51.resolve(root3, relFile);
     const stat2 = fs12.statSync(abs);
     if (!stat2.isFile() || stat2.size > 256 * 1024) return null;
     const text = fs12.readFileSync(abs, "utf8");
@@ -3952,7 +3956,7 @@ function registerLsp(program) {
       root: root3,
       // `--local` is the established air-gap flag across the CLI; honour it
       // here too, so an offline editor session stays offline.
-      offline: global.local === true,
+      offline: global.offline === true,
       diagnostics: opts.diagnostics === true,
       graph: opts.graph !== false,
       semantic: opts.semantic !== false,
@@ -3970,8 +3974,8 @@ function hookCommand(vgBin) {
   return `${vgBin} hook pre-tool-use`;
 }
 function installClaudeHooks(root3, vgBin = "vg") {
-  const file = path45.join(root3, ".claude", "settings.json");
-  const rel = path45.join(".claude", "settings.json");
+  const file = path51.join(root3, ".claude", "settings.json");
+  const rel = path51.join(".claude", "settings.json");
   let settings = {};
   if (fs12.existsSync(file)) {
     try {
@@ -4012,8 +4016,8 @@ function installClaudeHooks(root3, vgBin = "vg") {
   return { file: rel, status: "written" };
 }
 function uninstallClaudeHooks(root3) {
-  const file = path45.join(root3, ".claude", "settings.json");
-  const rel = path45.join(".claude", "settings.json");
+  const file = path51.join(root3, ".claude", "settings.json");
+  const rel = path51.join(".claude", "settings.json");
   if (!fs12.existsSync(file)) return { file: rel, status: "unchanged" };
   let settings;
   try {
@@ -4039,7 +4043,7 @@ function uninstallClaudeHooks(root3) {
   return { file: rel, status: "written" };
 }
 function writeSettings(file, settings) {
-  fs12.mkdirSync(path45.dirname(file), { recursive: true });
+  fs12.mkdirSync(path51.dirname(file), { recursive: true });
   fs12.writeFileSync(file, `${JSON.stringify(settings, null, 2)}
 `);
 }
@@ -4159,19 +4163,19 @@ function disabled() {
   return v === "1" || v === "true";
 }
 function hcsModuleDir() {
-  return path45.join(modulesBaseDir(), "hcs");
+  return path51.join(modulesBaseDir(), "hcs");
 }
 function candidatePaths() {
   const custom = process.env.VIBGRATE_HCS_PATH;
   if (custom) {
-    const p = path45.resolve(custom);
+    const p = path51.resolve(custom);
     try {
-      if (fs12.statSync(p).isDirectory()) return [path45.join(p, "index.js")];
+      if (fs12.statSync(p).isDirectory()) return [path51.join(p, "index.js")];
     } catch {
     }
     return [p];
   }
-  return [path45.join(hcsModuleDir(), "index.js")];
+  return [path51.join(hcsModuleDir(), "index.js")];
 }
 var cached;
 function resetHcsEngineCache() {
@@ -4321,11 +4325,11 @@ function requireModule(name) {
   return mod;
 }
 function confirm(question) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve25) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(question, (answer) => {
       rl.close();
-      resolve23(answer.trim() === "" || /^y(es)?$/i.test(answer.trim()));
+      resolve25(answer.trim() === "" || /^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -4391,7 +4395,7 @@ function registerShare(program) {
   const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
-    const gitDir = path45.join(root3, ".git");
+    const gitDir = path51.join(root3, ".git");
     if (!fs12.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
@@ -4413,15 +4417,15 @@ function registerShare(program) {
   applyGlobalOptions(cmd);
 }
 function writeVibgrateGitignore(root3, reports) {
-  const dir = path45.join(root3, ".vibgrate");
+  const dir = path51.join(root3, ".vibgrate");
   fs12.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs12.writeFileSync(path45.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs12.writeFileSync(path51.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root3) {
-  const file = path45.join(root3, ".gitattributes");
+  const file = path51.join(root3, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
   let content = fs12.existsSync(file) ? fs12.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
@@ -4439,7 +4443,7 @@ function configureMergeDriver(root3) {
 function installPreCommitHook(root3) {
   const hooksDir = hookDir(root3);
   fs12.mkdirSync(hooksDir, { recursive: true });
-  const file = path45.join(hooksDir, "pre-commit");
+  const file = path51.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
     "if command -v vg >/dev/null 2>&1; then",
@@ -4461,14 +4465,14 @@ ${content}`;
   fs12.chmodSync(file, 493);
 }
 function undo(root3) {
-  const hookFile = path45.join(hookDir(root3), "pre-commit");
+  const hookFile = path51.join(hookDir(root3), "pre-commit");
   if (fs12.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
     const next2 = fs12.readFileSync(hookFile, "utf8").replace(re, "\n");
     if (next2.trim() === "#!/bin/sh") fs12.rmSync(hookFile);
     else fs12.writeFileSync(hookFile, next2);
   }
-  const attr = path45.join(root3, ".gitattributes");
+  const attr = path51.join(root3, ".gitattributes");
   if (fs12.existsSync(attr)) {
     const next2 = fs12.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
     fs12.writeFileSync(attr, next2);
@@ -4481,10 +4485,10 @@ function undo(root3) {
 function hookDir(root3) {
   try {
     const configured = git(root3, ["config", "--get", "core.hooksPath"]).trim();
-    if (configured) return path45.resolve(root3, configured);
+    if (configured) return path51.resolve(root3, configured);
   } catch {
   }
-  return path45.join(root3, ".git", "hooks");
+  return path51.join(root3, ".git", "hooks");
 }
 function git(root3, args) {
   return execFileSync("git", args, { cwd: root3, encoding: "utf8" });
@@ -4498,7 +4502,7 @@ function registerWatch(program) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
-    const watchRoots = (paths.length ? paths : ["."]).map((p) => path45.resolve(root3, p));
+    const watchRoots = (paths.length ? paths : ["."]).map((p) => path51.resolve(root3, p));
     for (const w of watchRoots) {
       if (!fs12.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
@@ -4566,12 +4570,12 @@ function registerWatch(program) {
         throw new CliError(`cannot watch ${w}: ${err.message}`, ExitCode.ERROR);
       }
     }
-    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path45.relative(root3, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
-    await new Promise((resolve23) => {
+    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path51.relative(root3, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
+    await new Promise((resolve25) => {
       const stop = () => {
         for (const w of watchers) w.close();
         if (timer) clearTimeout(timer);
-        resolve23();
+        resolve25();
       };
       process.once("SIGINT", stop);
       process.once("SIGTERM", stop);
@@ -4899,7 +4903,7 @@ function normalizeStandards(raw) {
 }
 function loadStandards(root3) {
   for (const rel of STANDARDS_FILES) {
-    const p = path45__default.join(root3, rel);
+    const p = path51__default.join(root3, rel);
     let text;
     try {
       text = fs12__default.readFileSync(p, "utf8");
@@ -4928,14 +4932,14 @@ function registerDrift(program) {
   const cmd = program.command("drift").description("what is outdated across dependencies (offline; --online for currency)").option("--online", "query the npm registry for latest versions (opt-in network)").option("--fail-on <level>", "exit 2 on violations \u2014 major|minor (version drift) or standards (enterprise policy)").action(async function(opts) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
-    if (opts.online && global.local) {
+    if (opts.online && global.offline) {
       throw new CliError("--online conflicts with --local (no network in local mode)", ExitCode.USAGE_ERROR);
     }
     if (opts.failOn && !["major", "minor", "standards"].includes(opts.failOn)) {
       throw new CliError(`--fail-on must be one of: major, minor, standards (got "${opts.failOn}")`, ExitCode.USAGE_ERROR);
     }
     const inv = inventory(root3);
-    if (opts.online && !global.local) await enrichOnline(inv.records);
+    if (opts.online && !global.offline) await enrichOnline(inv.records);
     let standards = null;
     if (opts.failOn === "standards") {
       const loaded = loadStandards(root3);
@@ -5620,8 +5624,8 @@ async function runHostBench(options = {}) {
 }
 async function runArmSimulate(input) {
   const { arm, lib, modelPath, turns, trie, env, live } = input;
-  const path47 = `${modelPath}#${arm.id}`;
-  const session = await acquireHostSession(lib, path47);
+  const path53 = `${modelPath}#${arm.id}`;
+  const session = await acquireHostSession(lib, path53);
   const system = "You are a coding agent with a Task Capsule.";
   const capsule = "function readConfig(): Config { return load(); }";
   let last = null;
@@ -6567,7 +6571,7 @@ function registerModels(program) {
     );
   });
   applyGlobalOptions(modeCmd);
-  const resolve23 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(async function(modeArg) {
+  const resolve25 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(async function(modeArg) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
     const sys = await gatherSystemMemory();
@@ -6599,7 +6603,7 @@ function registerModels(program) {
       info(c.yellow("  will not fit \u2014 choose a lower mode or free memory before loading"));
     }
   });
-  applyGlobalOptions(resolve23);
+  applyGlobalOptions(resolve25);
   const installCmd = cmd.command("install").description("resolve the best Code Mode for this machine and install the pack").argument("[mode]", "spark | flow | forge (default: auto-fit)").option("--dry-run", "print the install plan only \u2014 do not download").option("--yes", "skip prompts (install already runs by default)").action(async function(modeArg, opts) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
@@ -6636,7 +6640,7 @@ function registerModels(program) {
       promise: resolved.pack.promise,
       fit: resolved.fit.label,
       installedNames: models.map((m) => m.name),
-      offline: !!global.local,
+      offline: !!global.offline,
       hasBinary,
       downloadUrl: resolved.underlying.downloadUrl,
       sha256: resolved.underlying.sha256
@@ -6664,7 +6668,7 @@ function registerModels(program) {
       if (installPlan.license) info(c.dim(`  license: ${installPlan.license}`));
     }
     const result = await executeModelInstallPlan(installPlan, {
-      offline: !!global.local,
+      offline: !!global.offline,
       quiet: !!global.json,
       onProgress: (line) => {
         if (!global.json) info(c.dim(`  ${line}`));
@@ -6733,7 +6737,7 @@ function registerModels(program) {
       backend: "ollama",
       weightsRef: name,
       installedNames: models.map((m) => m.name),
-      offline: !!global.local,
+      offline: !!global.offline,
       hasBinary
     });
     if (installPlan.ready) {
@@ -6751,7 +6755,7 @@ function registerModels(program) {
     }
     if (!global.json) printInstallPlanHuman("vg models pull", installPlan);
     const result = await executeModelInstallPlan(installPlan, {
-      offline: !!global.local,
+      offline: !!global.offline,
       quiet: !!global.json,
       onProgress: (line) => {
         if (!global.json) info(c.dim(`  ${line}`));
@@ -6988,8 +6992,8 @@ function registerModels(program) {
       }
     });
     if (opts.out) {
-      const outPath = path45.resolve(opts.out);
-      fs12.mkdirSync(path45.dirname(outPath), { recursive: true });
+      const outPath = path51.resolve(opts.out);
+      fs12.mkdirSync(path51.dirname(outPath), { recursive: true });
       fs12.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
@@ -7011,9 +7015,9 @@ function registerModels(program) {
     }
   });
   applyGlobalOptions(codingMetrics);
-  const catalog = cmd.command("catalog").description("the live hosted model catalog (OpenRouter) \u2014 key-free, cached, refreshed from the network").option("--offline", "never touch the network \u2014 use the cache (or the curated fallback)").option("--refresh", "bypass the cache and refresh from the network").action(async function(opts) {
+  const catalog = cmd.command("catalog").description("the live hosted model catalog (OpenRouter) \u2014 key-free, cached, refreshed from the network").option("--refresh", "bypass the cache and refresh from the network").action(async function(opts) {
     const global = readGlobal(this);
-    const cat = await fetchCatalog({ offline: opts.offline, noCache: opts.refresh });
+    const cat = await fetchCatalog({ offline: global.offline, noCache: opts.refresh });
     if (global.json) {
       json(cat);
       return;
@@ -7104,11 +7108,11 @@ function fitColor(label) {
   return label;
 }
 function confirmYesNo(question) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve25) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve23(/^y(es)?$/i.test(answer.trim()));
+      resolve25(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -7139,14 +7143,14 @@ function resolveUninstallTarget(name, runtimeOpt) {
     }
     return exact[0];
   }
-  const base = path45.basename(wantLc);
+  const base = path51.basename(wantLc);
   const soft = fleet.filter((m) => {
     const n = m.name.toLowerCase();
-    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path45.basename(n) === base;
+    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path51.basename(n) === base;
   });
   if (soft.length === 1) return soft[0];
   if (soft.length > 1) {
-    const baseHits = soft.filter((m) => path45.basename(m.name).toLowerCase() === base);
+    const baseHits = soft.filter((m) => path51.basename(m.name).toLowerCase() === base);
     const pool = baseHits.length ? baseHits : soft;
     const order = ["ollama", "gguf", "lm-studio"];
     for (const rt of order) {
@@ -7184,7 +7188,7 @@ function printBackends(backends) {
   }
 }
 function codeConfigPath(root3) {
-  return path45.join(root3, ".vibgrate", "code.json");
+  return path51.join(root3, ".vibgrate", "code.json");
 }
 function loadCodeConfig(root3) {
   try {
@@ -7266,7 +7270,7 @@ function discoverMcpServers(root3, ownServers) {
   const servers = {};
   const sources = [];
   for (const rel of MCP_CONFIG_FILES) {
-    const found = readMcpServersFile(path45.join(root3, rel));
+    const found = readMcpServersFile(path51.join(root3, rel));
     const names = Object.keys(found);
     if (names.length) {
       sources.push(rel);
@@ -7282,7 +7286,7 @@ function discoverMcpServers(root3, ownServers) {
 
 // src/commands/code.ts
 function registerCode(program) {
-  const cmd = program.command("code").description("graph-grounded coding agent (guided mode with no instruction; every edit and command is approved)").argument("[instruction...]", "what to change, in plain language (omit for guided interactive mode)").option("--provider <id>", "backend: vibgrate-relay (Vibgrate Relay), ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp").option("--model <id>", "model id (or set VG_CODE_MODEL). No model is hard-coded \u2014 pick the current best.").option("--mode <mode>", "Code Mode: spark | flow | forge (preferred over raw model names; auto-fits when omitted and no --model)").option("--model-path <gguf>", "gguf path for --provider llama-cpp (weights are never auto-downloaded)").option("-f, --file <path>", "restrict the edit surface to this file (repeatable)", collect, []).option("-b, --budget <n>", "approx context token budget", "3000").option("--apply", "one-shot path (--single/--mock) only: write the change (still requires --yes or an interactive confirm)").option("--yes", "consent to write / to a first-use package install, non-interactively").option("--auto", "autonomous agent: auto-approve every edit and command (use with care)").option("--max-steps <n>", "cap the number of agent steps", "24").option("--single", "one-shot planner (single edit) instead of the multi-step agent").option("--stream", "stream the model output live").option("--stream-json", "machine protocol: NDJSON agent events on stdout, approval decisions on stdin (for host UIs like the VS Code panel)").option("--session", "with --stream-json: stay open for further turns (warm graph and tools) instead of exiting after one").option("--verify [command]", "after the agent finishes, run tests and make it fix failures (uses the config testCommand if no command is given)").option("--continue [id]", "resume a session: the most recent one, or the given session id (recap + restore /undo)").option("--restore-checkpoint <commit>", "one-shot: restore the given --file paths from a checkpoint commit, then exit (for host UIs after the original session ended)").option("--reasoning-effort <level>", "how hard a reasoning-capable model should think: low | medium | high (ignored by models without the knob)").option("--worktree [id]", "run the session in an isolated git worktree under .vibgrate/worktrees (bare: create a new one; with id: reuse it)").option("--worktree-diff <id>", "one-shot: print the worktree's delta against its base as a patch, then exit").option("--worktree-apply <id>", "one-shot: apply the worktree's delta onto the main tree (git apply --3way), then exit").option("--worktree-remove <id>", "one-shot: remove the worktree checkout, then exit").option("--capsule", "use a source-bearing Task Capsule for first context (Fusion A/B; exact source ranges from the graph)").option("--no-capsule", "disable Task Capsule context even if enabled in .vibgrate/code.json").option("--security-tier <tier>", "shell isolation: L0 (host), L1 (Seatbelt/bubblewrap when available), L2/L3 reserved").option("--mock <file>", "use a scripted reply from <file> instead of a model (offline; for tests/CI)").option("-o, --out <file>", "write the JSON result to <file> (implies --json shape; for CI/benchmarks)").action(async function(instructionParts, opts) {
+  const cmd = program.command("code").description("graph-grounded coding agent (guided mode with no instruction; every edit and command is approved)").argument("[instruction...]", "what to change, in plain language (omit for guided interactive mode)").option("--provider <id>", "backend: vibgrate-relay (Vibgrate Relay), ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp").option("--model <id>", "model id (or set VG_CODE_MODEL). No model is hard-coded \u2014 pick the current best.").option("--mode <mode>", "Code Mode: spark | flow | forge (preferred over raw model names; auto-fits when omitted and no --model)").option("--model-path <gguf>", "gguf path for --provider llama-cpp (weights are never auto-downloaded)").option("-f, --file <path>", "restrict the edit surface to this file (repeatable)", collect, []).option("-b, --budget <n>", "approx context token budget", "3000").option("--apply", "one-shot path (--single/--mock) only: write the change (still requires --yes or an interactive confirm)").option("--yes", "consent to write / to a first-use package install, non-interactively").option("--auto", "autonomous agent: auto-approve every edit and command (use with care)").option("--max-steps <n>", "cap the number of agent steps (default 24; also settable as maxSteps in vibgrate.config.json)").option("--single", "one-shot planner (single edit) instead of the multi-step agent").option("--stream", "stream the model output live").option("--stream-json", "machine protocol: NDJSON agent events on stdout, approval decisions on stdin (for host UIs like the VS Code panel)").option("--session", "with --stream-json: stay open for further turns (warm graph and tools) instead of exiting after one").option("--verify [command]", "after the agent finishes, run tests and make it fix failures (uses the config testCommand if no command is given)").option("--continue [id]", "resume a session: the most recent one, or the given session id (recap + restore /undo)").option("--restore-checkpoint <commit>", "one-shot: restore the given --file paths from a checkpoint commit, then exit (for host UIs after the original session ended)").option("--reasoning-effort <level>", "how hard a reasoning-capable model should think: low | medium | high (ignored by models without the knob)").option("--worktree [id]", "run the session in an isolated git worktree under .vibgrate/worktrees (bare: create a new one; with id: reuse it)").option("--worktree-diff <id>", "one-shot: print the worktree's delta against its base as a patch, then exit").option("--worktree-apply <id>", "one-shot: apply the worktree's delta onto the main tree (git apply --3way), then exit").option("--worktree-remove <id>", "one-shot: remove the worktree checkout, then exit").option("--capsule", "use a source-bearing Task Capsule for first context (Fusion A/B; exact source ranges from the graph)").option("--no-capsule", "disable Task Capsule context even if enabled in .vibgrate/code.json").option("--security-tier <tier>", "shell isolation: L0 (host), L1 (Seatbelt/bubblewrap when available), L2/L3 reserved").option("--mock <file>", "use a scripted reply from <file> instead of a model (offline; for tests/CI)").option("-o, --out <file>", "write the JSON result to <file> (implies --json shape; for CI/benchmarks)").action(async function(instructionParts, opts) {
     const global = readGlobal(this);
     let instruction = (instructionParts ?? []).join(" ").trim();
     if (typeof opts.continue === "string") {
@@ -7436,7 +7440,7 @@ function registerCode(program) {
       }
       global.cwd = activeWorktree.path;
     }
-    if (!global.local) {
+    if (!global.offline) {
       await ensureRelevanceModule();
     }
     const config = loadCodeConfig(rootOf(global));
@@ -7449,7 +7453,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-X3NE3Y2G.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-GA43KYS5.js');
-        const { loadGraph: loadGraph2 } = await import('./load-7C5VETRD.js');
+        const { loadGraph: loadGraph2 } = await import('./load-UAVA732M.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -7522,7 +7526,8 @@ function registerCode(program) {
       }
     }
     const auto = opts.auto ?? config.auto;
-    const maxSteps = opts.maxSteps ? Number(opts.maxSteps) : config.maxSteps;
+    const parsedMaxSteps = opts.maxSteps === void 0 ? NaN : Number(opts.maxSteps);
+    const maxSteps = Number.isFinite(parsedMaxSteps) && parsedMaxSteps > 0 ? Math.floor(parsedMaxSteps) : config.maxSteps;
     const capsule = typeof opts.capsule === "boolean" ? opts.capsule : !!config.capsule;
     const securityTier = resolveSecurityTierFlag(opts.securityTier, config.securityTier, !!auto);
     const contextBudget = contextBudgetFor(config);
@@ -7534,7 +7539,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-2XRBRFRB.js');
+      const { runInteractive } = await import('./interactive-VQM2CTE2.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -7564,10 +7569,10 @@ function registerCode(program) {
     }
     if (!instruction && !stdinFirstTurn) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
     {
-      const { ensureCodeMap } = await import('./ensure-map-DL2S774J.js');
+      const { ensureCodeMap: ensureCodeMap2 } = await import('./ensure-map-VAIYCCEJ.js');
       const mapRoot = rootOf(global);
       try {
-        await ensureCodeMap(mapRoot, global, {
+        await ensureCodeMap2(mapRoot, global, {
           onProgress: (p) => {
             if (opts.streamJson) {
               process.stdout.write(
@@ -7624,7 +7629,7 @@ function registerCode(program) {
       const ensure = await ensureManagerRuntime({
         providerId: route.providers[0].id,
         model: route.providers[0].model,
-        offline: !!global.local,
+        offline: !!global.offline,
         // Code Mode / explicit custom selection / --yes count as consent for
         // npm runtime deps (and ollama pull when the binary is already present).
