@wrongstack/tools 0.293.0 → 0.295.1

package/dist/index.js

@@ -84,7 +84,7 @@ var init_win32_resolve = __esm({
 import { createWriteStream, mkdirSync } from "node:fs";
 import * as fsp from "node:fs/promises";
 import * as path2 from "node:path";
-import { wstackGlobalRoot } from "@wrongstack/core";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
 function toolOutputDir() {
   return path2.join(wstackGlobalRoot(), "tool-output");
 }
@@ -392,7 +392,7 @@ var init_circuit_breaker = __esm({
 });
 
 // src/_redact-command.ts
-import { expectDefined } from "@wrongstack/core";
+import { expectDefined } from "@wrongstack/core/utils";
 function redactCommand(cmd) {
   let result = cmd;
   for (const pattern of SENSITIVE_FLAG_PATTERNS) {
@@ -509,7 +509,12 @@ var init_process_registry = __esm({
         this.breaker.setEnabled(false);
       }
       register(info) {
-        this.processes.set(info.pid, { ...info, killed: false, protected: info.protected ?? false });
+        this.processes.set(info.pid, {
+          ...info,
+          killed: false,
+          protected: info.protected ?? false,
+          background: info.background ?? false
+        });
       }
       _isSafeSignalPid(pid) {
         return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
@@ -562,12 +567,21 @@ var init_process_registry = __esm({
         }
         return n;
       }
+      /** Count of active jobs explicitly launched in background mode. */
+      get activeBackgroundCount() {
+        let n = 0;
+        for (const p of this.processes.values()) {
+          if (p.background && !p.killed) n++;
+        }
+        return n;
+      }
       /**
        * Combined stats for observability — used by /ps and the TUI status bar.
        */
       stats() {
         return {
           activeCount: this.activeCount,
+          backgroundCount: this.activeBackgroundCount,
           totalCount: this.processes.size,
           breaker: this.breaker.snapshot()
         };
@@ -668,7 +682,7 @@ var init_process_registry = __esm({
         this.autoKillTimer = setTimeout(() => {
           this.autoKillTimer = null;
           this.autoKillArmedAt = null;
-          this.killAll({ force: false });
+          this.killAll({ force: false, preserveBackground: true });
           this.breaker.forceReset();
           this._emitBreakerCountdown();
         }, this.autoKillResetMs);
@@ -708,6 +722,7 @@ var init_process_registry = __esm({
         if (!p) return false;
         if (p.killed) return true;
         if (p.protected) return false;
+        if (opts.preserveBackground && p.background) return false;
         const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
         const isWin5 = os.platform() === "win32";
         if (isWin5) {
@@ -810,11 +825,11 @@ var init_process_registry = __esm({
 // src/_spawn-stream.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  buildChildEnv,
   emitProcessCompleted,
   emitProcessOutput,
   emitProcessStarted
-} from "@wrongstack/core";
+} from "@wrongstack/core/observability";
+import { buildChildEnv } from "@wrongstack/core/utils";
 async function* spawnStream(opts) {
   const max = opts.maxBytes ?? 2e5;
   const flushAt = opts.flushBytes ?? 4 * 1024;
@@ -1026,7 +1041,7 @@ var init_spawn_stream = __esm({
 import { createHash } from "node:crypto";
 import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
-import * as Core from "@wrongstack/core";
+import * as Core from "@wrongstack/core/utils";
 function sha256hex(content) {
   return createHash("sha256").update(content, "utf8").digest("hex");
 }
@@ -1070,16 +1085,16 @@ async function assertRealInsideRoot(absPath, ctx) {
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
   );
-  let probe = absPath;
+  let probe2 = absPath;
   for (; ; ) {
     let real;
     try {
-      real = await fsp2.realpath(probe);
+      real = await fsp2.realpath(probe2);
     } catch (err) {
       if (err.code === "ENOENT") {
-        const parent = path3.dirname(probe);
-        if (parent === probe) return;
-        probe = parent;
+        const parent = path3.dirname(probe2);
+        if (parent === probe2) return;
+        probe2 = parent;
         continue;
       }
       throw err;
@@ -1267,7 +1282,20 @@ function pythonProfile() {
     ]),
     ignoredDirectories: IGNORES,
     packageManagers: Object.freeze(["pip", "poetry", "pipenv", "uv"]),
-    executables: Object.freeze(["python", "python3", "ruff", "black", "pytest", "mypy", "pyright"]),
+    executables: Object.freeze([
+      "python",
+      "python3",
+      "pip",
+      "pip3",
+      "poetry",
+      "pipenv",
+      "uv",
+      "ruff",
+      "black",
+      "pytest",
+      "mypy",
+      "pyright"
+    ]),
     operations: Object.freeze({
       syntax: async (ctx) => {
         const py = ctx.options.target ? "python3" : "python3";
@@ -1327,6 +1355,14 @@ function pythonProfile() {
           network: true
         });
       },
+      "package-remove": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-remove", "At least one package name is required.") : processPlan(ctx, "package-remove", "pip", ["uninstall", "--yes", ...names], {
+          parser: "package-text",
+          reason: "Remove validated Python packages.",
+          mutating: true
+        });
+      },
       "package-audit": async (ctx) => processPlan(ctx, "package-audit", "pip", ["audit"], {
         parser: "pip-audit",
         reason: "Audit Python dependencies for vulnerabilities.",
@@ -1938,6 +1974,19 @@ function typescriptProfile() {
           network: true
         });
       },
+      "package-remove": async (ctx) => {
+        const names = packageNames(ctx);
+        if (names.length === 0)
+          return unavailable(ctx, "package-remove", "At least one package name is required.");
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "npm" ? ["uninstall", "--ignore-scripts", ...names] : ["remove", "--ignore-scripts", ...names];
+        return processPlan(ctx, "package-remove", manager, args, {
+          parser: "package-text",
+          reason: `Remove validated packages with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true
+        });
+      },
       "package-audit": async (ctx) => {
         const manager = ctx.workspace.packageManager ?? "npm";
         return processPlan(ctx, "package-audit", manager, ["audit", "--json"], {
@@ -2390,13 +2439,28 @@ var init_primary = __esm({
         }),
         "package-add": async (ctx) => {
           const names = packageNames(ctx);
-          return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : processPlan(ctx, "package-add", "dotnet", ["add", "package", ...names], {
-            parser: "dotnet-package",
-            reason: "Add validated NuGet packages.",
-            mutating: true,
-            network: true,
-            executesProjectCode: true
-          });
+          const [spec] = names;
+          const versionAt = spec?.lastIndexOf("@") ?? -1;
+          const packageName = versionAt > 0 ? spec?.slice(0, versionAt) : spec;
+          const packageVersion = versionAt > 0 ? spec?.slice(versionAt + 1) : void 0;
+          return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : names.length > 1 ? unavailable(ctx, "package-add", "NuGet package changes run one package at a time.") : processPlan(
+            ctx,
+            "package-add",
+            "dotnet",
+            [
+              "add",
+              "package",
+              packageName ?? "",
+              ...packageVersion ? ["--version", packageVersion] : []
+            ],
+            {
+              parser: "dotnet-package",
+              reason: "Add validated NuGet packages.",
+              mutating: true,
+              network: true,
+              executesProjectCode: true
+            }
+          );
         },
         "package-remove": async (ctx) => {
           const names = packageNames(ctx);
@@ -2608,8 +2672,8 @@ async function scanDirectory(directory, depth, profiles, limits, state, extraIgn
     collectFileEvidence(directory, fullPath, entry.name, profiles, state);
   }
 }
-function collectFileEvidence(directory, fullPath, basename11, profiles, state) {
-  const lower = basename11.toLowerCase();
+function collectFileEvidence(directory, fullPath, basename12, profiles, state) {
+  const lower = basename12.toLowerCase();
   const extension = path4.extname(lower);
   for (const profile of profiles) {
     const detector = profile.detectors.find(
@@ -2620,7 +2684,7 @@ function collectFileEvidence(directory, fullPath, basename11, profiles, state) {
       candidate.evidence.push({
         kind: detector.kind,
         path: fullPath,
-        value: basename11,
+        value: basename12,
         weight: detector.weight
       });
       if (detector.kind === "manifest" || detector.kind === "config") {
@@ -3486,7 +3550,7 @@ function validateOperationOptions(operation, packages) {
     if (value.startsWith(".") || value.startsWith("/") || /^[A-Za-z]:/.test(value) || value.includes("://")) {
       throw new Error(`Package paths and URLs are not supported: "${value}"`);
     }
-    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value)) {
+    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value) && !PYTHON_PACKAGE_RE.test(value)) {
       throw new Error(`Invalid package identifier "${value}"`);
     }
   }
@@ -3508,7 +3572,7 @@ function isInside2(candidate, root) {
   const relative13 = path6.relative(path6.resolve(root), path6.resolve(candidate));
   return relative13 === "" || !relative13.startsWith("..") && !path6.isAbsolute(relative13);
 }
-var MAX_ARGUMENTS, MAX_ARGUMENT_LENGTH, PACKAGE_NAME_RE, COMPOSER_PACKAGE_RE, GO_MODULE_RE;
+var MAX_ARGUMENTS, MAX_ARGUMENT_LENGTH, PACKAGE_NAME_RE, COMPOSER_PACKAGE_RE, GO_MODULE_RE, PYTHON_PACKAGE_RE;
 var init_plan = __esm({
   "src/languages/plan.ts"() {
     "use strict";
@@ -3519,6 +3583,7 @@ var init_plan = __esm({
     PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
     COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
     GO_MODULE_RE = /^(?:[a-z0-9.-]+\.)+[a-z0-9.-]+\/[a-z0-9._~+/@-]+$/i;
+    PYTHON_PACKAGE_RE = /^[a-z0-9._-]+(?:\[[a-z0-9._,-]+\])?==[a-z0-9*+._!~-]+$/i;
   }
 });
 
@@ -3937,15 +4002,15 @@ async function changedPaths(before, after, beforeSizes, afterSizes) {
   const beforeSet = new Set(before);
   const afterSet = new Set(after);
   const changed = /* @__PURE__ */ new Set();
-  for (const path34 of after) {
-    if (!beforeSet.has(path34)) changed.add(path34);
+  for (const path35 of after) {
+    if (!beforeSet.has(path35)) changed.add(path35);
   }
-  for (const path34 of before) {
-    if (!afterSet.has(path34)) changed.add(path34);
+  for (const path35 of before) {
+    if (!afterSet.has(path35)) changed.add(path35);
   }
   if (beforeSizes && afterSizes) {
-    for (const path34 of after) {
-      if (beforeSizes.get(path34) !== afterSizes.get(path34)) changed.add(path34);
+    for (const path35 of after) {
+      if (beforeSizes.get(path35) !== afterSizes.get(path35)) changed.add(path35);
     }
   }
   return [...changed].sort();
@@ -4420,7 +4485,6 @@ var init_package_tool = __esm({
         const operationOptions2 = {
           ...input.names ? { packages: input.names } : {},
           ...input.scope ? { packageScope: input.scope } : {},
-          ...input.dryRun !== void 0 ? { allowScripts: input.dryRun } : { allowScripts: false },
           ...input.allowScripts !== void 0 ? { allowScripts: input.allowScripts } : {}
         };
         const planResult = await planLanguageOperation({
@@ -4449,6 +4513,24 @@ var init_package_tool = __esm({
           };
           return;
         }
+        if (input.dryRun) {
+          yield {
+            type: "final",
+            output: {
+              status: "passed",
+              language: planResult.workspace.language,
+              workspace: planResult.workspace.root,
+              operation: planResult.plan.operation,
+              mutations: [],
+              vulnerabilities: [],
+              outdated: [],
+              manifestsChanged: [],
+              lockfilesChanged: [],
+              output: `Dry run: ${planResult.plan.command ?? "internal"} ${planResult.plan.args.join(" ")}`.trim()
+            }
+          };
+          return;
+        }
         const runner = executePackagePlan({
           projectRoot: ctx.projectRoot,
           workspace: planResult.workspace,
@@ -5261,10 +5343,10 @@ import {
   emitProcessCompleted as emitProcessCompleted2,
   emitProcessOutput as emitProcessOutput2,
   emitProcessStarted as emitProcessStarted2
-} from "@wrongstack/core";
+} from "@wrongstack/core/observability";
 
 // src/_env.ts
-import { buildChildEnv as buildChildEnv2 } from "@wrongstack/core";
+import { buildChildEnv as buildChildEnv2 } from "@wrongstack/core/utils";
 
