@vortex-os/base 0.11.0 → 0.12.1

package/dist/index.js

@@ -1,3 +1,14 @@
+import {
+  FAILURES_DIR,
+  GUARD_DENIAL_KEY,
+  failureReportSlice,
+  isValidFailureKey,
+  ladderStage,
+  recordFailure,
+  recordGuardDenial,
+  runFailureCli,
+  scanFailures
+} from "./chunk-UV76ZEDC.js";
 import {
   SESSION_END_COMMAND,
   SESSION_START_COMMAND,
@@ -16,7 +27,30 @@ import {
   serializeSettings,
   sniffEffortFromTranscript,
   statuslineCommand
-} from "./chunk-DWANI3LV.js";
+} from "./chunk-P7IMUUNY.js";
+import {
+  GUARD_WRITE_COMMAND,
+  GUARD_WRITE_MATCHER,
+  buildDenyDecision,
+  findControlChar,
+  guardWriteDecision,
+  resolveInstanceRoot,
+  runGuardCli,
+  scanToolInput
+} from "./chunk-2FVNWW77.js";
+import {
+  atomicWriteFile,
+  dist_exports,
+  exclusiveCreateFile,
+  isVisibleAt,
+  loadVortexConfig,
+  makeContext,
+  normalizePrivacy,
+  parseFrontmatter,
+  resolveEnvironment,
+  serializeFrontmatter,
+  validateDataRelativePath
+} from "./chunk-T53UWSTR.js";
 import {
   catchUpSessions
 } from "./chunk-3L5DLEGP.js";
@@ -24,287 +58,6 @@ import {
   __export
 } from "./chunk-PZ5AY32C.js";
 
-// ../core/dist/index.js
-var dist_exports = {};
-__export(dist_exports, {
-  Privacy: () => Privacy,
-  atomicWriteFile: () => atomicWriteFile,
-  exclusiveCreateFile: () => exclusiveCreateFile,
-  isVisibleAt: () => isVisibleAt,
-  loadVortexConfig: () => loadVortexConfig,
-  makeContext: () => makeContext,
-  maxPrivacy: () => maxPrivacy,
-  moduleDir: () => moduleDir,
-  normalizePrivacy: () => normalizePrivacy,
-  parseFrontmatter: () => parseFrontmatter,
-  resolveEnvironment: () => resolveEnvironment,
-  serializeFrontmatter: () => serializeFrontmatter,
-  validateDataRelativePath: () => validateDataRelativePath,
-  vortexConfigPath: () => vortexConfigPath
-});
-
-// ../core/dist/types.js
-var Privacy = {
-  Public: "public",
-  Internal: "internal",
-  Personal: "personal"
-};
-
-// ../core/dist/frontmatter.js
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-var FENCE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
-var BOM = "\uFEFF";
-function parseFrontmatter(source) {
-  const cleaned = source.startsWith(BOM) ? source.slice(1) : source;
-  const match = cleaned.match(FENCE);
-  if (!match) {
-    return {
-      frontmatter: {},
-      body: cleaned
-    };
-  }
-  const yaml = match[1] ?? "";
-  const body = cleaned.slice(match[0].length);
-  let parsed;
-  try {
-    const value = parseYaml(yaml);
-    parsed = typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
-  } catch {
-    parsed = {};
-  }
-  return { frontmatter: parsed, body };
-}
-function serializeFrontmatter(doc) {
-  const keys = Object.keys(doc.frontmatter ?? {});
-  if (keys.length === 0)
-    return doc.body;
-  const yaml = stringifyYaml(doc.frontmatter).trimEnd();
-  return `---
-${yaml}
----
-${doc.body}`;
-}
-
-// ../core/dist/privacy.js
-var ORDER = {
-  public: 0,
-  internal: 1,
-  personal: 2
-};
-function isVisibleAt(docPrivacy, viewerPrivacy) {
-  return ORDER[docPrivacy] <= ORDER[viewerPrivacy];
-}
-function maxPrivacy(a, b2) {
-  return ORDER[a] >= ORDER[b2] ? a : b2;
-}
-function normalizePrivacy(value, fallback = "internal") {
-  if (value === "public" || value === "internal" || value === "personal") {
-    return value;
-  }
-  return fallback;
-}
-
-// ../core/dist/paths.js
-import { resolve, join } from "path";
-function makeContext(repoRoot) {
-  const root = resolve(repoRoot);
-  return {
-    repoRoot: root,
-    agentDir: join(root, ".agent"),
-    dataDir: join(root, "data"),
-    modulesDir: join(root, "modules"),
-    pluginsDir: join(root, "plugins")
-  };
-}
-function moduleDir(ctx, moduleName) {
-  return join(ctx.modulesDir, moduleName);
-}
-
-// ../core/dist/config.js
-import { existsSync, readFileSync } from "fs";
-import { join as join2 } from "path";
-var DEFAULT_CONFIG = {
-  autoRecord: { sessionStart: true, worklog: true, decision: true, ambientRecall: true, archive: true, vectorize: true, vectorizeAutoDownload: true, commitFrameworkChanges: true, handoff: true, handoffRetentionDays: 7, reindex: true, backfill: true },
-  updates: { check: "session" },
-  environments: []
-};
-function vortexConfigPath(ctx) {
-  return join2(ctx.agentDir, "vortex.json");
-}
-function parseEnvironmentRule(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
-    return null;
-  const candidate = raw;
-  if (typeof candidate.label !== "string")
-    return null;
-  const rule = {
-    label: candidate.label
-  };
-  if (typeof candidate.pathExists === "string")
-    rule.pathExists = candidate.pathExists;
-  if (typeof candidate.hostname === "string")
-    rule.hostname = candidate.hostname;
-  if (typeof candidate.envVar === "string") {
-    rule.envVar = candidate.envVar;
-  } else if (typeof candidate.envVar === "object" && candidate.envVar !== null) {
-    const ev = candidate.envVar;
-    if (typeof ev.name === "string") {
-      rule.envVar = typeof ev.equals === "string" ? { name: ev.name, equals: ev.equals } : { name: ev.name };
-    }
-  }
-  return rule;
-}
-function loadVortexConfig(ctx) {
-  const path = vortexConfigPath(ctx);
-  if (!existsSync(path))
-    return DEFAULT_CONFIG;
-  try {
-    const raw = JSON.parse(readFileSync(path, "utf8"));
-    const environments = Array.isArray(raw.environments) ? raw.environments.map(parseEnvironmentRule).filter((rule) => rule !== null) : [];
-    const rawUpdates = raw.updates && typeof raw.updates === "object" && !Array.isArray(raw.updates) ? raw.updates : {};
-    const rawCheck = rawUpdates.check;
-    const check = rawCheck === void 0 ? "session" : typeof rawCheck === "string" && rawCheck.trim().toLowerCase() === "session" ? "session" : "off";
-    const rawAuto = raw.autoRecord && typeof raw.autoRecord === "object" && !Array.isArray(raw.autoRecord) ? raw.autoRecord : {};
-    const vectorizeAutoDownload = rawAuto.vectorizeAutoDownload === void 0 ? true : rawAuto.vectorizeAutoDownload === true;
-    const commitFrameworkChanges = rawAuto.commitFrameworkChanges === void 0 ? true : rawAuto.commitFrameworkChanges === true;
-    const handoff = rawAuto.handoff === void 0 ? true : rawAuto.handoff === true;
-    const reindex = rawAuto.reindex === void 0 ? true : rawAuto.reindex === true;
-    const backfill = rawAuto.backfill === void 0 ? true : rawAuto.backfill === true;
-    const rawDays = rawAuto.handoffRetentionDays;
-    const handoffRetentionDays = typeof rawDays === "number" && Number.isFinite(rawDays) && rawDays > 0 ? Math.floor(rawDays) : DEFAULT_CONFIG.autoRecord.handoffRetentionDays;
-    return {
-      autoRecord: {
-        ...DEFAULT_CONFIG.autoRecord,
-        ...raw.autoRecord ?? {},
-        vectorizeAutoDownload,
-        commitFrameworkChanges,
-        handoff,
-        handoffRetentionDays,
-        reindex,
-        backfill
-      },
-      updates: { check },
-      environments
-    };
-  } catch {
-    return DEFAULT_CONFIG;
-  }
-}
-function resolveEnvironment(config, signals) {
-  const host = signals.hostname?.toLowerCase();
-  const env = signals.env ?? {};
-  const pathExists = signals.pathExists ?? (() => false);
-  for (const rule of config.environments) {
-    if (rule.pathExists && pathExists(rule.pathExists))
-      return rule.label;
-    if (rule.hostname && host && rule.hostname.toLowerCase() === host)
-      return rule.label;
-    if (rule.envVar) {
-      if (typeof rule.envVar === "string") {
-        if (env[rule.envVar] !== void 0)
-          return rule.label;
-      } else {
-        const v2 = env[rule.envVar.name];
-        if (v2 !== void 0 && (rule.envVar.equals === void 0 || v2 === rule.envVar.equals)) {
-          return rule.label;
-        }
-      }
-    }
-  }
-  return null;
-}
-
-// ../core/dist/safe-fs.js
-import { rename, writeFile } from "fs/promises";
-import { isAbsolute, relative, resolve as resolve2, sep } from "path";
-var SYSTEM_META_DIRS = /* @__PURE__ */ new Set([
-  "worklog",
-  "decision-log",
-  "runbooks",
-  "hubs",
-  "_memory",
-  "_templates",
-  "_proactive-curator",
-  // Framework metadata carve-out: `data/.vortex/` holds the update-lifecycle
-  // ownership manifest and template backups. It is NOT user space — the curate
-  // value loop (and any LLM-chosen write path) must never target it, even
-  // though it does not start with `_`. (The leading-`_` rule below does not
-  // cover a leading-dot dir, so it is listed explicitly.)
-  ".vortex"
-]);
-var DRIVE_QUALIFIED = /^[a-zA-Z]:/;
-var CONTROL_CHARS = /[\u0000-\u001F]/;
-function validateDataRelativePath(dataDir, rel, _options = {}) {
-  if (typeof rel !== "string" || rel.length === 0) {
-    throw new Error("Invalid data-relative path: must be a non-empty string.");
-  }
-  if (CONTROL_CHARS.test(rel)) {
-    throw new Error("Invalid data-relative path: contains control characters.");
-  }
-  const normalized = rel.replace(/\\/g, "/");
-  if (normalized === "" || normalized === ".") {
-    throw new Error(`Invalid data-relative path: "${rel}" is empty or '.'.`);
-  }
-  if (DRIVE_QUALIFIED.test(normalized)) {
-    throw new Error(`Invalid data-relative path: "${rel}" is drive-qualified (must be data-relative).`);
-  }
-  if (isAbsolute(normalized) || normalized.startsWith("/")) {
-    throw new Error(`Invalid data-relative path: "${rel}" is absolute (must be data-relative).`);
-  }
-  const segments = normalized.split("/");
-  for (const segment of segments) {
-    if (segment === "" || segment === "." || segment === "..") {
-      throw new Error(`Invalid data-relative path: "${rel}" contains an empty, '.', or '..' segment (path traversal).`);
-    }
-  }
-  const filename = segments[segments.length - 1];
-  if (filename.length === 0 || filename.includes("/") || filename.includes("\\")) {
-    throw new Error(`Invalid data-relative path: "${rel}" has an invalid filename.`);
-  }
-  const first = segments[0];
-  if (SYSTEM_META_DIRS.has(first) || first.startsWith("_")) {
-    throw new Error(`Invalid data-relative path: "${rel}" targets a reserved system/meta directory ("${first}"). The curate value loop writes user documents only \u2014 not worklog/decision-log/runbooks/hubs or any _* directory.`);
-  }
-  const absPath = resolve2(dataDir, normalized);
-  const rootResolved = resolve2(dataDir);
-  let relToData = relative(rootResolved, absPath);
-  let relCompare = relToData;
-  let upPrefix = ".." + sep;
-  if (sep === "\\") {
-    relCompare = relToData.toLowerCase();
-    upPrefix = upPrefix.toLowerCase();
-  }
-  if (relCompare === ".." || relCompare.startsWith(upPrefix) || isAbsolute(relToData)) {
-    throw new Error(`Invalid data-relative path: "${rel}" resolves outside the data directory.`);
-  }
-  return absPath;
-}
-async function exclusiveCreateFile(absPath, body) {
-  try {
-    await writeFile(absPath, body, { encoding: "utf8", flag: "wx" });
-  } catch (e) {
-    if (e.code === "EEXIST") {
-      throw new Error(`Refusing to overwrite existing file: ${absPath}. create-file is an exclusive create; to add to an existing document use append-section instead.`);
-    }
-    throw e;
-  }
-}
-var atomicWriteCounter = 0;
-async function atomicWriteFile(absPath, body) {
-  const tmp = `${absPath}.tmp-${process.pid}-${atomicWriteCounter++}`;
-  try {
-    await writeFile(tmp, body, { encoding: "utf8" });
-    await rename(tmp, absPath);
-  } catch (e) {
-    try {
-      const { rm } = await import("fs/promises");
-      await rm(tmp, { force: true });
-    } catch {
-    }
-    throw e;
-  }
-}
-
 // ../modules/slash-commands/dist/index.js
 var dist_exports2 = {};
 __export(dist_exports2, {
@@ -418,8 +171,8 @@ var MemoryType = {
 };
 
 // ../modules/memory-system/dist/store.js
-import { readdir, readFile, writeFile as writeFile2, mkdir, unlink, stat } from "fs/promises";
-import { join as join3, basename, extname } from "path";
+import { readdir, readFile, writeFile, mkdir, unlink, stat } from "fs/promises";
+import { join, basename, extname } from "path";
 var MemoryStore = class {
   dir;
   constructor(dir) {
@@ -453,7 +206,7 @@ var MemoryStore = class {
       frontmatter: memory.frontmatter,
       body: memory.body
     });
-    await writeFile2(this.pathFor(memory.id), source, "utf8");
+    await writeFile(this.pathFor(memory.id), source, "utf8");
   }
   /** Delete a memory. Returns false if it did not exist. */
   async delete(id) {
@@ -477,13 +230,13 @@ var MemoryStore = class {
   }
   /** Absolute path of a memory file (file may not exist). */
   pathFor(id) {
-    return join3(this.dir, `${id}.md`);
+    return join(this.dir, `${id}.md`);
   }
 };
 
 // ../modules/memory-system/dist/memory-index.js
-import { writeFile as writeFile3 } from "fs/promises";
-import { join as join4 } from "path";
+import { writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
 async function writeMemoryIndex(store, options = {}) {
   const ids = await store.list();
   const lines = [];
@@ -495,7 +248,7 @@ async function writeMemoryIndex(store, options = {}) {
     const memory = await store.read(id);
     lines.push(`- [${memory.frontmatter.name}](${id}.md) \u2014 ${memory.frontmatter.description}`);
   }
-  await writeFile3(join4(store.dir, "MEMORY.md"), `${lines.join("\n")}
+  await writeFile2(join2(store.dir, "MEMORY.md"), `${lines.join("\n")}
 `, "utf8");
 }
 