         consent: !!(opts.yes || codeModeActive || customSelection || process.stdin.isTTY),
@@ -7649,20 +7654,20 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-TMB5TJNA.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-EATWIKLR.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-NW6AOE47.js');
-        const { nodeCodeFs } = await import('./session-KXT2ZTPE.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-GCZAHORX.js');
+        const { nodeCodeFs } = await import('./session-N2FTYIHQ.js');
         const readline6 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-M4ZNXOPX.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-Y23NVY7R.js');
-        const { resolveGraphBackend } = await import('./graph-backend-JXARVT3R.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-Y2BRBXUW.js');
+        const { resolveGraphBackend } = await import('./graph-backend-V5A2H5ZB.js');
         const { detectGitRef } = await import('./git-ref-LMT3EXYY.js');
         const { repositoryIdFromRoot } = await import('./paths-RVK6FKRN.js');
-        const { vgdRequest } = await import('./vgd-RW7HCEIP.js');
+        const { vgdRequest } = await import('./vgd-3A2TRNP5.js');
         const federation = loadOrDiscoverFederation(root3);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7720,7 +7725,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-LXBHKEFR.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-VDZWFEO2.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root3,
@@ -7765,8 +7770,8 @@ ${res.stderr}` : ""),
           files,
           indexFile: checkpointIndex
         });
-        const { loadApprovalRules, addApprovalRule, ruleForAction, ruleLabel } = await import('./approvals-KBM72NU2.js');
-        const { loadProjectRules, nodeRulesReader } = await import('./rules-ASYEUNB5.js');
+        const { loadApprovalRules, addApprovalRule, ruleForAction, ruleLabel } = await import('./approvals-ISJFILVK.js');
+        const { loadProjectRules, nodeRulesReader } = await import('./rules-TLRGB5L4.js');
         const projectRules = loadProjectRules(nodeRulesReader(root3));
         if (projectRules.sources.length && !global.quiet) {
           emitStream({
@@ -7823,8 +7828,8 @@ ${res.stderr}` : ""),
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession, STREAM_JSON_PROTOCOL_VERSION } = await import('./stream-json-NW6AOE47.js');
-            const { runAgent: runAgent2 } = await import('./agent-DHQYEHVW.js');
+            const { runCodeStreamJsonSession, STREAM_JSON_PROTOCOL_VERSION } = await import('./stream-json-GCZAHORX.js');
+            const { runAgent: runAgent2 } = await import('./agent-5GW7C7EB.js');
             const {
               condenseSession,
               loadLatestSession,
@@ -7835,7 +7840,7 @@ ${res.stderr}` : ""),
               sessionsDir,
               summarizeSession
             } = await import('./session-store-AQUORKWB.js');
-            const { VERSION: VERSION2 } = await import('./version-7ABYXWOZ.js');
+            const { VERSION: VERSION2 } = await import('./version-XNZ4GLMQ.js');
             const resumedRecord = typeof opts.continue === "string" ? loadSession(mainRoot, opts.continue) : opts.continue ? loadLatestSession(mainRoot) : void 0;
             if (typeof opts.continue === "string" && !resumedRecord) {
               emitStream({
@@ -7867,8 +7872,8 @@ ${res.stderr}` : ""),
               if (ended) return Promise.resolve(null);
               const queued = pendingTurns.shift();
               if (queued !== void 0) return Promise.resolve(queued);
-              return new Promise((resolve23) => {
-                wakeTurn = resolve23;
+              return new Promise((resolve25) => {
+                wakeTurn = resolve25;
               });
             };
             let turnIndex = 0;
@@ -8047,8 +8052,8 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-2XRBRFRB.js');
-      const { nodeCodeFs } = await import('./session-KXT2ZTPE.js');
+      const { agentTask } = await import('./interactive-VQM2CTE2.js');
+      const { nodeCodeFs } = await import('./session-N2FTYIHQ.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       let priorInstruction;
@@ -8063,7 +8068,7 @@ ${res.stderr}` : ""),
         }
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-LXBHKEFR.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-VDZWFEO2.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root3,
@@ -8087,11 +8092,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-M4ZNXOPX.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-Y23NVY7R.js');
-        const { resolveGraphBackend } = await import('./graph-backend-JXARVT3R.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-Y2BRBXUW.js');
+        const { resolveGraphBackend } = await import('./graph-backend-V5A2H5ZB.js');
         const { detectGitRef } = await import('./git-ref-LMT3EXYY.js');
         const { repositoryIdFromRoot } = await import('./paths-RVK6FKRN.js');
-        const { vgdRequest } = await import('./vgd-RW7HCEIP.js');
+        const { vgdRequest } = await import('./vgd-3A2TRNP5.js');
         const federation = loadFederation(root3);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -8237,11 +8242,11 @@ function resolveSecurityTierFlag(flag, fromConfig, auto) {
   return auto ? "L1" : "L0";
 }
 function confirm2(question) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve25) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve23(/^y(es)?$/i.test(answer.trim()));
+      resolve25(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -8350,9 +8355,9 @@ function registerLib(program) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
     const [verb, ...rest] = args;
-    const network = !global.local;
+    const network = !global.offline;
     if (!verb) return listCatalog(root3, global.json);
-    const online = (Boolean(opts.online) || network) && !global.local;
+    const online = (Boolean(opts.online) || network) && !global.offline;
     if (verb === "add") return addCmd(root3, rest, { ...opts, online }, global.json);
     if (verb === "publish") return publishCmd(root3, rest, opts, global, global.json);
     if (verb === "resolve") return resolveCmd(root3, rest, global.json);
@@ -8399,7 +8404,7 @@ async function addCmd(root3, rest, opts, asJson) {
 }
 function readPackageVersion(root3) {
   try {
-    const pkg = JSON.parse(fs12__default.readFileSync(path45__default.join(root3, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs12__default.readFileSync(path51__default.join(root3, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -8414,7 +8419,7 @@ function readOptionalFile(p) {
   }
 }
 async function publishCmd(root3, rest, opts, global, asJson) {
-  if (global.local) throw usageError("vg lib publish uploads to the hosted catalog \u2014 it needs network (remove --local)");
+  if (global.offline) throw usageError("vg lib publish uploads to the hosted catalog \u2014 it needs network (remove --offline/--local)");
   const name = (rest.join(" ") || opts.name || "").trim();
   if (!name) throw usageError("usage: vg lib publish <name> [--version <v>] [--readme <path>] [--dts <path>] [--language <lang>]");
   const dsn = resolveDsn();
@@ -8422,8 +8427,8 @@ async function publishCmd(root3, rest, opts, global, asJson) {
   if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
   const version = (opts.version || readPackageVersion(root3) || "").trim();
   if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
-  const readme = readOptionalFile(opts.readme ? path45__default.resolve(opts.readme) : path45__default.join(root3, "README.md"));
-  const dts = opts.dts ? readOptionalFile(path45__default.resolve(opts.dts)) : void 0;
+  const readme = readOptionalFile(opts.readme ? path51__default.resolve(opts.readme) : path51__default.join(root3, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path51__default.resolve(opts.dts)) : void 0;
   if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
   const result = await publishPrivateLibrary(
     { name, version, readme, dts, language: opts.language },
@@ -8546,7 +8551,7 @@ function registerExport(program) {
     const content = exportGraph(format, {
       graph,
       deps: needsDeps ? inventory(root3).records : void 0,
-      models: needsDeps && !global.local ? discoverModels() : void 0,
+      models: needsDeps && !global.offline ? discoverModels() : void 0,
       generatedAt: graph.generatedAt,
       compact: opts.compact === true ? true : opts.compact === false ? false : void 0,
       slim: opts.slim === true
@@ -8555,7 +8560,7 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs12.mkdirSync(path45.dirname(path45.resolve(file)), { recursive: true });
+    fs12.mkdirSync(path51.dirname(path51.resolve(file)), { recursive: true });
     fs12.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
@@ -8566,49 +8571,49 @@ function detectFormat(file) {
   if (lower.endsWith(".cdx.json")) return "cyclonedx";
   if (lower.endsWith(".spdx.json")) return "spdx";
   if (file === "-") return "json";
-  return formatForExt(path45.extname(file));
+  return formatForExt(path51.extname(file));
 }
 function registerBundle(program) {
-  const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
+  const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
     const global = readGlobal(this);
     const root3 = rootOf(global);
-    const outDir = path45.resolve(root3, opts.out ?? "vg-bundle");
+    const outDir = path51.resolve(root3, opts.out ?? "vg-bundle");
     let grammarFiles;
     try {
       grammarFiles = resolvedGrammarFiles();
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs12.mkdirSync(path45.join(outDir, "grammars"), { recursive: true });
+    fs12.mkdirSync(path51.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs12.copyFileSync(absPath, path45.join(outDir, "grammars", fileName));
+      fs12.copyFileSync(absPath, path51.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     for (const id of Object.keys(TOOLCHAIN_GRAMMARS).sort()) {
       const absPath = resolveToolchainGrammar(id);
       if (!absPath) continue;
-      fs12.copyFileSync(absPath, path45.join(outDir, "grammars", path45.basename(absPath)));
+      fs12.copyFileSync(absPath, path51.join(outDir, "grammars", path51.basename(absPath)));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root3, global.graph);
     if (fs12.existsSync(graphSrc)) {
-      fs12.copyFileSync(graphSrc, path45.join(outDir, "graph.json"));
+      fs12.copyFileSync(graphSrc, path51.join(outDir, "graph.json"));
       included.push("graph.json");
     } else {
       const graph = loadGraphFileWithSnapshot(graphSrc);
       if (graph) {
-        fs12.writeFileSync(path45.join(outDir, "graph.json"), serializeGraph(graph));
+        fs12.writeFileSync(path51.join(outDir, "graph.json"), serializeGraph(graph));
         included.push("graph.json");
       }
     }
     const cat = catalogPath(root3);
     if (fs12.existsSync(cat)) {
-      fs12.copyFileSync(cat, path45.join(outDir, "vibgrate.lib.json"));
+      fs12.copyFileSync(cat, path51.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
       if (fs12.existsSync(libDir(root3))) {
-        fs12.cpSync(libDir(root3), path45.join(outDir, "lib"), { recursive: true });
+        fs12.cpSync(libDir(root3), path51.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -8620,15 +8625,15 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs12.writeFileSync(path45.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs12.writeFileSync(path51.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
-      json({ out: path45.relative(root3, outDir), ...manifest });
+      json({ out: path51.relative(root3, outDir), ...manifest });
       return;
     }
-    info(`${c.cyan("vg bundle")} \xB7 wrote ${path45.relative(root3, outDir)}/`);
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path51.relative(root3, outDir)}/`);
     for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
-    info(c.dim(`  offline: vg build --grammars "${path45.relative(root3, outDir)}/grammars"`));
+    info(c.dim(`  offline: vg build --grammars "${path51.relative(root3, outDir)}/grammars"`));
   });
   applyGlobalOptions(cmd);
 }
@@ -8644,9 +8649,9 @@ var REACH_TIMEOUT_MS = 3e3;
 var CONFIG_BASENAMES = ["vibgrate.config.ts", "vibgrate.config.js", "vibgrate.config.json"];
 async function runDoctor(global) {
   const root3 = rootOf(global);
-  const local = global.local === true;
+  const local = global.offline === true;
   const graphPath = resolveGraphPath(root3, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs12.existsSync(path45.join(root3, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs12.existsSync(path51.join(root3, f))) ?? null;
   const graph = loadGraph(root3, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -8672,13 +8677,13 @@ async function runDoctor(global) {
     root: root3,
     configFile,
     map: {
-      path: path45.relative(root3, graphPath),
+      path: displayGraphPath(root3, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       staleFiles
     },
     libCatalog: {
-      path: path45.relative(root3, catalogPath(root3)),
+      path: path51.relative(root3, catalogPath(root3)),
       present: fs12.existsSync(catalogPath(root3)),
       libraries: libCount
     },
@@ -8736,7 +8741,7 @@ async function runDoctor(global) {
   );
   info(
     `  host pool  ${li.hostPool.size} warm session(s)` + (li.hostPool.sessions[0] ? c.dim(
-      ` \xB7 last ${path45.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
+      ` \xB7 last ${path51.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
     ) : c.dim(" \xB7 none (load via vg code / vgd host-load)"))
   );
   if (li.dynamicOnToken || li.dynamicCustomSampler) {
@@ -8906,12 +8911,12 @@ function registerLlmHost(program) {
     let binding = null;
     const ensured = await ensurePackage("node-llama-cpp@^3", {
       consent: !!opts.yes,
-      local: !!global.local,
+      local: !!global.offline,
       interactive: false
     });
     if (ensured.module) {
       binding = ensured.module;
-    } else if (opts.yes || !global.local) {
+    } else if (opts.yes || !global.offline) {
       if (!global.json) {
         info(
           c.dim(
@@ -9043,7 +9048,7 @@ async function readStdin() {
   return Buffer.concat(chunks).toString("utf-8");
 }
 function readFileOrThrow(file, label) {
-  const p = path45.resolve(file);
+  const p = path51.resolve(file);
   if (!fs12.existsSync(p)) throw usageError(`${label} file not found: ${p}`);
   return fs12.readFileSync(p, "utf-8");
 }
@@ -9055,8 +9060,8 @@ function writeOutput(outFile, content) {
     process.stdout.write(content.endsWith("\n") ? content : content + "\n");
     return;
   }
-  const outPath = path45.resolve(outFile);
-  const dir = path45.dirname(outPath);
+  const outPath = path51.resolve(outFile);
+  const dir = path51.dirname(outPath);
   if (!fs12.existsSync(dir)) throw usageError(`output directory does not exist: ${dir}`);
   fs12.writeFileSync(outPath, content.endsWith("\n") ? content : content + "\n", "utf-8");
   info(c.dim(`wrote ${outPath}`));
@@ -9091,7 +9096,7 @@ function registerHcs(program) {
     }
     const statePath = opts.previous ?? opts.out;
     const useIncremental = canIncremental && statePath !== void 0;
-    const root3 = path45.resolve(dir);
+    const root3 = path51.resolve(dir);
     if (!fs12.existsSync(root3) || !fs12.statSync(root3).isDirectory()) {
       throw usageError(`not a directory: ${root3}`);
     }
@@ -9116,7 +9121,7 @@ function registerHcs(program) {
       }
       for (const entry of entries.sort((a, b) => a.name < b.name ? -1 : 1)) {
         if (entry.name.startsWith(".")) continue;
-        const absChild = path45.join(abs, entry.name);
+        const absChild = path51.join(abs, entry.name);
         const relChild = rel ? `${rel}/${entry.name}` : entry.name;
         if (entry.isDirectory()) {
           if (!SKIP_DIRS.has(entry.name)) walk2(absChild, relChild);
@@ -9124,7 +9129,7 @@ function registerHcs(program) {
         }
         if (!entry.isFile()) continue;
         if (!opts.includeTests && TEST_PATTERNS.some((p) => p.test(relChild))) continue;
-        const lang = extToLang.get(path45.extname(entry.name).toLowerCase());
+        const lang = extToLang.get(path51.extname(entry.name).toLowerCase());
         if (!lang) continue;
         try {
           if (fs12.statSync(absChild).size > MAX_EXTRACT_FILE_BYTES) continue;
@@ -9158,7 +9163,7 @@ function registerHcs(program) {
       writeOutput(opts.out, parts2.join("\n"));
       return;
     }
-    const previousPath = path45.resolve(statePath);
+    const previousPath = path51.resolve(statePath);
     const previousNdjson = !opts.full && fs12.existsSync(previousPath) ? fs12.readFileSync(previousPath, "utf-8") : "";
     if (opts.full) info(c.dim("running a full re-extraction (--full)"));
     else if (!previousNdjson) info(c.dim(`previous stream not found at ${previousPath} \u2014 running a full extraction`));
@@ -9262,12 +9267,2005 @@ function registerHcs(program) {
   });
   applyGlobalOptions(cmd);
 }
+
+// src/review/format.ts
+var DECISION_LABEL = {
+  pass: "pass",
+  needs_review: "needs review",
+  fail: "fail",
+  undetermined: "undetermined"
+};
+function colorDecision(decision) {
+  const label = DECISION_LABEL[decision];
+  if (decision === "pass") return c.green(label);
+  if (decision === "fail") return c.red(label);
+  return c.yellow(label);
+}
+function formatText(result) {
+  const { receipt, reasons, budget } = result;
+  const lines = [];
+  const all = [...receipt.findings.architecture_findings, ...receipt.findings.security_findings];
+  lines.push(`${c.cyan("vg review")} \xB7 ${colorDecision(receipt.decision)} \xB7 ${receipt.enforcement}`);
+  lines.push(
+    c.dim(
+      `  ${receipt.git.dirty ? "working tree" : receipt.git.head_sha.slice(0, 8)} vs ${receipt.git.base_sha.slice(0, 8)}${receipt.git.merge_base ? " (merge-base)" : ""} \xB7 ${receipt.change_class.join(", ")}`
+    )
+  );
+  lines.push("");
+  if (all.length === 0) {
+    lines.push(c.dim("  no architecture or security-control findings"));
+  }
+  for (const f of all) {
+    const badge = f.protected_finding ? c.red("protected") : severityColor(f.severity);
+    lines.push(`  ${c.bold(f.id)} ${badge} ${c.dim(f.kind)}`);
+    lines.push(`    ${f.claim}`);
+    lines.push(c.dim(`    \u2192 ${f.remediation}`));
+    lines.push(
+      c.dim(`    alignment ${f.target_alignment} \xB7 confidence ${f.confidence.toFixed(2)} \xB7 ${f.paths.slice(0, 3).join(", ")}`)
+    );
+    lines.push("");
+  }
+  if (receipt.findings.unknowns.length > 0) {
+    lines.push(c.yellow("  unknowns"));
+    for (const u of receipt.findings.unknowns) lines.push(c.dim(`    \xB7 ${u}`));
+    lines.push("");
+  }
+  if (receipt.findings.required_checks.length > 0) {
+    lines.push(c.dim(`  required checks: ${receipt.findings.required_checks.join(", ")}`));
+  }
+  lines.push(c.dim(`  policy: ${reasons.join("; ")}`));
+  lines.push(
+    c.dim(
+      `  capsule ~${budget.estimatedTokens} tokens (median target ${budget.median}, cap ${budget.cap}${budget.trimmed ? ", trimmed" : ""})`
+    )
+  );
+  lines.push(
+    c.dim(
+      `  ${receipt.versions.policy} \xB7 model ${receipt.versions.model} \xB7 graph ${receipt.versions.graph_schema} \xB7 ${receipt.digests.receipt.slice(0, 19)}\u2026`
+    )
+  );
+  lines.push(c.dim("  explain one: `vg review explain <finding-id>` \xB7 machine result: `vg review --format json`"));
+  lines.push(c.dim("  Review reports change integrity. It is not a proof of security and absence of findings is not a certification."));
+  return lines.join("\n");
+}
+function severityColor(severity) {
+  if (severity === "critical" || severity === "high") return c.red(severity);
+  if (severity === "medium") return c.yellow(severity);
+  return c.dim(severity);
+}
+function formatMarkdown(result) {
+  const { receipt, reasons } = result;
+  const all = [...receipt.findings.architecture_findings, ...receipt.findings.security_findings];
+  const lines = [];
+  lines.push(`## Vibgrate Review \u2014 \`${DECISION_LABEL[receipt.decision]}\``);
+  lines.push("");
+  lines.push(
+    `\`${receipt.git.base_sha.slice(0, 8)}\` \u2192 \`${receipt.git.head_sha.slice(0, 8)}\`${receipt.git.dirty ? " (working tree)" : ""} \xB7 enforcement \`${receipt.enforcement}\``
+  );
+  lines.push("");
+  lines.push(
+    `| architecture | security | protected | unknowns |
+|---:|---:|---:|---:|
+| ${receipt.counts.architecture} | ${receipt.counts.security} | ${receipt.counts.protected} | ${receipt.counts.unknowns} |`
+  );
+  lines.push("");
+  if (all.length === 0) {
+    lines.push("No architecture or security-control findings.");
+  } else {
+    lines.push("| id | kind | severity | alignment | claim |");
+    lines.push("|---|---|---|---|---|");
+    for (const f of all) {
+      const kind = f.protected_finding ? `${f.kind} **(protected)**` : f.kind;
+      lines.push(`| \`${f.id}\` | ${kind} | ${f.severity} | ${f.target_alignment} | ${escapeCell(f.claim)} |`);
+    }
+  }
+  if (receipt.findings.unknowns.length > 0) {
+    lines.push("");
+    lines.push("**Unknowns**");
+    lines.push("");
+    for (const u of receipt.findings.unknowns) lines.push(`- ${u}`);
+  }
+  lines.push("");
+  lines.push(`<sub>${escapeCell(reasons.join("; "))}</sub>`);
+  lines.push("");
+  lines.push(
+    `<sub>policy \`${receipt.versions.policy}\` \xB7 model \`${receipt.versions.model}\` \xB7 receipt \`${receipt.digests.receipt.slice(0, 23)}\u2026\`</sub>`
+  );
+  lines.push("");
+  lines.push(
+    "<sub>Vibgrate Review reports change integrity against the declared architecture and security controls. It does not prove code is secure, and absence of findings is not a certification.</sub>"
+  );
+  return lines.join("\n");
+}
+function escapeCell(s) {
+  return s.replace(/\|/g, "\\|").replace(/\n/g, " ");
+}
+function formatSarif(receipt) {
+  const findings = receipt.findings.security_findings;