 // src/bash.ts
 init_output_spool();
@@ -5278,8 +5360,9 @@ import * as os3 from "node:os";
 init_process_registry();
 import * as fs6 from "node:fs/promises";
 import * as os2 from "node:os";
+import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
 import * as path9 from "node:path";
-var REGISTRY_FILE = ".wrongstack/process-registry.json";
+var REGISTRY_FILE = "process-registry.json";
 function toErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -5297,7 +5380,8 @@ function emitStructuredLog(level, event, message, error) {
 }
 var HEARTBEAT_INTERVAL_MS = 5e3;
 var STALE_THRESHOLD_MS = 3e4;
-var LOCKFILE = ".wrongstack/.process-registry.lock";
+var LOCK_STALE_MS = 3e4;
+var LOCKFILE = ".process-registry.lock";
 function generateInstanceId() {
   const hostname4 = os2.hostname();
   const pid = process.pid;
@@ -5325,21 +5409,26 @@ async function acquireLock(lockfilePath, timeoutMs = 5e3) {
         try {
           const content = await fs6.readFile(lockfilePath, "utf-8");
           const parts = content.split(":");
-          const lockPidStr = parts[0] ?? "0";
-          const lockPid = parseInt(lockPidStr, 10);
-          if (process.platform !== "win32") {
+          const lockPid = parseInt(parts[0] ?? "0", 10);
+          const lockTs = Number(parts[parts.length - 1]);
+          const staleByAge = Number.isFinite(lockTs) && Date.now() - lockTs > LOCK_STALE_MS;
+          let holderDead = false;
+          if (process.platform !== "win32" && Number.isFinite(lockPid) && lockPid > 0) {
             try {
               process.kill(lockPid, 0);
             } catch {
-              await fs6.unlink(lockfilePath);
-              continue;
+              holderDead = true;
             }
           }
-        } catch {
-          try {
-            await fs6.unlink(lockfilePath);
-          } catch {
+          if (holderDead || staleByAge) {
+            await fs6.unlink(lockfilePath).catch(() => {
+            });
+            continue;
           }
+        } catch {
+          await fs6.unlink(lockfilePath).catch(() => {
+          });
+          continue;
         }
         await new Promise((r) => setTimeout(r, 100));
         continue;
@@ -5349,25 +5438,35 @@ async function acquireLock(lockfilePath, timeoutMs = 5e3) {
   }
   throw new Error(`Failed to acquire lock after ${timeoutMs}ms`);
 }
+function freshRegistryData() {
+  return {
+    version: 1,
+    instances: /* @__PURE__ */ new Map(),
+    protectedPatterns: ["wrongstack", "node"],
+    lastCleanup: Date.now()
+  };
+}
 async function readRegistryFile(filePath) {
+  let content;
   try {
-    const content = await fs6.readFile(filePath, "utf-8");
-    const parsed = JSON.parse(content);
-    if (parsed.instances && Array.isArray(parsed.instances)) {
-      parsed.instances = new Map(parsed.instances);
-    }
-    return parsed;
+    content = await fs6.readFile(filePath, "utf-8");
   } catch (err) {
-    if (isNodeError(err) && err.code === "ENOENT") {
-      return {
-        version: 1,
-        instances: /* @__PURE__ */ new Map(),
-        protectedPatterns: ["wrongstack", "node"],
-        lastCleanup: Date.now()
-      };
-    }
+    if (isNodeError(err) && err.code === "ENOENT") return freshRegistryData();
     throw err;
   }
+  try {
+    const parsed = JSON.parse(content);
+    if (!parsed || typeof parsed !== "object") return freshRegistryData();
+    const base = freshRegistryData();
+    return {
+      version: 1,
+      instances: Array.isArray(parsed.instances) ? new Map(parsed.instances) : base.instances,
+      protectedPatterns: Array.isArray(parsed.protectedPatterns) ? parsed.protectedPatterns : base.protectedPatterns,
+      lastCleanup: typeof parsed.lastCleanup === "number" ? parsed.lastCleanup : base.lastCleanup
+    };
+  } catch {
+    return freshRegistryData();
+  }
 }
 async function writeRegistryFile(filePath, data) {
   const tmpPath = `${filePath}.tmp.${process.pid}`;
@@ -5386,12 +5485,18 @@ var PersistentProcessRegistry = class {
   lockPath;
   baseRegistry;
   heartbeatInterval = null;
+  cleanupInterval = null;
+  heartbeatRunning = false;
+  cleanupRunning = false;
   isShuttingDown = false;
+  onProcessExit = () => {
+    void this.syncToPersistent();
+  };
   constructor(baseRegistry) {
     this.instanceId = generateInstanceId();
-    const homeDir = os2.homedir();
-    this.registryPath = path9.join(homeDir, REGISTRY_FILE);
-    this.lockPath = path9.join(homeDir, LOCKFILE);
+    const globalRoot = wstackGlobalRoot3();
+    this.registryPath = path9.join(globalRoot, REGISTRY_FILE);
+    this.lockPath = path9.join(globalRoot, LOCKFILE);
     this.baseRegistry = baseRegistry ?? getProcessRegistry();
     this.ensureDirectory().catch((err) => {
       emitStructuredLog("warn", "process_registry.dir_create_failed", "PersistentProcessRegistry: failed to create .wrongstack directory", err);
@@ -5410,16 +5515,18 @@ var PersistentProcessRegistry = class {
    */
   start() {
     if (this.heartbeatInterval) return;
-    this.syncToPersistent();
+    this.isShuttingDown = false;
+    this.heartbeat();
     this.heartbeatInterval = setInterval(() => {
       this.heartbeat();
     }, HEARTBEAT_INTERVAL_MS);
     this.heartbeatInterval.unref?.();
-    setInterval(() => {
-      this.cleanupStaleEntries();
-    }, STALE_THRESHOLD_MS).unref?.();
+    this.cleanupInterval = setInterval(() => {
+      this.cleanup();
+    }, STALE_THRESHOLD_MS);
+    this.cleanupInterval.unref?.();
     this.registerMainProcess();
-    process.on("exit", () => this.syncToPersistent());
+    process.on("exit", this.onProcessExit);
   }
   /**
    * Stop the heartbeat and clean up.
@@ -5430,7 +5537,12 @@ var PersistentProcessRegistry = class {
       clearInterval(this.heartbeatInterval);
       this.heartbeatInterval = null;
     }
-    this.syncToPersistent();
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval);
+      this.cleanupInterval = null;
+    }
+    process.off("exit", this.onProcessExit);
+    void this.syncToPersistent();
   }
   /**
    * Register the main WrongStack process as protected.
@@ -5514,8 +5626,18 @@ var PersistentProcessRegistry = class {
    * Send heartbeat to mark all this instance's processes as alive.
    */
   heartbeat() {
-    if (this.isShuttingDown) return;
-    this.syncToPersistent();
+    if (this.isShuttingDown || this.heartbeatRunning) return;
+    this.heartbeatRunning = true;
+    void this.syncToPersistent().finally(() => {
+      this.heartbeatRunning = false;
+    });
+  }
+  cleanup() {
+    if (this.isShuttingDown || this.cleanupRunning) return;
+    this.cleanupRunning = true;
+    void this.cleanupStaleEntries().finally(() => {
+      this.cleanupRunning = false;
+    });
   }
   /**
    * Sync this instance's processes to the persistent registry.
@@ -6237,14 +6359,12 @@ var bashTool = {
     const detached = !isWin5;
     const startedAt = Date.now();
     if (input.background) {
-      let buf2 = "";
-      let truncated = false;
       const child2 = spawn3(shell, args, {
         cwd: ctx.projectRoot,
         env,
         // PowerShell takes the script on stdin (no argv quoting); cmd.exe
         // and POSIX shells ignore stdin when given the command inline.
-        stdio: [plan.useStdin ? "pipe" : "ignore", "pipe", "pipe"],
+        stdio: [plan.useStdin ? "pipe" : "ignore", "ignore", "ignore"],
         // win32: CreateProcess IGNORES CREATE_NO_WINDOW (windowsHide) when
         // DETACHED_PROCESS (detached: true) is set, so the console-less
         // cmd.exe's grandchildren (node, dev servers) each allocate a fresh
@@ -6263,8 +6383,8 @@ var bashTool = {
         }
       }
       const pid2 = child2.pid;
-      let stdoutBytes2 = 0;
-      let stderrBytes2 = 0;
+      const stdoutBytes2 = 0;
+      const stderrBytes2 = 0;
       let telemetryCompleted2 = false;
       emitProcessStarted2({
         ...pid2 !== void 0 ? { pid: pid2 } : {},
@@ -6297,41 +6417,17 @@ var bashTool = {
           startedAt: Date.now(),
           sessionId: ctx.session?.id,
           child: child2,
-          processGroupLeader: detached && child2.pid === pid2
+          processGroupLeader: detached && child2.pid === pid2,
+          background: true
         });
         child2.on("close", () => registry.unregister(pid2));
       }
-      const onBgData = (chunk, stream) => {
-        if (stream === "stdout") stdoutBytes2 += chunk.byteLength;
-        else stderrBytes2 += chunk.byteLength;
-        emitProcessOutput2({ pid: pid2, stream, chunk });
-        if (truncated) return;
-        const remain = MAX_OUTPUT - buf2.length;
-        if (remain > 0) {
-          buf2 += chunk.toString().slice(0, remain);
-        }
-        if (buf2.length >= MAX_OUTPUT) {
-          truncated = true;
-          child2.stdout?.off("data", onBgStdout);
-          child2.stderr?.off("data", onBgStderr);
-        }
-      };
-      const onBgStdout = (chunk) => onBgData(chunk, "stdout");
-      const onBgStderr = (chunk) => onBgData(chunk, "stderr");
-      child2.stdout?.on("data", onBgStdout);
-      child2.stderr?.on("data", onBgStderr);
-      const cleanupBackground = () => {
-        child2.stdout?.off("data", onBgStdout);
-        child2.stderr?.off("data", onBgStderr);
-      };
       child2.on("error", () => {
-        cleanupBackground();
         if (typeof pid2 === "number") registry.unregister(pid2);
         registry.afterCall(Date.now() - startedAt, true, bypassBreaker);
         completeBackground(1);
       });
       child2.on("close", (code, signal) => {
-        cleanupBackground();
         registry.afterCall(Date.now() - startedAt, false, bypassBreaker);
         completeBackground(code ?? (signal ? 1 : 0), signal ?? void 0);
       });
@@ -6339,7 +6435,7 @@ var bashTool = {
       yield {
         type: "final",
         output: {
-          output: normalizeCommandOutput(buf2),
+          output: "",
           exit_code: null,
           timed_out: false,
           pid: pid2
@@ -6610,6 +6706,7 @@ ${hint}` : ""),
     for (const entry of registry.bySession(sessionId)) {
       if (entry.name !== "bash") continue;
       if (entry.child.exitCode !== null) continue;
+      if (entry.background) continue;
       if (entry.protected) continue;
       registry.kill(entry.pid, { force: true });
     }
@@ -6619,7 +6716,7 @@ ${hint}` : ""),
 // src/batch-tool-use.ts
 import {
   GOVERNED_TOOL_EXECUTOR_META_KEY
-} from "@wrongstack/core";
+} from "@wrongstack/core/types";
 var batchToolUseTool = {
   name: "batch_tool_use",
   category: "Meta",
@@ -7399,6 +7496,10 @@ var BrowserSessionManager = class {
     const ids = [...this.sessions.values()].filter((session) => session.ownerId === ownerId).map((session) => session.id);
     for (const id of ids) await this.close(id, ownerId).catch(() => void 0);
   }
+  /** True when the manager owns no live browser contexts. */
+  isIdle() {
+    return this.sessions.size === 0;
+  }
   async dispose() {
     for (const session of [...this.sessions.values()]) {
       await session.context.close().catch(() => void 0);
@@ -7562,7 +7663,7 @@ async function abortable(signal, operation, onAbort) {
 
 // src/browser/tools.ts
 import * as path12 from "node:path";
-import { ToolCapabilities } from "@wrongstack/core";
+import { ToolCapabilities } from "@wrongstack/core/security";
 import { resolveWstackPaths } from "@wrongstack/core/utils";
 var managers = /* @__PURE__ */ new Map();
 var cleanupSignalByContext = /* @__PURE__ */ new WeakMap();
@@ -7583,12 +7684,17 @@ function managerFor(ctx) {
   if (cleanupSignalByContext.get(ctx) !== runSignal) {
     cleanupSignalByContext.set(ctx, runSignal);
     const managerForRun = manager;
+    const rootForRun = root;
     const ownerForRun = owner(ctx);
     ctx.registerAbortHook?.(async () => {
       if (cleanupSignalByContext.get(ctx) === runSignal) {
         cleanupSignalByContext.delete(ctx);
       }
       await managerForRun.closeOwner(ownerForRun);
+      if (managerForRun.isIdle() && managers.get(rootForRun) === managerForRun) {
+        managers.delete(rootForRun);
+        await managerForRun.dispose();
+      }
     });
   }
   return manager;
@@ -7976,7 +8082,7 @@ async function shutdownBrowserTools() {
 }
 
 // src/codebase-index/writer.ts
-import { expectDefined as expectDefined2 } from "@wrongstack/core";
+import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
 
 // src/codebase-index/circuit-breaker.ts
 var CircuitOpenError = class extends Error {
@@ -8066,7 +8172,7 @@ import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 import { createRequire } from "node:module";
 import * as fs9 from "node:fs";
 import * as path13 from "node:path";
-import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core";
+import { resolveWstackPaths as resolveWstackPaths2, sqliteCachePragmas } from "@wrongstack/core/utils";
 