@@ -533,7 +286,7 @@ __export(dist_exports4, {
 
 // ../modules/data-lint/dist/runner.js
 import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
-import { join as join5 } from "path";
+import { join as join3 } from "path";
 async function lintDirectory(options) {
   const start = Date.now();
   const extensions = options.extensions ?? [".md"];
@@ -570,7 +323,7 @@ async function collectFiles(dir, extensions) {
       throw e;
     }
     for (const entry of entries) {
-      const full = join5(current, entry.name);
+      const full = join3(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext))) {
@@ -631,7 +384,7 @@ function privacyValid() {
 
 // ../modules/data-lint/dist/rules/wiki-link-resolves.js
 import { readdir as readdir3 } from "fs/promises";
-import { basename as basename2, extname as extname2, join as join6 } from "path";
+import { basename as basename2, extname as extname2, join as join4 } from "path";
 var WIKI_LINK = /\[\[([^\]|#]+)(?:[|#][^\]]*)?\]\]/g;
 function wikiLinkResolves(options) {
   let cache;
@@ -652,7 +405,7 @@ function wikiLinkResolves(options) {
         continue;
       }
       for (const entry of entries) {
-        const full = join6(current, entry.name);
+        const full = join4(current, entry.name);
         if (entry.isDirectory()) {
           stack.push(full);
         } else if (entry.isFile()) {
@@ -737,7 +490,7 @@ __export(dist_exports5, {
 
 // ../modules/ai-coding-pitfalls/dist/catalog.js
 import { readdir as readdir4, readFile as readFile4 } from "fs/promises";
-import { basename as basename3, extname as extname3, join as join7 } from "path";
+import { basename as basename3, extname as extname3, join as join5 } from "path";
 var PitfallCatalog = class {
   dir;
   constructor(dir) {
@@ -765,7 +518,7 @@ var PitfallCatalog = class {
   async entries() {
     try {
       const names = await readdir4(this.dir);
-      return names.filter((n) => n.endsWith(".md")).map((n) => join7(this.dir, n));
+      return names.filter((n) => n.endsWith(".md")).map((n) => join5(this.dir, n));
     } catch (e) {
       if (e.code === "ENOENT")
         return [];
@@ -797,7 +550,7 @@ __export(dist_exports6, {
 
 // ../modules/tool-rules/dist/catalog.js
 import { readdir as readdir5, readFile as readFile5 } from "fs/promises";
-import { basename as basename4, extname as extname4, join as join8 } from "path";
+import { basename as basename4, extname as extname4, join as join6 } from "path";
 var ToolRuleCatalog = class {
   dir;
   constructor(dir) {
@@ -830,7 +583,7 @@ var ToolRuleCatalog = class {
   async entries() {
     try {
       const names = await readdir5(this.dir);
-      return names.filter((n) => n.endsWith(".md")).map((n) => join8(this.dir, n));
+      return names.filter((n) => n.endsWith(".md")).map((n) => join6(this.dir, n));
     } catch (e) {
       if (e.code === "ENOENT")
         return [];
@@ -2094,7 +1847,7 @@ __export(dist_exports8, {
 
 // ../modules/worklog/dist/store.js
 import { readdir as readdir6, readFile as readFile6, stat as stat2 } from "fs/promises";
-import { join as join9, resolve as resolve3, sep as sep2 } from "path";
+import { join as join7, resolve, sep } from "path";
 var FILENAME_PATTERN = /^(\d{4}-\d{2}-\d{2})(?:_(\d{4}))?-(.+)\.md$/;
 var MONTH_PATTERN = /^\d{2}$/;
 var YEAR_PATTERN = /^\d{4}$/;
@@ -2108,17 +1861,17 @@ var WorklogStore = class {
     const years = await this.listSubdirs(this.rootDir, YEAR_PATTERN);
     const entries = [];
     for (const year of years) {
-      const yearDir = join9(this.rootDir, year);
+      const yearDir = join7(this.rootDir, year);
       const months = await this.listSubdirs(yearDir, MONTH_PATTERN);
       for (const month of months) {
-        entries.push(...await this.entriesIn(join9(yearDir, month)));
+        entries.push(...await this.entriesIn(join7(yearDir, month)));
       }
     }
     return entries.sort(compareWorklog);
   }
   /** Entries within one calendar month. */
   async listByMonth(year, month) {
-    const monthDir = join9(this.rootDir, String(year).padStart(4, "0"), String(month).padStart(2, "0"));
+    const monthDir = join7(this.rootDir, String(year).padStart(4, "0"), String(month).padStart(2, "0"));
     const entries = await this.entriesIn(monthDir);
     return entries.sort(compareWorklog);
   }
@@ -2131,7 +1884,7 @@ var WorklogStore = class {
     const [year, month] = date.split("-");
     if (!year || !month)
       return void 0;
-    const monthDir = join9(this.rootDir, year, month);
+    const monthDir = join7(this.rootDir, year, month);
     const entries = (await this.entriesIn(monthDir)).filter((e) => e.date === date).sort(compareWorklog);
     return entries[0];
   }
@@ -2153,7 +1906,7 @@ var WorklogStore = class {
     const [year, month] = date.split("-");
     validateSegment("keyword", keyword);
     const stem = time ? `${date}_${time}-${keyword}` : `${date}-${keyword}`;
-    const abs = join9(this.rootDir, year, month, `${stem}.md`);
+    const abs = join7(this.rootDir, year, month, `${stem}.md`);
     assertContained(abs, this.rootDir);
     return abs;
   }
@@ -2181,7 +1934,7 @@ var WorklogStore = class {
       const match = name.match(FILENAME_PATTERN);
       if (!match)
         continue;
-      const path = join9(monthDir, name);
+      const path = join7(monthDir, name);
       try {
         const info = await stat2(path);
         if (!info.isFile())
@@ -2222,15 +1975,15 @@ function validateSegment(label, value) {
     throw new Error(`${label} must not contain NUL or control characters: ${value}`);
 }
 function assertContained(abs, rootDir) {
-  const root = resolve3(rootDir);
-  const target = resolve3(abs);
-  if (target !== root && !(target + sep2).startsWith(root + sep2)) {
+  const root = resolve(rootDir);
+  const target = resolve(abs);
+  if (target !== root && !(target + sep).startsWith(root + sep)) {
     throw new Error(`Refusing to write outside the store directory: ${abs}`);
   }
 }
 
 // ../modules/worklog/dist/append.js
-import { readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile3 } from "fs/promises";
 async function appendSection(entry, title, body) {
   const original = await readFile7(entry.path, "utf8");
   const trimmed = original.replace(/\s+$/u, "");
@@ -2241,7 +1994,7 @@ ${body.trimEnd()}
   const next = `${trimmed}
 
 ${section}`;
-  await writeFile4(entry.path, next, "utf8");
+  await writeFile3(entry.path, next, "utf8");
   return next;
 }
 
@@ -2254,7 +2007,7 @@ __export(dist_exports9, {
 
 // ../modules/decision-log/dist/store.js
 import { readdir as readdir7, readFile as readFile8, stat as stat3 } from "fs/promises";
-import { join as join10, resolve as resolve4, sep as sep3 } from "path";
+import { join as join8, resolve as resolve2, sep as sep2 } from "path";
 var FILENAME_PATTERN2 = /^(\d{4}-\d{2}-\d{2})-(.+)\.md$/;
 var DecisionStore = class {
   rootDir;
@@ -2276,7 +2029,7 @@ var DecisionStore = class {
       const match = name.match(FILENAME_PATTERN2);
       if (!match)
         continue;
-      const path = join10(this.rootDir, name);
+      const path = join8(this.rootDir, name);
       try {
         const info = await stat3(path);
         if (!info.isFile())
@@ -2348,7 +2101,7 @@ var DecisionStore = class {
       throw new Error(`Invalid date: ${date} (expected YYYY-MM-DD)`);
     }
     validateSegment2("slug", slug);
-    const abs = join10(this.rootDir, `${date}-${slug}.md`);
+    const abs = join8(this.rootDir, `${date}-${slug}.md`);
     assertContained2(abs, this.rootDir);
     return abs;
   }
@@ -2367,9 +2120,9 @@ function validateSegment2(label, value) {
     throw new Error(`${label} must not contain NUL or control characters: ${value}`);
 }
 function assertContained2(abs, rootDir) {
-  const root = resolve4(rootDir);
-  const target = resolve4(abs);
-  if (target !== root && !(target + sep3).startsWith(root + sep3)) {
+  const root = resolve2(rootDir);
+  const target = resolve2(abs);
+  if (target !== root && !(target + sep2).startsWith(root + sep2)) {
     throw new Error(`Refusing to write outside the store directory: ${abs}`);
   }
 }
@@ -2434,7 +2187,7 @@ __export(dist_exports10, {
 
 // ../modules/index-generator/dist/scan.js
 import { readdir as readdir8, readFile as readFile9, stat as stat4 } from "fs/promises";
-import { basename as basename5, extname as extname5, join as join11, relative as relative2 } from "path";
+import { basename as basename5, extname as extname5, join as join9, relative } from "path";
 var RESERVED_FILES = /* @__PURE__ */ new Set(["README.md", "_INDEX.md"]);
 var H1_PATTERN = /^#\s+(.+?)\s*$/m;
 async function scanDirectory(rootDir, opts = {}) {
@@ -2464,7 +2217,7 @@ async function walk(rootDir, currentDir, recursive, skipFilenames, skipPrefixes,
         continue;
       if (name.startsWith(".") || name.startsWith("_"))
         continue;
-      await walk(rootDir, join11(currentDir, name), recursive, skipFilenames, skipPrefixes, out);
+      await walk(rootDir, join9(currentDir, name), recursive, skipFilenames, skipPrefixes, out);
       continue;
     }
     if (!dirent.isFile())
@@ -2476,7 +2229,7 @@ async function walk(rootDir, currentDir, recursive, skipFilenames, skipPrefixes,
     const nameNoExt = basename5(name, ".md");
     if (skipPrefixes.some((p) => nameNoExt.startsWith(p)))
       continue;
-    const fullPath = join11(currentDir, name);
+    const fullPath = join9(currentDir, name);
     let info;
     try {
       info = await stat4(fullPath);
@@ -2493,7 +2246,7 @@ async function walk(rootDir, currentDir, recursive, skipFilenames, skipPrefixes,
     const updated = stringField(frontmatter, "updated") ?? stringField(frontmatter, "created");
     const scope = stringField(frontmatter, "scope");
     out.push({
-      relPath: relative2(rootDir, fullPath).split(/[\\/]/).join("/"),
+      relPath: relative(rootDir, fullPath).split(/[\\/]/).join("/"),
       name: nameNoExt,
       title,
       description,
@@ -2632,7 +2385,7 @@ function today() {
 
 // ../modules/index-generator/dist/nested.js
 import { readdir as readdir9, stat as stat5 } from "fs/promises";
-import { extname as extname6, join as join12 } from "path";
+import { extname as extname6, join as join10 } from "path";
 async function findIndexableDirs(rootDir, options = {}) {
   const minEntries = options.minEntries ?? 1;
   const skipPrefixes = options.skipPrefixes ?? [];
@@ -2668,7 +2421,7 @@ async function walk2(dir, minEntries, skipPrefixes, out) {
     if (skipPrefixes.some((p) => nameNoExt.startsWith(p)))
       continue;
     try {
-      const info = await stat5(join12(dir, dirent.name));
+      const info = await stat5(join10(dir, dirent.name));
       if (!info.isFile())
         continue;
     } catch {
@@ -2680,7 +2433,7 @@ async function walk2(dir, minEntries, skipPrefixes, out) {
     out.push(dir);
   }
   for (const name of subdirs) {
-    await walk2(join12(dir, name), minEntries, skipPrefixes, out);
+    await walk2(join10(dir, name), minEntries, skipPrefixes, out);
   }
 }
 
@@ -2692,7 +2445,7 @@ __export(dist_exports11, {
 
 // ../modules/runbooks/dist/store.js
 import { readdir as readdir10, readFile as readFile10, stat as stat6 } from "fs/promises";
-import { extname as extname7, join as join13 } from "path";
+import { extname as extname7, join as join11 } from "path";
 var RESERVED_FILES2 = /* @__PURE__ */ new Set(["README.md", "_INDEX.md"]);
 var RunbookStore = class {
   rootDir;
@@ -2715,7 +2468,7 @@ var RunbookStore = class {
         continue;
       if (RESERVED_FILES2.has(name))
         continue;
-      const path = join13(this.rootDir, name);
+      const path = join11(this.rootDir, name);
       try {
         const info = await stat6(path);
         if (!info.isFile())
@@ -2824,7 +2577,7 @@ function extractWikiLinks(body) {
 
 // ../modules/link-rewriter/dist/resolve.js
 import { readdir as readdir11 } from "fs/promises";
-import { basename as basename6, dirname, extname as extname8, isAbsolute as isAbsolute2, join as join14, relative as relative3, resolve as pathResolve } from "path";
+import { basename as basename6, dirname, extname as extname8, isAbsolute, join as join12, relative as relative2, resolve as pathResolve } from "path";
 async function buildFileIndex(rootDir, options = {}) {
   const byBasename = /* @__PURE__ */ new Map();
   const byRelPath = /* @__PURE__ */ new Map();
@@ -2857,7 +2610,7 @@ async function walk3(rootDir, dir, byBasename, byRelPath, additionalExts) {
     if (dirent.isDirectory()) {
       if (name.startsWith("."))
         continue;
-      await walk3(rootDir, join14(dir, name), byBasename, byRelPath, additionalExts);
+      await walk3(rootDir, join12(dir, name), byBasename, byRelPath, additionalExts);
       continue;
     }
     if (!dirent.isFile())
@@ -2866,7 +2619,7 @@ async function walk3(rootDir, dir, byBasename, byRelPath, additionalExts) {
     const isMd = ext === ".md";
     if (!isMd && !additionalExts.has(ext))
       continue;
-    const path = join14(dir, name);
+    const path = join12(dir, name);
     const key = isMd ? basename6(name, ".md") : name;
     const list = byBasename.get(key);
     if (list) {
@@ -2874,7 +2627,7 @@ async function walk3(rootDir, dir, byBasename, byRelPath, additionalExts) {
     } else {
       byBasename.set(key, [path]);
     }
-    const relRaw = relative3(rootDir, path).split(/[\\/]/).join("/");
+    const relRaw = relative2(rootDir, path).split(/[\\/]/).join("/");
     const rel = isMd ? relRaw.replace(/\.md$/, "") : relRaw;
     byRelPath.set(rel, path);
   }
@@ -2895,8 +2648,8 @@ function resolveLink(name, index, opts = {}) {
       return { kind: "not-found" };
     const baseDir = dirname(opts.sourcePath);
     const absolute = pathResolve(baseDir, normalized);
-    const rel = relative3(index.rootDir, absolute).split(/[\\/]/).join("/");
-    if (rel === ".." || rel.startsWith("../") || isAbsolute2(rel)) {
+    const rel = relative2(index.rootDir, absolute).split(/[\\/]/).join("/");
+    if (rel === ".." || rel.startsWith("../") || isAbsolute(rel)) {
       return { kind: "not-found" };
     }
     return lookupRelPath(rel, index);
@@ -2915,7 +2668,7 @@ function lookupRelPath(rel, index) {
   return { kind: "not-found" };
 }
 function toRel(path, rootDir) {
-  return relative3(rootDir, path).split(/[\\/]/).join("/");
+  return relative2(rootDir, path).split(/[\\/]/).join("/");
 }
 