+  const rules = [...new Map(findings.map((f) => [f.kind, f])).values()].map((f) => ({
+    id: f.kind,
+    name: f.kind,
+    shortDescription: { text: f.kind.replace(/_/g, " ") },
+    fullDescription: { text: f.remediation },
+    defaultConfiguration: { level: sarifLevel(f) },
+    properties: { tags: ["security", "vibgrate-review"] }
+  }));
+  return JSON.stringify(
+    {
+      $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+      version: "2.1.0",
+      runs: [
+        {
+          tool: {
+            driver: {
+              name: "Vibgrate Review",
+              version: receipt.versions.cli,
+              informationUri: "https://vibgrate.com/review",
+              rules
+            }
+          },
+          automationDetails: { id: `vibgrate-review/${receipt.git.head_sha}` },
+          results: findings.map((f) => ({
+            ruleId: f.kind,
+            level: sarifLevel(f),
+            message: { text: f.claim },
+            locations: f.paths.map((p) => ({
+              physicalLocation: { artifactLocation: { uri: p } }
+            })),
+            properties: {
+              findingId: f.id,
+              confidence: f.confidence,
+              targetAlignment: f.target_alignment,
+              protectedFinding: f.protected_finding === true,
+              remediation: f.remediation
+            }
+          }))
+        }
+      ]
+    },
+    null,
+    2
+  );
+}
+function sarifLevel(f) {
+  if (f.protected_finding || f.severity === "critical" || f.severity === "high") return "error";
+  if (f.severity === "medium") return "warning";
+  return "note";
+}
+function formatExplain(result, findingId) {
+  const all = [...result.receipt.findings.architecture_findings, ...result.receipt.findings.security_findings];
+  const finding = all.find((f) => f.id === findingId);
+  if (!finding) return null;
+  const lines = [];
+  lines.push(`${c.bold(finding.id)} ${severityColor(finding.severity)} ${c.dim(finding.kind)}`);
+  lines.push("");
+  lines.push(`  ${finding.claim}`);
+  lines.push("");
+  lines.push(c.dim(`  remediation: ${finding.remediation}`));
+  lines.push(c.dim(`  alignment:   ${finding.target_alignment}`));
+  lines.push(c.dim(`  confidence:  ${finding.confidence.toFixed(2)}`));
+  lines.push(c.dim(`  protected:   ${finding.protected_finding === true ? "yes \u2014 policy cannot pass while it is unresolved" : "no"}`));
+  lines.push(c.dim(`  produced by: ${finding.source ?? "scanner"}`));
+  lines.push("");
+  lines.push(c.dim("  evidence"));
+  for (const id of finding.evidence_ids) {
+    const e = result.capsule.evidence.find((x) => x.id === id);
+    if (!e) {
+      lines.push(c.red(`    ${id} \u2014 not present in the capsule (this finding failed verification)`));
+      continue;
+    }
+    const span = e.start_line ? `:${e.start_line}${e.end_line && e.end_line !== e.start_line ? `-${e.end_line}` : ""}` : "";
+    lines.push(`    ${c.bold(e.id)} ${c.dim(e.kind)} ${e.path ?? ""}${span}`);
+    if (e.note) lines.push(c.dim(`      ${e.note}`));
+  }
+  return lines.join("\n");
+}
+
+// src/review/policy.ts
+var ALIGNED = /* @__PURE__ */ new Set(["target", "approved_exception"]);
+function isProtected(f) {
+  return f.protected_finding === true;
+}
+function unresolvedProtected(findings, config) {
+  const enabled = (kind) => {
+    if (kind === "unguarded_entrypoint" || kind === "guard_removed") return config.protected.unguarded_entrypoint;
+    if (kind === "known_vulnerable_dependency") return config.protected.known_vulnerable_dependency;
+    if (kind === "validated_taint") return config.protected.validated_taint;
+    return true;
+  };
+  return [...findings.architecture_findings, ...findings.security_findings].filter(isProtected).filter((f) => enabled(f.kind));
+}
+function applyReviewPolicy(capsule, findings, config, verification) {
+  const reasons = [];
+  const all = [...findings.architecture_findings, ...findings.security_findings];
+  const protectedFindings = unresolvedProtected(findings, config);
+  const quickPath = findings.change_class.length === 1 && findings.change_class[0] === "none";
+  const decide = () => {
+    if (!verification.schema_valid || !verification.evidence_ids_valid) {
+      reasons.push("the findings document failed schema or evidence verification \u2014 nothing here can be trusted to decide on");
+      return "undetermined";
+    }
+    if (protectedFindings.length > 0) {
+      reasons.push(
+        `${protectedFindings.length} protected finding(s) are unresolved: ${protectedFindings.map((f) => f.kind).join(", ")}`
+      );
+      return "fail";
+    }
+    if (quickPath) {
+      reasons.push("no material architectural or security-control delta in this change set");
+      return "pass";
+    }
+    const high = all.filter(
+      (f) => (f.severity === "high" || f.severity === "critical") && !ALIGNED.has(f.target_alignment) && f.confidence >= config.high_confidence_threshold
+    );
+    if (high.length > 0) {
+      reasons.push(
+        `${high.length} high-severity finding(s) at or above the ${config.high_confidence_threshold} confidence threshold`
+      );
+      return config.high_severity_decision;
+    }
+    const blockingUnknowns = findings.unknowns.length > 0 || findings.required_checks.length > 0;
+    const material = all.filter((f) => !ALIGNED.has(f.target_alignment));
+    if (material.length > 0) {
+      reasons.push(`${material.length} finding(s) need a human look`);
+      return "needs_review";
+    }
+    if (blockingUnknowns) {
+      reasons.push(
+        `no findings, but ${findings.unknowns.length} unknown(s) and ${findings.required_checks.length} required check(s) remain`
+      );
+      return capsule.patterns.unknown ? "undetermined" : "needs_review";
+    }
+    if (all.length > 0) {
+      reasons.push("every finding is target-aligned or an approved exception");
+    } else {
+      reasons.push("no architecture or security-control findings in this change set");
+    }
+    return "pass";
+  };
+  let decision = decide();
+  let protectedFalseBless = false;
+  if (decision === "pass" && protectedFindings.length > 0) {
+    protectedFalseBless = true;
+    decision = "fail";
+    reasons.push("policy attempted `pass` with an unresolved protected finding \u2014 downgraded to `fail`");
+  }
+  return {
+    decision,
+    reasons,
+    protectedFalseBless,
+    quickPath: quickPath && decision === "pass",
+    protectedCount: protectedFindings.length
+  };
+}
+var FAIL_ON_LEVELS = ["none", "fail", "needs_review"];
+function exitCodeForDecision(decision, failOn) {
+  if (failOn === "none") return 0;
+  if (decision === "fail") return ExitCode.GATE_FAILED;
+  if (failOn === "needs_review" && (decision === "needs_review" || decision === "undetermined")) {
+    return ExitCode.GATE_FAILED;
+  }
+  return 0;
+}
+function resolveFailOn(flag, config) {
+  if (flag) return flag;
+  return config.enforcement === "enforced" ? config.fail_on : "none";
+}
+
+// src/review/delta.ts
+var SPEC_PATTERNS = [
+  /(?:import|export)\s+(?:type\s+)?(?:[^'"\n;]+?\s+from\s+)?['"]([^'"]+)['"]/g,
+  /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  /from\s+['"]([^'"]+)['"]/g,
+  /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  /(?:^|\n)\s*import\s+"([^"]+)"/g,
+  /(?:^|\n)\s*using\s+([A-Za-z0-9_.]+)\s*;/g
+];
+var TRY_SUFFIXES = [
+  "",
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
+  ".cs",
+  ".py",
+  ".go",
+  ".java",
+  ".kt",
+  "/index.ts",
+  "/index.tsx",
+  "/index.js"
+];
+function normalize2(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function dirname9(p) {
+  const n = normalize2(p);
+  const i = n.lastIndexOf("/");
+  return i <= 0 ? "" : n.slice(0, i);
+}
+function resolveRelative(fromFile, spec) {
+  const dir = dirname9(fromFile);
+  const parts = `${dir ? `${dir}/` : ""}${spec}`.split("/");
+  const out2 = [];
+  for (const part of parts) {
+    if (!part || part === ".") continue;
+    if (part === "..") {
+      if (out2.length > 0) out2.pop();
+      continue;
+    }
+    out2.push(part);
+  }
+  return out2.join("/");
+}
+function stripExt(p) {
+  return p.replace(/\.[^.]+$/, "");
+}
+function basenameNoExt(p) {
+  const base = normalize2(p).split("/").pop() ?? p;
+  return stripExt(base).toLowerCase();
+}
+function dependencyHints(text, fromFile) {
+  const hints = /* @__PURE__ */ new Set();
+  for (const pattern of SPEC_PATTERNS) {
+    pattern.lastIndex = 0;
+    let m;
+    while ((m = pattern.exec(text)) !== null) {
+      const spec = m[1]?.trim();
+      if (!spec) continue;
+      const cleaned = spec.replace(/\\/g, "/").replace(/\?.*$/, "").replace(/#.*$/, "");
+      hints.add(cleaned.toLowerCase());
+      hints.add(basenameNoExt(cleaned));
+      if (cleaned.startsWith(".")) {
+        const resolved = resolveRelative(fromFile, cleaned);
+        hints.add(resolved.toLowerCase());
+        hints.add(stripExt(resolved).toLowerCase());
+      }
+    }
+  }
+  return hints;
+}
+function destKeys(toPath) {
+  const n = normalize2(toPath);
+  const noExt = stripExt(n);
+  return [n, noExt, n.toLowerCase(), noExt.toLowerCase(), basenameNoExt(n)];
+}
+function hintsCoverDest(hints, toPath) {
+  for (const key2 of destKeys(toPath)) {
+    if (hints.has(key2)) return true;
+  }
+  const n = normalize2(toPath).toLowerCase();
+  for (const hint of hints) {
+    for (const suffix of TRY_SUFFIXES) {
+      if (hint + suffix === n || hint === n + suffix) return true;
+    }
+  }
+  return false;
+}
+function fileReferencesDest(text, fromFile, toPath) {
+  return hintsCoverDest(dependencyHints(text, fromFile), toPath);
+}
+function isIntroducedEdge(op, fromFile, toPath, baseText) {
+  if (op === "added") return true;
+  if (op === "removed") return false;
+  if (baseText === void 0) return false;
+  return !fileReferencesDest(baseText, fromFile, toPath);
+}
+function pathShapedCover(hints, toPath) {
+  const n = normalize2(toPath).toLowerCase();
+  const noExt = stripExt(n);
+  if (hints.has(n) || hints.has(noExt)) return true;
+  for (const hint of hints) {
+    if (!hint.includes("/")) continue;
+    for (const suffix of TRY_SUFFIXES) {
+      if (hint + suffix === n || hint === n + suffix) return true;
+    }
+  }
+  return false;
+}
+function removedDestinations(fromFile, baseText, headText, knownFiles) {
+  const oldHints = dependencyHints(baseText, fromFile);
+  const newHints = dependencyHints(headText, fromFile);
+  const out2 = [];
+  for (const dest of knownFiles) {
+    const n = normalize2(dest);
+    if (!pathShapedCover(oldHints, n)) continue;
+    if (pathShapedCover(newHints, n)) continue;
+    out2.push(n);
+  }
+  return out2.sort();
+}
+
+// src/review/capsule.ts
+var BOUNDARY_EDGE_KINDS = /* @__PURE__ */ new Set(["import", "call", "references"]);
+var EXEMPT_LAYERS = /* @__PURE__ */ new Set(["config", "shared", "testing"]);
+function normalize3(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function nodeTouchedByChange(node2, file) {
+  if (file.hunks.length === 0) return true;
+  return file.hunks.some((h) => node2.span.start <= h.end && node2.span.end >= h.start);
+}
+function estimateTokens(value) {
+  return Math.ceil(JSON.stringify(value).length / 4);
+}
+function compileCapsule(input) {
+  const { graph, change, config, profile } = input;
+  const unknowns = [];
+  const evidence = [];
+  const seenEvidence = /* @__PURE__ */ new Set();
+  const addEvidence = (e) => {
+    if (!seenEvidence.has(e.id)) {
+      seenEvidence.add(e.id);
+      evidence.push(e);
+    }
+    return e.id;
+  };
+  const changedPaths = new Set(change.files.map((f) => normalize3(f.path)));
+  const changedByPath = new Map(change.files.map((f) => [normalize3(f.path), f]));
+  const layerOf = /* @__PURE__ */ new Map();
+  const classify = (p) => {
+    const cached2 = layerOf.get(p);
+    if (cached2) return cached2;
+    const cls = classifyFile(p, "unknown");
+    if (!cls) return null;
+    const value = { layer: cls.layer, confidence: cls.confidence, role: cls.role };
+    layerOf.set(p, value);
+    return value;
+  };
+  const symbols = [];
+  const changedNodeIds = /* @__PURE__ */ new Set();
+  const nodesByFile = /* @__PURE__ */ new Map();
+  if (graph) {
+    for (const node2 of graph.nodes) {
+      const file = normalize3(node2.file);
+      let bucket = nodesByFile.get(file);
+      if (!bucket) nodesByFile.set(file, bucket = []);
+      bucket.push(node2);
+    }
+    for (const path53 of [...changedPaths].sort()) {
+      const file = changedByPath.get(path53);
+      for (const node2 of nodesByFile.get(path53) ?? []) {
+        if (node2.kind === "file" || node2.kind === "document") continue;
+        if (!nodeTouchedByChange(node2, file)) continue;
+        changedNodeIds.add(node2.id);
+        symbols.push({
+          node_id: node2.id,
+          name: node2.name,
+          kind: node2.kind,
+          path: path53,
+          start_line: node2.span.start,
+          end_line: node2.span.end
+        });
+      }
+    }
+  }
+  const addedEdges = [];
+  const removedEdges = [];
+  const nodeById = /* @__PURE__ */ new Map();
+  if (graph) for (const n of graph.nodes) nodeById.set(n.id, n);
+  const edgeEvidenceId = (e) => `edge:${e.id.slice(0, 12)}`;
+  const seenAdded = /* @__PURE__ */ new Set();
+  if (graph) {
+    for (const edge of graph.edges) {
+      if (!BOUNDARY_EDGE_KINDS.has(edge.kind)) continue;
+      const src = nodeById.get(edge.src);
+      const dst = nodeById.get(edge.dst);
+      if (!src || !dst) continue;
+      const fromPath = normalize3(src.file);
+      const toPath = normalize3(dst.file);
+      if (fromPath === toPath) continue;
+      if (!changedNodeIds.has(edge.src)) continue;
+      const file = changedByPath.get(fromPath);
+      const op = file?.op ?? "modified";
+      const baseText = input.baseFileText?.get(fromPath);
+      if (!isIntroducedEdge(op, fromPath, toPath, baseText)) continue;
+      const pair = `${fromPath}\0${toPath}\0${edge.kind}`;
+      if (seenAdded.has(pair)) continue;
+      seenAdded.add(pair);
+      const from = classify(fromPath);
+      const to = classify(toPath);
+      const id = addEvidence({
+        id: edgeEvidenceId(edge),
+        kind: "graph_edge",
+        path: fromPath,
+        start_line: src.span.start,
+        end_line: src.span.end,
+        protected_finding: false,
+        note: `${edge.kind} \u2192 ${toPath}`
+      });
+      addedEdges.push({
+        evidence_id: id,
+        kind: edge.kind,
+        from_path: fromPath,
+        to_path: toPath,
+        from_layer: from?.layer,
+        to_layer: to?.layer
+      });
+    }
+    const knownFiles = [...nodesByFile.keys()];
+    let removedN = 0;
+    for (const file of change.files) {
+      const fromPath = normalize3(file.path);
+      const baseText = input.baseFileText?.get(fromPath);
+      const headText = input.headFileText?.get(fromPath);
+      if (baseText === void 0 || headText === void 0) continue;
+      for (const toPath of removedDestinations(fromPath, baseText, headText, knownFiles)) {
+        removedN++;
+        const from = classify(fromPath);
+        const to = classify(toPath);
+        const id = addEvidence({
+          id: `edge:removed:${removedN}`,
+          kind: "graph_edge",
+          path: fromPath,
+          protected_finding: false,
+          note: `removed \u2192 ${toPath}`
+        });
+        removedEdges.push({
+          evidence_id: id,
+          kind: "import",
+          from_path: fromPath,
+          to_path: toPath,
+          from_layer: from?.layer,
+          to_layer: to?.layer
+        });
+      }
+    }
+  }
+  const roles = [];
+  const roleCounter = /* @__PURE__ */ new Map();
+  const roleEvidenceId = (role) => {
+    const n = (roleCounter.get(role) ?? 0) + 1;
+    roleCounter.set(role, n);
+    return `role:${role}:${n}`;
+  };
+  const emitRole = (path53, changed) => {
+    const cls = classify(path53);
+    if (!cls) return;
+    const role = cls.role ?? cls.layer;
+    const id = addEvidence({
+      id: roleEvidenceId(role),
+      kind: "role",
+      path: path53,
+      protected_finding: false,
+      note: `${role} (${cls.layer}, confidence ${cls.confidence.toFixed(2)})`
+    });
+    roles.push({ evidence_id: id, path: path53, role, layer: cls.layer, confidence: cls.confidence, changed });
+  };
+  for (const path53 of [...changedPaths].sort()) emitRole(path53, true);
+  const peerPool = graph ? [...nodesByFile.keys()].sort() : [];
+  const changedRoles = new Set(roles.filter((r) => r.changed).map((r) => r.role));
+  for (const role of [...changedRoles].sort()) {
+    let taken = 0;
+    for (const path53 of peerPool) {
+      if (taken >= MAX_ROLE_PEERS) break;
+      if (changedPaths.has(path53)) continue;
+      const cls = classify(path53);
+      if (!cls) continue;
+      if ((cls.role ?? cls.layer) !== role) continue;
+      emitRole(path53, false);
+      taken++;
+    }
+  }
+  const outgoingLayers = /* @__PURE__ */ new Map();
+  if (graph) {
+    for (const edge of graph.edges) {
+      if (!BOUNDARY_EDGE_KINDS.has(edge.kind)) continue;
+      const src = nodeById.get(edge.src);
+      const dst = nodeById.get(edge.dst);
+      if (!src || !dst) continue;
+      const from = normalize3(src.file);
+      const to = normalize3(dst.file);
+      if (from === to) continue;
+      const toLayer = classify(to)?.layer;
+      if (!toLayer) continue;
+      let set = outgoingLayers.get(from);
+      if (!set) outgoingLayers.set(from, set = /* @__PURE__ */ new Set());
+      set.add(toLayer);
+    }
+  }
+  const areaOfFile = /* @__PURE__ */ new Map();
+  if (graph) {
+    for (const area of graph.areas) {
+      for (const member of area.members) {
+        const node2 = nodeById.get(member);
+        if (node2) areaOfFile.set(normalize3(node2.file), area.id);
+      }
+    }
+  }
+  const dataAccess = /* @__PURE__ */ new Map();
+  const candidates = [];
+  for (const filePath of graph ? [...nodesByFile.keys()].sort() : []) {
+    const cls = classify(filePath);
+    if (!cls) continue;
+    const pattern = classifyDataAccess(cls.layer, [...outgoingLayers.get(filePath) ?? []]);
+    if (!pattern) continue;
+    dataAccess.set(filePath, pattern);
+    const areaId = areaOfFile.get(filePath);
+    const role = cls.role ?? cls.layer;
+    candidates.push({
+      path: filePath,
+      pattern,
+      role,
+      areaGroup: areaId !== void 0 ? `area:${areaId}:${role}` : null,
+      days: input.recencyDays?.get(filePath) ?? null
+    });
+  }
+  const areaCounts = /* @__PURE__ */ new Map();
+  for (const c2 of candidates) {
+    if (c2.areaGroup) areaCounts.set(c2.areaGroup, (areaCounts.get(c2.areaGroup) ?? 0) + 1);
+  }
+  const peerFiles = candidates.map((c2) => {
+    const useArea = c2.areaGroup !== null && (areaCounts.get(c2.areaGroup) ?? 0) >= MIN_GROUP_SIZE;
+    return {
+      path: c2.path,
+      pattern: c2.pattern,
+      group: useArea ? c2.areaGroup : `role:${c2.role}`,
+      groupKind: useArea ? "area" : "role",
+      daysSinceCommit: c2.days
+    };
+  });
+  const votes = voteAll(peerFiles, { declaredPatterns: input.intent?.patterns });
+  const observed = observedDominantPattern(roles);
+  const declared = config.target_pattern ?? input.intent?.patterns[0] ?? null;
+  const patterns = {
+    observed_dominant_pattern: observed,
+    declared_target_pattern: declared,
+    approved_exceptions: [...config.approved_exceptions].sort(),
+    legacy_pattern: observed && declared && observed !== declared ? observed : null,
+    unknown: observed === null && declared === null
+  };
+  const changedGroups = new Set(
+    peerFiles.filter((f) => changedPaths.has(f.path)).map((f) => f.group)
+  );
+  for (const vote of votes) {
+    if (!changedGroups.has(vote.group)) continue;
+    addEvidence({
+      id: `vote:${vote.group}`,
+      kind: "policy",
+      protected_finding: false,
+      note: vote.reason === "dominant" ? `${vote.size} peers, ${(vote.share * 100).toFixed(0)}% ${vote.dominant} (entropy ${vote.entropy.toFixed(2)})` : `${vote.size} peers, no convention (${vote.reason}, entropy ${vote.entropy.toFixed(2)})`
+    });
+  }
+  for (const citation of input.intent?.citations.slice(0, 4) ?? []) {
+    addEvidence({
+      id: `intent:${citation.file}:${citation.line}`,
+      kind: "policy",
+      path: citation.file,
+      start_line: citation.line,
+      end_line: citation.line,
+      protected_finding: false,
+      note: citation.text
+    });
+  }
+  const profileForRules = declared ?? observed ?? void 0;
+  const policies = boundaryProfileRules(profileForRules).map((rule, i) => ({
+    evidence_id: addEvidence({
+      id: `policy:layering:${i + 1}`,
+      kind: "policy",
+      protected_finding: false,
+      note: rule
+    }),
+    id: `layering-${i + 1}`,
+    rule,
+    source: declared ? "review.toml" : "derived"
+  }));
+  const crossesLayers = addedEdges.some(
+    (e) => e.from_layer && e.to_layer && e.from_layer !== e.to_layer && !EXEMPT_LAYERS.has(e.from_layer) && !EXEMPT_LAYERS.has(e.to_layer)
+  );
+  if (policies.length === 0 && crossesLayers) {
+    unknowns.push("This change crosses a layer boundary and no layering rules are enforced for this repository \u2014 set `target_pattern` in .vibgrate/review.toml to declare one.");
+  }
+  if (patterns.unknown && crossesLayers) {
+    unknowns.push("This change crosses a layer boundary and neither a declared target pattern nor an observed dominant pattern could be established \u2014 alignment is reported as unknown, not as a pass.");
+  }
+  const paths = addedEdges.filter((e) => e.from_layer && e.to_layer && e.from_layer !== e.to_layer).filter((e) => !EXEMPT_LAYERS.has(e.from_layer) && !EXEMPT_LAYERS.has(e.to_layer)).map((e) => ({
+    evidence_id: e.evidence_id,
+    from: e.from_path,
+    to: e.to_path,
+    hops: [e.from_layer, e.to_layer],
+    // Guard observation needs taint/authorization analysis this slice does
+    // not run. `null` says "not observed" — never `true`.