 // src/codebase-index/schema.ts
 var SCHEMA_VERSION = 3;
@@ -8122,23 +8228,13 @@ function buildBm25Index(docs) {
     const tokens = tokenise(d.text);
     return { id: d.id, tokens, raw: d.text, len: tokens.length };
   });
-  const df = {};
-  for (const doc of documents) {
-    const seen = /* @__PURE__ */ new Set();
-    for (const t of doc.tokens) {
-      if (!seen.has(t)) {
-        df[t] = (df[t] ?? 0) + 1;
-        seen.add(t);
-      }
-    }
-  }
   const N = documents.length;
   const totalLen = documents.reduce((sum, d) => sum + d.len, 0);
   const avgLen = N === 0 ? 0 : totalLen / N;
-  return new Bm25Index(documents, df, N, avgLen);
+  return new Bm25Index(documents, N, avgLen);
 }
 var Bm25Index = class {
-  constructor(documents, _df, N, avgLen) {
+  constructor(documents, N, avgLen) {
     this.documents = documents;
     this.N = N;
     this.safeAvgLen = avgLen === 0 ? 1 : avgLen;
@@ -8146,9 +8242,19 @@ var Bm25Index = class {
   documents;
   N;
   safeAvgLen;
+  /** Lazily-built id→doc index so getDoc is O(1) instead of an O(D) linear find. */
+  _byId;
   score(query, filter) {
     const qTokens = tokenise(query);
     if (qTokens.length === 0) return [];
+    const dfByTerm = /* @__PURE__ */ new Map();
+    for (const qTerm of qTokens) {
+      let dfVal = 0;
+      for (const candidate of this.documents) {
+        if (candidate.tokens.some((t) => t.startsWith(qTerm))) dfVal++;
+      }
+      dfByTerm.set(qTerm, dfVal);
+    }
     const results = [];
     for (const doc of this.documents) {
       if (filter && !filter(doc.id)) continue;
@@ -8159,10 +8265,7 @@ var Bm25Index = class {
           if (t.startsWith(qTerm)) tf++;
         }
         if (tf === 0) continue;
-        let dfVal = 0;
-        for (const candidate of this.documents) {
-          if (candidate.tokens.some((t) => t.startsWith(qTerm))) dfVal++;
-        }
+        const dfVal = dfByTerm.get(qTerm) ?? 0;
         if (dfVal === 0) continue;
         const idf = Math.log((this.N - dfVal + 0.5) / (dfVal + 0.5) + 1);
         const lenRatio = B * (doc.len / this.safeAvgLen);
@@ -8174,7 +8277,10 @@ var Bm25Index = class {
     return results;
   }
   getDoc(id) {
-    return this.documents.find((d) => d.id === id);
+    if (!this._byId) {
+      this._byId = new Map(this.documents.map((d) => [d.id, d]));
+    }
+    return this._byId.get(id);
   }
   extractSnippet(docId, queryTokens, radius = 40) {
     const doc = this.getDoc(docId);
@@ -8336,6 +8442,25 @@ var IndexStore = class _IndexStore {
    * and reuse it. Cleared in {@link close} when the connection is torn down.
    */
   stmtCache = /* @__PURE__ */ new Map();
+  /**
+   * Cached full-corpus BM25 index for the FTS5-unavailable fallback path.
+   * Built lazily on the first `searchRankedFallback` call and invalidated
+   * (via `bm25Dirty`) whenever the `symbols` table is mutated. Computing
+   * IDF over the full corpus is also more correct than the old per-query
+   * candidate-subset IDF.
+   *
+   * Cache-lifecycle invariants (single source of truth lives at the
+   * `invalidateBm25()` helper — see its docblock for the "every mutation
+   * MUST call this" contract):
+   *   - declaration: this field + `bm25Dirty` (here)
+   *   - invalidation: `invalidateBm25()` flips the flag and nulls the cache
+   *   - build: `getOrBuildBm25()` rebuilds against current `symbols` rows
+   *   - teardown: `close()` resets the flag and nulls the cache
+   */
+  bm25Cache = null;
+  // Dirty on open so the first getOrBuildBm25() rebuilds against current rows;
+  // an empty or pre-existing corpus makes a stale IDF table meaningless.
+  bm25Dirty = true;
   /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
   stmt(sql) {
     let s = this.stmtCache.get(sql);
@@ -8383,7 +8508,15 @@ var IndexStore = class _IndexStore {
     this.db = new Database(path13.join(this.indexDir, DB_FILE));
     try {
       this.db.exec("PRAGMA journal_mode = WAL");
-      this.db.exec("PRAGMA busy_timeout = 5000");
+      this.db.exec("PRAGMA synchronous = NORMAL");
+      this.db.exec("PRAGMA busy_timeout = 15000");
+      this.db.exec("PRAGMA temp_store = MEMORY");
+      const cache2 = sqliteCachePragmas();
+      this.db.exec(`PRAGMA cache_size = -${cache2.cacheSizeKiB}`);
+      this.db.exec(`PRAGMA mmap_size = ${cache2.mmapBytes}`);
+      this.db.exec("PRAGMA foreign_keys = ON");
+      this.db.exec("PRAGMA journal_size_limit = 67108864");
+      this.db.exec("PRAGMA wal_autocheckpoint = 1000");
     } catch {
     }
     this.initSchema();
@@ -8395,7 +8528,7 @@ var IndexStore = class _IndexStore {
         value TEXT NOT NULL
       );
     `);
-    const storedRows = this.db.prepare("SELECT value FROM metadata WHERE key = ?").all("version");
+    const storedRows = this.stmt("SELECT value FROM metadata WHERE key = ?").all("version");
     const storedVersion = storedRows.length ? Number(storedRows[0]?.value) : null;
     if (storedVersion !== null && storedVersion !== SCHEMA_VERSION) {
       this.db.exec(`
@@ -8404,9 +8537,9 @@ var IndexStore = class _IndexStore {
         DROP TABLE IF EXISTS refs;
       `);
       this.db.exec("DROP TABLE IF EXISTS symbols_fts");
-      this.db.prepare("UPDATE metadata SET value = ? WHERE key = ?").run(String(SCHEMA_VERSION), "version");
+      this.stmt("UPDATE metadata SET value = ? WHERE key = ?").run(String(SCHEMA_VERSION), "version");
     } else if (storedVersion === null) {
-      this.db.prepare("INSERT INTO metadata(key, value) VALUES (?, ?)").run("version", String(SCHEMA_VERSION));
+      this.stmt("INSERT INTO metadata(key, value) VALUES (?, ?)").run("version", String(SCHEMA_VERSION));
     }
     this.db.exec(`
       CREATE TABLE IF NOT EXISTS files (
@@ -8437,6 +8570,7 @@ var IndexStore = class _IndexStore {
     this.db.exec("CREATE INDEX IF NOT EXISTS idx_s_file ON symbols(file)");
     this.db.exec("CREATE INDEX IF NOT EXISTS idx_s_lang_kind ON symbols(lang, kind)");
     this.db.exec("CREATE INDEX IF NOT EXISTS idx_s_file_fk ON symbols(file_fk)");
+    this.db.exec("CREATE INDEX IF NOT EXISTS idx_s_name_id ON symbols(name, id)");
     this.db.exec(`
       CREATE TABLE IF NOT EXISTS refs (
         id INTEGER PRIMARY KEY,
@@ -8457,65 +8591,167 @@ var IndexStore = class _IndexStore {
       );
       this.ftsAvailable = true;
       const symbolCount = Number(
-        this.db.prepare("SELECT COUNT(*) AS n FROM symbols").get()?.n ?? 0
+        this.stmt("SELECT COUNT(*) AS n FROM symbols").get()?.n ?? 0
       );
       const ftsCount = Number(
-        this.db.prepare("SELECT COUNT(*) AS n FROM symbols_fts").get()?.n ?? 0
+        this.stmt("SELECT COUNT(*) AS n FROM symbols_fts").get()?.n ?? 0
       );
       if (symbolCount !== ftsCount) {
         this.db.exec("DELETE FROM symbols_fts");
-        const insert = this.db.prepare("INSERT INTO symbols_fts(rowid, text) VALUES (?, ?)");
-        const rows = this.db.prepare("SELECT id, name, signature, doc_comment FROM symbols ORDER BY id").all();
-        for (const row of rows) {
-          insert.run(row.id, buildIndexableText(row.name, row.signature, row.doc_comment));
-        }
+        const rows = this.stmt("SELECT id, name, signature, doc_comment FROM symbols ORDER BY id").all();
+        this.bulkInsertFts(
+          rows.map((row) => ({
+            id: row.id,
+            text: buildIndexableText(row.name, row.signature, row.doc_comment)
+          }))
+        );
+        this.invalidateBm25();
       }
     } catch {
       this.ftsAvailable = false;
     }
+    this.ensureNextSymbolIdSeeded();
+  }
+  // ─── ID allocation & bulk helpers ────────────────────────────────────────────
+  static NEXT_SYMBOL_ID_KEY = "next_symbol_id";
+  /** Stay under typical SQLite SQLITE_MAX_VARIABLE_NUMBER (often 999). */
+  static MAX_SQL_VARS = 900;
+  /**
+   * Ensure `metadata.next_symbol_id` exists. Safe to call outside a write
+   * transaction on open; the first concurrent writer under BEGIN IMMEDIATE
+   * re-reads and advances the counter atomically.
+   */
+  ensureNextSymbolIdSeeded() {
+    const existing = this.stmt("SELECT value FROM metadata WHERE key = ?").get(
+      _IndexStore.NEXT_SYMBOL_ID_KEY
+    );
+    if (existing?.value !== void 0) return;
+    const maxRows = this.stmt("SELECT MAX(id) AS m FROM symbols").all();
+    const next = (maxRows[0]?.m ?? 0) + 1;
+    this.stmt("INSERT OR REPLACE INTO metadata(key, value) VALUES (?, ?)").run(
+      _IndexStore.NEXT_SYMBOL_ID_KEY,
+      String(next)
+    );
+  }
+  /**
+   * Reserve `count` consecutive symbol ids. MUST run inside BEGIN IMMEDIATE
+   * so concurrent indexers cannot hand out overlapping ranges.
+   */
+  allocateSymbolIds(count) {
+    if (count <= 0) return this.getMaxSymbolId() + 1;
+    this.ensureNextSymbolIdSeeded();
+    const row = this.stmt("SELECT value FROM metadata WHERE key = ?").get(
+      _IndexStore.NEXT_SYMBOL_ID_KEY
+    );
+    const start = Math.max(1, Number(row?.value ?? 1) || 1);
+    this.stmt("INSERT OR REPLACE INTO metadata(key, value) VALUES (?, ?)").run(
+      _IndexStore.NEXT_SYMBOL_ID_KEY,
+      String(start + count)
+    );
+    return start;
+  }
+  /** Multi-row INSERT for symbols — amortizes prepare/bind overhead in large batches. */
+  bulkInsertSymbols(rows) {
+    if (rows.length === 0) return;
+    const cols = 12;
+    const chunkSize = Math.max(1, Math.floor(_IndexStore.MAX_SQL_VARS / cols));
+    for (let i = 0; i < rows.length; i += chunkSize) {
+      const chunk = rows.slice(i, i + chunkSize);
+      const placeholders = chunk.map(() => "(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").join(", ");
+      const stmt = this.stmt(
+        `INSERT INTO symbols(id, lang, kind, name, file, line, col, signature, doc_comment, scope, text, file_fk)
+         VALUES ${placeholders}`
+      );
+      const binds = [];
+      for (const r of chunk) {
+        binds.push(
+          r.id,
+          r.lang,
+          r.kind,
+          r.name,
+          r.file,
+          r.line,
+          r.col,
+          r.signature,
+          r.docComment,
+          r.scope,
+          r.text,
+          r.file
+        );
+      }
+      stmt.run(...binds);
+    }
+  }
+  bulkInsertFts(rows) {
+    if (!this.ftsAvailable || rows.length === 0) return;
+    const cols = 2;
+    const chunkSize = Math.max(1, Math.floor(_IndexStore.MAX_SQL_VARS / cols));
+    for (let i = 0; i < rows.length; i += chunkSize) {
+      const chunk = rows.slice(i, i + chunkSize);
+      const placeholders = chunk.map(() => "(?, ?)").join(", ");
+      const stmt = this.stmt(`INSERT INTO symbols_fts(rowid, text) VALUES ${placeholders}`);
+      const binds = [];
+      for (const r of chunk) binds.push(r.id, r.text);
+      stmt.run(...binds);
+    }
+  }
+  bulkInsertRefs(refs) {
+    if (refs.length === 0) return;
+    const cols = 5;
+    const chunkSize = Math.max(1, Math.floor(_IndexStore.MAX_SQL_VARS / cols));
+    for (let i = 0; i < refs.length; i += chunkSize) {
+      const chunk = refs.slice(i, i + chunkSize);
+      const placeholders = chunk.map(() => "(?, ?, ?, ?, ?)").join(", ");
+      const stmt = this.stmt(
+        `INSERT INTO refs(from_id, to_name, to_id, call_type, line) VALUES ${placeholders}`
+      );
+      const binds = [];
+      for (const ref of chunk) {
+        binds.push(ref.fromId, ref.toName, ref.toId ?? null, ref.callType, ref.line);
+      }
+      stmt.run(...binds);
+    }
   }
   // ─── Symbol CRUD ─────────────────────────────────────────────────────────────
   /**
    * Insert symbols, assigning IDs atomically inside `BEGIN IMMEDIATE` /
-   * `COMMIT`. The ID allocation (`SELECT MAX(id)`) and all `INSERT`s share
-   * the same transaction, preventing UNIQUE constraint violations when two
-   * processes index concurrently (each would see a different `MAX(id)` and
-   * neither can insert with the other's IDs).
+   * `COMMIT`. Id ranges come from the `next_symbol_id` metadata counter
+   * (O(1)); multi-row INSERT amortizes bind overhead for large files.
    *
    * @returns The symbols array with `id` fields populated so the caller can
    *          use them for refs without re-reading from the DB.
    */
   insertSymbols(symbols) {
+    this.invalidateBm25();
     return this.runWithRetry(() => {
       this.db.exec("BEGIN IMMEDIATE");
       try {
-        const maxRows = this.stmt("SELECT MAX(id) AS m FROM symbols").all();
-        let nextId = (maxRows[0]?.m ?? 0) + 1;
-        const stmt = this.db.prepare(
-          `INSERT INTO symbols(id, lang, kind, name, file, line, col, signature, doc_comment, scope, text, file_fk)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-        );
-        const ftsStmt = this.ftsAvailable ? this.db.prepare("INSERT INTO symbols_fts(rowid, text) VALUES (?, ?)") : null;
+        let nextId = this.allocateSymbolIds(symbols.length);
         const result = [];
+        const bulk = [];
+        const ftsRows = [];
         for (const s of symbols) {
           const id = nextId++;
-          stmt.run(
+          bulk.push({
             id,
-            s.lang,
-            s.kind,
-            s.name,
-            s.file,
-            s.line,
-            s.col,
-            s.signature,
-            s.docComment,
-            s.scope,
-            s.text,
-            s.file
-          );
-          ftsStmt?.run(id, buildIndexableText(s.name, s.signature, s.docComment));
+            lang: s.lang,
+            kind: s.kind,
+            name: s.name,
+            file: s.file,
+            line: s.line,
+            col: s.col,
+            signature: s.signature,
+            docComment: s.docComment,
+            scope: s.scope,
+            text: s.text
+          });
+          if (this.ftsAvailable) {
+            ftsRows.push({ id, text: buildIndexableText(s.name, s.signature, s.docComment) });
+          }
           result.push({ ...s, id });
         }
+        this.bulkInsertSymbols(bulk);
+        this.bulkInsertFts(ftsRows);
         this.db.exec("COMMIT");
         return result;
       } catch (err) {
@@ -8525,6 +8761,7 @@ var IndexStore = class _IndexStore {
     });
   }
   deleteSymbolsForFile(file) {
+    this.invalidateBm25();
     this.runWithRetry(() => {
       if (this.ftsAvailable) {
         this.stmt(
@@ -8540,17 +8777,20 @@ var IndexStore = class _IndexStore {
    * dropped the `files` row, leaving its symbols orphaned but still searchable.
    */
   deleteFile(file) {
+    this.invalidateBm25();
     this.runWithRetry(() => {
       this.db.exec("BEGIN IMMEDIATE");
       try {
         if (this.ftsAvailable) {
-          this.db.prepare(
+          this.stmt(
             "DELETE FROM symbols_fts WHERE rowid IN (SELECT id FROM symbols WHERE file_fk = ?)"
           ).run(file);
         }
-        this.db.prepare("DELETE FROM refs WHERE from_id IN (SELECT id FROM symbols WHERE file_fk = ?)").run(file);
-        this.db.prepare("DELETE FROM symbols WHERE file_fk = ?").run(file);
-        this.db.prepare("DELETE FROM files WHERE file = ?").run(file);
+        this.stmt(
+          "DELETE FROM refs WHERE from_id IN (SELECT id FROM symbols WHERE file_fk = ?)"
+        ).run(file);
+        this.stmt("DELETE FROM symbols WHERE file_fk = ?").run(file);
+        this.stmt("DELETE FROM files WHERE file = ?").run(file);
         this.db.exec("COMMIT");
       } catch (err) {
         this.db.exec("ROLLBACK");
@@ -8587,7 +8827,7 @@ var IndexStore = class _IndexStore {
     };
   }
   getAllFileMetas() {
-    return this.db.prepare("SELECT file, lang, mtime_ms, symbol_count, last_indexed FROM files").all().map((r) => ({
+    return this.stmt("SELECT file, lang, mtime_ms, symbol_count, last_indexed FROM files").all().map((r) => ({
       file: r.file,
       lang: r.lang,
       mtimeMs: r.mtime_ms,
@@ -8596,7 +8836,32 @@ var IndexStore = class _IndexStore {
     }));
   }
   // ─── Search ──────────────────────────────────────────────────────────────────
-  search(query, filter) {
+  search(query, filter, opts) {
+    const built = this.buildSearchWhere(query, filter);
+    if (built === null) return [];
+    const { where, values } = built;
+    const limit = typeof opts?.limit === "number" && Number.isFinite(opts.limit) ? Math.max(0, Math.trunc(opts.limit)) : void 0;
+    const limitSql = limit !== void 0 ? " LIMIT ?" : "";
+    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment, text FROM symbols ${where}${limitSql}`;
+    const binds = limit !== void 0 ? [...values, limit] : values;
+    const rows = this.stmt(sql).all(...binds);
+    return rows.map((r) => ({
+      id: r.id,
+      lang: r.lang,
+      kind: r.kind,
+      name: r.name,
+      file: r.file,
+      line: r.line,
+      col: r.col,
+      signature: r.signature,
+      docComment: r.doc_comment,
+      score: 0,
+      snippet: "",
+      lspKind: filter?.lspKind
+    }));
+  }
+  /** Shared WHERE builder for {@link search} / empty-query ranked totals. */
+  buildSearchWhere(query, filter) {
     const conditions = [];
     const values = [];
     let effectiveKind = filter?.kind;
@@ -8605,7 +8870,7 @@ var IndexStore = class _IndexStore {
       if (mapped !== null) {
         effectiveKind = mapped;
       } else {
-        return [];
+        return null;
       }
     }
     if (effectiveKind) {
@@ -8627,23 +8892,15 @@ var IndexStore = class _IndexStore {
       for (const t of tokens) values.push(`%${t}%`);
     }
     const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
-    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment, text FROM symbols ${where}`;
-    const stmt = this.db.prepare(sql);
-    const rows = stmt.all(...values);
-    return rows.map((r) => ({
-      id: r.id,
-      lang: r.lang,
-      kind: r.kind,
-      name: r.name,
-      file: r.file,
-      line: r.line,
-      col: r.col,
-      signature: r.signature,
-      docComment: r.doc_comment,
-      score: 0,
-      snippet: "",
-      lspKind: filter?.lspKind
-    }));
+    return { where, values };
+  }
+  countSearch(query, filter) {
+    const built = this.buildSearchWhere(query, filter);
+    if (built === null) return 0;
+    const row = this.stmt(`SELECT COUNT(*) AS n FROM symbols ${built.where}`).get(
+      ...built.values
+    );
+    return Number(row?.n ?? 0);
   }
   /**
    * Ranked search — the one-stop query the codebase-search tool and plug-lsp
@@ -8684,12 +8941,12 @@ var IndexStore = class _IndexStore {
       values.push(`%${escapeLike(filter.file.replace(/\\/g, "/"))}%`);
     }
     const where = conditions.join(" AND ");
-    const countRows = this.db.prepare(
+    const countRows = this.stmt(
       `SELECT COUNT(*) AS n FROM symbols_fts JOIN symbols s ON s.id = symbols_fts.rowid WHERE ${where}`
     ).all(...values);
     const total = countRows[0] ? Number(countRows[0].n) : 0;
     if (total === 0) return { results: [], total: 0 };
-    const rows = this.db.prepare(
+    const rows = this.stmt(
       `SELECT s.id, s.lang, s.kind, s.name, s.file, s.line, s.col, s.signature, s.doc_comment,
                 -bm25(symbols_fts) AS score,
                 snippet(symbols_fts, 0, '', '', '\u2026', 12) AS snippet
@@ -8722,20 +8979,60 @@ var IndexStore = class _IndexStore {
       total
     };
   }
+  /**
+   * Invalidate the cached BM25 index.
+   *
+   * **Contract: every method that mutates `symbols` MUST call this before
+   * returning.** (`refs` mutations do not affect the BM25 fallback because
+   * the corpus is built from `symbols.text` via `getAllIndexable()` and the
+   * BM25 score is filtered by the LIKE-selected candidate set in
+   * `searchRankedFallback`.) Today the call sites are `repairDrift`,
+   * `insertSymbols`, `deleteSymbolsForFile`, `deleteFile`, `clearAll`, and
+   * `commitBatch`. A future mutation that adds a new write path (e.g.
+   * `renameFile`, `updateSignature`) MUST also call this — otherwise the
+   * FTS5-unavailable fallback will serve stale search results. The
+   * `close()` reset at L1820-1821 tears the cache down on store shutdown,
+   * which is the only legitimate place that flips the flag outside this
+   * helper.
+   *
+   * Called *before* `runWithRetry` on purpose: if the write fails all
+   * retries the flag stays set, forcing a rebuild on the next search rather
+   * than trusting a cache that may not reflect the intended mutation.
+   * Do not move this inside the retry closure.
+   */
+  invalidateBm25() {
+    this.bm25Dirty = true;
+    this.bm25Cache = null;
+  }
+  /**
+   * Return the cached full-corpus BM25 index, rebuilding it only when the
+   * symbols table has been mutated since the last build. The full-corpus IDF
+   * is more correct than the old per-query candidate-subset IDF, and the
+   * amortized build cost drops from O(symbols × tokens) per search to once
+   * per write batch.
+   *
+   * Note: the first call after a long idle (or on a freshly opened store)
+   * pays the full corpus rebuild synchronously on the search path. For a
+   * 5 500+ symbol corpus this is a visible one-time latency spike.
+   */
+  getOrBuildBm25() {
+    if (this.bm25Cache && !this.bm25Dirty) return this.bm25Cache;
+    const docs = this.getAllIndexable();
+    this.bm25Cache = buildBm25Index(docs);
+    this.bm25Dirty = false;
+    return this.bm25Cache;
+  }
   /** Legacy ranked path: LIKE candidates + in-process BM25 + JS snippets. */
   searchRankedFallback(query, filter, limit) {
-    const candidates = this.search(query, filter);
-    if (candidates.length === 0) return { results: [], total: 0 };
     if (!query.trim()) {
-      return { results: candidates.slice(0, limit), total: candidates.length };
+      const total = this.countSearch(query, filter);
+      if (total === 0) return { results: [], total: 0 };
+      return { results: this.search(query, filter, { limit }), total };
     }
+    const candidates = this.search(query, filter);
+    if (candidates.length === 0) return { results: [], total: 0 };