 // ../modules/link-rewriter/dist/checker.js
@@ -2965,7 +2718,7 @@ function topBrokenTargets(broken, limit = 20) {
 }
 
 // ../modules/link-rewriter/dist/rewrite.js
-import { readFile as readFile12, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile12, writeFile as writeFile4 } from "fs/promises";
 import { extname as extname10 } from "path";
 async function rewriteDirectory(rootDir, opts) {
   const { redirections, dryRun = false } = opts;
@@ -2987,7 +2740,7 @@ async function rewriteDirectory(rootDir, opts) {
       rewritesApplied += fileRewrites.length;
       details.push({ sourcePath: path, rewrites: fileRewrites });
       if (!dryRun) {
-        await writeFile5(path, newBody, "utf8");
+        await writeFile4(path, newBody, "utf8");
       }
     }
   }
@@ -3091,18 +2844,18 @@ function normalizePath(p) {
 }
 
 // ../modules/proactive-curator/dist/doc-writer.js
-import { existsSync as existsSync2 } from "fs";
+import { existsSync } from "fs";
 import { appendFile, mkdir as mkdir2, readFile as readFile13 } from "fs/promises";
-import { dirname as dirname2, join as join15 } from "path";
+import { dirname as dirname2, join as join13 } from "path";
 async function writeDocAction(cwd, action) {
-  const dataDir = join15(cwd, "data");
+  const dataDir = join13(cwd, "data");
   const abs = validateDataRelativePath(dataDir, action.targetRelPath);
   if (action.kind === "create-file") {
     await mkdir2(dirname2(abs), { recursive: true });
     await exclusiveCreateFile(abs, action.body);
     return { writtenPath: abs, kind: "create-file" };
   }
-  if (!existsSync2(abs)) {
+  if (!existsSync(abs)) {
     throw new Error(`Cannot append-section: target file does not exist: ${action.targetRelPath}. append-section adds to an existing document; use create-file for a new one.`);
   }
   const existing = await readFile13(abs, "utf8");
@@ -3115,9 +2868,9 @@ ${action.body}`;
 }
 
 // ../modules/proactive-curator/dist/decline-store.js
-import { existsSync as existsSync3 } from "fs";
-import { appendFile as appendFile2, mkdir as mkdir3, readFile as readFile14, writeFile as writeFile6 } from "fs/promises";
-import { join as join16 } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { appendFile as appendFile2, mkdir as mkdir3, readFile as readFile14, writeFile as writeFile5 } from "fs/promises";
+import { join as join14 } from "path";
 var STORE_DIR = "data/_proactive-curator";
 var DECLINED_FILE = "declined.json";
 var ACCEPTED_LOG = "accepted.log";
@@ -3155,7 +2908,7 @@ async function recordDecline(cwd, args) {
     ...args.sourceDocs ? { sourceDocs: args.sourceDocs } : {}
   };
   updated[args.kind] = { ...updated[args.kind], [args.fingerprint]: entry };
-  await writeFile6(join16(cwd, STORE_DIR, DECLINED_FILE), JSON.stringify(updated, null, 2) + "\n", "utf8");
+  await writeFile5(join14(cwd, STORE_DIR, DECLINED_FILE), JSON.stringify(updated, null, 2) + "\n", "utf8");
 }
 async function recordAcceptance(cwd, args) {
   await ensureStoreDir(cwd);
@@ -3167,19 +2920,19 @@ async function recordAcceptance(cwd, args) {
     actionKind: args.actionKind,
     writtenPath: args.writtenPath
   });
-  await appendFile2(join16(cwd, STORE_DIR, ACCEPTED_LOG), line + "\n", "utf8");
+  await appendFile2(join14(cwd, STORE_DIR, ACCEPTED_LOG), line + "\n", "utf8");
 }
 async function resetDeclined(cwd, kind) {
-  const file = join16(cwd, STORE_DIR, DECLINED_FILE);
-  if (!existsSync3(file))
+  const file = join14(cwd, STORE_DIR, DECLINED_FILE);
+  if (!existsSync2(file))
     return;
   if (kind === void 0) {
-    await writeFile6(file, JSON.stringify(emptyDeclinedFile(), null, 2) + "\n", "utf8");
+    await writeFile5(file, JSON.stringify(emptyDeclinedFile(), null, 2) + "\n", "utf8");
     return;
   }
   const parsed = await readDeclinedFile(cwd) ?? emptyDeclinedFile();
   parsed[kind] = {};
-  await writeFile6(file, JSON.stringify(parsed, null, 2) + "\n", "utf8");
+  await writeFile5(file, JSON.stringify(parsed, null, 2) + "\n", "utf8");
 }
 function isActive(entry, nowMs) {
   const expiresMs = new Date(entry.expiresAt).getTime();
@@ -3200,8 +2953,8 @@ function purgeExpired(entries, now) {
   return out;
 }
 async function readDeclinedFile(cwd) {
-  const file = join16(cwd, STORE_DIR, DECLINED_FILE);
-  if (!existsSync3(file))
+  const file = join14(cwd, STORE_DIR, DECLINED_FILE);
+  if (!existsSync2(file))
     return null;
   try {
     const raw = await readFile14(file, "utf8");
@@ -3218,14 +2971,14 @@ function emptyDeclinedFile() {
   return { "capture-insight": {}, "create-hub": {} };
 }
 async function ensureStoreDir(cwd) {
-  await mkdir3(join16(cwd, STORE_DIR), { recursive: true });
+  await mkdir3(join14(cwd, STORE_DIR), { recursive: true });
 }
 
 // ../modules/proactive-curator/dist/insight-proposer.js
-import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir4, readFile as readFile15, readdir as readdir12, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname3, join as join17 } from "path";
-var SYSTEM_META_DIRS2 = /* @__PURE__ */ new Set([
+import { existsSync as existsSync3 } from "fs";
+import { mkdir as mkdir4, readFile as readFile15, readdir as readdir12, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname3, join as join15 } from "path";
+var SYSTEM_META_DIRS = /* @__PURE__ */ new Set([
   "worklog",
   "decision-log",
   "runbooks",
@@ -3435,7 +3188,7 @@ function normalizePlacementDecision(raw) {
 function isSystemMetaPath(p) {
   const normalized = p.replace(/\\/g, "/").replace(/^\/+/, "");
   const first = normalized.split("/")[0] ?? "";
-  if (SYSTEM_META_DIRS2.has(first))
+  if (SYSTEM_META_DIRS.has(first))
     return true;
   if (first.startsWith("_"))
     return true;
@@ -3530,7 +3283,7 @@ function joinDataPath(...parts) {
   return parts.filter((p) => p.length > 0).map((p) => p.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "")).join("/");
 }
 async function applyAction(cwd, action) {
-  const dataDir = join17(cwd, "data");
+  const dataDir = join15(cwd, "data");
   switch (action.kind) {
     case "create-file": {
       const res = await writeDocAction(cwd, {
@@ -3560,7 +3313,7 @@ async function applyAction(cwd, action) {
       const rel = joinDataPath(action.filePath);
       const file = validateDataRelativePath(dataDir, rel);
       await mkdir4(dirname3(file), { recursive: true });
-      await writeFile7(file, action.body, "utf8");
+      await writeFile6(file, action.body, "utf8");
       return file;
     }
   }
@@ -3575,8 +3328,8 @@ function nextActionHintFor(action) {
   return `New file at ${action.folderPath}/${action.filename}. Add cross-links from related docs as the topic grows.`;
 }
 async function scanTopicTree(cwd, maxEntries) {
-  const dataDir = join17(cwd, "data");
-  if (!existsSync4(dataDir)) {
+  const dataDir = join15(cwd, "data");
+  if (!existsSync3(dataDir)) {
     return { folders: [], truncated: false };
   }
   const folders = [];
@@ -3603,7 +3356,7 @@ async function scanTopicTree(cwd, maxEntries) {
       } else if (e.isFile() && e.name.endsWith(".md")) {
         if (e.name === "README.md" || e.name === "_INDEX.md" || e.name === "MEMORY.md")
           continue;
-        const filePath = join17(absDir, e.name);
+        const filePath = join15(absDir, e.name);
         let frontmatterTopic;
         let tags;
         try {
@@ -3640,14 +3393,14 @@ async function scanTopicTree(cwd, maxEntries) {
         return;
       }
       const childRel = joinDataPath(relDir, d2);
-      await visit(join17(absDir, d2), childRel);
+      await visit(join15(absDir, d2), childRel);
     }
   }
   await visit(dataDir, "");
   return { folders, truncated };
 }
 function isReservedDir(name, atRoot) {
-  if (atRoot && SYSTEM_META_DIRS2.has(name))
+  if (atRoot && SYSTEM_META_DIRS.has(name))
     return true;
   if (name.startsWith("."))
     return true;
@@ -3657,9 +3410,9 @@ function isReservedDir(name, atRoot) {
 }
 
 // ../modules/proactive-curator/dist/hub-proposer.js
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { mkdir as mkdir5, readFile as readFile16, readdir as readdir13 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join16 } from "path";
 var DEFAULT_CATEGORIES = [
   "worklog",
   "decision-log",
@@ -3746,13 +3499,13 @@ var HubProposer = class {
   }
 };
 async function scanDocs(cwd, categories) {
-  const dataDir = join18(cwd, "data");
-  if (!existsSync5(dataDir))
+  const dataDir = join16(cwd, "data");
+  if (!existsSync4(dataDir))
     return [];
   const out = [];
   for (const category of categories) {
-    const abs = join18(dataDir, category);
-    if (!existsSync5(abs))
+    const abs = join16(dataDir, category);
+    if (!existsSync4(abs))
       continue;
     await walk4(abs, category, out);
   }
@@ -3769,13 +3522,13 @@ async function walk4(absDir, relPath, acc) {
     if (e.isDirectory()) {
       if (e.name.startsWith(".") || e.name.startsWith("_"))
         continue;
-      await walk4(join18(absDir, e.name), `${relPath}/${e.name}`, acc);
+      await walk4(join16(absDir, e.name), `${relPath}/${e.name}`, acc);
     } else if (e.isFile() && e.name.endsWith(".md")) {
       if (e.name === "README.md" || e.name === "_INDEX.md" || e.name === "MEMORY.md")
         continue;
       if (e.name.startsWith("_TEMPLATE"))
         continue;
-      const filePath = join18(absDir, e.name);
+      const filePath = join16(absDir, e.name);
       let frontmatterTopic;
       let tags = [];
       try {
@@ -3846,8 +3599,8 @@ function pickCluster(clusters, weakThreshold, cwd) {
   for (const c of clusters) {
     if (c.docs.length < weakThreshold)
       return null;
-    const hubPath = join18(cwd, "data", HUB_DIR, `_HUB-${c.topic}.md`);
-    if (existsSync5(hubPath))
+    const hubPath = join16(cwd, "data", HUB_DIR, `_HUB-${c.topic}.md`);
+    if (existsSync4(hubPath))
       continue;
     return c;
   }
@@ -3970,9 +3723,9 @@ async function applyHubCreate(cwd, action) {
   if (fn.trim().length === 0 || fn === "." || fn === ".." || unsafe.test(fn)) {
     throw new Error(`Refusing to create hub: unsafe filename "${action.filename}" \u2014 must be a plain basename with no path separators, traversal, or reserved characters (including ":").`);
   }
-  const folder = join18(cwd, "data", HUB_DIR);
+  const folder = join16(cwd, "data", HUB_DIR);
   await mkdir5(folder, { recursive: true });
-  const file = join18(folder, fn);
+  const file = join16(folder, fn);
   await exclusiveCreateFile(file, action.body);
   return file;
 }
@@ -4259,6 +4012,10 @@ var ClaudeDesktopLLMJudge = class extends InjectedLLMJudge {
 var dist_exports14 = {};
 __export(dist_exports14, {
   DEFAULT_GAP_WINDOW_DAYS: () => DEFAULT_GAP_WINDOW_DAYS,
+  FAILURES_DIR: () => FAILURES_DIR,
+  GUARD_DENIAL_KEY: () => GUARD_DENIAL_KEY,
+  GUARD_WRITE_COMMAND: () => GUARD_WRITE_COMMAND,
+  GUARD_WRITE_MATCHER: () => GUARD_WRITE_MATCHER,
   HANDOFF_ARCHIVE_DIR: () => HANDOFF_ARCHIVE_DIR,
   HANDOFF_DIR: () => HANDOFF_DIR,
   OWNERSHIP_SCHEMA: () => OWNERSHIP_SCHEMA,
@@ -4269,6 +4026,7 @@ __export(dist_exports14, {
   applyGlobalSetup: () => applyGlobalSetup,
   argvToSlash: () => argvToSlash,
   autoReindexMemory: () => autoReindexMemory,
+  buildDenyDecision: () => buildDenyDecision,
   buildInstallCommand: () => buildInstallCommand,
   buildOwnershipManifest: () => buildOwnershipManifest,
   buildRegistry: () => buildRegistry,
@@ -4294,6 +4052,8 @@ __export(dist_exports14, {
   ensureWorklogEntry: () => ensureWorklogEntry,
   extractNextUp: () => extractNextUp,
   extractOpenTasks: () => extractOpenTasks,
+  failureReportSlice: () => failureReportSlice,
+  findControlChar: () => findControlChar,
   formatTokens: () => formatTokens,
   formatWindow: () => formatWindow,
   gapWindowSinceArg: () => gapWindowSinceArg,
@@ -4301,12 +4061,15 @@ __export(dist_exports14, {
   globalSettingsHasHook: () => globalSettingsHasHook,
   globalSettingsPath: () => globalSettingsPath,
   globalStatePath: () => globalStatePath,
+  guardWriteDecision: () => guardWriteDecision,
   handoffCommand: () => handoffCommand,
   inspectGlobalSetup: () => inspectGlobalSetup,
   inspectOwnership: () => inspectOwnership,
   isInstanceRoot: () => isInstanceRoot,
   isNewer: () => isNewer,
   isStableUpdate: () => isStableUpdate,
+  isValidFailureKey: () => isValidFailureKey,
+  ladderStage: () => ladderStage,
   logCommand: () => logCommand,
   makeBar: () => makeBar,
   ownershipManifestPath: () => ownershipManifestPath,
@@ -4318,23 +4081,30 @@ __export(dist_exports14, {
   readGlobalInstancePointer: () => readGlobalInstancePointer,
   readInstalledBaseVersion: () => readInstalledBaseVersion,
   recallCommand: () => recallCommand,
+  recordFailure: () => recordFailure,
   recordGlobalSetupDecline: () => recordGlobalSetupDecline,
+  recordGuardDenial: () => recordGuardDenial,
   reindexCommand: () => reindexCommand,
   renderAgenda: () => renderAgenda,
   renderGlobalBlock: () => renderGlobalBlock,
   renderSessionStartReport: () => renderSessionStartReport,
   renderStatusline: () => renderStatusline,
   repairOwnershipManifest: () => repairOwnershipManifest,
+  resolveInstanceRoot: () => resolveInstanceRoot,
   resolveRepoRoot: () => resolveRepoRoot,
   runCurateAccept: () => runCurateAccept,
   runCurateCandidates: () => runCurateCandidates,
   runCurateDecline: () => runCurateDecline,
   runCuratePreview: () => runCuratePreview,
+  runFailureCli: () => runFailureCli,
+  runGuardCli: () => runGuardCli,
   runStatuslineCli: () => runStatuslineCli,
   runTemplatesUpdate: () => runTemplatesUpdate,
   runVortexCli: () => runVortexCli,
   safeSegment: () => safeSegment,
+  scanFailures: () => scanFailures,
   scanHandoffs: () => scanHandoffs,
+  scanToolInput: () => scanToolInput,
   serializeSettings: () => serializeSettings,
   sessionStartCommand: () => sessionStartCommand,
   sniffEffortFromTranscript: () => sniffEffortFromTranscript,
@@ -4448,7 +4218,7 @@ function curateCommand(options) {
 }
 