+    guarded: null
+  }));
+  if (paths.length > 0) {
+    unknowns.push("Guard presence along the changed call paths was not observed \u2014 no runtime authorization test was supplied.");
+  }
+  const verification = changedFileCoverage(graph, changedPaths).map((v, i) => ({
+    evidence_id: addEvidence({
+      id: `verify:${v.kind}:${i + 1}`,
+      kind: "graph_node",
+      path: v.path,
+      protected_finding: false,
+      note: v.detail
+    }),
+    kind: v.kind,
+    path: v.path,
+    detail: v.detail
+  }));
+  const areas = graph ? graph.areas.map((a) => ({
+    id: a.id,
+    label: a.label,
+    size: a.size,
+    changed_members: a.members.filter((m) => changedNodeIds.has(m)).length
+  })).filter((a) => a.changed_members > 0).sort((a, b) => b.changed_members - a.changed_members).slice(0, 8) : [];
+  const capsule = {
+    schema_version: CAPSULE_SCHEMA,
+    identity: {
+      repo_pseudonym: input.repoPseudonym,
+      language: dominantLanguage(graph, change),
+      graph_schema: graph?.schemaVersion ?? "none",
+      analyzer_versions: { graph: graph?.provenance.version ?? "none", scanners: VERSION },
+      profile
+    },
+    change: {
+      base_sha: change.baseSha,
+      head_sha: change.headSha,
+      dirty: change.dirty,
+      dirty_tree_hash: change.dirtyTreeHash,
+      symbols,
+      ops: change.files.map((f) => ({
+        path: normalize3(f.path),
+        op: f.op,
+        added_lines: f.addedLines,
+        removed_lines: f.removedLines
+      })),
+      added_edges: addedEdges,
+      removed_edges: removedEdges,
+      contract_changes: []
+    },
+    roles,
+    areas,
+    patterns,
+    paths,
+    security: [],
+    policies,
+    verification,
+    evidence
+  };
+  const budget = CAPSULE_BUDGETS[profile];
+  const trimmed = trimToBudget(capsule, budget.cap);
+  return {
+    capsule,
+    votes,
+    dataAccess,
+    unknowns,
+    estimatedTokens: estimateTokens(capsule),
+    budget,
+    trimmed
+  };
+}
+function trimToBudget(capsule, cap) {
+  let trimmed = false;
+  const drop = () => {
+    if (capsule.roles.some((r) => !r.changed)) {
+      const keep = new Set(capsule.roles.filter((r) => r.changed).map((r) => r.evidence_id));
+      const dropped = capsule.roles.filter((r) => !r.changed).map((r) => r.evidence_id);
+      capsule.roles = capsule.roles.filter((r) => r.changed || keep.has(r.evidence_id));
+      capsule.evidence = capsule.evidence.filter((e) => !dropped.includes(e.id) || e.protected_finding);
+      return true;
+    }
+    if (capsule.areas.length > 0) {
+      capsule.areas = [];
+      return true;
+    }
+    return false;
+  };
+  while (estimateTokens(capsule) > cap) {
+    if (!drop()) break;
+    trimmed = true;
+  }
+  return trimmed;
+}
+function observedDominantPattern(roles) {
+  const layers = new Set(roles.map((r) => r.layer).filter((l) => !EXEMPT_LAYERS.has(l)));
+  if (layers.has("domain") && (layers.has("data-access") || layers.has("infrastructure")) && layers.has("services")) {
+    return "clean";
+  }
+  if (layers.size >= 3) return "layered";
+  return null;
+}
+function dominantLanguage(graph, change) {
+  if (graph && graph.meta.languages.length > 0) return graph.meta.languages[0];
+  const counts = /* @__PURE__ */ new Map();
+  for (const f of change.files) {
+    const ext = f.path.split(".").pop() ?? "";
+    counts.set(ext, (counts.get(ext) ?? 0) + 1);
+  }
+  const top = [...counts.entries()].sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1))[0];
+  return top?.[0] ?? "unknown";
+}
+function changedFileCoverage(graph, changedPaths) {
+  if (!graph) return [];
+  const testedFiles = /* @__PURE__ */ new Set();
+  const nodeById = new Map(graph.nodes.map((n) => [n.id, n]));
+  for (const edge of graph.edges) {
+    if (edge.kind !== "test" && edge.kind !== "coverage") continue;
+    const dst = nodeById.get(edge.dst);
+    if (dst) testedFiles.add(normalize3(dst.file));
+  }
+  const out2 = [];
+  for (const path53 of [...changedPaths].sort()) {
+    if (/(^|\/)(__tests__|tests?|spec)\//i.test(path53) || /\.(test|spec)\.[^.]+$/i.test(path53)) continue;
+    out2.push(
+      testedFiles.has(path53) ? { kind: "test_covering_change", path: path53, detail: "a test edge reaches this file" } : { kind: "no_test_covering_change", path: path53, detail: "no test edge reaches this file in the map" }
+    );
+  }
+  return out2.slice(0, 25);
+}
+function repoPseudonym(remote, root3) {
+  return digestString(`vg.review.pseudonym\0${remote ?? `local:${root3}`}`);
+}
+var REVIEW_CONFIG_PATH = ".vibgrate/review.toml";
+var DEFAULT_REVIEW_CONFIG = {
+  enforcement: "advisory",
+  fail_on: "fail",
+  target_pattern: null,
+  approved_exceptions: [],
+  protected: {
+    unguarded_entrypoint: true,
+    known_vulnerable_dependency: true,
+    validated_taint: true
+  },
+  high_confidence_threshold: 0.8,
+  high_severity_decision: "fail",
+  source: "defaults"
+};
+function bool(value, fallback) {
+  return typeof value === "boolean" ? value : fallback;
+}
+function str(value, allowed, fallback) {
+  return typeof value === "string" && allowed.includes(value) ? value : fallback;
+}
+function parseReviewConfig(text, source) {
+  const doc = parseToml(text);
+  if (!doc) return { ...DEFAULT_REVIEW_CONFIG, source };
+  const review = doc.review ?? {};
+  const prot = review.protected ?? {};
+  const exceptions = Array.isArray(review.approved_exceptions) ? review.approved_exceptions.filter((e) => typeof e === "string") : [];
+  const threshold = typeof review.high_confidence_threshold === "number" ? Math.min(1, Math.max(0, review.high_confidence_threshold)) : DEFAULT_REVIEW_CONFIG.high_confidence_threshold;
+  return {
+    enforcement: str(review.enforcement, ["advisory", "enforced"], DEFAULT_REVIEW_CONFIG.enforcement),
+    fail_on: str(review.fail_on, ["none", "fail", "needs_review"], DEFAULT_REVIEW_CONFIG.fail_on),
+    target_pattern: typeof review.target_pattern === "string" ? review.target_pattern : null,
+    approved_exceptions: exceptions,
+    protected: {
+      unguarded_entrypoint: bool(prot.unguarded_entrypoint, DEFAULT_REVIEW_CONFIG.protected.unguarded_entrypoint),
+      known_vulnerable_dependency: bool(
+        prot.known_vulnerable_dependency,
+        DEFAULT_REVIEW_CONFIG.protected.known_vulnerable_dependency
+      ),
+      validated_taint: bool(prot.validated_taint, DEFAULT_REVIEW_CONFIG.protected.validated_taint)
+    },
+    high_confidence_threshold: threshold,
+    high_severity_decision: str(
+      review.high_severity_decision,
+      ["fail", "needs_review"],
+      DEFAULT_REVIEW_CONFIG.high_severity_decision
+    ),
+    source
+  };
+}
+function loadReviewConfig(root3, base, run) {
+  const fromRef = (ref) => {
+    const res = run(["show", `${ref}:${REVIEW_CONFIG_PATH}`], root3);
+    return res.status === 0 && res.stdout.trim() ? res.stdout : null;
+  };
+  if (base) {
+    const text = fromRef(base);
+    if (text) return parseReviewConfig(text, "base-branch");
+  }
+  const head = fromRef("HEAD");
+  if (head) return parseReviewConfig(head, "head");
+  const local = path51.join(root3, REVIEW_CONFIG_PATH);
+  if (fs12.existsSync(local)) {
+    try {
+      return parseReviewConfig(fs12.readFileSync(local, "utf8"), "working-tree");
+    } catch {
+    }
+  }
+  return { ...DEFAULT_REVIEW_CONFIG };
+}
+
+// src/review/layers.ts
+var LAYERED_STACK = [
+  "presentation",
+  "routing",
+  "middleware",
+  "services",
+  "domain",
+  "data-access",
+  "infrastructure"
+];
+var RANK = new Map(LAYERED_STACK.map((l, i) => [l, i]));
+var SKIP_PROFILES = /* @__PURE__ */ new Set(["layered", "mvc", "mvvm"]);
+var CLEAN_PROFILES = /* @__PURE__ */ new Set(["clean", "hexagonal", "onion"]);
+var OUTER_LAYERS = /* @__PURE__ */ new Set(["presentation", "routing", "middleware"]);
+var PERSISTENCE_LAYERS = /* @__PURE__ */ new Set(["data-access", "infrastructure"]);
+var NO_SKIP = { skipped: false, bypassed: [], rule: "" };
+function evaluateLayerSkip(profile, from, to) {
+  if (CLEAN_PROFILES.has(profile)) {
+    if (OUTER_LAYERS.has(from) && PERSISTENCE_LAYERS.has(to)) {
+      return {
+        skipped: true,
+        bypassed: ["services"],
+        rule: `${profile}:outer-ring:${from}\u2192${to}`
+      };
+    }
+    return NO_SKIP;
+  }
+  if (!SKIP_PROFILES.has(profile)) return NO_SKIP;
+  const a = RANK.get(from);
+  const b = RANK.get(to);
+  if (a === void 0 || b === void 0) return NO_SKIP;
+  if (b <= a + 1) return NO_SKIP;
+  const bypassed = LAYERED_STACK.slice(a + 1, b).filter((l) => l !== "domain");
+  if (bypassed.length === 0) return NO_SKIP;
+  return { skipped: true, bypassed, rule: `${profile}:skip:${from}\u2192${to}` };
+}
+
+// src/review/scanners.ts
+var EXEMPT_LAYERS2 = /* @__PURE__ */ new Set(["config", "shared", "testing"]);
+var DEPENDENCY_MANIFESTS = /(^|\/)(package\.json|pnpm-lock\.yaml|package-lock\.json|yarn\.lock|.*\.csproj|packages\.lock\.json|Directory\.Packages\.props|requirements.*\.txt|pyproject\.toml|poetry\.lock|go\.mod|go\.sum|Cargo\.toml|Cargo\.lock|pom\.xml|build\.gradle(\.kts)?|Gemfile(\.lock)?|composer\.(json|lock))$/i;
+var GUARD_PATTERNS = [
+  /\b(authorize|authorise|authenticate|requireAuth|requireUser|ensureAuth|checkPermission|hasPermission|can|verifyToken|verifyJwt|assertScope|requireScope|guard)\s*\(/i,
+  /\[\s*Authorize\b/,
+  // C# attribute
+  /@(PreAuthorize|Secured|RolesAllowed|UseGuards)\b/,
+  // Spring / Nest
+  /\buse(Auth|Guard|Session)\b/,
+  /\b(csrf|rateLimit|validateRequest|zod|schema)\.(parse|safeParse|validate)\s*\(/i
+];
+var ENTRYPOINT_LAYERS = /* @__PURE__ */ new Set(["routing", "middleware"]);
+var ENTRYPOINT_ROLES = /* @__PURE__ */ new Set(["controller", "handler", "router"]);
+function alignment(capsule, fromLayer, toLayer) {
+  const pair = `${fromLayer}->${toLayer}`;
+  if (capsule.patterns.approved_exceptions.includes(pair)) return "approved_exception";
+  if (capsule.patterns.unknown) return "unknown";
+  if (capsule.patterns.declared_target_pattern) return "regression";
+  return "legacy_consistent";
+}
+function runScanners(input) {
+  const { capsule, config } = input;
+  const architecture = [];
+  const security = [];
+  const unknowns = [];
+  const requiredChecks = [];
+  const profile = capsule.patterns.declared_target_pattern ?? capsule.patterns.observed_dominant_pattern;
+  if (profile) {
+    let n = 0;
+    for (const edge of capsule.change.added_edges) {
+      const from = edge.from_layer;
+      const to = edge.to_layer;
+      if (!from || !to) continue;
+      if (EXEMPT_LAYERS2.has(from) || EXEMPT_LAYERS2.has(to)) continue;
+      const illegal = evaluateLayerBoundary(profile, from, to, edge.from_path, edge.to_path);
+      const skip = capsule.patterns.declared_target_pattern ? evaluateLayerSkip(profile, from, to) : { skipped: false, bypassed: []};
+      if (!illegal.illegal && !skip.skipped) continue;
+      const align = alignment(capsule, from, to);
+      const declared = Boolean(capsule.patterns.declared_target_pattern);
+      n++;
+      architecture.push({
+        id: `arch-${String(n).padStart(2, "0")}`,
+        kind: "boundary_bypass",
+        // A declared target makes this a regression against a stated intent;
+        // without one it is an observation about the repo's own majority.
+        severity: declared ? "high" : "medium",
+        confidence: declared ? 0.93 : 0.6,
+        claim: skip.skipped ? `A changed ${from} file depends directly on ${to}, skipping ${skip.bypassed.join(", ")} (${edge.from_path} \u2192 ${edge.to_path}).` : `A changed ${from} file depends on ${to}, against the ${illegal.rule} rule (${edge.from_path} \u2192 ${edge.to_path}).`,
+        evidence_ids: [edge.evidence_id, ...policyEvidenceIds(capsule)],
+        target_alignment: align,
+        remediation: `Route the operation through the ${intermediateLayer(from, to)} layer instead of calling ${to} directly.`,
+        paths: [edge.from_path, edge.to_path],
+        protected_finding: false,
+        source: "scanner"
+      });
+    }
+  }
+  let sec = 0;
+  if (config.protected.unguarded_entrypoint) {
+    for (const [filePath, lines] of [...input.removedLines.entries()].sort()) {
+      const removedGuards = lines.filter((l) => GUARD_PATTERNS.some((p) => p.test(l)));
+      if (removedGuards.length === 0) continue;
+      const stillGuarded = GUARD_PATTERNS.some((p) => p.test(input.fileText.get(filePath) ?? ""));
+      if (stillGuarded) continue;
+      sec++;
+      security.push({
+        id: `sec-${String(sec).padStart(2, "0")}`,
+        kind: "guard_removed",
+        severity: "high",
+        confidence: 0.9,
+        claim: `An authorization or validation guard was removed from ${filePath} and no equivalent guard remains in the file.`,
+        evidence_ids: [roleEvidenceFor(capsule, filePath) ?? sourceSpanEvidence(capsule, filePath)],
+        target_alignment: "regression",
+        remediation: "Restore the guard, or move it to a middleware the changed path provably passes through.",
+        paths: [filePath],
+        protected_finding: true,
+        source: "scanner"
+      });
+    }
+  }
+  if (config.protected.unguarded_entrypoint) {
+    const classified = [];
+    for (const [filePath, text] of [...input.fileText.entries()].sort()) {
+      for (const route of routesForFile(filePath, text)) classified.push(classifyRoute(route));
+    }
+    for (const [filePath, text] of [...input.peerFileText?.entries() ?? []].sort()) {
+      if (input.fileText.has(filePath)) continue;
+      for (const route of routesForFile(filePath, text)) classified.push(classifyRoute(route));
+    }
+    const changedFiles = input.changedPaths ?? /* @__PURE__ */ new Set();
+    for (const vote of voteAllAuth(classified)) {
+      for (const route of vote.deviators) {
+        if (!changedFiles.has(route.file)) continue;
+        sec++;
+        security.push({
+          id: `sec-${String(sec).padStart(2, "0")}`,
+          kind: "unguarded_entrypoint",
+          severity: vote.aboveFloor ? "high" : "medium",
+          confidence: vote.aboveFloor ? Math.min(0.95, vote.share) : 0.5,
+          claim: `${route.method} ${route.path || route.file} has no authorization guard in scope, while ${vote.guarded} of ${vote.classified} mutating routes in ${vote.group} do (${route.rule}).`,
+          evidence_ids: [roleEvidenceFor(capsule, route.file) ?? sourceSpanEvidence(capsule, route.file)],
+          target_alignment: "regression",
+          remediation: "Add an authorization check, or register the route behind a middleware it provably passes through.",
+          paths: [route.file],
+          // Below the peer floor this is a real observation but not a claim
+          // strong enough to block a merge, so it must not be protected.