     const candidateById = new Map(candidates.map((c) => [c.id, c]));
-    const bm25 = buildBm25Index(
-      candidates.map((c) => ({
-        id: c.id,
-        text: buildIndexableText(c.name, c.signature, c.docComment)
-      }))
-    );
+    const bm25 = this.getOrBuildBm25();
     const scored = bm25.score(query, (id) => candidateById.has(id));
     const q = query.trim().toLowerCase();
     const rank = (id) => {
@@ -8777,7 +9074,7 @@ var IndexStore = class _IndexStore {
   // ─── Stats ───────────────────────────────────────────────────────────────────
   getStats() {
     const sizeBytes = this.sizeBytes();
-    const lastRows = this.db.prepare("SELECT value FROM metadata WHERE key = 'last_indexed'").all();
+    const lastRows = this.stmt("SELECT value FROM metadata WHERE key = 'last_indexed'").all();
     const lastIndexed = lastRows.length ? Number(lastRows[0]?.value) : null;
     const totalRows = this.stmt("SELECT COUNT(*) FROM symbols").all();
     const totalSymbols = totalRows[0] ? Number(totalRows[0]["COUNT(*)"]) : 0;
@@ -8802,19 +9099,20 @@ var IndexStore = class _IndexStore {
   }
   setLastIndexed(ts2) {
     this.runWithRetry(() => {
-      this.db.prepare("INSERT OR REPLACE INTO metadata(key, value) VALUES('last_indexed', ?)").run(String(ts2));
+      this.stmt("INSERT OR REPLACE INTO metadata(key, value) VALUES('last_indexed', ?)").run(String(ts2));
     });
   }
   getMetadata(key) {
-    const rows = this.db.prepare("SELECT value FROM metadata WHERE key = ?").all(key);
+    const rows = this.stmt("SELECT value FROM metadata WHERE key = ?").all(key);
     return rows[0]?.value;
   }
   setMetadata(key, value) {
     this.runWithRetry(() => {
-      this.db.prepare("INSERT OR REPLACE INTO metadata(key, value) VALUES(?, ?)").run(key, value);
+      this.stmt("INSERT OR REPLACE INTO metadata(key, value) VALUES(?, ?)").run(key, value);
     });
   }
   clearAll() {
+    this.invalidateBm25();
     this.runWithRetry(() => {
       this.db.exec("BEGIN IMMEDIATE");
       try {
@@ -8841,13 +9139,7 @@ var IndexStore = class _IndexStore {
     this.runWithRetry(() => {
       this.stmt("DELETE FROM refs WHERE from_id = ?").run(fromId);
       if (refs.length === 0) return;
-      const stmt = this.db.prepare(
-        `INSERT INTO refs(from_id, to_name, to_id, call_type, line)
-         VALUES (?, ?, ?, ?, ?)`
-      );
-      for (const ref of refs) {
-        stmt.run(fromId, ref.toName, ref.toId ?? null, ref.callType, ref.line);
-      }
+      this.bulkInsertRefs(refs.map((ref) => ({ ...ref, fromId })));
     });
   }
   /**
@@ -8864,13 +9156,7 @@ var IndexStore = class _IndexStore {
   insertRefsBatch(refs) {
     if (refs.length === 0) return;
     this.runWithRetry(() => {
-      const stmt = this.db.prepare(
-        `INSERT INTO refs(from_id, to_name, to_id, call_type, line)
-         VALUES (?, ?, ?, ?, ?)`
-      );
-      for (const ref of refs) {
-        stmt.run(ref.fromId, ref.toName, ref.toId ?? null, ref.callType, ref.line);
-      }
+      this.bulkInsertRefs(refs);
     });
   }
   /**
@@ -8895,65 +9181,61 @@ var IndexStore = class _IndexStore {
     if (entries.length === 0 && (options.deleteForFiles?.length ?? 0) === 0) {
       return [];
     }
+    this.invalidateBm25();
     return this.runWithRetry(() => {
       this.db.exec("BEGIN IMMEDIATE");
       try {
         if (options.deleteForFiles && options.deleteForFiles.length > 0) {
           const placeholders = options.deleteForFiles.map(() => "?").join(",");
           if (this.ftsAvailable) {
-            this.db.prepare(
+            this.stmt(
               `DELETE FROM symbols_fts WHERE rowid IN (SELECT id FROM symbols WHERE file IN (${placeholders}))`
             ).run(...options.deleteForFiles);
           }
-          this.db.prepare(
+          this.stmt(
             `DELETE FROM refs WHERE from_id IN (SELECT id FROM symbols WHERE file IN (${placeholders}))`
           ).run(...options.deleteForFiles);
-          this.db.prepare(`DELETE FROM symbols WHERE file IN (${placeholders})`).run(...options.deleteForFiles);
+          this.stmt(`DELETE FROM symbols WHERE file IN (${placeholders})`).run(...options.deleteForFiles);
         }
-        const maxRows = this.stmt("SELECT MAX(id) AS m FROM symbols").all();
-        let nextId = (maxRows[0]?.m ?? 0) + 1;
-        const symStmt = this.db.prepare(
-          `INSERT INTO symbols(id, lang, kind, name, file, line, col, signature, doc_comment, scope, text, file_fk)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-        );
-        const ftsStmt = this.ftsAvailable ? this.db.prepare("INSERT INTO symbols_fts(rowid, text) VALUES (?, ?)") : null;
+        const totalSymbols = entries.reduce((n, e) => n + e.symbols.length, 0);
+        let nextId = this.allocateSymbolIds(totalSymbols);
         const allInserted = [];
         const refsToInsert = [];
+        const bulkSyms = [];
+        const ftsRows = [];
         for (const entry of entries) {
           const insertedForEntry = [];
           for (const s of entry.symbols) {
             const id = nextId++;
-            symStmt.run(
+            bulkSyms.push({
               id,
-              s.lang,
-              s.kind,
-              s.name,
-              s.file,
-              s.line,
-              s.col,
-              s.signature,
-              s.docComment,
-              s.scope,
-              s.text,
-              s.file
-            );
-            ftsStmt?.run(id, buildIndexableText(s.name, s.signature, s.docComment));
+              lang: s.lang,
+              kind: s.kind,
+              name: s.name,
+              file: s.file,
+              line: s.line,
+              col: s.col,
+              signature: s.signature,
+              docComment: s.docComment,
+              scope: s.scope,
+              text: s.text
+            });
+            if (this.ftsAvailable) {
+              ftsRows.push({
+                id,
+                text: buildIndexableText(s.name, s.signature, s.docComment)
+              });
+            }
             const inserted = { ...s, id };
             allInserted.push(inserted);
             insertedForEntry.push(inserted);
           }
           refsToInsert.push(...assignRefsToSymbols(entry.refs, insertedForEntry));
         }
-        if (refsToInsert.length > 0) {
-          const refStmt = this.db.prepare(
-            `INSERT INTO refs(from_id, to_name, to_id, call_type, line)
-             VALUES (?, ?, ?, ?, ?)`
-          );
-          for (const ref of refsToInsert) {
-            refStmt.run(ref.fromId, ref.toName, ref.toId ?? null, ref.callType, ref.line);
-          }
-        }
-        const upsertStmt = this.db.prepare(
+        this.bulkInsertSymbols(bulkSyms);
+        this.bulkInsertFts(ftsRows);
+        this.bulkInsertRefs(refsToInsert);
+        const upsertStmt = this.stmt(
           `INSERT INTO files(file, lang, mtime_ms, symbol_count, last_indexed)
            VALUES (?, ?, ?, ?, ?)
            ON CONFLICT(file) DO UPDATE SET
@@ -8980,7 +9262,7 @@ var IndexStore = class _IndexStore {
    */
   deleteRefsForFile(file) {
     this.runWithRetry(() => {
-      this.db.prepare("DELETE FROM refs WHERE from_id IN (SELECT id FROM symbols WHERE file = ?)").run(file);
+      this.stmt("DELETE FROM refs WHERE from_id IN (SELECT id FROM symbols WHERE file = ?)").run(file);
     });
   }
   /**
@@ -8993,20 +9275,75 @@ var IndexStore = class _IndexStore {
    */
   resolveRefs() {
     return this.runWithRetry(() => {
-      const result = this.db.prepare(
-        `UPDATE refs SET to_id = (
-           SELECT id FROM symbols WHERE name = refs.to_name LIMIT 1
-         ) WHERE to_id IS NULL AND to_name IS NOT NULL
-           AND to_name IN (SELECT name FROM symbols)`
-      ).run();
-      return result.changes ?? 0;
+      try {
+        const result = this.stmt(
+          `UPDATE refs
+           SET to_id = s.id
+           FROM (
+             SELECT name, MIN(id) AS id FROM symbols GROUP BY name
+           ) AS s
+           WHERE refs.to_id IS NULL
+             AND refs.to_name IS NOT NULL
+             AND refs.to_name = s.name`
+        ).run();
+        return result.changes ?? 0;
+      } catch {
+        const result = this.stmt(
+          `UPDATE refs SET to_id = (
+             SELECT id FROM symbols WHERE name = refs.to_name LIMIT 1
+           ) WHERE to_id IS NULL AND to_name IS NOT NULL
+             AND to_name IN (SELECT name FROM symbols)`
+        ).run();
+        return result.changes ?? 0;
+      }
     });
   }
+  /**
+   * Clear symbols/refs for a file and mark it as indexed with zero symbols.
+   * Used by the indexer for empty-parse results so three writes share one txn.
+   */
+  replaceEmptyFile(meta) {
+    this.invalidateBm25();
+    this.runWithRetry(() => {
+      this.db.exec("BEGIN IMMEDIATE");
+      try {
+        if (this.ftsAvailable) {
+          this.stmt(
+            "DELETE FROM symbols_fts WHERE rowid IN (SELECT id FROM symbols WHERE file_fk = ?)"
+          ).run(meta.file);
+        }
+        this.stmt(
+          "DELETE FROM refs WHERE from_id IN (SELECT id FROM symbols WHERE file_fk = ?)"
+        ).run(meta.file);
+        this.stmt("DELETE FROM symbols WHERE file_fk = ?").run(meta.file);
+        this.stmt(
+          `INSERT INTO files(file, lang, mtime_ms, symbol_count, last_indexed)
+           VALUES (?, ?, ?, ?, ?)
+           ON CONFLICT(file) DO UPDATE SET
+             lang = excluded.lang,
+             mtime_ms = excluded.mtime_ms,
+             symbol_count = excluded.symbol_count,
+             last_indexed = excluded.last_indexed`
+        ).run(meta.file, meta.lang, meta.mtimeMs, meta.symbolCount, meta.lastIndexed);
+        this.db.exec("COMMIT");
+      } catch (err) {
+        this.db.exec("ROLLBACK");
+        throw err;
+      }
+    });
+  }
+  /** Best-effort query planner refresh after a large reindex. */
+  optimize() {
+    try {
+      this.db.exec("PRAGMA optimize");
+    } catch {
+    }
+  }
   /**
    * Find all references TO a given symbol (who calls / uses this symbol?).
    */
   findRefsTo(symbolId) {
-    return this.db.prepare(
+    return this.stmt(
       "SELECT id, from_id, to_name, to_id, call_type, line FROM refs WHERE to_id = ? OR to_name = (SELECT name FROM symbols WHERE id = ?)"
     ).all(symbolId, symbolId).map((r) => ({
       id: r.id,
@@ -9021,7 +9358,7 @@ var IndexStore = class _IndexStore {
    * Find all references FROM a given symbol (what does this symbol call/use?).
    */
   findRefsFrom(symbolId) {
-    return this.db.prepare("SELECT id, from_id, to_name, to_id, call_type, line FROM refs WHERE from_id = ?").all(symbolId).map((r) => ({
+    return this.stmt("SELECT id, from_id, to_name, to_id, call_type, line FROM refs WHERE from_id = ?").all(symbolId).map((r) => ({
       id: r.id,
       fromId: r.from_id,
       toName: r.to_name,
@@ -9094,61 +9431,77 @@ var IndexStore = class _IndexStore {
    * symbol resolved in package B). Node metadata includes symbol/file counts.
    */
   getPackageGraph() {
-    const symbols = this.db.prepare("SELECT file, id FROM symbols ORDER BY id").all();
+    const fileCounts = this.stmt(
+      "SELECT file, COUNT(*) AS n FROM symbols GROUP BY file"
+    ).all();
     const pkgNodes = /* @__PURE__ */ new Map();
     const fileToPkg = /* @__PURE__ */ new Map();
-    const symbolToPkg = /* @__PURE__ */ new Map();
-    for (const s of symbols) {
-      const pkg = _IndexStore.derivePackage(s.file) ?? "(root)";
-      fileToPkg.set(s.file, pkg);
-      symbolToPkg.set(s.id, pkg);
+    for (const { file, n } of fileCounts) {
+      const pkg = _IndexStore.derivePackage(file) ?? "(root)";
+      fileToPkg.set(file, pkg);
       const node = pkgNodes.get(pkg);
       if (node) {
-        node.symbolCount = (node.symbolCount ?? 0) + 1;
+        node.symbolCount = (node.symbolCount ?? 0) + n;
       } else {
         pkgNodes.set(pkg, {
           id: `pkg:${pkg}`,
           label: pkg,
           kind: "package",
           package: pkg,
-          symbolCount: 1,
+          symbolCount: n,
           fileCount: 0
         });
       }
     }
-    const files = this.db.prepare("SELECT DISTINCT file FROM files").all();
+    const files = this.stmt("SELECT DISTINCT file FROM files").all();
     for (const { file } of files) {
       const pkg = _IndexStore.derivePackage(file) ?? "(root)";
+      fileToPkg.set(file, pkg);
       const node = pkgNodes.get(pkg);
       if (node) node.fileCount = (node.fileCount ?? 0) + 1;
+      else {
+        pkgNodes.set(pkg, {
+          id: `pkg:${pkg}`,
+          label: pkg,
+          kind: "package",
+          package: pkg,
+          symbolCount: 0,
+          fileCount: 1
+        });
+      }
     }
-    const refRows = this.db.prepare(
-      `SELECT r.from_id, r.to_id, r.call_type
+    const refRows = this.stmt(
+      `SELECT r.call_type, sf.file AS from_file, st.file AS to_file, COUNT(*) AS n
        FROM refs r
-       WHERE r.to_id IS NOT NULL`
+       JOIN symbols sf ON sf.id = r.from_id
+       JOIN symbols st ON st.id = r.to_id
+       WHERE r.to_id IS NOT NULL AND r.call_type != 'import'
+       GROUP BY r.call_type, sf.file, st.file`
     ).all();
     const edgeMap = /* @__PURE__ */ new Map();
     for (const r of refRows) {
-      if (r.call_type === "import") continue;
-      const fromPkg = symbolToPkg.get(r.from_id);
-      const toPkg = symbolToPkg.get(r.to_id);
-      if (!fromPkg || !toPkg || fromPkg === toPkg) continue;
+      const fromPkg = fileToPkg.get(r.from_file) ?? _IndexStore.derivePackage(r.from_file) ?? "(root)";
+      const toPkg = fileToPkg.get(r.to_file) ?? _IndexStore.derivePackage(r.to_file) ?? "(root)";
+      if (fromPkg === toPkg) continue;
       const key = `${fromPkg}\0${toPkg}`;
       let e = edgeMap.get(key);
       if (!e) {
         e = { weight: 0, types: /* @__PURE__ */ new Map() };
         edgeMap.set(key, e);
       }
-      e.weight++;
-      e.types.set(r.call_type, (e.types.get(r.call_type) ?? 0) + 1);
+      const n = Number(r.n) || 0;
+      e.weight += n;
+      e.types.set(r.call_type, (e.types.get(r.call_type) ?? 0) + n);
     }
-    const importRows = this.db.prepare(
-      `SELECT r.from_id, r.to_name
+    const importRows = this.stmt(
+      `SELECT r.to_name, s.file AS from_file, COUNT(*) AS n
        FROM refs r
-       WHERE r.call_type = 'import'`
+       JOIN symbols s ON s.id = r.from_id
+       WHERE r.call_type = 'import'
+       GROUP BY r.to_name, s.file`
     ).all();
     for (const r of importRows) {
-      const fromPkg = symbolToPkg.get(r.from_id);
+      const fromPkg = fileToPkg.get(r.from_file) ?? _IndexStore.derivePackage(r.from_file) ?? "(root)";
       const toPkg = _IndexStore.packageFromImport(r.to_name);
       if (!fromPkg || !toPkg || fromPkg === toPkg || !pkgNodes.has(toPkg)) continue;
       const key = `${fromPkg}\0${toPkg}`;
@@ -9157,8 +9510,9 @@ var IndexStore = class _IndexStore {
         edge = { weight: 0, types: /* @__PURE__ */ new Map() };
         edgeMap.set(key, edge);
       }
-      edge.weight++;
-      edge.types.set("import", (edge.types.get("import") ?? 0) + 1);
+      const n = Number(r.n) || 0;
+      edge.weight += n;
+      edge.types.set("import", (edge.types.get("import") ?? 0) + n);
     }
     const edges = [];
     for (const [key, e] of edgeMap) {
@@ -9185,12 +9539,12 @@ var IndexStore = class _IndexStore {
    * derived from cross-file symbol references within the package.
    */
   getFileGraph(packageFilter) {
-    const allFiles = this.db.prepare("SELECT DISTINCT file FROM symbols").all();
+    const allFiles = this.stmt("SELECT DISTINCT file FROM symbols").all();
     const pkgFilePaths = allFiles.filter((f) => (_IndexStore.derivePackage(f.file) ?? "(root)") === packageFilter).map((f) => f.file);
     const localFiles = new Set(pkgFilePaths);
     if (localFiles.size === 0) return { nodes: [], edges: [] };
     const filePlaceholders = [...localFiles].map(() => "?").join(",");
-    const pkgSyms = this.db.prepare(
+    const pkgSyms = this.stmt(
       `SELECT file, id, name, kind, lang, line FROM symbols WHERE file IN (${filePlaceholders}) ORDER BY id`
     ).all(...pkgFilePaths);
     const fileNodes = /* @__PURE__ */ new Map();
@@ -9222,12 +9576,13 @@ var IndexStore = class _IndexStore {
       ensureFileNode(file);
     }
     const indexedFiles = new Set(allFiles.map((f) => f.file));
-    const refRows = this.db.prepare(
-      `SELECT r.from_id, r.to_id, r.call_type
+    const refRows = this.stmt(
+      `SELECT r.from_id, r.to_id, r.call_type, COUNT(*) AS n
        FROM refs r
        WHERE (r.from_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders}))
            OR r.to_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders})))
-         AND r.to_id IS NOT NULL`
+         AND r.to_id IS NOT NULL
+       GROUP BY r.from_id, r.to_id, r.call_type`
     ).all(...pkgFilePaths, ...pkgFilePaths);
     const knownSymIds = new Set(pkgSyms.map((s) => s.id));
     const crossRefIds = /* @__PURE__ */ new Set();
@@ -9237,7 +9592,7 @@ var IndexStore = class _IndexStore {
     }
     if (crossRefIds.size > 0) {
       const crossPlaceholders = [...crossRefIds].map(() => "?").join(",");
-      const extras = this.db.prepare(
+      const extras = this.stmt(
         `SELECT id, file FROM symbols WHERE id IN (${crossPlaceholders})`
       ).all(...crossRefIds);
       for (const x of extras) {
@@ -9262,14 +9617,16 @@ var IndexStore = class _IndexStore {
         e = { weight: 0, types: /* @__PURE__ */ new Map() };
         edgeMap.set(key, e);
       }
-      e.weight++;
-      e.types.set(r.call_type, (e.types.get(r.call_type) ?? 0) + 1);
+      const n = Number(r.n) || 0;
+      e.weight += n;
+      e.types.set(r.call_type, (e.types.get(r.call_type) ?? 0) + n);
     }
-    const importRows = this.db.prepare(
-      `SELECT r.from_id, r.to_name
+    const importRows = this.stmt(
+      `SELECT r.from_id, r.to_name, COUNT(*) AS n
        FROM refs r
        WHERE r.call_type = 'import'
-         AND r.from_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders}))`
+         AND r.from_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders}))
+       GROUP BY r.from_id, r.to_name`
     ).all(...pkgFilePaths);
     for (const r of importRows) {
       const fromFile = symToFile.get(r.from_id);
@@ -9284,8 +9641,9 @@ var IndexStore = class _IndexStore {
         edge = { weight: 0, types: /* @__PURE__ */ new Map() };
         edgeMap.set(key, edge);
       }
-      edge.weight++;
-      edge.types.set("import", (edge.types.get("import") ?? 0) + 1);
+      const n = Number(r.n) || 0;
+      edge.weight += n;
+      edge.types.set("import", (edge.types.get("import") ?? 0) + n);
     }
     const edges = [];
     for (const [key, e] of edgeMap) {
@@ -9312,7 +9670,7 @@ var IndexStore = class _IndexStore {
    * derived from intra-file and cross-file symbol references (who calls whom).
    */
   getSymbolGraph(fileFilter) {
-    const syms = this.db.prepare(
+    const syms = this.stmt(
       "SELECT id, name, kind, lang, file, line, signature, scope FROM symbols WHERE file = ? ORDER BY line, id"
     ).all(fileFilter);
     if (syms.length === 0) return { nodes: [], edges: [] };
@@ -9332,17 +9690,25 @@ var IndexStore = class _IndexStore {
       scope: s.scope,
       external: s.file !== fileFilter
     });
-    const symIds = new Set(syms.map((s) => s.id));
-    const refRows = this.db.prepare(
-      `SELECT r.from_id, r.to_id, r.to_name, r.call_type, r.line
-       FROM refs r
-       WHERE r.from_id IN (SELECT id FROM symbols WHERE file = ?)
-          OR r.to_id IN (SELECT id FROM symbols WHERE file = ?)`
+    const refRows = this.stmt(
+      `SELECT from_id, to_id, call_type, COUNT(*) AS n
+       FROM (
+         SELECT r.from_id, r.to_id, r.to_name, r.call_type, r.line
+         FROM refs r
+         JOIN symbols s ON s.id = r.from_id
+         WHERE s.file = ?
+         UNION
+         SELECT r.from_id, r.to_id, r.to_name, r.call_type, r.line
+         FROM refs r
+         JOIN symbols s ON s.id = r.to_id
+         WHERE s.file = ?
+       )
+       WHERE to_id IS NOT NULL
+       GROUP BY from_id, to_id, call_type`
     ).all(fileFilter, fileFilter);
     const edgeMap = /* @__PURE__ */ new Map();
     for (const r of refRows) {
-      if (r.to_id === null) continue;
-      if (!symIds.has(r.from_id) && !symIds.has(r.to_id)) continue;
+      if (r.to_id == null) continue;
       relatedIds.add(r.from_id);
       relatedIds.add(r.to_id);
       const key = `${r.from_id}\0${r.to_id}`;
@@ -9351,8 +9717,9 @@ var IndexStore = class _IndexStore {
         e = { weight: 0, types: /* @__PURE__ */ new Map() };
         edgeMap.set(key, e);
       }
-      e.weight++;
-      e.types.set(r.call_type, (e.types.get(r.call_type) ?? 0) + 1);
+      const n = Number(r.n) || 0;
+      e.weight += n;
+      e.types.set(r.call_type, (e.types.get(r.call_type) ?? 0) + n);
     }
     const edges = [];
     for (const [key, e] of edgeMap) {
@@ -9376,7 +9743,7 @@ var IndexStore = class _IndexStore {
     const missingIds = [...relatedIds].filter((id) => !loadedIds.has(id));
     if (missingIds.length > 0) {
       const placeholders = missingIds.map(() => "?").join(",");
-      const extras = this.db.prepare(
+      const extras = this.stmt(
         `SELECT id, name, kind, lang, file, line, signature, scope FROM symbols WHERE id IN (${placeholders})`
       ).all(...missingIds);
       for (const s of extras) symById.set(s.id, s);
@@ -9390,6 +9757,8 @@ var IndexStore = class _IndexStore {
   }
   close() {
     this.stmtCache.clear();
+    this.bm25Dirty = true;
+    this.bm25Cache = null;
     try {
       this.db.close();
     } catch {
@@ -9403,14 +9772,121 @@ import { fileURLToPath } from "node:url";
 import { Worker } from "node:worker_threads";
 