 // ../plugins/session-rituals/dist/commands/recall.js
-import { join as join19 } from "path";
+import { join as join17 } from "path";
 function asMode(s) {
   return s === "keyword" || s === "semantic" || s === "hybrid" ? s : void 0;
 }
@@ -4484,7 +4254,7 @@ function parseRecallArgs(rest, defaultK) {
   return out;
 }
 function defaultDbPath(ctx) {
-  return join19(ctx.dataDir, "_indexes", "memory.sqlite");
+  return join17(ctx.dataDir, "_indexes", "memory.sqlite");
 }
 function recallCommand(options) {
   const defaultK = options.defaultK ?? 5;
@@ -4542,9 +4312,9 @@ function recallCommand(options) {
 }
 
 // ../plugins/session-rituals/dist/commands/decision.js
-import { writeFile as writeFile8 } from "fs/promises";
-import { join as join20 } from "path";
-import { existsSync as existsSync6 } from "fs";
+import { writeFile as writeFile7 } from "fs/promises";
+import { join as join18 } from "path";
+import { existsSync as existsSync5 } from "fs";
 var decisionCommand = {
   name: "decision",
   description: "Create a new Decision Log entry from the canonical template at `data/decision-log/<today>-<slug>.md`. Refuses to overwrite an existing file.",
@@ -4562,14 +4332,14 @@ var decisionCommand = {
       throw new Error("`/decision` requires a title after the slug.");
     }
     const date = todayIso();
-    const dir = join20(input.context.dataDir, "decision-log");
+    const dir = join18(input.context.dataDir, "decision-log");
     const store = new DecisionStore(dir);
     const path = store.pathFor(date, slug);
-    if (existsSync6(path)) {
+    if (existsSync5(path)) {
       throw new Error(`Refusing to overwrite existing entry: ${path}`);
     }
     const body = renderTemplate({ date, slug, title });
-    await writeFile8(path, body, "utf8");
+    await writeFile7(path, body, "utf8");
     return { path, date, slug };
   }
 };
@@ -4589,9 +4359,9 @@ function todayIso() {
 }
 
 // ../plugins/session-rituals/dist/commands/reindex.js
-import { existsSync as existsSync7 } from "fs";
-import { readFile as readFile17, writeFile as writeFile9, utimes } from "fs/promises";
-import { join as join21 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { readFile as readFile17, writeFile as writeFile8, utimes } from "fs/promises";
+import { join as join19 } from "path";
 var TARGETS = [
   {
     dir: "_memory",
@@ -4701,8 +4471,8 @@ var reindexCommand = {
     }
     const results = [];
     for (const t of targets) {
-      const dir = join21(input.context.dataDir, t.dir);
-      if (!existsSync7(dir)) {
+      const dir = join19(input.context.dataDir, t.dir);
+      if (!existsSync6(dir)) {
         results.push({ dir: t.dir, status: "missing", entries: 0, bytes: 0 });
         continue;
       }
@@ -4717,7 +4487,7 @@ var reindexCommand = {
         entries,
         privacy: t.privacy
       });
-      const target = join21(dir, "_INDEX.md");
+      const target = join19(dir, "_INDEX.md");
       let existing;
       try {
         existing = await readFile17(target, "utf8");
@@ -4733,7 +4503,7 @@ var reindexCommand = {
         });
         continue;
       }
-      await writeFile9(target, body, "utf8");
+      await writeFile8(target, body, "utf8");
       results.push({
         dir: t.dir,
         status: "written",
@@ -4749,8 +4519,8 @@ async function autoReindexMemory(ctx) {
     const target = TARGETS.find((t) => t.dir === "_memory");
     if (!target)
       return "missing";
-    const dir = join21(ctx.dataDir, target.dir);
-    if (!existsSync7(dir))
+    const dir = join19(ctx.dataDir, target.dir);
+    if (!existsSync6(dir))
       return "missing";
     const entries = await scanDirectory(dir, {
       recursive: target.recursive,
@@ -4763,7 +4533,7 @@ async function autoReindexMemory(ctx) {
       entries,
       privacy: target.privacy
     });
-    const indexPath = join21(dir, "_INDEX.md");
+    const indexPath = join19(dir, "_INDEX.md");
     let existing;
     try {
       existing = await readFile17(indexPath, "utf8");
@@ -4775,10 +4545,10 @@ async function autoReindexMemory(ctx) {
     if (sameListing) {
       status = "unchanged";
     } else {
-      await writeFile9(indexPath, body, "utf8");
+      await writeFile8(indexPath, body, "utf8");
       status = "written";
     }
-    if (existsSync7(indexPath)) {
+    if (existsSync6(indexPath)) {
       const now = /* @__PURE__ */ new Date();
       await utimes(indexPath, now, now);
     }
@@ -4792,9 +4562,9 @@ function stripIndexDate(body) {
 }
 
 // ../plugins/session-rituals/dist/commands/session-start.js
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { readdir as readdir14 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join20 } from "path";
 var COUNTED_DIRS = ["_memory", "worklog", "decision-log"];
 var sessionStartCommand = {
   name: "session-start",
@@ -4804,8 +4574,8 @@ var sessionStartCommand = {
     const counts = {};
     const missing = [];
     for (const name of COUNTED_DIRS) {
-      const dir = join22(dataDir, name);
-      if (!existsSync8(dir)) {
+      const dir = join20(dataDir, name);
+      if (!existsSync7(dir)) {
         missing.push(name);
         counts[name] = 0;
         continue;
@@ -4837,7 +4607,7 @@ async function countMarkdown(dir, recursive) {
     } else if (e.isDirectory() && recursive) {
       if (e.name.startsWith(".") || e.name.startsWith("_"))
         continue;
-      total += await countMarkdown(join22(dir, e.name), recursive);
+      total += await countMarkdown(join20(dir, e.name), recursive);
     }
   }
   return total;
@@ -4883,9 +4653,9 @@ function todayIso2() {
 }
 
 // ../plugins/session-rituals/dist/handoff.js
-import { existsSync as existsSync9 } from "fs";
-import { mkdir as mkdir6, open, readdir as readdir15, readFile as readFile18, rename as rename2, stat as stat7 } from "fs/promises";
-import { join as join23 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { mkdir as mkdir6, open, readdir as readdir15, readFile as readFile18, rename, stat as stat7 } from "fs/promises";
+import { join as join21 } from "path";
 
 // ../plugins/session-rituals/dist/agenda.js
 var DEFAULT_RECENT = 7;
@@ -5083,7 +4853,7 @@ async function createHandoffSkeleton(dataDir, opts) {
   const now = opts?.now ?? /* @__PURE__ */ new Date();
   const date = isoDate(now);
   const time = isoTime(now);
-  const dir = join23(dataDir, HANDOFF_DIR);
+  const dir = join21(dataDir, HANDOFF_DIR);
   await mkdir6(dir, { recursive: true });
   const stamp = `${date} ${time.slice(0, 2)}:${time.slice(2)}`;
   const title = (opts?.title ?? "").trim();
@@ -5091,7 +4861,7 @@ async function createHandoffSkeleton(dataDir, opts) {
   const base = `${date}_${time}`;
   for (let i = 0; i < MAX_COLLISION_TRIES; i++) {
     const name = i === 0 ? `${base}.md` : `${base}-${i + 1}.md`;
-    const abs = join23(dir, name);
+    const abs = join21(dir, name);
     try {
       const fh = await open(abs, "wx");
       try {
@@ -5125,8 +4895,8 @@ ${heading}
 `;
 }
 async function scanHandoffs(dataDir, opts) {
-  const dir = join23(dataDir, HANDOFF_DIR);
-  if (!existsSync9(dir))
+  const dir = join21(dataDir, HANDOFF_DIR);
+  if (!existsSync8(dir))
     return { active: [], omitted: 0 };
   let names;
   try {
@@ -5140,7 +4910,7 @@ async function scanHandoffs(dataDir, opts) {
   const omitted = Math.max(0, matched.length - take.length);
   const active = [];
   for (const { name, m: m2 } of take) {
-    const abs = join23(dir, name);
+    const abs = join21(dir, name);
     let title = name.replace(/\.md$/, "");
     let nextUp = [];
     try {
@@ -5160,8 +4930,8 @@ async function scanHandoffs(dataDir, opts) {
 async function pruneHandoffs(dataDir, opts) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const retentionDays = opts.retentionDays;
-  const dir = join23(dataDir, HANDOFF_DIR);
-  if (!existsSync9(dir) || !(retentionDays > 0))
+  const dir = join21(dataDir, HANDOFF_DIR);
+  if (!existsSync8(dir) || !(retentionDays > 0))
     return { archived: 0 };
   let names;
   try {
@@ -5173,21 +4943,21 @@ async function pruneHandoffs(dataDir, opts) {
   const stale = names.map((name) => ({ name, m: name.match(HANDOFF_PATTERN) })).filter((x2) => x2.m !== null && x2.m[1] < cutoff);
   if (stale.length === 0)
     return { archived: 0 };
-  const archiveDir = join23(dir, HANDOFF_ARCHIVE_DIR);
+  const archiveDir = join21(dir, HANDOFF_ARCHIVE_DIR);
   await mkdir6(archiveDir, { recursive: true });
   let archived = 0;
   for (const { name } of stale) {
-    const from = join23(dir, name);
-    let to = join23(archiveDir, name);
-    if (existsSync9(to)) {
+    const from = join21(dir, name);
+    let to = join21(archiveDir, name);
+    if (existsSync8(to)) {
       const stem = name.replace(/\.md$/, "");
       let i = 2;
-      while (existsSync9(join23(archiveDir, `${stem}-${i}.md`)))
+      while (existsSync8(join21(archiveDir, `${stem}-${i}.md`)))
         i++;
-      to = join23(archiveDir, `${stem}-${i}.md`);
+      to = join21(archiveDir, `${stem}-${i}.md`);
     }
     try {
-      await rename2(from, to);
+      await rename(from, to);
       archived++;
     } catch {
     }
@@ -5235,16 +5005,16 @@ var handoffCommand = {
 
 // ../plugins/session-rituals/dist/commands/vortex.js
 import { spawn } from "child_process";
-import { constants, existsSync as existsSync12 } from "fs";
-import { copyFile as copyFile2, mkdir as mkdir9, readdir as readdir16, readFile as readFile21, stat as stat8, writeFile as writeFile11 } from "fs/promises";
-import { basename as basename7, dirname as dirname5, extname as extname11, join as join26, relative as relative5 } from "path";
+import { constants, existsSync as existsSync11 } from "fs";
+import { copyFile as copyFile2, mkdir as mkdir9, readdir as readdir16, readFile as readFile21, stat as stat8, writeFile as writeFile10 } from "fs/promises";
+import { basename as basename7, dirname as dirname5, extname as extname11, join as join24, relative as relative4 } from "path";
 import { fileURLToPath } from "url";
 
 // ../plugins/session-rituals/dist/global-setup.js
 import { homedir } from "os";
-import { existsSync as existsSync10, readFileSync as readFileSync2 } from "fs";
-import { mkdir as mkdir7, readFile as readFile19, writeFile as writeFile10 } from "fs/promises";
-import { isAbsolute as isAbsolute3, join as join24 } from "path";
+import { existsSync as existsSync9, readFileSync } from "fs";
+import { mkdir as mkdir7, readFile as readFile19, writeFile as writeFile9 } from "fs/promises";
+import { isAbsolute as isAbsolute2, join as join22 } from "path";
 async function readFileIfExists(path) {
   try {
     return await readFile19(path, "utf8");
@@ -5255,23 +5025,23 @@ async function readFileIfExists(path) {
   }
 }
 function isSafeInstanceRoot(dir) {
-  return typeof dir === "string" && dir.trim().length > 0 && isAbsolute3(dir) && !/[\r\n`]/.test(dir) && isInstanceRoot(dir);
+  return typeof dir === "string" && dir.trim().length > 0 && isAbsolute2(dir) && !/[\r\n`]/.test(dir) && isInstanceRoot(dir);
 }
 function globalClaudeDir(home = homedir()) {
-  return join24(home, ".claude");
+  return join22(home, ".claude");
 }
 function globalSettingsPath(home = homedir()) {
-  return join24(globalClaudeDir(home), "settings.json");
+  return join22(globalClaudeDir(home), "settings.json");
 }
 function globalStatePath(home = homedir()) {
-  return join24(globalClaudeDir(home), "vortex-global.json");
+  return join22(globalClaudeDir(home), "vortex-global.json");
 }
 function globalMemoryPath(home = homedir()) {
-  return join24(globalClaudeDir(home), "CLAUDE.md");
+  return join22(globalClaudeDir(home), "CLAUDE.md");
 }
 function readGlobalStateRaw(home = homedir()) {
   try {
-    const parsed = JSON.parse(readFileSync2(globalStatePath(home), "utf8"));
+    const parsed = JSON.parse(readFileSync(globalStatePath(home), "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -5284,11 +5054,11 @@ function readGlobalInstancePointer(home = homedir()) {
   return typeof root === "string" && root.trim().length > 0 ? root.trim() : null;
 }
 function isInstanceRoot(dir) {
-  return existsSync10(join24(dir, ".agent", "vortex.json")) || existsSync10(join24(dir, "data", "_memory", "user_profile.md"));
+  return existsSync9(join22(dir, ".agent", "vortex.json")) || existsSync9(join22(dir, "data", "_memory", "user_profile.md"));
 }
 function globalSettingsHasHook(home = homedir()) {
   try {
-    const settings = parseSettings(readFileSync2(globalSettingsPath(home), "utf8"));
+    const settings = parseSettings(readFileSync(globalSettingsPath(home), "utf8"));
     const wired = (event, command) => Boolean(settings.hooks?.[event]?.some((g) => g.hooks?.some((h) => h.command === command)));
     return wired("SessionStart", SESSION_START_COMMAND) && wired("SessionEnd", SESSION_END_COMMAND);
   } catch {
@@ -5332,9 +5102,9 @@ async function applyGlobalSetup(opts) {
   const skipped = [];
   const statePath = globalStatePath(home);
   const settingsPath = globalSettingsPath(home);
-  const instSettingsPath = join24(instanceRoot, ".claude", "settings.json");
+  const instSettingsPath = join22(instanceRoot, ".claude", "settings.json");
   const mdPath = globalMemoryPath(home);
-  const hadState = existsSync10(statePath);
+  const hadState = existsSync9(statePath);
   const prevState = readGlobalStateRaw(home) ?? {};
   const settingsText = await readFileIfExists(settingsPath);
   const mergedGlobal = ensureVortexHooks(parseSettings(settingsText));
@@ -5347,27 +5117,27 @@ async function applyGlobalSetup(opts) {
   const { declinedAt: _wasDeclined, ...restState } = prevState;
   const nextState = { ...restState, instanceRoot };
   if (!hadState || prevState.instanceRoot !== instanceRoot || typeof prevState.declinedAt === "string") {
-    await writeFile10(statePath, JSON.stringify(nextState, null, 2) + "\n", "utf8");
+    await writeFile9(statePath, JSON.stringify(nextState, null, 2) + "\n", "utf8");
     (hadState ? modified : created).push(statePath);
   } else {
     skipped.push(statePath);
   }
   if (!mergedGlobal.alreadyWired) {
-    await writeFile10(settingsPath, serializeSettings(mergedGlobal.settings), "utf8");
+    await writeFile9(settingsPath, serializeSettings(mergedGlobal.settings), "utf8");
     (settingsText === null ? created : modified).push(settingsPath);
   } else {
     skipped.push(settingsPath);
   }
   if (mergedInst !== null) {
     if (!mergedInst.alreadyWired) {
-      await writeFile10(instSettingsPath, serializeSettings(mergedInst.settings), "utf8");
+      await writeFile9(instSettingsPath, serializeSettings(mergedInst.settings), "utf8");
       modified.push(instSettingsPath);
     } else {
       skipped.push(instSettingsPath);
     }
   }
   if (nextMd !== mdText) {
-    await writeFile10(mdPath, nextMd, "utf8");
+    await writeFile9(mdPath, nextMd, "utf8");
     (mdRead === null ? created : modified).push(mdPath);
   } else {
     skipped.push(mdPath);
@@ -5381,23 +5151,23 @@ async function recordGlobalSetupDecline(opts) {
   const statePath = globalStatePath(home);
   const prevState = readGlobalStateRaw(home) ?? {};
   const nextState = { ...prevState, declinedAt: now.toISOString() };
-  await writeFile10(statePath, JSON.stringify(nextState, null, 2) + "\n", "utf8");
+  await writeFile9(statePath, JSON.stringify(nextState, null, 2) + "\n", "utf8");
   return statePath;
 }
 