+          protected_finding: vote.aboveFloor,
+          source: "scanner"
+        });
+        if (vote.aboveFloor) requiredChecks.push("authz-test");
+      }
+      const changedUnsure = vote.unsure.filter((r) => changedFiles.has(r.file));
+      if (changedUnsure.length > 0) {
+        unknowns.push(
+          `${changedUnsure.length} changed route(s) in ${vote.group} could not be classified as guarded or open (${[...new Set(changedUnsure.map((r) => r.rule))].join(", ")}) \u2014 neither confirmed nor excluded.`
+        );
+      }
+    }
+  }
+  const dependencyChanges = capsule.change.ops.filter((o) => DEPENDENCY_MANIFESTS.test(o.path));
+  if (config.protected.known_vulnerable_dependency && dependencyChanges.length > 0) {
+    if (input.vulnerablePackages === null) {
+      unknowns.push(
+        `${dependencyChanges.length} dependency manifest(s) changed and no advisory data was available \u2014 run \`vg scan --vulns\` so \`vg review\` can check them.`
+      );
+      requiredChecks.push("dependency-advisory-check");
+    } else {
+      for (const vuln of input.vulnerablePackages) {
+        const declaredIn = dependencyChanges.find(
+          (o) => (input.fileText.get(o.path) ?? "").includes(vuln.package)
+        );
+        if (!declaredIn) continue;
+        sec++;
+        security.push({
+          id: `sec-${String(sec).padStart(2, "0")}`,
+          kind: "known_vulnerable_dependency",
+          severity: "high",
+          confidence: 1,
+          claim: `A changed dependency manifest declares ${vuln.package}, which has a known advisory: ${vuln.detail}`,
+          evidence_ids: [dependencyEvidence(capsule, declaredIn.path)],
+          target_alignment: "regression",
+          remediation: "Upgrade to a fixed version, or record a scoped, expiry-bound exception.",
+          paths: [declaredIn.path],
+          protected_finding: true,
+          source: "scanner"
+        });
+      }
+    }
+  }
+  const hasTaintSurface = capsule.paths.length > 0 || capsule.roles.some(
+    (r) => r.changed && (ENTRYPOINT_ROLES.has(r.role) || ENTRYPOINT_LAYERS.has(r.layer))
+  );
+  if (config.protected.validated_taint && hasTaintSurface) {
+    unknowns.push("This change touches an entrypoint or a cross-layer path and taint validation was not run \u2014 dataflow analysis is not part of this review slice, so tainted-input findings are neither confirmed nor excluded.");
+  }
+  for (const vote of input.votes ?? []) {
+    if (vote.reason !== "dominant" || !vote.dominant) continue;
+    const changedDeviators = vote.deviators.filter((p) => input.changedPaths?.has(p));
+    if (changedDeviators.length === 0) continue;
+    for (const filePath of changedDeviators) {
+      const actual = input.dataAccess?.get(filePath);
+      if (!actual) continue;
+      if (!isRegression(actual, vote.dominant)) continue;
+      const declared = Boolean(capsule.patterns.declared_target_pattern);
+      architecture.push({
+        id: `arch-${String(architecture.length + 1).padStart(2, "0")}`,
+        kind: "peer_deviation",
+        severity: declared ? "high" : "medium",
+        // The vote's own share is the calibration: a 100%-consistent group of
+        // 20 peers is far stronger evidence than a bare 70% of 3.
+        confidence: Math.min(0.95, vote.share * Math.min(1, vote.size / 8)),
+        claim: `${filePath} ${describePattern(actual)}, while ${(vote.share * 100).toFixed(0)}% of its ${vote.size} ${vote.groupKind} peers ${describePattern(vote.dominant)}.`,
+        evidence_ids: [`vote:${vote.group}`, ...policyEvidenceIds(capsule)].filter(
+          (id) => capsule.evidence.some((e) => e.id === id)
+        ),
+        target_alignment: alignment(capsule, void 0, void 0),
+        remediation: `Follow the pattern its peers use \u2014 see ${vote.exemplars.slice(0, 2).join(", ") || "the peer group"}.`,
+        paths: [filePath],
+        protected_finding: false,
+        source: "scanner"
+      });
+    }
+  }
+  if (input.similarity && input.changedBodies) {
+    const changedIds = new Set(input.changedBodies.map((b) => b.id));
+    const reported = /* @__PURE__ */ new Set();
+    for (const body of input.changedBodies) {
+      if (!isComparable(body.file)) continue;
+      const hits = input.similarity.find(body, changedIds).filter((h) => isComparable(h.file));
+      if (hits.length === 0) continue;
+      const key2 = `${body.file}:${body.name}`;
+      if (reported.has(key2)) continue;
+      reported.add(key2);
+      const best = hits[0];
+      architecture.push({
+        id: `arch-${String(architecture.length + 1).padStart(2, "0")}`,
+        kind: "duplicate_implementation",
+        severity: "medium",
+        confidence: Math.min(0.9, best.score),
+        claim: `${body.name} in ${body.file} is structurally ${(best.score * 100).toFixed(0)}% the same as ${best.name} in ${best.file}:${best.startLine}` + (hits.length > 1 ? ` (and ${hits.length - 1} other near-match(es))` : "") + ".",
+        evidence_ids: [duplicateEvidence(capsule, body, best)],
+        // Reusing what exists is what the architecture wants; this is a
+        // deviation from that, but never a *security* regression.
+        target_alignment: capsule.patterns.declared_target_pattern ? "regression" : "unknown",
+        remediation: `Call ${best.name} instead, or extract the shared behaviour if the two genuinely differ.`,
+        paths: [body.file, best.file],
+        protected_finding: false,
+        source: "scanner"
+      });
+    }
+  }
+  const untested = capsule.verification.filter((v) => v.kind === "no_test_covering_change");
+  if (untested.length > 0) {
+    architecture.push({
+      id: `arch-${String(architecture.length + 1).padStart(2, "0")}`,
+      kind: "unverified_change",
+      severity: "medium",
+      confidence: 0.7,
+      claim: `${untested.length} changed file(s) have no test edge reaching them in the code map.`,
+      evidence_ids: untested.slice(0, 8).map((v) => v.evidence_id),
+      target_alignment: "unknown",
+      remediation: "Add a test that exercises the changed call path, or point `vg build` at the coverage report that already covers it.",
+      paths: untested.map((v) => v.path).slice(0, 25),
+      protected_finding: false,
+      source: "scanner"
+    });
+    requiredChecks.push("changed-call-path-test");
+  }
+  return {
+    architecture,
+    security,
+    unknowns,
+    requiredChecks: [...new Set(requiredChecks)].sort()
+  };
+}
+function policyEvidenceIds(capsule) {
+  return capsule.policies.slice(0, 2).map((p) => p.evidence_id);
+}
+function roleEvidenceFor(capsule, filePath) {
+  return capsule.roles.find((r) => r.path === filePath)?.evidence_id ?? null;
+}
+function sourceSpanEvidence(capsule, filePath) {
+  const existing = capsule.evidence.find((e) => e.path === filePath);
+  if (existing) return existing.id;
+  const id = `source_span:${capsule.evidence.length + 1}`;
+  capsule.evidence.push({ id, kind: "source_span", path: filePath, protected_finding: true });
+  return id;
+}
+function duplicateEvidence(capsule, body, match) {
+  const id = `duplicate:${body.file}:${body.name}`;
+  if (!capsule.evidence.some((e) => e.id === id)) {
+    capsule.evidence.push({
+      id,
+      kind: "graph_node",
+      path: match.file,
+      start_line: match.startLine,
+      end_line: match.endLine,
+      protected_finding: false,
+      note: `${body.name} (${body.file}:${body.startLine}) ~= ${match.name} (${match.file}:${match.startLine})`
+    });
+  }
+  return id;
+}
+function dependencyEvidence(capsule, filePath) {
+  const existing = capsule.evidence.find((e) => e.kind === "dependency" && e.path === filePath);
+  if (existing) return existing.id;
+  const id = `dependency:${filePath}`;
+  capsule.evidence.push({ id, kind: "dependency", path: filePath, protected_finding: true });
+  return id;
+}
+function intermediateLayer(from, to) {
+  if (to === "data-access" || to === "infrastructure") return "application service";
+  if (from === "domain") return "port / interface";
+  return "service";
+}
+function removedLinesFromDiff(diff2) {
+  const map = /* @__PURE__ */ new Map();
+  let current = null;
+  for (const line of diff2.split("\n")) {
+    if (line.startsWith("--- ")) continue;
+    if (line.startsWith("+++ ")) {
+      const p = line.slice(4).trim();
+      current = p === "/dev/null" ? null : p.replace(/^b\//, "");
+      if (current && !map.has(current)) map.set(current, []);
+      continue;
+    }
+    if (current && line.startsWith("-") && !line.startsWith("---")) {
+      map.get(current).push(line.slice(1));
+    }
+  }
+  return map;
+}
+function vulnerablePackagesFromScan(root3) {
+  const file = path51.join(root3, ".vibgrate", "scan_result.json");
+  if (!fs12.existsSync(file)) return null;
+  try {
+    const artifact = JSON.parse(fs12.readFileSync(file, "utf8"));
+    const findings = (artifact.findings ?? []).filter((f) => f.ruleId === "vibgrate/vulnerability");
+    return findings.map((f) => ({
+      package: String(f.details?.package ?? f.location),
+      detail: f.message
+    }));
+  } catch {
+    return null;
+  }
+}
+
+// src/review/verify.ts
+var FORBIDDEN_CLAIMS = [
+  { pattern: /\b(is|are|remains?|stays?)\s+secure\b/i, label: "secure" },
+  { pattern: /\bno\s+vulnerabilit(y|ies)\b/i, label: "no vulnerability" },
+  { pattern: /\b(is|are)\s+safe\b/i, label: "safe" },
+  { pattern: /\b(is|are)\s+approved\b/i, label: "approved" },
+  { pattern: /\bvulnerability[- ]free\b/i, label: "vulnerability-free" }
+];
+var RUNTIME_CLAIM = /\b(at runtime|when (?:it |this )?runs|in production|will (?:always |never )?(?:throw|fail|return|execute)|executes?)\b/i;
+var UNCERTAINTY = /\b(may|might|could|appears?|likely|unlikely|not observed|unverified|no runtime|static(?:ally)?)\b/i;
+var SEVERITIES = /* @__PURE__ */ new Set(["low", "medium", "high", "critical"]);
+function verifyFinding(finding, domain, evidenceIds, errors, invalidEvidence) {
+  const where = `${domain} finding ${finding.id || "(no id)"}`;
+  if (typeof finding.id !== "string" || !finding.id) errors.push(`${where}: missing id`);
+  if (typeof finding.kind !== "string" || !finding.kind) errors.push(`${where}: missing kind`);
+  if (!SEVERITIES.has(finding.severity)) errors.push(`${where}: invalid severity "${String(finding.severity)}"`);
+  if (typeof finding.confidence !== "number" || finding.confidence < 0 || finding.confidence > 1) {
+    errors.push(`${where}: confidence must be a number in 0..1`);
+  }
+  if (typeof finding.claim !== "string" || !finding.claim.trim()) errors.push(`${where}: missing claim`);
+  if (!TARGET_ALIGNMENTS.includes(finding.target_alignment)) {
+    errors.push(`${where}: invalid target_alignment "${String(finding.target_alignment)}"`);
+  }
+  if (typeof finding.remediation !== "string" || !finding.remediation.trim()) {
+    errors.push(`${where}: missing remediation`);
+  }
+  if (!Array.isArray(finding.paths)) errors.push(`${where}: paths must be an array`);
+  if (!Array.isArray(finding.evidence_ids) || finding.evidence_ids.length === 0) {
+    errors.push(`${where}: claims a flow with no supporting graph or scanner fact`);
+    invalidEvidence.value = true;
+  } else {
+    for (const id of finding.evidence_ids) {
+      if (!evidenceIds.has(id)) {
+        errors.push(`${where}: cites evidence id "${id}" that is not in the capsule`);
+        invalidEvidence.value = true;
+      }
+    }
+  }
+  const prose = `${finding.claim ?? ""} ${finding.remediation ?? ""}`;
+  for (const { pattern, label } of FORBIDDEN_CLAIMS) {
+    if (pattern.test(prose)) errors.push(`${where}: makes the absolute claim "${label}"`);
+  }
+  if (RUNTIME_CLAIM.test(prose) && !UNCERTAINTY.test(prose)) {
+    errors.push(`${where}: asserts runtime behaviour without stating the uncertainty (nothing was executed)`);
+  }
+}
+function verifyFindings(findings, capsule) {
+  const errors = [];
+  const invalidEvidence = { value: false };
+  if (findings?.schema_version !== FINDINGS_SCHEMA) {
+    errors.push(`expected schema_version ${FINDINGS_SCHEMA}, got ${String(findings?.schema_version)}`);
+    return { schema_valid: false, evidence_ids_valid: false, errors };
+  }
+  if ("decision" in findings) {
+    errors.push("findings carry a `decision` field \u2014 only policy may decide");
+  }
+  if (!Array.isArray(findings.architecture_findings)) errors.push("architecture_findings must be an array");
+  if (!Array.isArray(findings.security_findings)) errors.push("security_findings must be an array");
+  if (!Array.isArray(findings.unknowns)) errors.push("unknowns must be an array");
+  if (!Array.isArray(findings.required_checks)) errors.push("required_checks must be an array");
+  if (!Array.isArray(findings.change_class)) errors.push("change_class must be an array");
+  const evidenceIds = new Set(capsule.evidence.map((e) => e.id));
+  for (const f of findings.architecture_findings ?? []) {
+    verifyFinding(f, "architecture", evidenceIds, errors, invalidEvidence);
+  }
+  for (const f of findings.security_findings ?? []) {
+    verifyFinding(f, "security", evidenceIds, errors, invalidEvidence);
+  }
+  const ids = [...findings.architecture_findings ?? [], ...findings.security_findings ?? []].map((f) => f.id);
+  const dupes = ids.filter((id, i) => ids.indexOf(id) !== i);
+  for (const id of new Set(dupes)) errors.push(`duplicate finding id "${id}"`);
+  return {
+    schema_valid: errors.length === 0,
+    evidence_ids_valid: !invalidEvidence.value,
+    errors
+  };
+}
+
+// src/review/run.ts
+function defaultRun2(args, cwd) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 2e4,
+    maxBuffer: 64 * 1024 * 1024,
+    windowsHide: true
+  });
+  return { stdout: res.stdout ?? "", status: res.status ?? 1 };
+}
+var NON_CODE = /\.(md|mdx|markdown|txt|rst|adoc|png|jpe?g|gif|svg|ico|webp|woff2?|ttf|eot|pdf|csv|snap|lock)$/i;
+var NON_CODE_DIRS = /(^|\/)(docs?|\.github\/ISSUE_TEMPLATE|changelog|marketing)\//i;
+var DEPENDENCY_MANIFEST = /(^|\/)(package\.json|pnpm-lock\.yaml|package-lock\.json|yarn\.lock|.*\.csproj|packages\.lock\.json|Directory\.Packages\.props|requirements.*\.txt|pyproject\.toml|poetry\.lock|go\.mod|go\.sum|Cargo\.toml|Cargo\.lock|pom\.xml|build\.gradle(\.kts)?|Gemfile(\.lock)?|composer\.(json|lock))$/i;
+var EXEMPT_LAYERS3 = /* @__PURE__ */ new Set(["config", "shared", "testing"]);
+function changeClassOf(capsule, findings) {
+  const classes = [];
+  const roleByPath = new Map(capsule.roles.filter((r) => r.changed).map((r) => [r.path, r]));
+  const architecturalPaths = capsule.change.ops.filter((op) => {
+    if (DEPENDENCY_MANIFEST.test(op.path)) return false;
+    if (NON_CODE.test(op.path) || NON_CODE_DIRS.test(op.path)) return false;
+    const role = roleByPath.get(op.path);
+    return role === void 0 || !EXEMPT_LAYERS3.has(role.layer);
+  });
+  if (findings.architecture > 0 || capsule.change.added_edges.length > 0 || architecturalPaths.length > 0) {
+    classes.push("architecture");
+  }
+  const dependencyChanges = capsule.change.ops.filter((op) => DEPENDENCY_MANIFEST.test(op.path));
+  if (findings.security > 0 || capsule.security.length > 0 || dependencyChanges.length > 0) {
+    classes.push("security");
+  }
+  return classes.length > 0 ? classes : ["none"];
+}
+async function runReview(opts) {
+  const root3 = path51.resolve(opts.root);
+  const run = opts.run ?? defaultRun2;
+  if (!isGitRepo(root3, run)) {
+    throw new CliError(
+      `\`vg review\` needs a git repository \u2014 ${root3} is not one (or git is not on PATH)`,
+      ExitCode.USAGE_ERROR
+    );
+  }
+  const change = collectChangeSet(root3, opts.base, run);
+  const repoRoot = change.topLevel;
+  const config = loadReviewConfig(repoRoot, opts.base, run);
+  const graph = loadGraph(root3, opts.graphPath);
+  if (!graph) {
+    throw new CliError(
+      "no code map found \u2014 run `vg` in this repository first, then `vg review`" + (opts.graphPath ? ` (looked at ${opts.graphPath})` : ""),
+      ExitCode.ENGINE_UNAVAILABLE
+    );
+  }
+  const recencyDays = fileRecencyDays(repoRoot, {}, run);
+  const intent = readDeclaredIntent(repoRoot);
+  const changedPathSet = new Set(change.files.map((f) => f.path.replace(/\\/g, "/")));
+  const fileText = /* @__PURE__ */ new Map();
+  for (const file of change.files) {
+    if (file.op === "removed") continue;
+    const abs = path51.join(repoRoot, file.path);
+    try {
+      const stat2 = fs12.statSync(abs);
+      if (stat2.isFile() && stat2.size <= 2 * 1024 * 1024) {
+        fileText.set(file.path.replace(/\\/g, "/"), fs12.readFileSync(abs, "utf8"));
+      }
+    } catch {
+    }
+  }
+  const baseFileText = readBaseFileTexts(change, run);
+  const profile = opts.base ? "ci-wide" : "interactive-narrow";
+  const compiled = compileCapsule({
+    graph,
+    change,
+    config,
+    profile,
+    repoPseudonym: repoPseudonym(change.remote, repoRoot),
+    recencyDays,
+    intent,
+    baseFileText,
+    headFileText: fileText
+  });
+  const capsule = compiled.capsule;
+  const diffArgs = opts.base ? ["diff", "-U3", "-M", `${change.baseSha}..HEAD`] : ["diff", "-U3", "-M", "HEAD"];
+  const removedLines = removedLinesFromDiff(run(diffArgs, repoRoot).stdout);
+  const peerFileText = /* @__PURE__ */ new Map();
+  const ROUTE_LAYERS = /* @__PURE__ */ new Set(["routing", "middleware", "presentation"]);
+  for (const node2 of graph.nodes) {
+    const rel = node2.file.replace(/\\/g, "/");
+    if (peerFileText.has(rel) || fileText.has(rel)) continue;
+    if (peerFileText.size >= 300) break;
+    const cls = classifyFile(rel, "unknown");
+    if (!cls || !ROUTE_LAYERS.has(cls.layer)) continue;
+    try {
+      const abs = path51.join(repoRoot, rel);
+      const stat2 = fs12.statSync(abs);
+      if (stat2.isFile() && stat2.size <= 512 * 1024) peerFileText.set(rel, fs12.readFileSync(abs, "utf8"));
+    } catch {
+    }
+  }
+  const similarity = new SimilarityIndex();
+  const changedBodies = [];
+  const FUNCTION_KINDS = /* @__PURE__ */ new Set(["function", "method"]);
+  const sourceCache = /* @__PURE__ */ new Map();
+  const linesOf = (rel) => {
+    if (sourceCache.has(rel)) return sourceCache.get(rel);
+    let value = null;
+    try {
+      const abs = path51.join(repoRoot, rel);
+      const stat2 = fs12.statSync(abs);
+      if (stat2.isFile() && stat2.size <= 1024 * 1024) value = fs12.readFileSync(abs, "utf8").split("\n");
+    } catch {
+      value = null;
+    }
+    sourceCache.set(rel, value);
+    return value;
+  };
+  for (const node2 of graph.nodes) {
+    if (!FUNCTION_KINDS.has(node2.kind)) continue;
+    const rel = node2.file.replace(/\\/g, "/");
+    if (!isComparable(rel)) continue;
+    const lines = linesOf(rel);
+    if (!lines) continue;
+    const text = lines.slice(node2.span.start - 1, node2.span.end).join("\n");
+    if (!text.trim()) continue;
+    const body = {
+      id: node2.id,
+      name: node2.name,
+      file: rel,
+      startLine: node2.span.start,
+      endLine: node2.span.end,
+      text
+    };
+    if (changedPathSet.has(rel)) changedBodies.push(body);
+    else similarity.add(body);
+  }
+  const scan = runScanners({
+    capsule,
+    config,
+    removedLines,
+    fileText,
+    vulnerablePackages: vulnerablePackagesFromScan(repoRoot),
+    votes: compiled.votes,
+    peerFileText,
+    similarity,
+    changedBodies,
+    dataAccess: compiled.dataAccess,
+    changedPaths: changedPathSet
+  });
+  let findings = {
+    schema_version: FINDINGS_SCHEMA,
+    change_class: changeClassOf(capsule, {
+      architecture: scan.architecture.length,
+      security: scan.security.length
+    }),
+    architecture_findings: scan.architecture,
+    security_findings: scan.security,
+    unknowns: [.../* @__PURE__ */ new Set([...compiled.unknowns, ...scan.unknowns])],
+    required_checks: scan.requiredChecks
+  };
+  let modelId = "none";
+  let quantization = null;
+  if (opts.explain) {
+    const explainImpl = opts.explainImpl ?? (await import('./explain-EXPJTCB5.js')).explainFindings;
+    const explained = await explainImpl(capsule, findings, { offline: opts.offline });
+    findings = explained.findings;
+    modelId = explained.model;
+    quantization = explained.quantization;
+  }
+  const verification = verifyFindings(findings, capsule);
+  const policy = applyReviewPolicy(capsule, findings, config, verification);
+  const createdAt = opts.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const capsuleDigest = digest(capsule);
+  const findingsDigest = digest(findings);
+  const evidenceDigest = digest(capsule.evidence);
+  const protectedCount = [...findings.architecture_findings, ...findings.security_findings].filter(
+    (f) => f.protected_finding === true
+  ).length;
+  const receipt = {
+    schema_version: RECEIPT_SCHEMA,
+    receipt_id: receiptId(Date.parse(createdAt) || 0, `${capsuleDigest}${findingsDigest}`),
+    created_at: createdAt,
+    workspace_id: opts.workspaceId ?? null,
+    repo: {
+      name: change.remote ? change.remote.split("/").slice(-2).join("/") : path51.basename(repoRoot),
+      remote: change.remote,
+      repo_key: repoKey(change.remote, repoRoot)
+    },
+    git: {
+      base_sha: change.baseSha,
+      head_sha: change.headSha,
+      merge_base: change.mergeBase,
+      ref: change.ref,
+      dirty: change.dirty,
+      dirty_tree_hash: change.dirtyTreeHash
+    },
+    decision: policy.decision,
+    enforcement: config.enforcement,
+    quick_path: policy.quickPath,
+    change_class: findings.change_class,
+    counts: {
+      architecture: findings.architecture_findings.length,
+      security: findings.security_findings.length,
+      protected: protectedCount,
+      unknowns: findings.unknowns.length
+    },
+    findings,
+    versions: {
+      cli: VERSION,
+      graph_schema: graph?.schemaVersion ?? "none",
+      policy: REVIEW_POLICY_VERSION,
+      model: modelId,
+      quantization,
+      capsule_schema: CAPSULE_SCHEMA
+    },
+    digests: {
+      capsule: capsuleDigest,
+      findings: findingsDigest,
+      evidence: evidenceDigest,
+      receipt: ""
+    },
+    verification: {
+      protected_false_bless: policy.protectedFalseBless,
+      schema_valid: verification.schema_valid,
+      evidence_ids_valid: verification.evidence_ids_valid
+    },
+    signature: null
+  };
+  receipt.digests.receipt = receiptDigest(receipt);
+  return {
+    receipt,
+    capsule,
+    config,
+    verification,
+    reasons: policy.reasons,
+    votes: compiled.votes,
+    intent: {
+      target: capsule.patterns.declared_target_pattern,
+      sources: intent.sources
+    },
+    repoRoot,
+    budget: {
+      estimatedTokens: compiled.estimatedTokens,
+      median: compiled.budget.median,
+      cap: compiled.budget.cap,
+      trimmed: compiled.trimmed
+    }
+  };
+}
+var CONTEXT_PATH = ".vibgrate/review-context.md";
+var BLOCK_START = "<!-- vibgrate:review-context:start -->";
+var BLOCK_END = "<!-- vibgrate:review-context:end -->";
+var MAX_CONVENTIONS = 8;
+var MAX_OPEN_FINDINGS = 10;
+function renderContext(input) {
+  const { receipt, votes, declaredTarget } = input;
+  const findings = [...receipt.findings.architecture_findings, ...receipt.findings.security_findings];
+  const lines = [];
+  lines.push("# Review context");
+  lines.push("");
+  lines.push(
+    "Generated by `vg review --write-context`. It records what Vibgrate Review knows about this repository so an agent does not have to rediscover it. Commit it."