 // src/codebase-index/indexer.ts
-import { expectDefined as expectDefined6 } from "@wrongstack/core";
+import { expectDefined as expectDefined6 } from "@wrongstack/core/utils";
 import * as fs14 from "node:fs/promises";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 import { availableParallelism } from "node:os";
-import { compileGlob as compileGlob2 } from "@wrongstack/core";
+import { DEFAULT_WALK_IGNORE_DIRS, indexParallelBatchSize, isFrugalPerf } from "@wrongstack/core/utils";
 
 // src/codebase-index/ts-parser.ts
 import * as ts from "@typescript/typescript6";
+
+// src/codebase-index/languages.ts
+import * as path14 from "node:path";
+var EXT_TO_LANG = {
+  // TypeScript / JavaScript (first-class TS compiler API)
+  ".ts": "ts",
+  ".mts": "ts",
+  ".cts": "ts",
+  ".tsx": "tsx",
+  ".js": "js",
+  ".mjs": "js",
+  ".cjs": "js",
+  ".jsx": "jsx",
+  // First-class native/spawn parsers (+ regex fallback)
+  ".go": "go",
+  ".py": "py",
+  ".pyi": "py",
+  ".pyw": "py",
+  ".rs": "rs",
+  ".json": "json",
+  ".jsonc": "json",
+  ".yaml": "yaml",
+  ".yml": "yaml",
+  // C family
+  ".c": "c",
+  ".h": "c",
+  ".cc": "cpp",
+  ".cpp": "cpp",
+  ".cxx": "cpp",
+  ".hh": "cpp",
+  ".hpp": "cpp",
+  ".hxx": "cpp",
+  // JVM / .NET
+  ".java": "java",
+  ".cs": "csharp",
+  ".kt": "kotlin",
+  ".kts": "kotlin",
+  ".scala": "scala",
+  ".sc": "scala",
+  // Scripting
+  ".php": "php",
+  ".rb": "ruby",
+  ".swift": "swift",
+  ".dart": "dart",
+  ".lua": "lua",
+  ".r": "r",
+  ".R": "r",
+  ".pl": "other",
+  ".pm": "other",
+  // Systems / functional
+  ".zig": "zig",
+  ".ex": "elixir",
+  ".exs": "elixir",
+  ".hs": "haskell",
+  ".lhs": "haskell",
+  // Shell / data / docs / web
+  ".sh": "shell",
+  ".bash": "shell",
+  ".zsh": "shell",
+  ".ps1": "shell",
+  ".sql": "sql",
+  ".md": "md",
+  ".mdx": "md",
+  ".toml": "toml",
+  ".html": "html",
+  ".htm": "html",
+  ".css": "css",
+  ".scss": "css",
+  ".less": "css",
+  ".vue": "vue",
+  ".svelte": "svelte",
+  ".proto": "proto",
+  ".graphql": "graphql",
+  ".gql": "graphql"
+};
+var INDEXABLE_EXTENSIONS = Object.freeze(
+  [...new Set(Object.keys(EXT_TO_LANG).map((e) => e.toLowerCase()))].sort()
+);
+var SPECIAL_FILENAMES = {
+  makefile: "other",
+  gnumakefile: "other",
+  dockerfile: "other",
+  "docker-compose.yml": "yaml",
+  "docker-compose.yaml": "yaml",
+  "cmakelists.txt": "other",
+  gemfile: "ruby",
+  rakefile: "ruby",
+  procfile: "other",
+  justfile: "other"
+};
+function detectLang(file) {
+  const base = path14.basename(file);
+  const lowerBase = base.toLowerCase();
+  if (lowerBase.endsWith(".d.ts") || lowerBase.endsWith(".d.mts") || lowerBase.endsWith(".d.cts")) {
+    return "ts";
+  }
+  const special = SPECIAL_FILENAMES[lowerBase];
+  if (special) return special;
+  const ext = path14.extname(base).toLowerCase();
+  if (!ext) return null;
+  return EXT_TO_LANG[ext] ?? null;
+}
+function isIndexablePath(file) {
+  return detectLang(file) !== null;
+}
+
+// src/codebase-index/ts-parser.ts
 var KIND_MAP = {
   [ts.SyntaxKind.ClassDeclaration]: "class",
   [ts.SyntaxKind.InterfaceDeclaration]: "interface",
@@ -9437,32 +9913,6 @@ function kindOf(node) {
   if (ts.isModuleDeclaration(node)) return "namespace";
   return KIND_MAP[node.kind] ?? null;
 }
-function extToLang(ext) {
-  switch (ext) {
-    case ".ts":
-      return "ts";
-    case ".tsx":
-      return "tsx";
-    case ".js":
-      return "js";
-    case ".jsx":
-      return "jsx";
-    case ".go":
-      return "go";
-    case ".py":
-      return "py";
-    case ".rs":
-      return "rs";
-    case ".json":
-      return "json";
-    case ".yaml":
-      return "yaml";
-    case ".yml":
-      return "yaml";
-    default:
-      return null;
-  }
-}
 function getSignature(printer, node, sourceFile) {
   const raw = printer.printNode(ts.EmitHint.Unspecified, node, sourceFile);
   return raw.replace(/\s+/g, " ").slice(0, 500);
@@ -9585,22 +10035,30 @@ function deduplicateRefs(refs) {
     return true;
   });
 }
-function detectLang(file) {
-  const idx = file.lastIndexOf(".");
-  if (idx < 0) return null;
-  return extToLang(file.slice(idx));
-}
 