 // ../plugins/session-rituals/dist/update.js
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { copyFile, mkdir as mkdir8, readFile as readFile20 } from "fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join25, relative as relative4, sep as sep4 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join23, relative as relative3, sep as sep3 } from "path";
 var OWNERSHIP_SCHEMA = "vortex-ownership/2";
 var OWNERSHIP_SCHEMA_V1 = "vortex-ownership/1";
 var MANIFEST_NAME = "manifest.json";
 function ownershipManifestPath(ctx) {
-  return join25(ctx.dataDir, ".vortex", "ownership.json");
+  return join23(ctx.dataDir, ".vortex", "ownership.json");
 }
 function frameworkBookkeepingPrefix(ctx) {
-  return toPosix(relative4(ctx.repoRoot, join25(ctx.dataDir, ".vortex"))) + "/";
+  return toPosix(relative3(ctx.repoRoot, join23(ctx.dataDir, ".vortex"))) + "/";
 }
 function committableUpdatePaths(ctx, result) {
   const out = /* @__PURE__ */ new Set();
@@ -5408,11 +5178,11 @@ function committableUpdatePaths(ctx, result) {
       out.add(a.path);
     }
   }
-  out.add(toPosix(relative4(ctx.repoRoot, ownershipManifestPath(ctx))));
+  out.add(toPosix(relative3(ctx.repoRoot, ownershipManifestPath(ctx))));
   return [...out];
 }
 function toPosix(p) {
-  return p.split(sep4).join("/");
+  return p.split(sep3).join("/");
 }
 function normalizeEol(input) {
   const s = typeof input === "string" ? input : input.toString("utf8");
@@ -5443,24 +5213,24 @@ function templateDestRelPath(templateRelPath) {
   if (top === "routers")
     return tail;
   if (top === "commands")
-    return join25(".claude", "commands", tail);
+    return join23(".claude", "commands", tail);
   if (top === "config")
-    return join25(".agent", tail);
+    return join23(".agent", tail);
   return null;
 }
 function assertUnderRoot(rootAbs, candidateAbs) {
-  const rel = relative4(rootAbs, candidateAbs);
-  const up = ".." + sep4;
-  const winsensitive = sep4 === "\\";
+  const rel = relative3(rootAbs, candidateAbs);
+  const up = ".." + sep3;
+  const winsensitive = sep3 === "\\";
   const cmp = winsensitive ? rel.toLowerCase() : rel;
   const upCmp = winsensitive ? up.toLowerCase() : up;
-  if (rel === ".." || cmp.startsWith(upCmp) || isAbsolute4(rel)) {
+  if (rel === ".." || cmp.startsWith(upCmp) || isAbsolute3(rel)) {
     throw new Error(`Refusing to write outside the instance root: ${candidateAbs}`);
   }
 }
 async function readTemplateIndex(templatesDir) {
-  const indexPath = join25(templatesDir, MANIFEST_NAME);
-  if (!existsSync11(indexPath))
+  const indexPath = join23(templatesDir, MANIFEST_NAME);
+  if (!existsSync10(indexPath))
     return null;
   try {
     const parsed = JSON.parse(await readFile20(indexPath, "utf8"));
@@ -5484,14 +5254,14 @@ async function buildOwnershipManifest(ctx, templatesDir) {
     if (seenDest.has(destRel))
       continue;
     seenDest.add(destRel);
-    const shippedAbs = join25(templatesDir, entry.path);
-    if (!existsSync11(shippedAbs))
+    const shippedAbs = join23(templatesDir, entry.path);
+    if (!existsSync10(shippedAbs))
       continue;
     const sourceSha256 = await sha256File(shippedAbs);
-    const destAbs = join25(ctx.repoRoot, destRel);
+    const destAbs = join23(ctx.repoRoot, destRel);
     assertUnderRoot(ctx.repoRoot, destAbs);
     let installedSha256 = null;
-    if (existsSync11(destAbs)) {
+    if (existsSync10(destAbs)) {
       const onDisk = await sha256File(destAbs);
       installedSha256 = onDisk === sourceSha256 ? sourceSha256 : null;
     }
@@ -5512,14 +5282,14 @@ async function writeOwnershipManifest(ctx, templatesDir) {
   if (!manifest)
     return null;
   const mp = ownershipManifestPath(ctx);
-  await mkdir8(join25(ctx.dataDir, ".vortex"), { recursive: true });
+  await mkdir8(join23(ctx.dataDir, ".vortex"), { recursive: true });
   await atomicWriteFile(mp, JSON.stringify(manifest, null, 2) + "\n");
   return { path: mp, fileCount: manifest.files.length };
 }
 async function inspectOwnership(ctx, templatesDir) {
   let own = await readOwnershipManifest(ctx);
   if (!own) {
-    const malformed = existsSync11(ownershipManifestPath(ctx));
+    const malformed = existsSync10(ownershipManifestPath(ctx));
     return { present: false, malformed, total: 0, pristine: 0, modified: 0, missing: 0, unmanaged: 0 };
   }
   if (templatesDir && own.schema === OWNERSHIP_SCHEMA_V1) {
@@ -5534,8 +5304,8 @@ async function inspectOwnership(ctx, templatesDir) {
       unmanaged++;
       continue;
     }
-    const abs = join25(ctx.repoRoot, e.path);
-    if (!existsSync11(abs)) {
+    const abs = join23(ctx.repoRoot, e.path);
+    if (!existsSync10(abs)) {
       missing++;
       continue;
     }
@@ -5552,7 +5322,7 @@ async function inspectOwnership(ctx, templatesDir) {
 }
 async function repairOwnershipManifest(ctx, templatesDir) {
   const mp = ownershipManifestPath(ctx);
-  if (existsSync11(mp)) {
+  if (existsSync10(mp)) {
     const existing = await readOwnershipManifest(ctx);
     return existing ? { status: "already-present", path: mp, fileCount: existing.files.length } : { status: "unreadable", path: mp };
   }
@@ -5561,7 +5331,7 @@ async function repairOwnershipManifest(ctx, templatesDir) {
 }
 async function readOwnershipManifest(ctx) {
   const mp = ownershipManifestPath(ctx);
-  if (!existsSync11(mp))
+  if (!existsSync10(mp))
     return null;
   try {
     const parsed = JSON.parse(await readFile20(mp, "utf8"));
@@ -5585,13 +5355,13 @@ async function migrateOwnershipToV2(own, ctx, templatesDir) {
   if (index) {
     for (const idx of index.files) {
       if (templateDestRelPath(idx.path))
-        tmplAbsById.set(idx.templateId, join25(templatesDir, idx.path));
+        tmplAbsById.set(idx.templateId, join23(templatesDir, idx.path));
     }
   }
   const files = [];
   for (const e of own.files) {
     const tmplAbs = tmplAbsById.get(e.templateId);
-    if (!tmplAbs || !existsSync11(tmplAbs)) {
+    if (!tmplAbs || !existsSync10(tmplAbs)) {
       files.push(e);
       continue;
     }
@@ -5602,10 +5372,10 @@ async function migrateOwnershipToV2(own, ctx, templatesDir) {
       continue;
     }
     const srcUnchanged = matchesLegacyRawHash(e.sourceSha256, tmplBuf);
-    const destAbs = join25(ctx.repoRoot, e.path);
+    const destAbs = join23(ctx.repoRoot, e.path);
     let diskPristine = false;
     let normDisk = null;
-    if (existsSync11(destAbs)) {
+    if (existsSync10(destAbs)) {
       try {
         const diskBuf = await readFile20(destAbs);
         normDisk = sha256(diskBuf);
@@ -5674,15 +5444,15 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
       continue;
     seenDest.add(destRel);
     seenTemplateIds.add(idx.templateId);
-    const shippedAbs = join25(templatesDir, idx.path);
-    if (!existsSync11(shippedAbs))
+    const shippedAbs = join23(templatesDir, idx.path);
+    if (!existsSync10(shippedAbs))
       continue;
     const newSource = await sha256File(shippedAbs);
-    const destAbs = join25(ctx.repoRoot, destRel);
+    const destAbs = join23(ctx.repoRoot, destRel);
     assertUnderRoot(ctx.repoRoot, destAbs);
     const path = toPosix(destRel);
     const templateId = idx.templateId;
-    const exists = existsSync11(destAbs);
+    const exists = existsSync10(destAbs);
     const curHash = exists ? await sha256File(destAbs) : null;
     const prior = ownByTemplateId.get(templateId);
     if (adopt.has(path)) {
@@ -5725,7 +5495,7 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
             templateId,
             action: "conflict",
             detail: "a file already exists in a newly-shipped slot \u2014 wrote .new",
-            newFilePath: toPosix(relative4(ctx.repoRoot, destAbs + ".new"))
+            newFilePath: toPosix(relative3(ctx.repoRoot, destAbs + ".new"))
           },
           shippedAbs,
           destAbs,
@@ -5783,7 +5553,7 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
             templateId,
             action: "conflict",
             detail: "you edited this and the template changed \u2014 wrote .new; your file is untouched",
-            newFilePath: toPosix(relative4(ctx.repoRoot, destAbs + ".new"))
+            newFilePath: toPosix(relative3(ctx.repoRoot, destAbs + ".new"))
           },
           shippedAbs,
           destAbs,
@@ -5805,18 +5575,18 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
   const allOps = [...ops, ...orphanOps];
   const appliedActions = [];
   const finalEntries = [];
-  const backupRoot = join25(ctx.dataDir, ".vortex", "backups", (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-"));
+  const backupRoot = join23(ctx.dataDir, ".vortex", "backups", (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-"));
   let applyError = false;
   const writeDotNew = async (destAbs, content) => {
     const newPath = destAbs + ".new";
-    if (existsSync11(newPath)) {
+    if (existsSync10(newPath)) {
       if (await readFile20(newPath, "utf8") === content)
         return void 0;
-      const backupAbs = join25(backupRoot, toPosix(relative4(ctx.repoRoot, newPath)));
+      const backupAbs = join23(backupRoot, toPosix(relative3(ctx.repoRoot, newPath)));
       await mkdir8(dirname4(backupAbs), { recursive: true });
       await copyFile(newPath, backupAbs);
       await atomicWriteFile(newPath, content);
-      return toPosix(relative4(ctx.repoRoot, backupAbs));
+      return toPosix(relative3(ctx.repoRoot, backupAbs));
     }
     await atomicWriteFile(newPath, content);
     return void 0;
@@ -5831,15 +5601,15 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
         const newSource = op.entry ? op.entry.sourceSha256 : sha256(content);
         if (action.action === "replace") {
           const prior = ownByTemplateId.get(action.templateId);
-          if (!existsSync11(destAbs)) {
+          if (!existsSync10(destAbs)) {
             await mkdir8(dirname4(destAbs), { recursive: true });
             await atomicWriteFile(destAbs, content);
           } else if (await sha256File(destAbs) === (prior?.installedSha256 ?? null)) {
-            const backupAbs = join25(backupRoot, action.path);
+            const backupAbs = join23(backupRoot, action.path);
             await mkdir8(dirname4(backupAbs), { recursive: true });
             await copyFile(destAbs, backupAbs);
             await atomicWriteFile(destAbs, content);
-            action = { ...action, backupPath: toPosix(relative4(ctx.repoRoot, backupAbs)) };
+            action = { ...action, backupPath: toPosix(relative3(ctx.repoRoot, backupAbs)) };
           } else {
             const backupPath = await writeDotNew(destAbs, content);
             action = {
@@ -5847,20 +5617,20 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
               templateId: action.templateId,
               action: "conflict",
               detail: "file changed since planning \u2014 wrote .new instead of overwriting",
-              newFilePath: toPosix(relative4(ctx.repoRoot, destAbs + ".new")),
+              newFilePath: toPosix(relative3(ctx.repoRoot, destAbs + ".new")),
               ...backupPath ? { backupPath } : {}
             };
             entry = { templateId: action.templateId, path: action.path, sourceSha256: newSource, installedSha256: prior?.installedSha256 ?? null };
           }
         } else if (action.action === "restore" || action.action === "install") {
-          if (existsSync11(destAbs) && await sha256File(destAbs) !== newSource) {
+          if (existsSync10(destAbs) && await sha256File(destAbs) !== newSource) {
             const backupPath = await writeDotNew(destAbs, content);
             action = {
               path: action.path,
               templateId: action.templateId,
               action: "conflict",
               detail: "target appeared since planning \u2014 wrote .new instead of overwriting",
-              newFilePath: toPosix(relative4(ctx.repoRoot, destAbs + ".new")),
+              newFilePath: toPosix(relative3(ctx.repoRoot, destAbs + ".new")),
               ...backupPath ? { backupPath } : {}
             };
             entry = { templateId: action.templateId, path: action.path, sourceSha256: newSource, installedSha256: null };
@@ -5874,11 +5644,11 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
           if (backupPath)
             action = { ...action, backupPath };
         } else if (action.action === "adopt") {
-          if (existsSync11(destAbs)) {
-            const backupAbs = join25(backupRoot, action.path);
+          if (existsSync10(destAbs)) {
+            const backupAbs = join23(backupRoot, action.path);
             await mkdir8(dirname4(backupAbs), { recursive: true });
             await copyFile(destAbs, backupAbs);
-            action = { ...action, backupPath: toPosix(relative4(ctx.repoRoot, backupAbs)) };
+            action = { ...action, backupPath: toPosix(relative3(ctx.repoRoot, backupAbs)) };
           }
           await mkdir8(dirname4(destAbs), { recursive: true });
           await atomicWriteFile(destAbs, content);
@@ -5907,7 +5677,7 @@ async function runTemplatesUpdate(ctx, templatesDir, options = {}) {
       generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       files: newEntries
     };
-    await mkdir8(join25(ctx.dataDir, ".vortex"), { recursive: true });
+    await mkdir8(join23(ctx.dataDir, ".vortex"), { recursive: true });
     await atomicWriteFile(ownershipManifestPath(ctx), JSON.stringify(manifest, null, 2) + "\n");
   }
   const summary = summarize(appliedActions);
@@ -6163,15 +5933,15 @@ var DEFAULT_INIT_TASK = "Setting up my VortEX instance";
 function resolveTemplatesDir() {
   const here = dirname5(fileURLToPath(import.meta.url));
   const candidates = [
-    join26(here, "..", "..", "templates"),
+    join24(here, "..", "..", "templates"),
     // session-rituals: dist/commands -> templates
-    join26(here, "..", "templates"),
+    join24(here, "..", "templates"),
     // base aggregate: dist -> templates
-    join26(here, "templates")
+    join24(here, "templates")
     // defensive: alongside the bundle
   ];
   for (const c of candidates) {
-    if (existsSync12(join26(c, "commands")) || existsSync12(join26(c, "routers")))
+    if (existsSync11(join24(c, "commands")) || existsSync11(join24(c, "routers")))
       return c;
   }
   return null;
@@ -6179,19 +5949,19 @@ function resolveTemplatesDir() {
 async function installCommandTemplates(repoRoot, templatesDir) {
   if (!templatesDir)
     return [];
-  const commandsDir = join26(templatesDir, "commands");
-  if (!existsSync12(commandsDir))
+  const commandsDir = join24(templatesDir, "commands");
+  if (!existsSync11(commandsDir))
     return [];
-  const destDir = join26(repoRoot, ".claude", "commands");
+  const destDir = join24(repoRoot, ".claude", "commands");
   await mkdir9(destDir, { recursive: true });
   const written = [];
   for (const name of await readdir16(commandsDir)) {
     if (!name.endsWith(".md"))
       continue;
-    const dest = join26(destDir, name);
-    if (existsSync12(dest))
+    const dest = join24(destDir, name);
+    if (existsSync11(dest))
       continue;
-    await copyFile2(join26(commandsDir, name), dest);
+    await copyFile2(join24(commandsDir, name), dest);
     written.push(dest);
   }
   return written;
@@ -6206,16 +5976,16 @@ var ROUTER_FILES = [
 async function installRouterTemplates(repoRoot, templatesDir) {
   if (!templatesDir)
     return [];
-  const routersDir = join26(templatesDir, "routers");
-  if (!existsSync12(routersDir))
+  const routersDir = join24(templatesDir, "routers");
+  if (!existsSync11(routersDir))
     return [];
   const written = [];
   for (const name of ROUTER_FILES) {
-    const src = join26(routersDir, name);
-    if (!existsSync12(src))
+    const src = join24(routersDir, name);
+    if (!existsSync11(src))
       continue;
-    const dest = join26(repoRoot, name);
-    if (existsSync12(dest))
+    const dest = join24(repoRoot, name);
+    if (existsSync11(dest))
       continue;
     await copyFile2(src, dest);
     written.push(dest);
@@ -6224,15 +5994,15 @@ async function installRouterTemplates(repoRoot, templatesDir) {
 }
 async function seedInstanceConfig(repoRoot, templatesDir) {
   const written = [];
-  const agentDir = join26(repoRoot, ".agent");
-  const vortexJson = join26(agentDir, "vortex.json");
-  if (!existsSync12(vortexJson)) {
+  const agentDir = join24(repoRoot, ".agent");
+  const vortexJson = join24(agentDir, "vortex.json");
+  if (!existsSync11(vortexJson)) {
     await mkdir9(agentDir, { recursive: true });
-    const tmpl = templatesDir ? join26(templatesDir, "config", "vortex.json") : null;
-    if (tmpl && existsSync12(tmpl)) {
+    const tmpl = templatesDir ? join24(templatesDir, "config", "vortex.json") : null;
+    if (tmpl && existsSync11(tmpl)) {
       await copyFile2(tmpl, vortexJson);
     } else {
-      await writeFile11(vortexJson, JSON.stringify({
+      await writeFile10(vortexJson, JSON.stringify({
         autoRecord: {
           sessionStart: true,
           worklog: true,
@@ -6247,9 +6017,9 @@ async function seedInstanceConfig(repoRoot, templatesDir) {
     }