+  );
+  lines.push("");
+  lines.push("## The architecture this repository is aiming at");
+  lines.push("");
+  if (declaredTarget) {
+    lines.push(`**Declared target: \`${declaredTarget}\`.**`);
+    if (input.intentSources.length > 0) {
+      lines.push("");
+      lines.push(`Declared in ${input.intentSources.map((s) => `\`${s}\``).join(", ")}.`);
+    }
+    lines.push("");
+    lines.push(
+      "Write new code to match this target, **not** to match whatever most of the existing code does. Where the two disagree, the target wins and the existing code is the thing being migrated."
+    );
+  } else {
+    lines.push("**No target architecture has been declared.**");
+    lines.push("");
+    lines.push(
+      "The conventions below are what the code currently does. They are an observation, not an instruction \u2014 they may be exactly what the team is trying to move away from. Set `target_pattern` in `.vibgrate/review.toml` to make the intended architecture explicit, and Review will hold changes to it."
+    );
+  }
+  lines.push("");
+  const decided = votes.filter((v) => v.reason === "dominant" && v.dominant).slice(0, MAX_CONVENTIONS);
+  lines.push("## What the existing code does");
+  lines.push("");
+  if (decided.length === 0) {
+    lines.push("No peer group was consistent enough to establish a convention.");
+  } else {
+    lines.push("| Peer group | Convention | Share | Follow the example in |");
+    lines.push("|---|---|---:|---|");
+    for (const vote of decided) {
+      lines.push(
+        `| \`${vote.group}\` | ${describePattern(vote.dominant)} | ${(vote.share * 100).toFixed(0)}% | ${vote.exemplars.slice(0, 2).map((e) => `\`${e}\``).join(", ") || "\u2014"} |`
+      );
+    }
+  }
+  const noConvention = votes.filter((v) => v.reason === "no_convention");
+  if (noConvention.length > 0) {
+    lines.push("");
+    lines.push(
+      `${noConvention.length} peer group(s) have **no** convention \u2014 the patterns are too evenly split for one to be normal. Pick the one that matches the declared target rather than copying the nearest file.`
+    );
+  }
+  lines.push("");
+  lines.push("## Open findings on the last reviewed change");
+  lines.push("");
+  lines.push(
+    `Decision: \`${receipt.decision}\` \xB7 ${receipt.counts.architecture} architecture \xB7 ${receipt.counts.security} security \xB7 ${receipt.counts.protected} protected \xB7 at \`${receipt.git.head_sha.slice(0, 8)}\`.`
+  );
+  lines.push("");
+  if (findings.length === 0) {
+    lines.push("None.");
+  } else {
+    for (const f of findings.slice(0, MAX_OPEN_FINDINGS)) {
+      const badge = f.protected_finding ? " **(protected \u2014 cannot be waived)**" : "";
+      lines.push(`- \`${f.kind}\`${badge} \u2014 ${f.claim} \u2192 ${f.remediation}`);
+    }
+    if (findings.length > MAX_OPEN_FINDINGS) {
+      lines.push(`- \u2026and ${findings.length - MAX_OPEN_FINDINGS} more (\`vg review\`).`);
+    }
+  }
+  lines.push("");
+  lines.push("## If you are an AI agent working in this repository");
+  lines.push("");
+  lines.push(
+    declaredTarget ? `1. Match the declared \`${declaredTarget}\` architecture above, even where existing code does not.` : "1. There is no declared architecture. Match the nearest convention above, and say so in your PR description."
+  );
+  lines.push("2. Before writing a new function, check whether one already does the job \u2014 `vg review` reports re-implementations.");
+  lines.push("3. A new mutating route needs an authorization guard unless the surrounding routes are deliberately public.");
+  lines.push("4. Run `vg review` before you finish. A `protected` finding cannot be waived \u2014 it must be fixed.");
+  lines.push("");
+  lines.push(
+    "<sub>Review reports change integrity. It does not prove code is secure, and absence of findings is not a certification.</sub>"
+  );
+  return lines.join("\n");
+}
+function writeContextFile(root3, input) {
+  const target = path51.join(root3, CONTEXT_PATH);
+  fs12.mkdirSync(path51.dirname(target), { recursive: true });
+  fs12.writeFileSync(target, `${renderContext(input)}
+`, "utf8");
+  return CONTEXT_PATH;
+}
+function injectContextBlock(existing, body) {
+  const block = `${BLOCK_START}
+${body}
+${BLOCK_END}`;
+  const startAt = existing.indexOf(BLOCK_START);
+  const endAt = existing.indexOf(BLOCK_END);
+  if (startAt !== -1 && endAt !== -1 && endAt > startAt) {
+    return existing.slice(0, startAt) + block + existing.slice(endAt + BLOCK_END.length);
+  }
+  const separator = existing.endsWith("\n") ? "\n" : "\n\n";
+  return `${existing}${separator}${block}
+`;
+}
+var PREPARE_LOCK_STALE_MS = 10 * 60 * 1e3;
+async function ensureCodeMap(opts) {
+  const { root: root3, graphPath } = opts;
+  const haveMap = loadGraph(root3, graphPath) !== null;
+  if (opts.autoBuild === false) {
+    return { action: haveMap ? "up-to-date" : "skipped", reason: haveMap ? void 0 : "auto-build disabled" };
+  }
+  if (graphPath) {
+    return { action: haveMap ? "up-to-date" : "skipped", reason: haveMap ? void 0 : "an explicit --graph path was given" };
+  }
+  const bar = opts.quiet ? void 0 : new ProgressBar("mapping the repository");
+  const onParseProgress = (done, total) => {
+    opts.onProgress?.(done, total);
+    bar?.update(done, total);
+  };
+  try {
+    if (haveMap) {
+      const outcome = await refreshIfStale(root3, { onParseProgress });
+      if (outcome.status === "refreshed") {
+        return { action: "refreshed", files: outcome.totalFiles, ms: outcome.ms };
+      }
+      if (outcome.status === "error") {
+        return { action: "skipped", reason: outcome.message };
+      }
+      return { action: "up-to-date" };
+    }
+    return await firstBuild(root3, onParseProgress);
+  } finally {
+    bar?.done();
+  }
+}
+async function firstBuild(root3, onParseProgress) {
+  const lock = path51.join(cacheDir(root3), "refresh.lock");
+  if (!acquireLock(lock, PREPARE_LOCK_STALE_MS)) {
+    return { action: "skipped", reason: "another vg process is building the map" };
+  }
+  const start = Date.now();
+  try {
+    const exclude = mergeExcludes(root3, void 0);
+    const result = await buildGraph({ root: root3, exclude, onParseProgress });
+    writeArtifacts(result.graph, { root: root3, html: false, report: false });
+    writeSnapshot(root3, result.graph.provenance.corpusHash, result.fileStats, { exclude });
+    return { action: "built", files: result.totalFiles, ms: Date.now() - start };
+  } catch (err) {
+    return { action: "skipped", reason: err.message };
+  } finally {
+    releaseLock(lock);
+  }
+}
+function reviewPolicyState(root3, base, run) {
+  const inRef = (ref) => {
+    const res = run(["show", `${ref}:${REVIEW_CONFIG_PATH}`], root3);
+    return res.status === 0 && res.stdout.trim().length > 0;
+  };
+  if (inRef("HEAD")) return { present: true, where: "head" };
+  if (fs12.existsSync(path51.join(root3, REVIEW_CONFIG_PATH))) {
+    return { present: true, where: "working-tree" };
+  }
+  return { present: false, where: null };
+}
+function seedReviewPolicy(opts) {
+  const target = path51.join(opts.root, REVIEW_CONFIG_PATH);
+  const pattern = opts.observedPattern ?? null;
+  if (fs12.existsSync(target)) return { written: false, path: REVIEW_CONFIG_PATH, targetPattern: pattern };
+  fs12.mkdirSync(path51.dirname(target), { recursive: true });
+  fs12.writeFileSync(target, renderReviewPolicy(pattern), "utf8");
+  return { written: true, path: REVIEW_CONFIG_PATH, targetPattern: pattern };
+}
+function renderReviewPolicy(observedPattern) {
+  const lines = [
+    "# Vibgrate Review policy \u2014 written by `vg review` on its first run.",
+    "# Commit this file: Review reads it from the *base branch*, so a pull",
+    "# request cannot weaken the policy that judges it.",
+    "",
+    "[review]",
+    '# "advisory" reports without ever gating. Switch to "enforced" when you',
+    "# want `fail_on` to decide the exit code in CI.",
+    'enforcement = "advisory"',
+    'fail_on = "fail"',
+    ""
+  ];
+  if (observedPattern) {
+    lines.push(
+      `# Derived from the layering this repository already exhibits. Change it`,
+      `# to the shape you want \u2014 Review judges changes against this, not against`,
+      `# the majority.`,
+      `target_pattern = "${observedPattern}"`
+    );
+  } else {
+    lines.push(
+      "# No single layering shape dominates this repository yet, so nothing is",
+      '# declared. Set one (e.g. "clean", "layered", "hexagonal") to have Review',
+      "# judge layer traversals instead of reporting them as unknown.",
+      '# target_pattern = "clean"'
+    );
+  }
+  lines.push(
+    "",
+    "# Layer pairs an author may traverse without it counting as a regression.",
+    "approved_exceptions = []",
+    "",
+    "# Protected findings can never be blessed into a pass.",
+    "[review.protected]",
+    "unguarded_entrypoint = true",
+    "known_vulnerable_dependency = true",
+    "validated_taint = true",
+    ""
+  );
+  return `${lines.join("\n")}`;
+}
+
+// src/commands/review.ts
+var FORMATS = ["text", "json", "sarif", "md"];
+function registerReview(program) {
+  const cmd = program.command("review").description("Vibgrate Review \u2014 architecture + security-control review of the current change, locally").option("--base <ref>", "review HEAD against the merge-base with <ref> (e.g. origin/main)").option("--format <fmt>", `output format (${FORMATS.join(" | ")})`, "text").option("-o, --out <file>", "write the formatted result to a file").option("--push", "send the receipt to Vibgrate Cloud (needs a DSN)").option(
+    "--fail-on <level>",
+    'gate CI on this decision level (none | fail | needs_review). Omit to use .vibgrate/review.toml; gating is off unless enforcement = "enforced"'
+  ).option("--explain", "add local-model explanations (requires a local model; fails closed without one)").option("--dsn <dsn>", "DSN token for --push (or use VIBGRATE_DSN / `vg login`)").option("--strict", "fail the command when --push fails").option("--include-spans", "include evidence line ranges in the pushed receipt").option("--include-snippets", "include capped source snippets in the pushed receipt (explicit opt-in)").option("--no-auto-build", "do not build or refresh the code map \u2014 fail with exit 6 when it is missing or stale").option("--no-setup", "do not write a starter .vibgrate/review.toml when the repository has no review policy").option("--write-context", "write .vibgrate/review-context.md \u2014 committed agent memory").option(
+    "--inject-context [file]",
+    "update the managed review block inside an instruction file (default: CLAUDE.md)"
+  ).action(async function(opts) {
+    const global = readGlobal(this);
+    const root3 = rootOf(global);
+    if (!FORMATS.includes(opts.format)) {
+      throw new CliError(`unknown --format "${opts.format}" (expected ${FORMATS.join(", ")})`, ExitCode.USAGE_ERROR);
+    }
+    const prepared = await ensureCodeMap({
+      root: root3,
+      graphPath: global.graph,
+      autoBuild: opts.autoBuild,
+      quiet: Boolean(global.quiet) || Boolean(global.json)
+    });
+    reportPrepare(prepared, Boolean(global.quiet) || Boolean(global.json));
+    const result = await runReview({
+      root: root3,
+      base: opts.base,
+      explain: opts.explain,
+      offline: global.offline,
+      graphPath: global.graph,
+      generatedAt: global.generatedAt
+    });
+    if (opts.failOn && !FAIL_ON_LEVELS.includes(opts.failOn)) {
+      throw new CliError(
+        `unknown --fail-on "${opts.failOn}" (expected ${FAIL_ON_LEVELS.join(", ")})`,
+        ExitCode.USAGE_ERROR
+      );
+    }
+    const failOn = resolveFailOn(opts.failOn, result.config);
+    const format = global.json ? "json" : opts.format;
+    const rendered = render(result, format);
+    if (opts.out) {
+      const target = path51.resolve(root3, opts.out);
+      fs12.mkdirSync(path51.dirname(target), { recursive: true });
+      fs12.writeFileSync(target, `${rendered}
+`, "utf8");
+      if (!global.quiet) {
+        info(formatText(result));
+        info(c.dim(`  ${format} written to ${opts.out}`));
+      }
+    } else if (format === "text") {
+      if (!global.quiet) info(rendered);
+    } else {
+      out(rendered);
+    }
+    maybeSeedPolicy(result, opts, Boolean(global.quiet) || Boolean(global.json));
+    if (opts.writeContext || opts.injectContext) writeAgentContext(result, opts, Boolean(global.quiet));
+    if (opts.push) {
+      rejectPushWhenOffline(global.offline);
+      await doPush(root3, result, opts, Boolean(global.quiet));
+    }
+    const code = exitCodeForDecision(result.receipt.decision, failOn);
+    if (code !== 0) {
+      info(c.red(`
+Failing: review decision is \`${result.receipt.decision}\` and the gate is \`${failOn}\`.`));
+      process.exitCode = code;
+    }
+  });
+  applyGlobalOptions(cmd);
+  const explain = cmd.command("explain").description("show the evidence behind one finding from the current change").argument("<finding-id>", "a finding id from the last `vg review` run (e.g. arch-01)").option("--base <ref>", "review HEAD against the merge-base with <ref>").action(async function(findingId, opts) {
+    const global = readGlobal(this);
+    const explainRoot = rootOf(global);
+    reportPrepare(
+      await ensureCodeMap({
+        root: explainRoot,
+        graphPath: global.graph,
+        quiet: Boolean(global.quiet) || Boolean(global.json)
+      }),
+      Boolean(global.quiet) || Boolean(global.json)
+    );
+    const result = await runReview({
+      root: explainRoot,
+      base: opts.base,
+      offline: global.offline,
+      graphPath: global.graph,
+      generatedAt: global.generatedAt
+    });
+    const text = formatExplain(result, findingId);
+    if (!text) {
+      throw new CliError(
+        `no finding "${findingId}" in this change set \u2014 run \`vg review\` to list the current findings`,
+        ExitCode.NOT_FOUND
+      );
+    }
+    if (global.json) {
+      const all = [...result.receipt.findings.architecture_findings, ...result.receipt.findings.security_findings];
+      const finding = all.find((f) => f.id === findingId);
+      out(
+        JSON.stringify(
+          {
+            finding,
+            evidence: result.capsule.evidence.filter((e) => finding.evidence_ids.includes(e.id))
+          },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    info(text);
+  });
+  applyGlobalOptions(explain);
+}
+function reportPrepare(prepared, quiet) {
+  if (quiet) return;
+  const secs = prepared.ms === void 0 ? "" : ` in ${(prepared.ms / 1e3).toFixed(1)}s`;
+  if (prepared.action === "built") {
+    info(c.dim(`  code map built \u2014 ${prepared.files} files${secs}`));
+  } else if (prepared.action === "refreshed") {
+    info(c.dim(`  code map refreshed \u2014 ${prepared.files} files${secs}`));
+  } else if (prepared.action === "skipped" && prepared.reason) {
+    info(c.yellow(`  code map not built: ${prepared.reason}`));
+  }
+}
+function maybeSeedPolicy(result, opts, quiet) {
+  if (opts.setup === false || opts.base) return;
+  if (result.config.source !== "defaults") return;
+  if (reviewPolicyState(result.repoRoot, void 0, defaultRun).present) return;
+  const seeded = seedReviewPolicy({
+    root: result.repoRoot,
+    observedPattern: result.capsule.patterns.observed_dominant_pattern
+  });
+  if (!seeded.written || quiet) return;
+  info(
+    c.green(`
+  Review baseline ready \u2014 wrote ${seeded.path}`) + c.dim(
+      seeded.targetPattern ? `
+  target_pattern = "${seeded.targetPattern}" (derived from this repository). Edit it, commit it,
+  and future changes are judged against a declared architecture rather than a guess.` : "\n  No layering shape dominates yet, so target_pattern is left commented out.\n  Set one and commit the file to have future changes judged against it."