 // src/codebase-index/go-parser.ts
 init_win32_resolve();
 import { spawn as spawn4 } from "node:child_process";
 import * as os5 from "node:os";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 import * as fs10 from "node:fs/promises";
+
+// src/codebase-index/spawn-gate.ts
+var chain = Promise.resolve();
+function withSpawnGate(fn) {
+  const run = chain.then(fn, fn);
+  chain = run.then(
+    () => void 0,
+    () => void 0
+  );
+  return run;
+}
+
+// src/codebase-index/go-parser.ts
 async function parseSymbols2(opts) {
   const { file, content, lang } = opts;
   try {
-    const parsed = await syncGoParse(file, content, lang);
+    const parsed = await withSpawnGate(() => syncGoParse(file, content, lang));
     if (parsed.symbols.length > 0) {
       return parsed;
     }
@@ -9896,11 +10354,16 @@ func formatType(t ast.Expr) string {
 	}
 }
 `;
+var _cachedGoScriptPath = null;
 async function syncGoParse(filePath, content, lang) {
-  const tmpDir = await fs10.mkdtemp(path14.join(os5.tmpdir(), "ws-go-parse-"));
   try {
-    const scriptPath = path14.join(tmpDir, "parse.go");
-    await fs10.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
+    let scriptPath = _cachedGoScriptPath;
+    if (!scriptPath) {
+      const tmpDir = await fs10.mkdtemp(path15.join(os5.tmpdir(), "ws-go-parse-"));
+      scriptPath = path15.join(tmpDir, "parse.go");
+      await fs10.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
+      _cachedGoScriptPath = scriptPath;
+    }
     const goBinary = resolveWin32Command("go");
     const goResult = await new Promise(
       (resolve15, reject) => {
@@ -9957,24 +10420,312 @@ async function syncGoParse(filePath, content, lang) {
     return { file: filePath, lang, symbols, mtimeMs: Date.now() };
   } catch {
     return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
-  } finally {
-    await fs10.rm(tmpDir, { recursive: true, force: true });
   }
 }
 
 // src/codebase-index/py-parser.ts
 init_win32_resolve();
-import { spawn as spawn5, spawnSync } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import * as fs11 from "node:fs/promises";
 import * as os6 from "node:os";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
+
+// src/codebase-index/generic-parser.ts
+var C_LIKE = [
+  { re: /\b(?:class|struct|enum|interface|union)\s+([A-Za-z_]\w*)/g, kind: "class" },
+  {
+    re: /\b(?:public|private|protected|static|final|async|override|virtual|inline|export)?\s*(?:[\w:<>[\]\s*&]+)\s+([A-Za-z_]\w*)\s*\([^;{]*\)\s*(?:const)?\s*[{;]/g,
+    kind: "function"
+  },
+  { re: /\b(?:namespace)\s+([A-Za-z_]\w*)/g, kind: "namespace" }
+];
+var LANG_PATTERNS = {
+  py: [
+    { re: /^(?:async\s+)?def\s+([A-Za-z_]\w*)/gm, kind: "function" },
+    { re: /^class\s+([A-Za-z_]\w*)/gm, kind: "class" },
+    { re: /^([A-Za-z_]\w*)\s*=/gm, kind: "var" }
+  ],
+  go: [
+    { re: /^func\s+(?:\([^)]*\)\s*)?([A-Za-z_]\w*)\s*\(/gm, kind: "function" },
+    { re: /^type\s+([A-Za-z_]\w*)\b/gm, kind: "type" },
+    { re: /^(?:const|var)\s+([A-Za-z_]\w*)\b/gm, kind: "const" },
+    { re: /^package\s+([A-Za-z_]\w*)/gm, kind: "namespace" }
+  ],
+  rs: [
+    { re: /\bfn\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /\bstruct\s+([A-Za-z_]\w*)/g, kind: "struct" },
+    { re: /\benum\s+([A-Za-z_]\w*)/g, kind: "enum" },
+    { re: /\btrait\s+([A-Za-z_]\w*)/g, kind: "trait" },
+    { re: /\bimpl(?:\s*<[^>]+>)?\s+([A-Za-z_]\w*)/g, kind: "impl" },
+    { re: /\b(?:const|static)\s+([A-Za-z_]\w*)/g, kind: "const" },
+    { re: /\bmod\s+([A-Za-z_]\w*)/g, kind: "mod" }
+  ],
+  c: C_LIKE,
+  cpp: C_LIKE,
+  java: [
+    { re: /\b(?:class|interface|enum|record)\s+([A-Za-z_]\w*)/g, kind: "class" },
+    {
+      re: /\b(?:public|private|protected|static|final|abstract|synchronized|native|default|\s)+\s*[\w.<>,[\]\s]+\s+([A-Za-z_]\w*)\s*\(/g,
+      kind: "method"
+    }
+  ],
+  csharp: [
+    { re: /\b(?:class|interface|struct|enum|record)\s+([A-Za-z_]\w*)/g, kind: "class" },
+    { re: /\bnamespace\s+([A-Za-z_.\w]+)/g, kind: "namespace" },
+    {
+      re: /\b(?:public|private|protected|internal|static|async|override|virtual|\s)+\s*[\w.<>,[\]\s]+\s+([A-Za-z_]\w*)\s*\(/g,
+      kind: "method"
+    }
+  ],
+  php: [
+    { re: /\bfunction\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /\bclass\s+([A-Za-z_]\w*)/g, kind: "class" },
+    { re: /\binterface\s+([A-Za-z_]\w*)/g, kind: "interface" },
+    { re: /\bnamespace\s+([A-Za-z_\\]+)/g, kind: "namespace" }
+  ],
+  ruby: [
+    { re: /^\s*def\s+(?:self\.)?([A-Za-z_]\w*[!?]?)/gm, kind: "function" },
+    { re: /^\s*class\s+([A-Za-z_]\w*)/gm, kind: "class" },
+    { re: /^\s*module\s+([A-Za-z_]\w*)/gm, kind: "namespace" }
+  ],
+  swift: [
+    { re: /\b(?:func)\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /\b(?:class|struct|enum|protocol|actor)\s+([A-Za-z_]\w*)/g, kind: "class" }
+  ],
+  kotlin: [
+    { re: /\b(?:fun)\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /\b(?:class|interface|object|enum\s+class|data\s+class)\s+([A-Za-z_]\w*)/g, kind: "class" }
+  ],
+  scala: [
+    { re: /\b(?:def)\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /\b(?:class|object|trait|enum)\s+([A-Za-z_]\w*)/g, kind: "class" }
+  ],
+  shell: [
+    { re: /^(?:function\s+)?([A-Za-z_]\w*)\s*\(\)\s*\{/gm, kind: "function" },
+    { re: /^([A-Za-z_][\w]*)\s*\(\)\s*\{/gm, kind: "function" }
+  ],
+  sql: [
+    { re: /\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:TABLE|VIEW|INDEX|FUNCTION|PROCEDURE|TRIGGER)\s+(?:IF\s+NOT\s+EXISTS\s+)?([A-Za-z_"][\w."]*)/gi, kind: "type" }
+  ],
+  md: [
+    { re: /^(#{1,6})\s+(.+)$/gm, kind: "namespace" }
+  ],
+  toml: [
+    { re: /^\[([^\]]+)\]/gm, kind: "namespace" }
+  ],
+  html: [
+    { re: /\bid\s*=\s*["']([^"']+)["']/gi, kind: "property" },
+    { re: /<(?:script|template|style)\b/gi, kind: "namespace" }
+  ],
+  css: [
+    { re: /^\s*([.#]?[A-Za-z_][\w-]*)\s*\{/gm, kind: "type" },
+    { re: /@(?:keyframes|media|supports)\s+([^{\s]+)/g, kind: "namespace" }
+  ],
+  vue: [
+    { re: /\b(?:function|const|let|var|class|export\s+(?:default\s+)?(?:function|class|const))\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /<(?:script|template|style)\b/gi, kind: "namespace" }
+  ],
+  svelte: [
+    { re: /\b(?:function|const|let|var|class|export\s+(?:default\s+)?(?:function|class|const))\s+([A-Za-z_]\w*)/g, kind: "function" }
+  ],
+  dart: [
+    { re: /\b(?:class|enum|mixin|extension)\s+([A-Za-z_]\w*)/g, kind: "class" },
+    { re: /\b([A-Za-z_]\w*)\s*\([^;]*\)\s*(?:async\s*)?\{/g, kind: "function" }
+  ],
+  lua: [
+    { re: /\bfunction\s+([A-Za-z_.:]\w*)/g, kind: "function" },
+    { re: /\blocal\s+function\s+([A-Za-z_]\w*)/g, kind: "function" }
+  ],
+  r: [
+    { re: /([A-Za-z.]\w*)\s*<-\s*function\s*\(/g, kind: "function" },
+    { re: /([A-Za-z.]\w*)\s*=\s*function\s*\(/g, kind: "function" }
+  ],
+  proto: [
+    { re: /\b(?:message|service|enum)\s+([A-Za-z_]\w*)/g, kind: "type" },
+    { re: /\brpc\s+([A-Za-z_]\w*)/g, kind: "function" }
+  ],
+  graphql: [
+    { re: /\b(?:type|interface|enum|input|union|scalar)\s+([A-Za-z_]\w*)/g, kind: "type" },
+    { re: /\b(?:query|mutation|subscription)\s+([A-Za-z_]\w*)/g, kind: "function" }
+  ],
+  zig: [
+    { re: /\b(?:fn|pub\s+fn)\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /\b(?:const|var)\s+([A-Za-z_]\w*)/g, kind: "const" },
+    { re: /\b(?:struct|enum|union)\s*\{/g, kind: "type" }
+  ],
+  elixir: [
+    { re: /\bdef(?:p|macro|macrop)?\s+([A-Za-z_]\w*[!?]?)/g, kind: "function" },
+    { re: /\bdefmodule\s+([A-Za-z_.]\w*)/g, kind: "namespace" }
+  ],
+  haskell: [
+    { re: /^([A-Za-z_]\w*)\s*::/gm, kind: "function" },
+    { re: /\bdata\s+([A-Za-z_]\w*)/g, kind: "type" },
+    { re: /\btype\s+(?:family\s+)?([A-Za-z_]\w*)/g, kind: "type" },
+    { re: /\bclass\s+([A-Za-z_]\w*)/g, kind: "class" }
+  ],
+  other: [
+    { re: /^(?:export\s+)?(?:async\s+)?function\s+([A-Za-z_]\w*)/gm, kind: "function" },
+    { re: /^(?:export\s+)?class\s+([A-Za-z_]\w*)/gm, kind: "class" },
+    { re: /^(?:export\s+)?(?:const|let|var)\s+([A-Za-z_]\w*)/gm, kind: "const" },
+    { re: /^(?:async\s+)?def\s+([A-Za-z_]\w*)/gm, kind: "function" },
+    { re: /^func\s+(?:\([^)]*\)\s*)?([A-Za-z_]\w*)/gm, kind: "function" },
+    { re: /\bfn\s+([A-Za-z_]\w*)/g, kind: "function" },
+    { re: /^(?:target|PHONY)\s*:/gm, kind: "namespace" }
+  ]
+};
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "if",
+  "else",
+  "for",
+  "while",
+  "switch",
+  "case",
+  "return",
+  "break",
+  "continue",
+  "new",
+  "delete",
+  "typeof",
+  "instanceof",
+  "void",
+  "null",
+  "true",
+  "false",
+  "this",
+  "super",
+  "import",
+  "export",
+  "from",
+  "as",
+  "default",
+  "public",
+  "private",
+  "protected",
+  "static",
+  "final",
+  "class",
+  "struct",
+  "enum",
+  "interface",
+  "function",
+  "def",
+  "fn",
+  "func",
+  "var",
+  "let",
+  "const",
+  "package",
+  "namespace",
+  "module",
+  "using",
+  "include",
+  "require",
+  "select",
+  "from",
+  "where",
+  "and",
+  "or",
+  "not",
+  "in",
+  "is",
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "async",
+  "await",
+  "yield"
+]);
+function patternsFor(lang) {
+  return LANG_PATTERNS[lang] ?? LANG_PATTERNS.other ?? [];
+}
+function looksBinary(content) {
+  if (content.includes("\0")) return true;
+  const sample = content.slice(0, 2048);
+  if (sample.length === 0) return false;
+  let bad = 0;
+  for (let i = 0; i < sample.length; i++) {
+    const c = sample.charCodeAt(i);
+    if (c === 9 || c === 10 || c === 13) continue;
+    if (c < 32 || c === 127) bad++;
+  }
+  return bad / sample.length > 0.1;
+}
+function lineColAt(content, index) {
+  let line = 1;
+  let lastNl = -1;
+  for (let i = 0; i < index && i < content.length; i++) {
+    if (content.charCodeAt(i) === 10) {
+      line++;
+      lastNl = i;
+    }
+  }
+  return { line, col: index - lastNl };
+}
+var GENERIC_MAX_SYMBOLS_DEFAULT = 500;
+var GENERIC_MAX_FILE_CHARS = 512 * 1024;
+function parseGeneric2(opts) {
+  const { file, lang } = opts;
+  const maxSymbols = opts.maxSymbols ?? GENERIC_MAX_SYMBOLS_DEFAULT;
+  const mtimeMs = Date.now();
+  if (!opts.content || looksBinary(opts.content)) {
+    return { file, lang, symbols: [], mtimeMs };
+  }
+  const content = opts.content.length > GENERIC_MAX_FILE_CHARS ? opts.content.slice(0, GENERIC_MAX_FILE_CHARS) : opts.content;
+  const patterns = patternsFor(lang);
+  const symbols = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const pattern of patterns) {
+    const re = new RegExp(pattern.re.source, pattern.re.flags.includes("g") ? pattern.re.flags : `${pattern.re.flags}g`);
+    re.lastIndex = 0;
+    for (const match of content.matchAll(re)) {
+      if (symbols.length >= maxSymbols) break;
+      let name = (match[1] ?? match[2] ?? "").trim();
+      if (lang === "md" && match[2]) name = match[2].trim();
+      if (!name || name.length > 200) continue;
+      name = name.replace(/^#+\s*/, "").replace(/["'`]/g, "");
+      if (!name || KEYWORDS.has(name.toLowerCase())) continue;
+      if (!/^[A-Za-z_#.@/\w][\w.\-:/#!?]*$/.test(name) && lang !== "md" && lang !== "toml") {
+        continue;
+      }
+      const { line, col } = lineColAt(content, match.index);
+      const key = `${name}\0${line}\0${pattern.kind}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const nl = content.indexOf("\n", match.index);
+      const lineText = content.slice(match.index, nl === -1 ? content.length : nl);
+      const signature = (lineText || name).trim().slice(0, 500);
+      symbols.push({
+        id: 0,
+        lang,
+        kind: lang === "md" ? "namespace" : pattern.kind,
+        name: name.slice(0, 200),
+        file,
+        line,
+        col,
+        signature,
+        docComment: "",
+        scope: "",
+        text: `${name} ${signature}`.trim().slice(0, 1e3)
+      });
+    }
+    if (symbols.length >= maxSymbols) break;
+  }
+  return { file, lang, symbols, mtimeMs };
+}
 async function parseSymbols3(opts) {
+  return parseGeneric2(opts);
+}
+
+// src/codebase-index/py-parser.ts
+async function parseSymbols4(opts) {
   const { file, content, lang } = opts;
   try {
-    return await syncPyParse(file, content, lang);
+    const native = await withSpawnGate(() => syncPyParse(file, content, lang));
+    if (native !== null) return native;
   } catch {
-    return { file, lang, symbols: [], mtimeMs: Date.now() };
   }
+  return parseGeneric2({ file, content, lang: lang === "py" ? "py" : lang });
 }
 var PY_PARSE_SCRIPT = `import ast, json, sys, os
 