     written.push(vortexJson);
   }
-  const pkgPath = join26(repoRoot, "package.json");
-  if (!existsSync12(pkgPath)) {
-    await writeFile11(pkgPath, JSON.stringify({
+  const pkgPath = join24(repoRoot, "package.json");
+  if (!existsSync11(pkgPath)) {
+    await writeFile10(pkgPath, JSON.stringify({
       name: "vortex-instance",
       version: "0.0.0",
       private: true,
@@ -6266,8 +6036,8 @@ async function runInit(input, tokens) {
   const templatesDir = resolveTemplatesDir();
   const requiredDirs = ["_memory", "worklog", "decision-log", "hubs", "inbox", "runbooks"];
   for (const d2 of requiredDirs) {
-    const p = join26(dataDir, d2);
-    if (!existsSync12(p))
+    const p = join24(dataDir, d2);
+    if (!existsSync11(p))
       await mkdir9(p, { recursive: true });
   }
   const scaffolded = [];
@@ -6279,8 +6049,8 @@ async function runInit(input, tokens) {
     scaffolded.push(...await seedInstanceConfig(repoRoot, templatesDir));
   } catch {
   }
-  const profilePath = join26(dataDir, "_memory", "user_profile.md");
-  if (existsSync12(profilePath) && !args.force) {
+  const profilePath = join24(dataDir, "_memory", "user_profile.md");
+  if (existsSync11(profilePath) && !args.force) {
     const manifestNotes = [];
     try {
       const m2 = await writeOwnershipManifest(input.context, templatesDir);
@@ -6341,24 +6111,24 @@ async function runInit(input, tokens) {
   const name = args.name.trim();
   const role = args.role.trim();
   const task = args.task?.trim() || DEFAULT_INIT_TASK;
-  await writeFile11(profilePath, renderUserProfile(name, role, task, today2), "utf8");
+  await writeFile10(profilePath, renderUserProfile(name, role, task, today2), "utf8");
   created.push(profilePath);
   const [year, month] = today2.split("-");
-  const worklogDir = join26(dataDir, "worklog", year, month);
+  const worklogDir = join24(dataDir, "worklog", year, month);
   await mkdir9(worklogDir, { recursive: true });
-  const worklogPath = join26(worklogDir, `${today2}-vortex-init.md`);
-  await writeFile11(worklogPath, renderFirstWorklog(name, role, task, today2), "utf8");
+  const worklogPath = join24(worklogDir, `${today2}-vortex-init.md`);
+  await writeFile10(worklogPath, renderFirstWorklog(name, role, task, today2), "utf8");
   created.push(worklogPath);
   const hookNotes = [];
   try {
-    const settingsPath = join26(input.context.repoRoot, ".claude", "settings.json");
-    const existingText = existsSync12(settingsPath) ? await readFile21(settingsPath, "utf8") : null;
-    const { settings, added, alreadyWired } = ensureVortexHooks(parseSettings(existingText));
+    const settingsPath = join24(input.context.repoRoot, ".claude", "settings.json");
+    const existingText = existsSync11(settingsPath) ? await readFile21(settingsPath, "utf8") : null;
+    const { settings, added, alreadyWired } = ensureVortexHooks(parseSettings(existingText), { guard: true });
     if (!alreadyWired) {
-      await mkdir9(join26(input.context.repoRoot, ".claude"), { recursive: true });
-      await writeFile11(settingsPath, serializeSettings(settings), "utf8");
+      await mkdir9(join24(input.context.repoRoot, ".claude"), { recursive: true });
+      await writeFile10(settingsPath, serializeSettings(settings), "utf8");
       created.push(settingsPath);
-      hookNotes.push(`Wired ${added.join(" + ")} hook(s) into .claude/settings.json \u2014 the VortEX boot report runs automatically at session start.`);
+      hookNotes.push(`Wired ${added.join(" + ")} hook(s) into .claude/settings.json \u2014 the VortEX boot report runs automatically at session start` + (added.includes("PreToolUse") ? ", and the write guard now denies literal control bytes in file writes (remove the PreToolUse group to opt out)." : "."));
     } else {
       hookNotes.push("Session hooks already wired in .claude/settings.json.");
     }
@@ -6476,10 +6246,36 @@ async function runUpdate(input, tokens) {
   const dryRun = tokens.includes("--dry-run");
   const adopt = parseAdoptArgs(tokens);
   const templatesDir = resolveTemplatesDir();
-  const result = await runTemplatesUpdate(input.context, templatesDir, {
+  let result = await runTemplatesUpdate(input.context, templatesDir, {
     dryRun,
     adopt: adopt.size > 0 ? adopt : void 0
   });
+  if (!dryRun) {
+    try {
+      const settingsPath = join24(input.context.repoRoot, ".claude", "settings.json");
+      const existingText = existsSync11(settingsPath) ? await readFile21(settingsPath, "utf8") : null;
+      const { settings, added, alreadyWired } = ensureVortexHooks(parseSettings(existingText), { guard: true });
+      if (!alreadyWired) {
+        await mkdir9(join24(input.context.repoRoot, ".claude"), { recursive: true });
+        await writeFile10(settingsPath, serializeSettings(settings), "utf8");
+        result = {
+          ...result,
+          nextActions: [
+            ...result.nextActions,
+            `Wired missing ${added.join(" + ")} hook(s) into .claude/settings.json` + (added.includes("PreToolUse") ? " \u2014 the write guard now denies literal control bytes in file writes (remove the PreToolUse group to opt out)." : ".")
+          ]
+        };
+      }
+    } catch (e) {
+      result = {
+        ...result,
+        nextActions: [
+          ...result.nextActions,
+          `\u26A0\uFE0F Could not verify/wire session hooks: ${e.message}`
+        ]
+      };
+    }
+  }
   if (dryRun || result.status === "no-manifest" || result.status === "no-templates")
     return result;
   if (!loadVortexConfig(input.context).autoRecord.commitFrameworkChanges)
@@ -6619,18 +6415,18 @@ var COUNT_KEY_TO_DIR = {
 };
 async function runStatus(input) {
   const { dataDir } = input.context;
-  const profilePath = join26(dataDir, "_memory", "user_profile.md");
-  const initialized = existsSync12(profilePath);
+  const profilePath = join24(dataDir, "_memory", "user_profile.md");
+  const initialized = existsSync11(profilePath);
   const counts = {
-    memory: await safeCount(join26(dataDir, "_memory"), false),
-    worklog: await safeCount(join26(dataDir, "worklog"), true),
-    decisionLog: await safeCount(join26(dataDir, "decision-log"), false),
-    runbooks: await safeCount(join26(dataDir, "runbooks"), false),
-    hubs: await safeCount(join26(dataDir, "hubs"), false)
+    memory: await safeCount(join24(dataDir, "_memory"), false),
+    worklog: await safeCount(join24(dataDir, "worklog"), true),
+    decisionLog: await safeCount(join24(dataDir, "decision-log"), false),
+    runbooks: await safeCount(join24(dataDir, "runbooks"), false),
+    hubs: await safeCount(join24(dataDir, "hubs"), false)
   };
   let latestWorklog;
   try {
-    const store = new WorklogStore(join26(dataDir, "worklog"));
+    const store = new WorklogStore(join24(dataDir, "worklog"));
     const latest = await store.getLatest();
     if (latest) {
       latestWorklog = {
@@ -6657,8 +6453,8 @@ async function runStatus(input) {
   for (const [key, count] of Object.entries(counts)) {
     if (count === 0) {
       const dirName = COUNT_KEY_TO_DIR[key];
-      const dirPath = join26(dataDir, dirName);
-      missing.push(existsSync12(dirPath) ? `${dirName}/ is empty` : `${dirName}/ does not exist`);
+      const dirPath = join24(dataDir, dirName);
+      missing.push(existsSync11(dirPath) ? `${dirName}/ is empty` : `${dirName}/ does not exist`);
     }
   }
   const nextActions = [];
@@ -6693,7 +6489,7 @@ function extractProfile(body) {
   return out;
 }
 async function safeCount(dir, recursive) {
-  if (!existsSync12(dir))
+  if (!existsSync11(dir))
     return 0;
   try {
     return await countMarkdown2(dir, recursive);
@@ -6717,7 +6513,7 @@ async function countMarkdown2(dir, recursive) {
     } else if (e.isDirectory() && recursive) {
       if (e.name.startsWith(".") || e.name.startsWith("_"))
         continue;
-      total += await countMarkdown2(join26(dir, e.name), recursive);
+      total += await countMarkdown2(join24(dir, e.name), recursive);
     }
   }
   return total;
@@ -6852,7 +6648,7 @@ async function runImport(input, tokens) {
       ]
     };
   }
-  if (!existsSync12(args.from)) {
+  if (!existsSync11(args.from)) {
     return {
       subcommand: "import",
       status: "source-missing",
@@ -6886,8 +6682,8 @@ async function runImport(input, tokens) {
   const systemDirsCreated = [];
   if (!args.dryRun) {
     for (const d2 of systemDirs) {
-      const p = join26(dataDir, d2);
-      if (!existsSync12(p)) {
+      const p = join24(dataDir, d2);
+      if (!existsSync11(p)) {
         await mkdir9(p, { recursive: true });
         systemDirsCreated.push(d2);
       }
@@ -6983,7 +6779,7 @@ async function runImport(input, tokens) {
 async function walkAndImport(rootSource, currentDir, dataDir, dryRun, stats) {
   const entries = await readdir16(currentDir, { withFileTypes: true });
   for (const e of entries) {
-    const sourcePath = join26(currentDir, e.name);
+    const sourcePath = join24(currentDir, e.name);
     if (e.isDirectory()) {
       if (IMPORT_SKIP_DIRS.has(e.name.toLowerCase()))
         continue;
@@ -7024,7 +6820,7 @@ async function walkAndImport(rootSource, currentDir, dataDir, dryRun, stats) {
           body: parsed.body
         });
         try {
-          await writeFile11(targetPath, out, { encoding: "utf8", flag: "wx" });
+          await writeFile10(targetPath, out, { encoding: "utf8", flag: "wx" });
           stats.copied++;
         } catch (e2) {
           if (e2.code === "EEXIST") {
@@ -7057,7 +6853,7 @@ async function importAttachment(sourcePath, relPath, filename, dataDir, dryRun,
     stats.importedExtensions.add(ext);
   if (dryRun)
     return;
-  const targetPath = join26(dataDir, relPath);
+  const targetPath = join24(dataDir, relPath);
   await mkdir9(dirname5(targetPath), { recursive: true });
   try {
     await copyFile2(sourcePath, targetPath, constants.COPYFILE_EXCL);
@@ -7121,27 +6917,27 @@ function computeTargetPath(category, sourcePath, rootSource, dataDir, filename)
   const mdName = withMdExtension(filename);
   if (category === "preserved") {
     const relPath = withMdExtension(sourcePath.substring(rootSource.length).replace(/^[/\\]/, ""));
-    return join26(dataDir, relPath);
+    return join24(dataDir, relPath);
   }
   if (category === "worklog") {
     const match = mdName.match(/^(\d{4})-(\d{2})-/);
     if (match) {
-      return join26(dataDir, "worklog", match[1], match[2], mdName);
+      return join24(dataDir, "worklog", match[1], match[2], mdName);
     }
     const d2 = /* @__PURE__ */ new Date();
     const y2 = String(d2.getFullYear());
     const m2 = String(d2.getMonth() + 1).padStart(2, "0");
-    return join26(dataDir, "worklog", y2, m2, mdName);
+    return join24(dataDir, "worklog", y2, m2, mdName);
   }
   if (category === "decisionLog")
-    return join26(dataDir, "decision-log", mdName);
+    return join24(dataDir, "decision-log", mdName);
   if (category === "runbooks")
-    return join26(dataDir, "runbooks", mdName);
+    return join24(dataDir, "runbooks", mdName);
   if (category === "hubs")
-    return join26(dataDir, "hubs", mdName);
+    return join24(dataDir, "hubs", mdName);
   if (category === "memory")
-    return join26(dataDir, "_memory", mdName);
-  return join26(dataDir, mdName);
+    return join24(dataDir, "_memory", mdName);
+  return join24(dataDir, mdName);
 }
 function withMdExtension(name) {
   const ext = extname11(name);
@@ -7288,7 +7084,7 @@ async function checkControlBytes(dataDir) {
       return;
     }
     for (const e of entries) {
-      const p = join26(dir, e.name);
+      const p = join24(dir, e.name);
       if (e.isDirectory()) {
         if (SKIP_DIRS.has(e.name))
           continue;
@@ -7299,7 +7095,7 @@ async function checkControlBytes(dataDir) {
           for (let i = 0; i < buf.length; i++) {
             const x2 = buf[i];
             if (x2 < 32 && x2 !== 9 && x2 !== 10 && x2 !== 13) {
-              offenders.push(`${relative5(dataDir, p).replace(/\\/g, "/")} @ byte ${i}`);
+              offenders.push(`${relative4(dataDir, p).replace(/\\/g, "/")} @ byte ${i}`);
               break;
             }
           }
@@ -7322,7 +7118,7 @@ async function checkControlBytes(dataDir) {
   };
 }
 function checkSystemDirs(dataDir) {
-  const missing = DOCTOR_SYSTEM_DIRS.filter((d2) => !existsSync12(join26(dataDir, d2)));
+  const missing = DOCTOR_SYSTEM_DIRS.filter((d2) => !existsSync11(join24(dataDir, d2)));
   if (missing.length === 0) {
     return {
       id: "system-dirs",
@@ -7338,8 +7134,8 @@ function checkSystemDirs(dataDir) {
   };
 }
 function checkUserProfile(dataDir) {
-  const profilePath = join26(dataDir, "_memory", "user_profile.md");
-  if (existsSync12(profilePath)) {
+  const profilePath = join24(dataDir, "_memory", "user_profile.md");
+  if (existsSync11(profilePath)) {
     return {
       id: "user-profile",
       label: "user_profile.md exists",
@@ -7356,11 +7152,11 @@ function checkUserProfile(dataDir) {
 async function checkIndexes(dataDir) {
   const missing = [];
   for (const d2 of DOCTOR_SYSTEM_DIRS) {
-    const dirPath = join26(dataDir, d2);
-    if (!existsSync12(dirPath))
+    const dirPath = join24(dataDir, d2);
+    if (!existsSync11(dirPath))
       continue;
-    const indexPath = join26(dirPath, "_INDEX.md");
-    if (!existsSync12(indexPath))
+    const indexPath = join24(dirPath, "_INDEX.md");
+    if (!existsSync11(indexPath))
       missing.push(`${d2}/_INDEX.md`);
   }
   if (missing.length === 0) {
@@ -7393,7 +7189,7 @@ async function collectAttachmentExtensions(dataDir) {
         if (e.name.startsWith(".") || e.name === "_session-archive" || e.name === "node_modules") {
           continue;
         }
-        stack.push(join26(current, e.name));
+        stack.push(join24(current, e.name));
       } else if (e.isFile()) {
         const ext = extname11(e.name);
         if (ext && ext.toLowerCase() !== ".md")
@@ -7490,8 +7286,8 @@ async function checkFrontmatterLint(dataDir, additionalExtensions = []) {
   }
 }
 async function checkRunbookAging(dataDir) {
-  const runbooksDir = join26(dataDir, "runbooks");
-  if (!existsSync12(runbooksDir)) {
+  const runbooksDir = join24(dataDir, "runbooks");
+  if (!existsSync11(runbooksDir)) {
     return {
       id: "runbook-aging",
       label: `runbooks tested within ${RUNBOOK_AGING_DAYS} days`,
@@ -7511,7 +7307,7 @@ async function checkRunbookAging(dataDir) {
         continue;
       }
       total++;
-      const filePath = join26(runbooksDir, e.name);
+      const filePath = join24(runbooksDir, e.name);
       const raw = await readFile21(filePath, "utf8");
       const { frontmatter } = parseFrontmatter(raw);
       if (!frontmatter.last_tested) {
@@ -7574,8 +7370,8 @@ function checkNodeVersion() {
   };
 }
 async function checkGitRemote(repoRoot) {
-  const gitConfig = join26(repoRoot, ".git", "config");
-  if (!existsSync12(gitConfig)) {
+  const gitConfig = join24(repoRoot, ".git", "config");
+  if (!existsSync11(gitConfig)) {
     return {
       id: "git-remote",
       label: "git remote for sync",
@@ -7614,11 +7410,11 @@ async function detectExternalFolders(excludePath) {
   if (!home)
     return void 0;
   const candidates = [
-    join26(home, "Documents", "obsidian-vault"),
-    join26(home, "Documents", "notes"),
-    join26(home, "Documents", "Notebook"),
-    join26(home, "notes"),
-    join26(home, "Notes")
+    join24(home, "Documents", "obsidian-vault"),
+    join24(home, "Documents", "notes"),
+    join24(home, "Documents", "Notebook"),
+    join24(home, "notes"),
+    join24(home, "Notes")
   ];
   const excludeNorm = excludePath.replace(/[/\\]+$/, "");
   const found = [];
@@ -7627,7 +7423,7 @@ async function detectExternalFolders(excludePath) {
     if (candNorm === excludeNorm || candNorm.startsWith(excludeNorm + "/") || candNorm.startsWith(excludeNorm + "\\") || excludeNorm.startsWith(candNorm + "/") || excludeNorm.startsWith(candNorm + "\\")) {
       continue;
     }
-    if (!existsSync12(candidate))
+    if (!existsSync11(candidate))
       continue;
     let mdCount = 0;
     try {
@@ -7751,7 +7547,7 @@ async function runSync(input, tokens) {
 var SYNC_TAIL_LENGTH = 1e3;
 async function runShellCommand(cmd, cmdArgs, cwd) {
   const start = Date.now();
-  return new Promise((resolve5) => {
+  return new Promise((resolve3) => {
     let stdout = "";
     let stderr = "";
     const child = spawn(cmd, [...cmdArgs], { cwd, shell: true });
@@ -7762,7 +7558,7 @@ async function runShellCommand(cmd, cmdArgs, cwd) {
       stderr += chunk.toString("utf8");
     });
     child.on("close", (code) => {
-      resolve5({
+      resolve3({
         exitCode: code ?? -1,
         durationMs: Date.now() - start,
         stdoutTail: tailString(stdout, SYNC_TAIL_LENGTH),
@@ -7770,7 +7566,7 @@ async function runShellCommand(cmd, cmdArgs, cwd) {
       });
     });
     child.on("error", (err) => {
-      resolve5({
+      resolve3({
         exitCode: -1,
         durationMs: Date.now() - start,
         stdoutTail: tailString(stdout, SYNC_TAIL_LENGTH),
@@ -7816,22 +7612,22 @@ function createRitualRegistry(options) {
 