+    )
+  );
+}
+function render(result, format) {
+  if (format === "json") return JSON.stringify(result.receipt, null, 2);
+  if (format === "sarif") return formatSarif(result.receipt);
+  if (format === "md") return formatMarkdown(result);
+  return formatText(result);
+}
+async function doPush(root3, result, opts, quiet) {
+  const dsn = resolveDsn(opts.dsn);
+  if (!dsn) {
+    const message = "no DSN for --push \u2014 run `vg login`, set VIBGRATE_DSN, or pass --dsn";
+    if (opts.strict) throw new CliError(message, ExitCode.USAGE_ERROR);
+    info(c.yellow(`  ${message}`));
+    return;
+  }
+  const parsed = parseDsn$1(dsn);
+  if (!parsed) {
+    const message = "invalid DSN format (expected vibgrate+https://<key>:<secret>@<host>/<workspace>)";
+    if (opts.strict) throw new CliError(message, ExitCode.USAGE_ERROR);
+    info(c.yellow(`  ${message}`));
+    return;
+  }
+  const envelope = buildEnvelope(result.receipt, {
+    workspaceId: parsed.workspaceId,
+    pushedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  const body = { ...envelope };
+  const spans = collectSpans(root3, result.receipt, result.capsule, {
+    includeSpans: opts.includeSpans,
+    includeSnippets: opts.includeSnippets
+  });
+  if (spans) body.spans = spans;
+  const res = await pushReceipt(parsed, body);
+  if (!res.ok) {
+    const message = `push failed (${res.status}) \u2014 ${res.detail ?? ""}`;
+    if (opts.strict) throw new CliError(message, ExitCode.ERROR);
+    info(c.yellow(`  ${message}`));
+    return;
+  }
+  if (!quiet) info(c.green("\u2714") + ` receipt pushed to ${res.host}`);
+}
+function writeAgentContext(result, opts, quiet) {
+  const input = {
+    receipt: result.receipt,
+    votes: result.votes,
+    declaredTarget: result.intent.target,
+    intentSources: result.intent.sources
+  };
+  if (opts.writeContext) {
+    const written = writeContextFile(result.repoRoot, input);
+    if (!quiet) info(c.dim(`  agent context written to ${written}`));
+  }
+  if (opts.injectContext) {
+    const target = typeof opts.injectContext === "string" ? opts.injectContext : "CLAUDE.md";
+    const abs = path51.resolve(result.repoRoot, target);
+    const existing = fs12.existsSync(abs) ? fs12.readFileSync(abs, "utf8") : "";
+    fs12.writeFileSync(abs, injectContextBlock(existing, renderContext(input)), "utf8");
+    if (!quiet) info(c.dim(`  managed review block updated in ${target}`));
+  }
+}
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
-  const rootDir = path45.resolve(targetPath);
-  const vibgrateDir2 = path45.join(rootDir, ".vibgrate");
+  const rootDir = path51.resolve(targetPath);
+  const vibgrateDir2 = path51.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
   console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
-  const configPath = path45.join(rootDir, "vibgrate.config.ts");
+  const configPath = path51.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
     console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
@@ -9275,7 +11273,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-4X6MQBDA.js');
+    const { runBaseline } = await import('./baseline-YL2IZZ4Y.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -9378,7 +11376,7 @@ function collectPackageImports(graph, ecosystem, pkg) {
   };
 }
 async function firstReferenceLine(rootDir, relFile, identifier, readFile3) {
-  const content = await readFile3(path45.join(rootDir, relFile));
+  const content = await readFile3(path51.join(rootDir, relFile));
   if (!content) return null;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\b${escaped}\\b`);
@@ -9416,9 +11414,9 @@ function sitesFromImportFiles(files, limit = 10) {
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs26.stat(absPath);
+    const stat2 = await fs32.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs26.readFile(absPath, "utf8");
+    return await fs32.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -9614,7 +11612,7 @@ var AI_ASSISTANT_DETECTORS = [
 async function detectAiAssistant(rootDir) {
   for (const detector of AI_ASSISTANT_DETECTORS) {
     for (const file of detector.files) {
-      if (await pathExists$1(path45.join(rootDir, file))) {
+      if (await pathExists$1(path51.join(rootDir, file))) {
         return detector.name;
       }
     }
@@ -9808,7 +11806,7 @@ function reportStandards(rootDir) {
 }
 async function printRuntimeSnapshot(rootDir, opts, already) {
   try {
-    const { attachVgd: attachVgd2 } = await import('./attach-O74NL4M5.js');
+    const { attachVgd: attachVgd2 } = await import('./attach-JUSALQ75.js');
     const { vgdRequest } = await import('./client-P5XSRFV4.js');
     const { formatSemanticProgress } = await import('./semantic-status-2JFLIQQJ.js');
     let repositoryId = already?.repositoryId;
@@ -9850,7 +11848,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent registry lookups", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--no-daemon", "Never auto-start or use the local runtime (vgd) \u2014 run everything in this process").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
-  const rootDir = path45.resolve(targetPath);
+  const rootDir = path51.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -9858,7 +11856,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   const hasDsn = !!resolveDsn(opts.dsn);
   let willPush = !opts.offline && (opts.push || hasDsn);
   const noLocalArtifacts = opts.localArtifacts === false;
-  const isFirstRun = !await pathExists$1(path45.join(rootDir, ".vibgrate", "scan_result.json"));
+  const isFirstRun = !await pathExists$1(path51.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
   let planTier;
   let upgradeUrl;
@@ -10017,7 +12015,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   const advanced = await loadAdvancedScanHook();
   const artifact = await runCoreScan(rootDir, scanOpts, advanced);
   if (wantGraph && builtGraph) {
-    const { attachVgd: attachVgd2 } = await import('./attach-O74NL4M5.js');
+    const { attachVgd: attachVgd2 } = await import('./attach-JUSALQ75.js');
     const { ActivityLog: ActivityLog2 } = await import('./activity-MF2GNYAI.js');
     const activity = new ActivityLog2();
     const attached = await activity.time(
@@ -10185,11 +12183,11 @@ function scanStaleness(rootDir, artifactPath) {
       scanned++;
       if (scanned > MAX_ENTRIES2) break;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path45.join(dir, e.name), depth + 1);
+        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path51.join(dir, e.name), depth + 1);
         continue;
       }
       if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
-      const abs = path45.join(dir, e.name);
+      const abs = path51.join(dir, e.name);
       let mtimeMs;
       try {
         mtimeMs = fs12.statSync(abs).mtimeMs;
@@ -10198,7 +12196,7 @@ function scanStaleness(rootDir, artifactPath) {
       }
       if (mtimeMs > newest) {
         newest = mtimeMs;
-        newestChanged = path45.relative(rootDir, abs) || e.name;
+        newestChanged = path51.relative(rootDir, abs) || e.name;
       }
     }
   };
@@ -10338,13 +12336,13 @@ function analyzeTree(root3, packages) {
       if (filesSeen >= MAX_FILES) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk2(path45.join(dir, entry.name), depth + 1);
+        walk2(path51.join(dir, entry.name), depth + 1);
         continue;
       }
-      const fileEco = EXT_ECOSYSTEM[path45.extname(entry.name)];
+      const fileEco = EXT_ECOSYSTEM[path51.extname(entry.name)];
       if (!fileEco || fileEco === "unknown") continue;
       filesSeen++;
-      const full = path45.join(dir, entry.name);
+      const full = path51.join(dir, entry.name);
       let content;
       try {
         if (fs12.statSync(full).size > MAX_FILE_BYTES2) continue;
@@ -10620,7 +12618,7 @@ function pmCommandFor(ecosystem, pkg, version, pm = "npm", opts = {}) {
       return null;
   }
 }
-function defaultRun(cmd, cwd) {
+function defaultRun3(cmd, cwd) {
   const res = spawnSync(cmd.cmd, cmd.args, { cwd, stdio: "inherit", shell: false });
   if (res.error) {
     if (res.error.code === "ENOENT") {
@@ -10633,7 +12631,7 @@ function defaultRun(cmd, cwd) {
 }
 var ROOT_TARGET = [{ dir: ".", isWorkspaceRoot: false }];
 function applyPlan(rootDir, upgrades, opts = {}) {
-  const run = opts.run ?? defaultRun;
+  const run = opts.run ?? defaultRun3;
   const resolveTargets = opts.resolveTargets ?? (() => ROOT_TARGET);
   const results = [];
   for (const u of upgrades) {
@@ -10659,7 +12657,7 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     }
     const outcomes = effective.map((t) => {
       const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
-      return { t, res: run(c2, path45.join(rootDir, t.dir)) };
+      return { t, res: run(c2, path51.join(rootDir, t.dir)) };
     });
     const failures = outcomes.filter((o) => !o.res.ok);
     if (failures.length === 0) {
@@ -10688,8 +12686,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
   return results;
 }
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path45.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path45.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path51.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path51.join(CACHE_DIR, "update-check.json");
 async function fetchLatestVersion() {
   try {
     const controller = new AbortController();
@@ -10716,8 +12714,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs26.mkdir(CACHE_DIR, { recursive: true });
-    await fs26.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs32.mkdir(CACHE_DIR, { recursive: true });
+    await fs32.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -10752,8 +12750,8 @@ function buildDeferredUpdateScript(opts) {
 }
 function scheduleDeferredUpdate(command, pid = process.pid, dir = os.tmpdir()) {
   const stamp = `${pid}-${process.hrtime.bigint().toString(36)}`;
-  const scriptPath = path45.join(dir, `vg-update-${stamp}.cmd`);
-  const logPath = path45.join(dir, `vg-update-${stamp}.log`);
+  const scriptPath = path51.join(dir, `vg-update-${stamp}.cmd`);
+  const logPath = path51.join(dir, `vg-update-${stamp}.log`);
   try {
     fs12.writeFileSync(scriptPath, buildDeferredUpdateScript({ pid, command, logPath }), "utf8");
     const child = spawn(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", scriptPath], {
@@ -10809,14 +12807,14 @@ async function findGlobalInstall(pkg = PACKAGE_NAME, run = defaultRunner) {
       pm: "yarn",
       root: () => {
         const dir = tryRun("yarn global dir");
-        return dir ? path45.join(dir, "node_modules") : null;
+        return dir ? path51.join(dir, "node_modules") : null;
       }
     },
-    { pm: "bun", root: () => path45.join(os.homedir(), ".bun", "install", "global", "node_modules") }
+    { pm: "bun", root: () => path51.join(os.homedir(), ".bun", "install", "global", "node_modules") }
   ];
   for (const probe of probes) {
     const root3 = probe.root();
-    if (root3 && await pathExists(path45.join(root3, pkg))) return probe.pm;
+    if (root3 && await pathExists(path51.join(root3, pkg))) return probe.pm;
   }
   return null;
 }
@@ -10835,15 +12833,15 @@ function getGlobalUpdateCommand(pm, pkg, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path45.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path45.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path45.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path51.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path51.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path51.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 async function detectWorkspaceRoot(cwd) {
-  if (await pathExists(path45.join(cwd, "pnpm-workspace.yaml"))) return true;
+  if (await pathExists(path51.join(cwd, "pnpm-workspace.yaml"))) return true;
   try {
-    const pkgPath = path45.join(cwd, "package.json");
+    const pkgPath = path51.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.workspaces != null;
@@ -10870,7 +12868,7 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
 }
 async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   try {
-    const pkgPath = path45.join(cwd, "package.json");
+    const pkgPath = path51.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.devDependencies?.[pkg]) return "dev";
@@ -10885,18 +12883,18 @@ async function confirmWorkspaceRoot(pm) {
 async function confirm3(question) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve23) => {
+  return new Promise((resolve25) => {
     rl.question(chalk7.yellow(question), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve23(t === "y" || t === "yes");
+      resolve25(t === "y" || t === "yes");
     });
   });
 }
 var CAPTURED_OUTPUT_LIMIT = 64e3;
 async function runInstall(cmd, cwd) {
   const { spawn: spawn4 } = await import('child_process');
-  return new Promise((resolve23) => {
+  return new Promise((resolve25) => {
     const child = spawn4(cmd, {
       cwd,
       shell: true,
@@ -10915,15 +12913,15 @@ async function runInstall(cmd, cwd) {
     };
     tee(child.stdout, process.stdout);
     tee(child.stderr, process.stderr);
-    child.on("error", (err) => resolve23({ ok: false, output: `${output}
+    child.on("error", (err) => resolve25({ ok: false, output: `${output}
 ${String(err)}` }));
-    child.on("close", (code) => resolve23({ ok: code === 0, output }));
+    child.on("close", (code) => resolve25({ ok: code === 0, output }));
   });
 }
 async function releaseWindowsFileLocks(cwd, keepVersion) {
   reapAndReport(cwd, keepVersion);
   try {
-    const { vgdSocketPath } = await import('./vgd-RW7HCEIP.js');
+    const { vgdSocketPath } = await import('./vgd-3A2TRNP5.js');
     const result = await stopVgd(vgdSocketPath());
     if (result === "stopped") {
       console.log(chalk7.dim("Stopped the vgd daemon so its files can be replaced \u2014 it restarts on the new build after the install."));
@@ -11054,7 +13052,7 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
 );
 async function rewarmVgdAndReport(cwd) {
   try {
-    const { vgdIsRunning, vgdRequest } = await import('./vgd-RW7HCEIP.js');
+    const { vgdIsRunning, vgdRequest } = await import('./vgd-3A2TRNP5.js');
     if (!await vgdIsRunning()) return;
     const loaded = await vgdRequest({ op: "load-graph", root: cwd });
     if (!loaded.ok || !("stored" in loaded)) return;
@@ -11165,13 +13163,13 @@ function collectCandidates(artifact) {
   return out2;
 }
 var defaultFixScanner = async (rootDir) => {
-  const scratch = path45.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
+  const scratch = path51.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
   const scanOpts = { vibgrateVersion: VERSION, format: "json", out: scratch, quiet: true, concurrency: 8 };
   const advanced = await loadAdvancedScanHook();
   return runCoreScan(rootDir, scanOpts, advanced);
 };
 async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
-  const artifactPath = path45.isAbsolute(inFile) ? inFile : path45.join(rootDir, inFile);
+  const artifactPath = path51.isAbsolute(inFile) ? inFile : path51.join(rootDir, inFile);
   if (await pathExists(artifactPath)) {
     const staleness = scanStaleness(rootDir, artifactPath);
     if (!staleness.stale) {
@@ -11198,7 +13196,7 @@ async function repositoryIdentity(rootDir, override) {
   }
 }
 var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Preview the recommended plan (or --plan <tier>) without applying; never prompts").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
-  const rootDir = path45.resolve(targetPath);
+  const rootDir = path51.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -11359,7 +13357,7 @@ function emit(report, format) {
   }
 }
 function relProjectDir(rootDir, projectPath) {
-  const rel = path45.isAbsolute(projectPath) ? path45.relative(rootDir, projectPath) : projectPath;
+  const rel = path51.isAbsolute(projectPath) ? path51.relative(rootDir, projectPath) : projectPath;
   return rel === "" ? "." : rel;
 }
 async function buildTargetResolver(rootDir, artifact) {
@@ -11400,14 +13398,14 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve23) => {
+  return new Promise((resolve25) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve23(null);
+      if (t === "q" || t === "quit") return resolve25(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve23(null);
-      resolve23(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve25(null);
+      resolve25(plans[n - 1].tier);
     });
   });
 }
@@ -11485,7 +13483,7 @@ Applied the ${chosen.label} plan:`));
   }
   if (failed.length) process.exitCode = 2;
 }
-function formatText(artifact) {
+function formatText2(artifact) {
   const lines = [];
   const teal2 = chalk7.hex("#3FB0A4");
   const mint2 = chalk7.hex("#4FE3C1");
@@ -11838,10 +13836,29 @@ function formatArchitectureDiagram(arch) {
       lines.push(chalk7.dim(`    + ${arch.folders.length - 12} more`));
     }
   }
+  if (arch.coverage) {
+    const pct = Math.round(arch.coverage.ratio * 100);
+    lines.push(
+      `  Coverage: ${pct}%  (${arch.coverage.classified} classified, ${arch.coverage.unclassified} unclassified)`
+    );
+    const attributed = Object.entries(arch.coverage.bySource).filter(([, n]) => n > 0).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([src, n]) => `${src} ${n}`);
+    if (attributed.length > 0) {
+      lines.push(chalk7.dim(`    by source: ${attributed.join(", ")}`));
+    }
+  }
   if (arch.unclassifiedFiles && arch.unclassifiedFiles.length > 0) {
     const extra = arch.unclassified > arch.unclassifiedFiles.length ? ` of ${arch.unclassified}` : "";
     lines.push(`  Unclassified source (sample): ${arch.unclassifiedFiles.length}${extra}`);
   }
+  if (arch.unclassifiedFolders && arch.unclassifiedFolders.length > 0) {
+    lines.push("  Unclassified by folder:");
+    for (const folder of arch.unclassifiedFolders.slice(0, 8)) {
+      lines.push(`    ${String(folder.count).padStart(4)}  ${folder.path}`);
+    }
+    if (arch.unclassifiedFolders.length > 8) {
+      lines.push(chalk7.dim(`    + ${arch.unclassifiedFolders.length - 8} more`));
+    }
+  }
   lines.push("");
   if (arch.layers.length > 0) {
     for (const layer of arch.layers) {
@@ -12129,7 +14146,7 @@ function generatePriorityActions(artifact) {
 }
 
 // src/reporting/formatters/markdown.ts
-function formatMarkdown(artifact) {
+function formatMarkdown2(artifact) {
   const lines = [];
   lines.push("# Vibgrate Drift Report");
   lines.push("");
@@ -12242,7 +14259,7 @@ function formatMarkdown(artifact) {
 
 // src/reporting/commands/report.ts
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path45.resolve(opts.in);
+  const artifactPath = path51.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
     console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
     console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
@@ -12251,14 +14268,14 @@ var reportCommand = new Command("report").description("Generate a drift report f
   const artifact = await readJsonFile(artifactPath);
   switch (opts.format) {
     case "md":
-      console.log(formatMarkdown(artifact));
+      console.log(formatMarkdown2(artifact));
       break;
     case "json":
       console.log(JSON.stringify(artifact, null, 2));
       break;
     case "text":
     default:
-      console.log(formatText(artifact));
+      console.log(formatText2(artifact));
       break;
   }
 });
@@ -12289,10 +14306,10 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve23) => setTimeout(resolve23, ms));
+var delay = (ms) => new Promise((resolve25) => setTimeout(resolve25, ms));
 function isInside(dir, file) {
-  const rel = path45.relative(dir, file);
-  return !!rel && !rel.startsWith("..") && !path45.isAbsolute(rel);
+  const rel = path51.relative(dir, file);
+  return !!rel && !rel.startsWith("..") && !path51.isAbsolute(rel);
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
   "--local",
@@ -12460,8 +14477,8 @@ var logoutCommand = new Command("logout").description("Clear stored Vibgrate log
 });
 
 // src/reporting/commands/locale/client.ts
-function buildUrl(scheme, host, path47, query) {
-  const url = new URL(`${scheme}://${host}/v1/locale${path47}`);
+function buildUrl(scheme, host, path53, query) {
+  const url = new URL(`${scheme}://${host}/v1/locale${path53}`);
   for (const [key2, value] of Object.entries(query ?? {})) {
     if (value !== void 0 && value !== "") url.searchParams.set(key2, String(value));
   }
@@ -12509,8 +14526,8 @@ function createLocaleClient(dsn) {
       ExitCode.ERROR
     );
   }
-  const request = async (method, path47, opts = {}) => {
-    const url = buildUrl(parsed.scheme, parsed.host, path47, opts.query);
+  const request = async (method, path53, opts = {}) => {
+    const url = buildUrl(parsed.scheme, parsed.host, path53, opts.query);
     const body = opts.body === void 0 ? void 0 : JSON.stringify(opts.body);
     const response = await fetch(url, {
       method,
@@ -12526,16 +14543,16 @@ function createLocaleClient(dsn) {
   };
   return {
     workspaceId: parsed.workspaceId,
-    get: (path47, query) => request("GET", path47, { query }),
-    post: (path47, body) => request("POST", path47, { body }),
-    patch: (path47, body) => request("PATCH", path47, { body }),
-    del: (path47, body) => request("DELETE", path47, { body })
+    get: (path53, query) => request("GET", path53, { query }),
+    post: (path53, body) => request("POST", path53, { body }),
+    patch: (path53, body) => request("PATCH", path53, { body }),
+    del: (path53, body) => request("DELETE", path53, { body })
   };
 }
 var LOCALE_CONFIG_FILENAMES = ["vibgrate.locale.yaml", ".vibgrate/locale.yaml"];
 function findLocaleConfig(cwd) {
   for (const name of LOCALE_CONFIG_FILENAMES) {
-    const candidate = path45.join(cwd, name);
+    const candidate = path51.join(cwd, name);
     if (fs12.existsSync(candidate)) return candidate;
   }
   return null;
@@ -12549,15 +14566,15 @@ function parseLocaleConfig(text) {
     const items = value.filter((v) => typeof v === "string" && v.trim().length > 0);
     return items.length ? items : void 0;
   };
-  const str = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+  const str2 = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
   return {
-    project: str(obj.project),
-    sourceLanguage: str(obj.sourceLanguage),
+    project: str2(obj.project),
+    sourceLanguage: str2(obj.sourceLanguage),
     targetLanguages: stringArray(obj.targetLanguages),
-    format: str(obj.format),
-    path: str(obj.path),
+    format: str2(obj.format),
+    path: str2(obj.path),
     namespaces: stringArray(obj.namespaces),
-    version: str(obj.version)
+    version: str2(obj.version)
   };
 }
 function loadLocaleConfig(cwd) {
@@ -12567,7 +14584,7 @@ function loadLocaleConfig(cwd) {
     return { config: parseLocaleConfig(fs12.readFileSync(file, "utf8")), file };
   } catch (error) {
     throw new Error(
-      `Could not parse ${path45.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`
+      `Could not parse ${path51.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`
     );
   }
 }
@@ -12582,8 +14599,8 @@ function serializeLocaleConfig(config) {
   return stringify(out2);
 }
 function writeLocaleConfig(cwd, config, filename) {
-  const target = filename ?? path45.join(cwd, LOCALE_CONFIG_FILENAMES[0]);
-  fs12.mkdirSync(path45.dirname(target), { recursive: true });
+  const target = filename ?? path51.join(cwd, LOCALE_CONFIG_FILENAMES[0]);
+  fs12.mkdirSync(path51.dirname(target), { recursive: true });
   fs12.writeFileSync(target, serializeLocaleConfig(config), "utf8");
   return target;
 }
@@ -12725,7 +14742,7 @@ function validatePathTemplate(template) {
   if (!template.includes("{language}")) {
     return 'path template must contain {language} (e.g. "src/locales/{language}/{namespace}.json").';
   }
-  if (path45.isAbsolute(template)) {
+  if (path51.isAbsolute(template)) {
     return "path template must be relative to the project directory.";
   }
   if (template.split(/[\\/]/).includes("..")) {
@@ -12741,7 +14758,7 @@ function resolveLocaleFiles(cwd, template, languages, namespaces) {
   for (const language of languages) {
     for (const namespace of namespaces) {
       const relative13 = renderPath(template, language, namespace);
-      const file = path45.resolve(cwd, relative13);
+      const file = path51.resolve(cwd, relative13);
       out2.push({ language, namespace, file, relative: relative13, exists: fs12.existsSync(file) });
     }
   }
@@ -12763,7 +14780,7 @@ function writeCatalog(file, format, catalog, opts = {}) {
   const existing = fs12.existsSync(file) ? fs12.readFileSync(file, "utf8") : null;
   const changed = existing !== encoded;
   if (changed && !opts.dryRun) {
-    fs12.mkdirSync(path45.dirname(file), { recursive: true });
+    fs12.mkdirSync(path51.dirname(file), { recursive: true });
     fs12.writeFileSync(file, encoded, "utf8");
   }
   return { file, changed, bytes: Buffer.byteLength(encoded, "utf8") };
@@ -12784,7 +14801,7 @@ function diffCatalogs(before, after) {
 // src/reporting/commands/locale/index.ts
 var cwdOption = ["-C, --cwd <dir>", "Run against this directory (default: current)"];
 function root(opts) {
-  return path45.resolve(opts.cwd ?? process.cwd());
+  return path51.resolve(opts.cwd ?? process.cwd());
 }
 function withCommonOptions(cmd) {
   return cmd.option(...cwdOption).option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN, or run "vg login")').option("--project <slug>", "Locale project slug or id").option("--format <format>", `Locale file format (${SUPPORTED_FORMATS.join(", ")})`).option("--path <template>", "Path template, e.g. src/locales/{language}/{namespace}.json").option("--namespace <name>", "Restrict to one namespace").option("--language <code>", "Restrict to one BCP-47 language").option("--ver <version>", "Target version (default: latest)").option("--json", "Machine-readable output").option("-q, --quiet", "Suppress non-essential output");
@@ -12854,7 +14871,7 @@ var configCmd = withCommonOptions(
     if (!isSupportedFormat(next2.format)) codecFor(next2.format);
     const written = writeLocaleConfig(dir, next2, file ?? void 0);
     emit2(opts, { file: written, config: next2 }, () => {
-      console.log(chalk7.green(`Wrote ${path45.relative(dir, written) || path45.basename(written)}`));
+      console.log(chalk7.green(`Wrote ${path51.relative(dir, written) || path51.basename(written)}`));
       console.log(
         chalk7.dim('Credentials are not stored here \u2014 run "vg login" or set VIBGRATE_DSN.')