@@ -10179,20 +10930,37 @@ visitor.visit(tree)
 
 print(json.dumps([s.to_dict() for s in syms]))
 `;
-function resolvePython() {
+async function resolvePython() {
   const candidates = process.platform === "win32" ? ["python3", "python", "py"] : ["python3", "python"];
   for (const name of candidates) {
     const resolved = resolveWin32Command(name);
-    const result = spawnSync(resolved, ["--version"], {
-      stdio: "pipe",
-      timeout: 5e3
-    });
-    if (result.error) continue;
-    if (result.status !== 0) continue;
+    if (!await commandIsAvailable(resolved)) continue;
     return resolved;
   }
   return null;
 }
+function commandIsAvailable(command) {
+  return new Promise((resolve15) => {
+    let settled = false;
+    const proc = spawn5(command, ["--version"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    const finish = (available) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve15(available);
+    };
+    const timer = setTimeout(() => {
+      proc.kill("SIGKILL");
+      finish(false);
+    }, 5e3);
+    timer.unref?.();
+    proc.once("error", () => finish(false));
+    proc.once("close", (code) => finish(code === 0));
+  });
+}
 function spawnPyParser(pyBinary, scriptPath, filePath, content) {
   return new Promise((resolve15, reject) => {
     let settled = false;
@@ -10228,21 +10996,20 @@ function spawnPyParser(pyBinary, scriptPath, filePath, content) {
   });
 }
 var _cachedScriptPath = null;
-var _cachedPyBinary = null;
+var cachedPyBinary;
 async function syncPyParse(filePath, content, lang) {
   try {
     if (!_cachedScriptPath) {
-      const tmpDir = path15.join(os6.tmpdir(), "ws-py-parse");
+      const tmpDir = path16.join(os6.tmpdir(), "ws-py-parse");
       await fs11.mkdir(tmpDir, { recursive: true });
-      _cachedScriptPath = path15.join(tmpDir, "parse.py");
+      _cachedScriptPath = path16.join(tmpDir, "parse.py");
       await fs11.writeFile(_cachedScriptPath, PY_PARSE_SCRIPT, "utf8");
     }
-    if (!_cachedPyBinary) {
-      _cachedPyBinary = resolvePython();
-      if (!_cachedPyBinary) return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
-    }
+    cachedPyBinary ??= resolvePython();
+    const pyBinary = await cachedPyBinary;
+    if (!pyBinary) return null;
     const { code, stdout } = await spawnPyParser(
-      _cachedPyBinary,
+      pyBinary,
       _cachedScriptPath,
       filePath,
       content
@@ -10266,31 +11033,40 @@ async function syncPyParse(filePath, content, lang) {
     }));
     return { file: filePath, lang, symbols, mtimeMs: Date.now() };
   } catch {
-    return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
+    return null;
   }
 }
 
 // src/codebase-index/rs-parser.ts
 init_win32_resolve();
-import { expectDefined as expectDefined3 } from "@wrongstack/core";
-import { execFileSync, spawn as spawn6 } from "node:child_process";
+import { expectDefined as expectDefined3 } from "@wrongstack/core/utils";
+import { execFile, spawn as spawn6 } from "node:child_process";
 import * as fs12 from "node:fs/promises";
-import * as path16 from "node:path";
-async function parseSymbols4(opts) {
+import * as path17 from "node:path";
+async function parseSymbols5(opts) {
   const { file, content, lang } = opts;
-  const nativeAvailable = checkNativeParser();
+  const nativeAvailable = await checkNativeParser();
   if (nativeAvailable) {
-    const result = await tryNativeParse(file, content);
+    const result = await withSpawnGate(() => tryNativeParse(file, content));
     if (result) return result;
   }
   return regexParse({ file, content, lang });
 }
+var nativeParserAvailability;
+function probe(command, args) {
+  return new Promise((resolve15, reject) => {
+    execFile(command, args, { timeout: 1e4, windowsHide: true }, (error) => {
+      if (error) reject(error);
+      else resolve15();
+    });
+  });
+}
 function checkNativeParser() {
-  try {
-    execFileSync("rustc", ["--version"], { stdio: "pipe", windowsHide: true });
-    const toolsDir = path16.join(process.cwd(), "tools");
+  nativeParserAvailability ??= (async () => {
     try {
-      execFileSync(
+      await probe("rustc", ["--version"]);
+      const toolsDir = path17.join(process.cwd(), "tools");
+      await probe(
         "cargo",
         [
           "metadata",
@@ -10298,23 +11074,21 @@ function checkNativeParser() {
           "--format-version",
           "1",
           "--manifest-path",
-          path16.join(toolsDir, "Cargo.toml")
-        ],
-        { stdio: "pipe", windowsHide: true }
+          path17.join(toolsDir, "Cargo.toml")
+        ]
       );
       return true;
     } catch {
       return false;
     }
-  } catch {
-    return false;
-  }
+  })();
+  return nativeParserAvailability;
 }
 async function tryNativeParse(file, content) {
   try {
-    const toolsDir = path16.join(process.cwd(), "tools");
-    const crateDir = path16.join(toolsDir, "syn-parser");
-    const tmpFile = path16.join(crateDir, "src", "input.rs");
+    const toolsDir = path17.join(process.cwd(), "tools");
+    const crateDir = path17.join(toolsDir, "syn-parser");
+    const tmpFile = path17.join(crateDir, "src", "input.rs");
     await fs12.writeFile(tmpFile, content, "utf8");
     const cargoBinary = resolveWin32Command("cargo");
     const result = await new Promise(
@@ -10322,7 +11096,7 @@ async function tryNativeParse(file, content) {
         let settled = false;
         const proc = spawn6(
           cargoBinary,
-          ["run", "--manifest-path", path16.join(toolsDir, "Cargo.toml")],
+          ["run", "--manifest-path", path17.join(toolsDir, "Cargo.toml")],
           {
             cwd: process.cwd(),
             stdio: ["pipe", "pipe", "pipe"],
@@ -10436,9 +11210,9 @@ function regexParse(opts) {
 }
 
 // src/codebase-index/json-parser.ts
-import { expectDefined as expectDefined4 } from "@wrongstack/core";
-import * as path17 from "node:path";
-function parseSymbols5(opts) {
+import { expectDefined as expectDefined4 } from "@wrongstack/core/utils";
+import * as path18 from "node:path";
+function parseSymbols6(opts) {
   const { file, content, lang } = opts;
   try {
     return regexParse2({ file, content, lang });
@@ -10449,9 +11223,9 @@ function parseSymbols5(opts) {
 function regexParse2(opts) {
   const { file, content, lang } = opts;
   const symbols = [];
-  const basename11 = path17.basename(file).toLowerCase();
-  const isPackageJson = basename11 === "package.json";
-  const isTsconfig = basename11 === "tsconfig.json" || basename11 === "tsconfig.build.json";
+  const basename12 = path18.basename(file).toLowerCase();
+  const isPackageJson = basename12 === "package.json";
+  const isTsconfig = basename12 === "tsconfig.json" || basename12 === "tsconfig.build.json";
   const isJsonSchema = content.includes("$schema") || content.includes("$id") || content.includes("$ref");
   const isOpenApi = content.includes("openapi") || content.includes("swagger");
   const lines = content.split("\n");
@@ -10475,11 +11249,11 @@ function regexParse2(opts) {
     const line = lineFromOffset(offset);
     symbols.push(
       makeSymbol({
-        name: path17.basename(file),
+        name: path18.basename(file),
         kind: "object",
         line,
         col: 0,
-        signature: `"${path17.basename(file)}" = { ... }`,
+        signature: `"${path18.basename(file)}" = { ... }`,
         file,
         lang
       })
@@ -10641,8 +11415,8 @@ function makeSymbol(opts) {
 }
 
 // src/codebase-index/yaml-parser.ts
-import { expectDefined as expectDefined5, truncate } from "@wrongstack/core";
-function parseSymbols6(opts) {
+import { expectDefined as expectDefined5, truncate } from "@wrongstack/core/utils";
+function parseSymbols7(opts) {
   const { file, content, lang } = opts;
   try {
     return regexParse3({ file, content, lang });
@@ -10791,8 +11565,8 @@ function makeSymbol2(opts) {
 
 // src/codebase-index/gitignore.ts
 import * as fs13 from "node:fs/promises";
-import * as path18 from "node:path";
-import { compileGlob } from "@wrongstack/core";
+import * as path19 from "node:path";
+import { compileGlob } from "@wrongstack/core/utils";
 function globBody(glob) {
   return compileGlob(glob).source.replace(/^\^/, "").replace(/\$$/, "");
 }
@@ -10837,7 +11611,7 @@ function compileGitignore(lines) {
 async function loadGitignoreMatcher(projectRoot) {
   let lines = [];
   try {
-    const raw = await fs13.readFile(path18.join(projectRoot, ".gitignore"), "utf8");
+    const raw = await fs13.readFile(path19.join(projectRoot, ".gitignore"), "utf8");
     lines = raw.split("\n");
   } catch {
   }
@@ -10846,7 +11620,9 @@ async function loadGitignoreMatcher(projectRoot) {
 