 // ../plugins/session-rituals/dist/cli-dispatch.js
 import { execFileSync as execFileSync2, spawn as spawn2 } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync4, mkdirSync, openSync, writeSync, closeSync, linkSync, rmSync, statSync } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync3, mkdirSync, openSync, writeSync, closeSync, linkSync, rmSync, statSync } from "fs";
 import { createRequire } from "module";
 import { hostname } from "os";
-import { isAbsolute as isAbsolute5, join as join30 } from "path";
+import { isAbsolute as isAbsolute4, join as join28 } from "path";
 
 // ../plugins/session-rituals/dist/update-check.js
 import { execSync } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync3 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync2 } from "fs";
+import { join as join25 } from "path";
 var PKG = "@vortex-os/base";
 var NPM_TIMEOUT_MS = 4e3;
 function readInstalledBaseVersion(templatesDir = resolveTemplatesDir()) {
   if (!templatesDir)
     return null;
   try {
-    const m2 = JSON.parse(readFileSync3(join27(templatesDir, "manifest.json"), "utf8"));
+    const m2 = JSON.parse(readFileSync2(join25(templatesDir, "manifest.json"), "utf8"));
     return typeof m2.baseVersion === "string" && parseCore(m2.baseVersion) ? m2.baseVersion.trim() : null;
   } catch {
     return null;
@@ -7903,8 +7699,8 @@ function isStableUpdate(latest, installed) {
   return compareSemver(latest, installed) === 1;
 }
 function buildInstallCommand(repoRoot) {
-  const has = (f) => existsSync13(join27(repoRoot, f));
-  const local = existsSync13(join27(repoRoot, "node_modules", "@vortex-os", "base"));
+  const has = (f) => existsSync12(join25(repoRoot, f));
+  const local = existsSync12(join25(repoRoot, "node_modules", "@vortex-os", "base"));
   let installPart;
   if (!local) {
     installPart = `npm i -g ${PKG}@latest`;
@@ -7932,9 +7728,9 @@ function checkBaseUpdate(ctx) {
 }
 
 // ../plugins/session-rituals/dist/session-start-report.js
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import { readdir as readdir17, readFile as readFile22, stat as stat9 } from "fs/promises";
-import { join as join28 } from "path";
+import { join as join26 } from "path";
 var COUNTED_DIRS2 = ["_memory", "worklog", "decision-log"];
 var DEFAULT_GAP_WINDOW_DAYS = 30;
 function gapWindowSinceArg() {
@@ -7951,8 +7747,8 @@ async function collectSessionStartReport(ctx, opts) {
   const counts = {};
   const missing = [];
   for (const name of COUNTED_DIRS2) {
-    const dir = join28(ctx.dataDir, name);
-    if (!existsSync14(dir)) {
+    const dir = join26(ctx.dataDir, name);
+    if (!existsSync13(dir)) {
       missing.push(name);
       counts[name] = 0;
       continue;
@@ -7962,7 +7758,7 @@ async function collectSessionStartReport(ctx, opts) {
   const { recent, recentGroup, recentWorklogsOmitted, dates, latestBodies } = await scanWorklog(ctx.dataDir);
   const cutoff = isoDate2(addDays2(now, -(opts?.gapWindowDays ?? DEFAULT_GAP_WINDOW_DAYS)));
   const recentWorklogDates = dates.filter((d2) => d2 >= cutoff);
-  const mem = await scanMemoryTiers(join28(ctx.dataDir, "_memory"));
+  const mem = await scanMemoryTiers(join26(ctx.dataDir, "_memory"));
   const ho = await scanHandoffs(ctx.dataDir);
   const handoffs = ho.active.map((h) => ({
     date: h.date,
@@ -8029,7 +7825,7 @@ async function scanMemoryTiers(memoryDir) {
   for (const e of entries) {
     if (!e.isFile() || !e.name.endsWith(".md"))
       continue;
-    const full = join28(memoryDir, e.name);
+    const full = join26(memoryDir, e.name);
     if (e.name === "_INDEX.md") {
       indexExists = true;
       try {
@@ -8189,6 +7985,16 @@ function renderSessionStartReport(report, extras) {
   if (carry && carry.uncommitted > 0) {
     lines.push(`- \u21A9\uFE0F ${carry.uncommitted} uncommitted change(s) carried over from a prior session \u2014 likely normal work in progress.`);
   }
+  const fl = extras?.failures;
+  if (fl && fl.warnings.length > 0) {
+    lines.push(`- \u{1F501} recurring failures (open ledger entries: ${fl.totalOpen}):`);
+    for (const w2 of fl.warnings) {
+      const stageText = w2.stage === "promote" ? "3rd+ occurrence \u2014 PROPOSE a deterministic guard to the user (ladder: promote; never self-install)" : `2nd occurrence \u2014 the covering rule's write-time gate is MANDATORY this session${w2.rule ? ` (rule: ${w2.rule})` : ""}`;
+      lines.push(`  - ${w2.key} \xD7${w2.count} (last ${w2.lastDate}) \u2014 ${stageText}`);
+    }
+    if (fl.omitted > 0)
+      lines.push(`  - \u2026(+${fl.omitted} more \u2014 \`vortex failure list\`)`);
+  }
   const cu = extras?.catchUp;
   if (cu && (cu.ingestedLocal > 0 || cu.indexedPulled > 0 || cu.errors > 0)) {
     const parts = [];
@@ -8258,15 +8064,15 @@ async function countMarkdown3(dir, recursive) {
     } else if (e.isDirectory() && recursive) {
       if (e.name.startsWith(".") || e.name.startsWith("_"))
         continue;
-      total += await countMarkdown3(join28(dir, e.name), recursive);
+      total += await countMarkdown3(join26(dir, e.name), recursive);
     }
   }
   return total;
 }
 var MAX_GROUP_READ = 20;
 async function scanWorklog(dataDir) {
-  const root = join28(dataDir, "worklog");
-  if (!existsSync14(root))
+  const root = join26(dataDir, "worklog");
+  if (!existsSync13(root))
     return { recent: null, recentGroup: [], recentWorklogsOmitted: 0, dates: [], latestBodies: [] };
   const dates = /* @__PURE__ */ new Set();
   const consistent = [];
@@ -8281,7 +8087,7 @@ async function scanWorklog(dataDir) {
     for (const e of entries) {
       const childRel = rel ? `${rel}/${e.name}` : e.name;
       if (e.isDirectory()) {
-        await walk5(join28(absDir, e.name), childRel);
+        await walk5(join26(absDir, e.name), childRel);
       } else if (e.isFile()) {
         const m2 = e.name.match(/^(\d{4})-(\d{2})-(\d{2})(?:_\d{4})?-.+\.md$/);
         if (!m2)
@@ -8310,7 +8116,7 @@ async function scanWorklog(dataDir) {
   const recentGroup = [];
   const latestBodies = [];
   for (const g of group) {
-    const { title, body } = await readWorklogTitleAndBody(join28(root, g.rel));
+    const { title, body } = await readWorklogTitleAndBody(join26(root, g.rel));
     recentGroup.push({ path: defangReportPath(`worklog/${g.rel}`), title });
     latestBodies.push(body);
   }
@@ -8389,11 +8195,11 @@ function isoDate2(d2) {
 }
 