       );
@@ -13330,7 +15347,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
   try {
     const statements = [];
     if (opts.from) {
-      const fromPath = path45.resolve(opts.from);
+      const fromPath = path51.resolve(opts.from);
       if (!await pathExists(fromPath)) {
         process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
 `));
@@ -13348,9 +15365,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     });
     const json2 = JSON.stringify(doc, null, 2);
     if (opts.out) {
-      await writeTextFile(path45.resolve(opts.out), json2 + "\n");
+      await writeTextFile(path51.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path45.resolve(opts.out)}
+        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path51.resolve(opts.out)}
 `
       );
     } else {
@@ -13533,7 +15550,7 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path45.resolve(filePath);
+  const absolutePath = path51.resolve(filePath);
   if (!await pathExists(absolutePath)) {
     console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
@@ -13550,7 +15567,7 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path45.resolve(opts.out), body);
+    await writeTextFile(path51.resolve(opts.out), body);
     console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
@@ -13561,7 +15578,7 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path45.resolve(opts.out), report);
+    await writeTextFile(path51.resolve(opts.out), report);
     console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
@@ -13692,20 +15709,20 @@ function resolveRegime(id) {
   return regime;
 }
 function evidenceDir(root3) {
-  return path45.join(root3, ".vibgrate", "evidence");
+  return path51.join(root3, ".vibgrate", "evidence");
 }
 function orgPath(root3) {
-  return path45.join(evidenceDir(root3), "org.json");
+  return path51.join(evidenceDir(root3), "org.json");
 }
 function productsPath(root3) {
-  return path45.join(evidenceDir(root3), "products.json");
+  return path51.join(evidenceDir(root3), "products.json");
 }
 function releasesDir(root3) {
-  return path45.join(evidenceDir(root3), "releases");
+  return path51.join(evidenceDir(root3), "releases");
 }
 function releasePath(root3, productId, version) {
   const safe = `${productId}@${version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-  return path45.join(releasesDir(root3), `${safe}.json`);
+  return path51.join(releasesDir(root3), `${safe}.json`);
 }
 var DEFAULT_ORG = {
   responsiblePersons: [],
@@ -13736,7 +15753,7 @@ async function freezeRelease(root3, release) {
   const p = releasePath(root3, release.productId, release.version);
   if (await pathExists(p)) {
     throw new CliError(
-      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path45.relative(root3, p)} only if it was frozen in error`,
+      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path51.relative(root3, p)} only if it was frozen in error`,
       ExitCode.USAGE_ERROR
     );
   }
@@ -13750,7 +15767,7 @@ async function loadReleases(root3, productId) {
   const files = (await readdir(dir)).filter((f) => f.endsWith(".json")).sort();
   const releases = [];
   for (const f of files) {
-    const rel = await readJsonFile(path45.join(dir, f));
+    const rel = await readJsonFile(path51.join(dir, f));
     if (!productId || rel.productId === productId) releases.push(rel);
   }
   return releases;
@@ -13911,9 +15928,9 @@ function derInt(n) {
   if (bytes[0] & 128) bytes = Buffer.concat([Buffer.from([0]), bytes]);
   return der(TAG.INTEGER, bytes);
 }
-function buildTimeStampReq(digest) {
+function buildTimeStampReq(digest2) {
   const algId = der(TAG.SEQUENCE, Buffer.concat([der(TAG.OID, OID_SHA256), der(TAG.NULL, Buffer.alloc(0))]));
-  const messageImprint = der(TAG.SEQUENCE, Buffer.concat([algId, der(TAG.OCTET_STRING, digest)]));
+  const messageImprint = der(TAG.SEQUENCE, Buffer.concat([algId, der(TAG.OCTET_STRING, digest2)]));
   const version = derInt(1);
   const nonce = der(TAG.INTEGER, crypto3.randomBytes(16));
   const certReq = der(TAG.BOOLEAN, Buffer.from([255]));
@@ -13992,9 +16009,9 @@ function verifyTimestamp(tsr, digestHex) {
     reason: imprintMatches ? `RFC 3161 token binds to this result at ${token.genTime} (TSA signature chain not re-verified here \u2014 use \`openssl ts -verify\`)` : "RFC 3161 token imprint does not match this result"
   };
 }
-async function requestTimestamp(tsaUrl, digest) {
+async function requestTimestamp(tsaUrl, digest2) {
   if (typeof fetch !== "function") throw new CliError("network fetch unavailable \u2014 cannot reach the TSA", ExitCode.ERROR);
-  const req = buildTimeStampReq(digest);
+  const req = buildTimeStampReq(digest2);
   let res;
   try {
     res = await fetch(tsaUrl, {
@@ -14008,7 +16025,7 @@ async function requestTimestamp(tsaUrl, digest) {
   }
   if (!res.ok) throw new CliError(`TSA ${tsaUrl} returned ${res.status}`, ExitCode.ERROR);
   const body = Buffer.from(await res.arrayBuffer());
-  const v = verifyTimestamp(body, digest.toString("hex"));
+  const v = verifyTimestamp(body, digest2.toString("hex"));
   if (!v.imprintMatches) throw new CliError(`TSA response did not bind to our digest (${v.reason})`, ExitCode.ERROR);
   return body;
 }
@@ -14445,12 +16462,12 @@ function verifyEvidenceEnvelope(env, opts = {}) {
 var DEFAULT_KEY = "attest-key.pem";
 function resolveSigningKey(root3, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
-  const keyPath = chosen ? path45.resolve(chosen) : path45.join(root3, ".vibgrate", DEFAULT_KEY);
+  const keyPath = chosen ? path51.resolve(chosen) : path51.join(root3, ".vibgrate", DEFAULT_KEY);
   let minted = false;
   if (!fs12.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs12.mkdirSync(path45.dirname(keyPath), { recursive: true });
+    fs12.mkdirSync(path51.dirname(keyPath), { recursive: true });
     fs12.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
     fs12.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
@@ -14468,16 +16485,16 @@ function resolveSigningKey(root3, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs12.mkdirSync(path45.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs12.writeFileSync(path45.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs12.mkdirSync(path51.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs12.writeFileSync(path51.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
-  write(path45.join("inputs", "advisory.json"), input.advisory);
+  write(path51.join("inputs", "advisory.json"), input.advisory);
   for (const rel of input.releases) {
     const safe = `${rel.productId}@${rel.version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-    write(path45.join("inputs", "releases", `${safe}.json`), rel);
+    write(path51.join("inputs", "releases", `${safe}.json`), rel);
   }
-  write(path45.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
+  write(path51.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
   write("provenance.json", {
     method: "deterministic",
     modelDrafted: [],
@@ -14493,13 +16510,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs12.writeFileSync(path45.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs12.writeFileSync(path51.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs12.writeFileSync(path45.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs12.writeFileSync(path51.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs12.writeFileSync(path45.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs12.writeFileSync(path51.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -14560,13 +16577,13 @@ function undeterminedFields(result, regime) {
   return gaps.filter((g) => regime.submission.requires.some((r) => g.startsWith(r)) || g.startsWith("exposure") || g.startsWith("member"));
 }
 async function recordDrill(root3, record) {
-  const dir = path45.join(evidenceDir(root3), "drills");
-  const p = path45.join(dir, `${record.drillId}.json`);
+  const dir = path51.join(evidenceDir(root3), "drills");
+  const p = path51.join(dir, `${record.drillId}.json`);
   await writeJsonFile(p, record);
   return p;
 }
 async function hasRecentDrill(root3, asOf) {
-  const dir = path45.join(evidenceDir(root3), "drills");
+  const dir = path51.join(evidenceDir(root3), "drills");
   if (!await pathExists(dir)) return void 0;
   const { readdir } = await import('fs/promises');
   const { readJsonFile: readJsonFile2 } = await import('./fs-4G5A65KS.js');
@@ -14574,7 +16591,7 @@ async function hasRecentDrill(root3, asOf) {
   if (files.length === 0) return void 0;
   const cutoff = new Date(new Date(asOf).getTime() - 90 * 24 * 3600 * 1e3).toISOString();
   for (const f of files) {
-    const rec = await readJsonFile2(path45.join(dir, f));
+    const rec = await readJsonFile2(path51.join(dir, f));
     if (rec.ranAt >= cutoff) return true;
   }
   return false;
@@ -14654,7 +16671,7 @@ function formatRegimeList() {
 
 // src/reporting/commands/evidence/index.ts
 function root2(opts) {
-  return path45.resolve(opts.cwd ?? process.cwd());
+  return path51.resolve(opts.cwd ?? process.cwd());
 }
 function slug(name) {
   return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "product";
@@ -14742,7 +16759,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
   const release = await buildRelease({
     productId: product.id,
     version,
-    from: path45.resolve(rootDir, opts.from),
+    from: path51.resolve(rootDir, opts.from),
     shipDate: opts.shipDate,
     buildId: opts.buildId,
     artefactDigest: opts.digest,
@@ -14750,7 +16767,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
     frozenAt: nowIso()
   });
   const p = await freezeRelease(rootDir, release);
-  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path45.relative(rootDir, p)}`);
+  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path51.relative(rootDir, p)}`);
 });
 async function runExposure(rootDir, vuln, opts) {
   const org = await loadOrg(rootDir);
@@ -14787,8 +16804,8 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
   const { result, regime, releases, advisory } = await runExposure(rootDir, vuln, opts);
   let timestampToken;
   if (opts.tsa) {
-    const digest = Buffer.from(exposureSubjectDigest(result), "hex");
-    timestampToken = await requestTimestamp(opts.tsa, digest);
+    const digest2 = Buffer.from(exposureSubjectDigest(result), "hex");
+    timestampToken = await requestTimestamp(opts.tsa, digest2);
     result.meta.timestamp = { source: "rfc3161", value: parseTimestampToken(timestampToken).genTime };
   }
   if (opts.format === "json") {
@@ -14802,7 +16819,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
     console.log("\n" + buildPack(result, regime, org, stage));
   }
   if (opts.bundle) {
-    const dir = path45.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
+    const dir = path51.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
     let envelope;
     if (opts.sign !== false) {
       const { key: key2, minted } = resolveSigningKey(rootDir);
@@ -14810,7 +16827,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
       envelope = signEvidenceStatement(buildEvidenceStatement(result, VERSION), key2);
     }
     writeBundle({ outDir: dir, result, advisory, releases, regime, envelope, timestampToken, cliVersion: VERSION });
-    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path45.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
+    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path51.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
   }
   process.exitCode = exposureExit(result.overallStatus);
 });
@@ -14842,7 +16859,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs12.writeFileSync(path45.resolve(rootDir, opts.out), md);
+    fs12.writeFileSync(path51.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -14884,18 +16901,18 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
   }
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
-  const abs = path45.resolve(bundlePath);
-  const envPath = fs12.statSync(abs).isDirectory() ? path45.join(abs, "evidence.intoto.jsonl") : abs;
+  const abs = path51.resolve(bundlePath);
+  const envPath = fs12.statSync(abs).isDirectory() ? path51.join(abs, "evidence.intoto.jsonl") : abs;
   if (!fs12.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
   const envelope = JSON.parse(fs12.readFileSync(envPath, "utf8").trim().split("\n")[0]);
-  const resultPath = path45.join(path45.dirname(envPath), "result.json");
+  const resultPath = path51.join(path51.dirname(envPath), "result.json");
   const result = fs12.existsSync(resultPath) ? JSON.parse(fs12.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs12.readFileSync(path45.resolve(opts.pub), "utf8") : void 0;
+  const publicKeyPem = opts.pub ? fs12.readFileSync(path51.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
-  const tsrPath = path45.join(path45.dirname(envPath), "timestamp.tsr");
+  const tsrPath = path51.join(path51.dirname(envPath), "timestamp.tsr");
   if (fs12.existsSync(tsrPath) && result) {
     const t = verifyTimestamp(fs12.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
@@ -14964,12 +16981,12 @@ var exportCmd = new Command("export").description("Air-gap bundle of all evidenc
   const releases = [];
   for (const list of releasesByProduct.values()) releases.push(...list);
   const report = computeReadiness({ regime, org, products, releasesByProduct, recentDrill: await hasRecentDrill(rootDir, today()) });
-  const dir = path45.resolve(rootDir, opts.out);
-  await writeJsonFile(path45.join(dir, "org.json"), org);
-  await writeJsonFile(path45.join(dir, "products.json"), products);
-  for (const r of releases) await writeJsonFile(path45.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
-  await writeJsonFile(path45.join(dir, "readiness.json"), report);
-  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path45.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
+  const dir = path51.resolve(rootDir, opts.out);
+  await writeJsonFile(path51.join(dir, "org.json"), org);
+  await writeJsonFile(path51.join(dir, "products.json"), products);
+  for (const r of releases) await writeJsonFile(path51.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
+  await writeJsonFile(path51.join(dir, "readiness.json"), report);
+  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path51.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
 });
 var pushCmd = new Command("push").description("Push the product registry (and an optional exposure result) to Vibgrate Cloud").option(...cwdOption2).option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env / `vg login`)").option("--regime <id>", "Reporting regime").option("--result <file>", "An exposure result.json (or a bundle dir) to include").option("--signed", "Mark the included exposure result as signed").option("--strict", "Fail on push errors").action(async (opts) => {
   const rootDir = root2(opts);
@@ -14995,8 +17012,8 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   }));
   let exposure;
   if (opts.result) {
-    const raw = path45.resolve(rootDir, opts.result);
-    const resultPath = fs12.existsSync(raw) && fs12.statSync(raw).isDirectory() ? path45.join(raw, "result.json") : raw;
+    const raw = path51.resolve(rootDir, opts.result);
+    const resultPath = fs12.existsSync(raw) && fs12.statSync(raw).isDirectory() ? path51.join(raw, "result.json") : raw;
     if (!fs12.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
     exposure = JSON.parse(fs12.readFileSync(resultPath, "utf8"));
   }
@@ -15059,6 +17076,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "module",
   "daemon",
   "policy",
+  "review",
   "llm-host",
   "hcs",
   "install",
@@ -15128,6 +17146,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerPolicy(program);
   registerLlmHost(program);
   registerHcs(program);
+  registerReview(program);
   program.addCommand(initCommand);
   program.addCommand(scanCommand);
   program.addCommand(fixCommand);
@@ -15152,6 +17171,7 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--only",
   "--exclude",
   "--export",
+  "--out",
   "-o",
   "--budget",
   "-b"
@@ -15197,7 +17217,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs12.existsSync(path45.resolve(cwd, first))) {
+  if (fs12.existsSync(path51.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];
@@ -15224,15 +17244,15 @@ function findFirstPositional(args) {
 async function main(argv = process.argv) {
   const raw = argv.slice(2);
   if (process.env.NO_COLOR || raw.includes("--no-color")) disableColor();
-  if (!raw.includes("--local")) kickRelevanceReadiness();
+  if (!raw.includes("--local") && !raw.includes("--offline")) kickRelevanceReadiness();
   const cwd = readCwd(raw);
   const program = buildProgram();
   program.exitOverride((err) => {
     throw err;
   });
   program.configureOutput({
-    writeErr: (str) => process.stderr.write(str),
-    writeOut: (str) => process.stdout.write(str)
+    writeErr: (str2) => process.stderr.write(str2),
+    writeOut: (str2) => process.stdout.write(str2)
   });
   try {
     const dispatched = dispatch(raw, cwd);
@@ -15243,9 +17263,9 @@ async function main(argv = process.argv) {
 }
 function readCwd(raw) {
   const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
-  if (i >= 0 && raw[i + 1]) return path45.resolve(raw[i + 1]);
+  if (i >= 0 && raw[i + 1]) return path51.resolve(raw[i + 1]);
   const eq = raw.find((a) => a.startsWith("--cwd="));
-  if (eq) return path45.resolve(eq.slice("--cwd=".length));
+  if (eq) return path51.resolve(eq.slice("--cwd=".length));
   return process.cwd();
 }
 function handleError(err) {