 // ../plugins/session-rituals/dist/curate-cli.js
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile23, readdir as readdir18 } from "fs/promises";
-import { join as join29 } from "path";
-var SYSTEM_META_DIRS3 = /* @__PURE__ */ new Set([
+import { join as join27 } from "path";
+var SYSTEM_META_DIRS2 = /* @__PURE__ */ new Set([
   "worklog",
   "decision-log",
   "runbooks",
@@ -8416,7 +8222,7 @@ function firstSegment(rel) {
 }
 function isSystemMetaRel(rel) {
   const first = firstSegment(rel);
-  return SYSTEM_META_DIRS3.has(first) || first.startsWith("_");
+  return SYSTEM_META_DIRS2.has(first) || first.startsWith("_");
 }
 function validateCuratePayload(payload) {
   const errors = [];
@@ -8472,10 +8278,10 @@ function joinRel(...parts) {
 }
 async function runCurateCandidates(repoRoot, options) {
   const maxEntries = options?.maxEntries ?? 200;
-  const dataDir = join29(repoRoot, "data");
+  const dataDir = join27(repoRoot, "data");
   const candidates = [];
   let truncated = false;
-  if (existsSync15(dataDir)) {
+  if (existsSync14(dataDir)) {
     async function visit(absDir, relDir) {
       if (candidates.length >= maxEntries) {
         truncated = true;
@@ -8496,9 +8302,9 @@ async function runCurateCandidates(repoRoot, options) {
           const atRoot = relDir === "";
           if (e.name.startsWith("."))
             continue;
-          if (atRoot && (SYSTEM_META_DIRS3.has(e.name) || e.name.startsWith("_")))
+          if (atRoot && (SYSTEM_META_DIRS2.has(e.name) || e.name.startsWith("_")))
             continue;
-          await visit(join29(absDir, e.name), joinRel(relDir, e.name));
+          await visit(join27(absDir, e.name), joinRel(relDir, e.name));
         } else if (e.isFile() && e.name.endsWith(".md")) {
           if (NON_DOC_FILES.has(e.name))
             continue;
@@ -8507,7 +8313,7 @@ async function runCurateCandidates(repoRoot, options) {
           let topic = null;
           let tags = [];
           try {
-            const raw = await readFile23(join29(absDir, e.name), "utf8");
+            const raw = await readFile23(join27(absDir, e.name), "utf8");
             const parsed = parseFrontmatter(raw);
             if (typeof parsed.frontmatter.topic === "string") {
               topic = parsed.frontmatter.topic.trim().toLowerCase();
@@ -8545,7 +8351,7 @@ async function runCuratePreview(repoRoot, payload, now = /* @__PURE__ */ new Dat
     };
   }
   try {
-    validateDataRelativePath(join29(repoRoot, "data"), v2.effectiveRelPath);
+    validateDataRelativePath(join27(repoRoot, "data"), v2.effectiveRelPath);
   } catch (e) {
     return {
       subcommand: "curate-preview",
@@ -8562,10 +8368,10 @@ async function runCuratePreview(repoRoot, payload, now = /* @__PURE__ */ new Dat
   let targetExists;
   let wouldDo;
   if (payload.action === "create-file") {
-    targetExists = existsSync15(join29(repoRoot, "data", v2.effectiveRelPath));
+    targetExists = existsSync14(join27(repoRoot, "data", v2.effectiveRelPath));
     wouldDo = targetExists ? `create-file at ${v2.effectiveRelPath} \u2014 but the file already EXISTS, so accept would REFUSE (no overwrite).` : `create a new document at data/${v2.effectiveRelPath}.`;
   } else {
-    targetExists = existsSync15(join29(repoRoot, "data", v2.effectiveRelPath));
+    targetExists = existsSync14(join27(repoRoot, "data", v2.effectiveRelPath));
     wouldDo = targetExists ? `append a "## ${payload.sectionHeader}" section to data/${v2.effectiveRelPath}.` : `append-section to data/${v2.effectiveRelPath} \u2014 but the file does NOT exist, so accept would FAIL (append-section never creates).`;
   }
   const nextActions = [];
@@ -8710,13 +8516,13 @@ function readCuratePayload(args) {
       break;
     }
     if (t === "--payload-file" && i + 1 < args.length) {
-      raw = readFileSync4(args[++i], "utf8");
+      raw = readFileSync3(args[++i], "utf8");
       break;
     }
   }
   if (raw === null) {
     try {
-      raw = readFileSync4(0, "utf8");
+      raw = readFileSync3(0, "utf8");
     } catch {
       raw = "";
     }
@@ -8740,11 +8546,22 @@ async function runVortexCli(argv, io) {
   const err = io?.stderr ?? ((s) => process.stderr.write(s));
   try {
     if (argv[0] === "statusline") {
-      const { runStatuslineCli: runStatuslineCli2 } = await import("./statusline-NQKJ3NWD.js");
+      const { runStatuslineCli: runStatuslineCli2 } = await import("./statusline-JTSL5CCH.js");
       const statuslineRoot = process.env.VORTEX_REPO_ROOT?.trim() || process.cwd();
       return runStatuslineCli2(argv.slice(1), statuslineRoot, out, err);
     }
+    if (argv[0] === "guard") {
+      const { runGuardCli: runGuardCli2 } = await import("./guard-IMJR6ET7.js");
+      return runGuardCli2(argv.slice(1), out, err);
+    }
     const repoRoot = resolveRepoRoot();
+    if (argv[0] === "failure") {
+      const { runFailureCli: runFailureCli2 } = await import("./failures-PMURLMVB.js");
+      const { resolveInstanceRoot: resolveInstanceRoot2 } = await import("./guard-IMJR6ET7.js");
+      const root = resolveInstanceRoot2(process.cwd()) ?? repoRoot;
+      const ctx = makeContext(root);
+      return runFailureCli2(argv.slice(1), ctx.dataDir, out, err);
+    }
     if (argv[0] === "session-start") {
       await runSessionStart(repoRoot, out);
       return 0;
@@ -8784,6 +8601,8 @@ ${names}
   session-end    \u2014  no-op (kept for hook compatibility; worklog gap handling is at session-start)
   check-updates  \u2014  check the npm registry for a newer @vortex-os/base (read-only; prints the exact update command)
   statusline     \u2014  render the Claude Code status bar from stdin JSON (\`lite\` for 1-line; \`install [--lite]\` wires .claude/settings.json)
+  failure        \u2014  failure ledger (\`record\` an occurrence by recurrence key / \`list\` open groups with their escalation stage)
+  guard          \u2014  deterministic write-time guards (\`write\` = PreToolUse hook body; wired by \`vortex init\`)
 
 Instance shortcuts (also available as \`/vortex <sub>\`):
   init   \u2014  first-time setup: routers + data/ + hooks + slash-commands
@@ -8850,12 +8669,12 @@ function memoryExtendedPresent() {
 }
 var VECTORIZE_LOCK_TTL_MS = 6 * 60 * 60 * 1e3;
 function vectorizeLockPath(ctx) {
-  return join30(ctx.dataDir, "_indexes", ".vectorize.lock");
+  return join28(ctx.dataDir, "_indexes", ".vectorize.lock");
 }
 function vectorizeSetupInProgress(ctx) {
   const lock = vectorizeLockPath(ctx);
   try {
-    if (!existsSync16(lock))
+    if (!existsSync15(lock))
       return false;
     return Date.now() - statSync(lock).mtimeMs < VECTORIZE_LOCK_TTL_MS;
   } catch {
@@ -8876,9 +8695,9 @@ function spawnVectorizeSetup(repoRoot) {
 }
 async function runVectorizeSetup(repoRoot, out, err) {
   const ctx = makeContext(repoRoot);
-  const indexDir = join30(ctx.dataDir, "_indexes");
-  const finalDb = join30(indexDir, "memory.sqlite");
-  if (existsSync16(finalDb)) {
+  const indexDir = join28(ctx.dataDir, "_indexes");
+  const finalDb = join28(indexDir, "memory.sqlite");
+  if (existsSync15(finalDb)) {
     out("recall index already present \u2014 nothing to do\n");
     return;
   }
@@ -8909,7 +8728,7 @@ async function runVectorizeSetup(repoRoot, out, err) {
       return;
     }
   }
-  const tmpDb = join30(indexDir, `memory.sqlite.building-${process.pid}`);
+  const tmpDb = join28(indexDir, `memory.sqlite.building-${process.pid}`);
   const tmpSidecars = [tmpDb + "-wal", tmpDb + "-shm", tmpDb + "-journal"];
   const cleanTmp = () => {
     rmSync(tmpDb, { force: true });
@@ -8919,7 +8738,7 @@ async function runVectorizeSetup(repoRoot, out, err) {
   let tokenWritten = false;
   const releaseLock = () => {
     try {
-      const cur = existsSync16(lockPath) ? readFileSync4(lockPath, "utf8").trim() : "";
+      const cur = existsSync15(lockPath) ? readFileSync3(lockPath, "utf8").trim() : "";
       if (cur === token || cur === "" && !tokenWritten)
         rmSync(lockPath, { force: true });
     } catch {
@@ -8932,7 +8751,7 @@ async function runVectorizeSetup(repoRoot, out, err) {
     } finally {
       closeSync(lockFd);
     }
-    if (existsSync16(finalDb)) {
+    if (existsSync15(finalDb)) {
       out("recall index already present \u2014 nothing to do\n");
       return;
     }
@@ -8948,7 +8767,7 @@ async function runVectorizeSetup(repoRoot, out, err) {
     } finally {
       db.close();
     }
-    if (existsSync16(tmpDb + "-wal")) {
+    if (existsSync15(tmpDb + "-wal")) {
       throw new Error("temp index retained a WAL sidecar after consolidation; refusing to publish");
     }
     try {
@@ -9032,7 +8851,7 @@ async function runSessionStart(repoRoot, out) {
   let vectorized = null;
   let vectorizeSetupStarted = false;
   if (config.autoRecord.vectorize) {
-    const dbExists = existsSync16(join30(ctx.dataDir, "_indexes", "memory.sqlite"));
+    const dbExists = existsSync15(join28(ctx.dataDir, "_indexes", "memory.sqlite"));
     const action = decideVectorizeAction({
       vectorizeOn: true,
       dbExists,
@@ -9055,6 +8874,16 @@ async function runSessionStart(repoRoot, out) {
       }
     }
   }
+  let failures = null;
+  if (config.autoRecord.failures) {
+    try {
+      const { scanFailures: scanFailures2, failureReportSlice: failureReportSlice2 } = await import("./failures-PMURLMVB.js");
+      const slice = failureReportSlice2(await scanFailures2(ctx.dataDir));
+      if (slice.warnings.length > 0)
+        failures = slice;
+    } catch {
+    }
+  }
   let templateUpdate = null;
   try {
     const td = resolveTemplatesDir();
@@ -9094,7 +8923,8 @@ async function runSessionStart(repoRoot, out) {
     updateCheck: updateCheck ?? void 0,
     globalSetupOffer: globalSetupOffer || void 0,
     carryover: carryover ?? void 0,
-    handoffPrune: handoffPrune ?? void 0
+    handoffPrune: handoffPrune ?? void 0,
+    failures: failures ?? void 0
   }));
 }
 async function runSessionEnd(_repoRoot, _out) {
@@ -9121,7 +8951,7 @@ function detectInterruptedGitOp(repoRoot) {
     const resolved = gitOut(repoRoot, args).split(/\r?\n/).map((s) => s.trim());
     for (let i = 0; i < markers.length; i++) {
       const p = resolved[i];
-      if (p && existsSync16(isAbsolute5(p) ? p : join30(repoRoot, p)))
+      if (p && existsSync15(isAbsolute4(p) ? p : join28(repoRoot, p)))
         return markers[i];
     }
   } catch {
@@ -9141,23 +8971,23 @@ function resolveSessionEnvironment(ctx, config) {
   let environment = resolveEnvironment(config, {
     hostname: hostname(),
     env: process.env,
-    pathExists: existsSync16
+    pathExists: existsSync15
   });
   if (!environment)
     environment = process.env.VORTEX_ENV?.trim() || null;
   if (!environment) {
-    const envFile = join30(ctx.repoRoot, ".agent", "environment");
-    if (existsSync16(envFile)) {
-      environment = readFileSync4(envFile, "utf8").split(/\r?\n/)[0]?.trim() || null;
+    const envFile = join28(ctx.repoRoot, ".agent", "environment");
+    if (existsSync15(envFile)) {
+      environment = readFileSync3(envFile, "utf8").split(/\r?\n/)[0]?.trim() || null;
     }
   }
   return environment;
 }
 
 // ../plugins/session-rituals/dist/ambient-recall.js
-import { join as join31 } from "path";
+import { join as join29 } from "path";
 function defaultDbPath2(ctx) {
-  return join31(ctx.dataDir, "_indexes", "memory.sqlite");
+  return join29(ctx.dataDir, "_indexes", "memory.sqlite");
 }
 function createAmbientRecaller(ctx, options) {
   const resolveDb = options.dbPath ?? defaultDbPath2;
@@ -9194,14 +9024,14 @@ function createAmbientRecaller(ctx, options) {
 }
 
 // ../plugins/session-rituals/dist/worklog-write.js
-import { mkdir as mkdir10, writeFile as writeFile12 } from "fs/promises";
-import { dirname as dirname6, join as join32 } from "path";
+import { mkdir as mkdir10, writeFile as writeFile11 } from "fs/promises";
+import { dirname as dirname6, join as join30 } from "path";
 async function ensureWorklogEntry(ctx, opts) {
   const now = opts?.now ?? /* @__PURE__ */ new Date();
   const date = isoDate3(now);
   const time = isoTime2(now);
   const keyword = (opts?.keyword ?? "worklog").trim() || "worklog";
-  const store = new WorklogStore(join32(ctx.dataDir, "worklog"));
+  const store = new WorklogStore(join30(ctx.dataDir, "worklog"));
   const existing = await store.get(date);
   if (existing) {
     return { path: existing.path, date: existing.date, keyword: existing.keyword, created: false };
@@ -9209,7 +9039,7 @@ async function ensureWorklogEntry(ctx, opts) {
   const path = store.pathFor(date, keyword, time);
   const title = opts?.title ?? `${date} worklog`;
   await mkdir10(dirname6(path), { recursive: true });
-  await writeFile12(path, renderWorklogFile(date, title, opts?.body ?? ""), "utf8");
+  await writeFile11(path, renderWorklogFile(date, title, opts?.body ?? ""), "utf8");
   return { path, date, keyword, created: true };
 }
 function renderWorklogFile(date, title, body) {