 // src/codebase-index/indexer.ts
 var YIELD_EVERY_N = 50;
-var PARALLEL_BATCH = Math.min(availableParallelism() * 4, 40);
+function resolveParallelBatch() {
+  return indexParallelBatchSize(availableParallelism());
+}
 function yieldEventLoop() {
   return new Promise((resolve15) => setImmediate(resolve15));
 }
@@ -10858,22 +11634,12 @@ function throwIfAborted(signal) {
 function isAbortError(err) {
   return err instanceof DOMException && err.name === "AbortError";
 }
-var DEFAULT_IGNORE = [
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  ".next",
-  "coverage",
-  ".turbo",
-  "__snapshots__",
-  ".nyc_output"
-];
+var DEFAULT_IGNORE = DEFAULT_WALK_IGNORE_DIRS;
 var DEFAULT_IGNORE_FILES = /* @__PURE__ */ new Set(["package-lock.json", "pnpm-lock.yaml", "pnpm-lock.yml"]);
 var MAX_INDEX_FILE_BYTES = 5 * 1024 * 1024;
 function isWithinProject(projectRoot, file) {
-  const rel = path19.relative(projectRoot, file);
-  return rel !== "" && !rel.startsWith(`..${path19.sep}`) && rel !== ".." && !path19.isAbsolute(rel);
+  const rel = path20.relative(projectRoot, file);
+  return rel !== "" && !rel.startsWith(`..${path20.sep}`) && rel !== ".." && !path20.isAbsolute(rel);
 }
 function isMissingPathError(err) {
   const code = err?.code;
@@ -10884,18 +11650,7 @@ async function findSourceFiles(projectRoot, ignore, isGitIgnored, signal) {
   const errors = [];
   let complete = true;
   const ignoreSet = /* @__PURE__ */ new Set([...DEFAULT_IGNORE, ...ignore]);
-  const globs = [
-    { ext: ".ts", pat: compileGlob2("**/*.ts") },
-    { ext: ".tsx", pat: compileGlob2("**/*.tsx") },
-    { ext: ".js", pat: compileGlob2("**/*.js") },
-    { ext: ".jsx", pat: compileGlob2("**/*.jsx") },
-    { ext: ".go", pat: compileGlob2("**/*.go") },
-    { ext: ".py", pat: compileGlob2("**/*.py") },
-    { ext: ".rs", pat: compileGlob2("**/*.rs") },
-    { ext: ".json", pat: compileGlob2("**/*.json") },
-    { ext: ".yaml", pat: compileGlob2("**/*.yaml") },
-    { ext: ".yml", pat: compileGlob2("**/*.yml") }
-  ];
+  const indexableExts = new Set(INDEXABLE_EXTENSIONS);
   let dirCount = 0;
   const walk2 = async (dir) => {
     throwIfAborted(signal);
@@ -10914,19 +11669,16 @@ async function findSourceFiles(projectRoot, ignore, isGitIgnored, signal) {
     dirCount++;
     for (const e of entries) {
       if (ignoreSet.has(e.name)) continue;
-      const full = path19.join(dir, e.name);
-      const rel = path19.relative(projectRoot, full).replace(/\\/g, "/");
+      const full = path20.join(dir, e.name);
+      const rel = path20.relative(projectRoot, full).replace(/\\/g, "/");
       if (e.isDirectory()) {
         if (isGitIgnored(rel, true)) continue;
         await walk2(full);
       } else if (e.isFile()) {
         if (DEFAULT_IGNORE_FILES.has(e.name) || isGitIgnored(rel, false)) continue;
-        const ext = path19.extname(e.name).toLowerCase();
-        for (const { ext: extName, pat } of globs) {
-          if (ext === extName && (pat.test(rel) || pat.test(e.name))) {
-            results.push(full);
-            break;
-          }
+        const ext = path20.extname(e.name).toLowerCase();
+        if (indexableExts.has(ext) || detectLang(full) !== null) {
+          results.push(full);
         }
       }
     }
@@ -10935,24 +11687,25 @@ async function findSourceFiles(projectRoot, ignore, isGitIgnored, signal) {
   return { files: results, complete, errors };
 }
 async function parseFile(file, content, lang) {
-  switch (lang) {
+  const symbolLang = lang;
+  switch (symbolLang) {
     case "ts":
     case "tsx":
     case "js":
     case "jsx":
-      return parseSymbols({ file, content, lang });
+      return parseSymbols({ file, content, lang: symbolLang });
     case "go":
       return parseSymbols2({ file, content, lang: "go" });
     case "py":
-      return parseSymbols3({ file, content, lang: "py" });
+      return parseSymbols4({ file, content, lang: "py" });
     case "rs":
-      return parseSymbols4({ file, content, lang: "rs" });
+      return parseSymbols5({ file, content, lang: "rs" });
     case "json":
-      return parseSymbols5({ file, content, lang: "json" });
+      return parseSymbols6({ file, content, lang: "json" });
     case "yaml":
-      return parseSymbols6({ file, content, lang: "yaml" });
+      return parseSymbols7({ file, content, lang: "yaml" });
     default:
-      return { file, lang, symbols: [], mtimeMs: Date.now() };
+      return parseSymbols3({ file, content, lang: symbolLang });
   }
 }
 function assignRefsToSymbols2(refs, symbols) {
@@ -11000,10 +11753,10 @@ async function runIndexerWithStore(store, opts) {
   let discoveredFiles = null;
   let discoveryComplete = true;
   if (opts.files && opts.files.length > 0) {
-    files = opts.files.map((f) => path19.resolve(projectRoot, f)).filter((f) => {
+    files = opts.files.map((f) => path20.resolve(projectRoot, f)).filter((f) => {
       if (!isWithinProject(projectRoot, f)) return false;
-      const rel = path19.relative(projectRoot, f).replace(/\\/g, "/");
-      return !rel.split("/").some((seg) => DEFAULT_IGNORE.includes(seg)) && !DEFAULT_IGNORE_FILES.has(path19.basename(f)) && !isGitIgnored(rel, false);
+      const rel = path20.relative(projectRoot, f).replace(/\\/g, "/");
+      return !rel.split("/").some((seg) => DEFAULT_IGNORE.includes(seg)) && !DEFAULT_IGNORE_FILES.has(path20.basename(f)) && !isGitIgnored(rel, false);
     });
   } else {
     const discovery = await findSourceFiles(projectRoot, ignore, isGitIgnored, signal);
@@ -11024,15 +11777,19 @@ async function runIndexerWithStore(store, opts) {
   if (!force) {
     for (const meta of store.getAllFileMetas()) existingMeta.set(meta.file, meta);
   }
+  const parallelBatch = resolveParallelBatch();
   let filesSinceLastYield = 0;
-  for (let batchStart = 0; batchStart < files.length; batchStart += PARALLEL_BATCH) {
-    const batchEnd = Math.min(batchStart + PARALLEL_BATCH, files.length);
+  for (let batchStart = 0; batchStart < files.length; batchStart += parallelBatch) {
+    const batchEnd = Math.min(batchStart + parallelBatch, files.length);
     const batchFiles = files.slice(batchStart, batchEnd);
     opts.onProgress?.(batchEnd, files.length);
     filesSinceLastYield += batchFiles.length;
     if (filesSinceLastYield >= YIELD_EVERY_N) {
       filesSinceLastYield = 0;
       await yieldEventLoop();
+      if (isFrugalPerf()) {
+        await new Promise((r) => setTimeout(r, 8));
+      }
       throwIfAborted(signal);
     }
     const statOpts = signal ? { signal } : {};
@@ -11136,9 +11893,7 @@ async function runIndexerWithStore(store, opts) {
         continue;
       }
       if (parsed.symbols.length === 0) {
-        store.deleteRefsForFile(file);
-        store.deleteSymbolsForFile(file);
-        store.upsertFile({
+        store.replaceEmptyFile({
           file,
           lang,
           mtimeMs: Math.floor(stat18.mtimeMs),
@@ -11207,6 +11962,7 @@ async function runIndexerWithStore(store, opts) {
   }
   store.resolveRefs();
   store.setMetadata("relation_graph_version", relationGraphVersion);
+  store.optimize();
   const durationMs = Date.now() - startMs;
   store.setLastIndexed(Date.now());
   return {
@@ -11497,10 +12253,10 @@ async function callInline(op, args, opts) {
     opts.signal?.removeEventListener("abort", onOuterAbort);
   }
 }
-var chain = Promise.resolve();
+var chain2 = Promise.resolve();
 function withMutex(job) {
-  const run = chain.then(job, job);
-  chain = run.then(
+  const run = chain2.then(job, job);
+  chain2 = run.then(
     () => void 0,
     () => void 0
   );
@@ -11514,11 +12270,62 @@ function circuitOpenError() {
 }
 var DEFAULT_DEBOUNCE_MS = 400;
 var debounceTimers = /* @__PURE__ */ new Map();
-function debounceKey(indexDir, file) {
-  return `${indexDir ?? ""}|${file}`;
+var readyReindexBatches = /* @__PURE__ */ new Map();
+function debounceKey(projectRoot, indexDir, file) {
+  return JSON.stringify([projectRoot, indexDir ?? "", file]);
+}
+function reindexBatchKey(projectRoot, indexDir) {
+  return JSON.stringify([projectRoot, indexDir ?? ""]);
+}
+function flushReadyReindexBatch(key) {
+  const batch = readyReindexBatches.get(key);
+  if (!batch) return;
+  readyReindexBatches.delete(key);
+  if (!indexCircuitBreaker.allowRequest()) {
+    const error = circuitOpenError();
+    for (const onError of batch.onErrors) onError(error);
+    return;
+  }
+  void withMutex(
+    () => callIndexOp(
+      "index",
+      {
+        projectRoot: batch.projectRoot,
+        files: [...batch.files].sort(),
+        indexDir: batch.indexDir
+      },
+      { timeoutMs: batch.timeoutMs }
+    )
+  ).then(
+    () => indexCircuitBreaker.recordSuccess(),
+    (err) => {
+      indexCircuitBreaker.recordFailure(err);
+      for (const onError of batch.onErrors) onError(err);
+    }
+  );
+}
+function addReadyReindex(opts) {
+  const key = reindexBatchKey(opts.projectRoot, opts.indexDir);
+  const existing = readyReindexBatches.get(key);
+  if (existing) {
+    existing.files.add(opts.file);
+    existing.timeoutMs = Math.max(existing.timeoutMs, opts.timeoutMs);
+    if (opts.onError) existing.onErrors.add(opts.onError);
+    return;
+  }
+  const batch = {
+    projectRoot: opts.projectRoot,
+    indexDir: opts.indexDir,
+    files: /* @__PURE__ */ new Set([opts.file]),
+    timeoutMs: opts.timeoutMs,
+    onErrors: new Set(opts.onError ? [opts.onError] : [])
+  };
+  batch.flush = setImmediate(() => flushReadyReindexBatch(key));
+  batch.flush.unref?.();
+  readyReindexBatches.set(key, batch);
 }
 function isIndexableFile(filePath) {
-  return detectLang(filePath) !== null;
+  return isIndexablePath(filePath);
 }
 function isRecoverableConstraintError(err) {
   if (err instanceof Error) {
@@ -11578,28 +12385,18 @@ function enqueueReindex(opts) {
   if (files.length === 0) return;
   const ms = opts.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   for (const file of files) {
-    const key = debounceKey(opts.indexDir, file);
+    const key = debounceKey(opts.projectRoot, opts.indexDir, file);
     const existing = debounceTimers.get(key);
     if (existing) clearTimeout(existing);
     const timer = setTimeout(() => {
       debounceTimers.delete(key);
-      if (!indexCircuitBreaker.allowRequest()) {
-        opts.onError?.(circuitOpenError());
-        return;
-      }
-      void withMutex(
-        () => callIndexOp(
-          "index",
-          { projectRoot: opts.projectRoot, files: [file], indexDir: opts.indexDir },
-          { timeoutMs: opts.timeoutMs ?? DEFAULT_INCREMENTAL_TIMEOUT_MS }
-        )
-      ).then(
-        () => indexCircuitBreaker.recordSuccess(),
-        (err) => {
-          indexCircuitBreaker.recordFailure(err);
-          opts.onError?.(err);
-        }
-      );
+      addReadyReindex({
+        projectRoot: opts.projectRoot,
+        file,
+        indexDir: opts.indexDir,
+        timeoutMs: opts.timeoutMs ?? DEFAULT_INCREMENTAL_TIMEOUT_MS,
+        onError: opts.onError
+      });
     }, ms);
     timer.unref?.();
     debounceTimers.set(key, timer);
@@ -11608,6 +12405,10 @@ function enqueueReindex(opts) {
 function cancelPendingReindexes() {
   for (const t of debounceTimers.values()) clearTimeout(t);
   debounceTimers.clear();
+  for (const batch of readyReindexBatches.values()) {
+    if (batch.flush) clearImmediate(batch.flush);
+  }
+  readyReindexBatches.clear();
 }
 async function searchCodebaseIndex(args, opts = {}) {
   return callIndexOp("search", args, {
@@ -11893,7 +12694,7 @@ var codebaseStatsTool = {
 
 // src/design.ts
 import * as fs16 from "node:fs/promises";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 import {
   applyTokenOverrides,
   getDesignKitLoader,
@@ -11902,23 +12703,24 @@ import {
   materializeTokens,
   recordKitChoice,
   recordOverrides,
+  resolveSemanticTune,
   runDesignVerify,
   setActiveKit,
   setDesignOverrides
-} from "@wrongstack/core";
+} from "@wrongstack/core/design";
 async function resolveReal(p) {
-  const resolved = path20.resolve(p);
-  let probe = resolved;
+  const resolved = path21.resolve(p);
+  let probe2 = resolved;
   const missing = [];
   for (; ; ) {
     try {
-      return path20.resolve(await fs16.realpath(probe), ...missing);
+      return path21.resolve(await fs16.realpath(probe2), ...missing);
     } catch (err) {
       if (err.code === "ENOENT") {
-        const parent = path20.dirname(probe);
-        if (parent === probe) return resolved;
-        missing.unshift(path20.basename(probe));
-        probe = parent;
+        const parent = path21.dirname(probe2);
+        if (parent === probe2) return resolved;
+        missing.unshift(path21.basename(probe2));
+        probe2 = parent;
         continue;
       }
       return resolved;
@@ -11948,8 +12750,8 @@ var designTool = {
     properties: {
       action: {
         type: "string",
-        enum: ["list", "use", "foundations", "set", "materialize", "verify"],
-        description: "list = menu; use = load+pin a kit; foundations = baseline; set = override colors/tokens; materialize = write tokens to a theme file; verify = scan UI for off-palette colors. Default: list."
+        enum: ["list", "use", "foundations", "set", "tune", "materialize", "verify"],
+        description: "list = menu; use = load+pin a kit; foundations = baseline; set = override colors/tokens; tune = high-level knobs (radius/density/font/motion); materialize = write tokens to a theme file; verify = scan UI for token drift. Default: list."
       },
       kit: {
         type: "string",
@@ -11965,6 +12767,16 @@ var designTool = {
         description: 'Token overrides for "set"/"use": { "primary": "oklch(\u2026)", "dark.bg": "#111" }. Bare key = both themes; "light."/"dark." prefix = that theme only. Empty value clears an override.',
         additionalProperties: { type: "string" }
       },
+      tune: {
+        type: "object",
+        description: 'High-level knobs for "tune": { "radius": "lg", "density": "compact", "font": "Space Grotesk", "motion": "snappy" }. radius = none|sm|md|lg|xl|full or a base length; density = compact|cozy|comfortable; motion = snappy|smooth|none. Resolved to concrete token overrides.',
+        properties: {
+          radius: { type: "string" },
+          density: { type: "string" },
+          font: { type: "string" },
+          motion: { type: "string" }
+        }
+      },
       out: {
         type: "string",
         description: "Materialize output path (project-relative). Defaults to a per-stack convention."
@@ -12062,6 +12874,28 @@ ${body}`
 These win over kit tokens. Run \`design {action:"materialize"}\` to write them to a theme file.`
       };
     }
+    if (action === "tune") {
+      const patch = resolveSemanticTune(input.tune ?? {});
+      if (Object.keys(patch).length === 0) {
+        return {
+          action,
+          output: 'No recognized knobs. Pass tune:{ radius:"lg", density:"compact", font:"\u2026", motion:"snappy" }.'
+        };
+      }
+      const merged = await recordOverrides(ctx.projectRoot, patch, (/* @__PURE__ */ new Date()).toISOString());
+      if (!merged) {
+        return {
+          action,
+          output: 'No active kit. Pick one first: `design {action:"use", kit:"<id>"}`.'
+        };
+      }
+      setDesignOverrides(ctx, merged);
+      return {
+        action,
+        output: `Tuned. Resolved ${Object.keys(patch).length} token override(s): ${Object.entries(patch).map(([k, v]) => `${k}=${v}`).join(", ")}
+Run \`design {action:"materialize"}\` to write the tuned tokens to your theme file.`
+      };
+    }
     if (action === "materialize") {
       const active = await loadActiveKit(ctx.projectRoot);
       if (!active) {
@@ -12083,11 +12917,11 @@ These win over kit tokens. Run \`design {action:"materialize"}\` to write them t
         outPath: input.out
       });
       const root = await resolveReal(ctx.projectRoot);
-      const absResolved = path20.isAbsolute(result.path) ? path20.resolve(result.path) : path20.resolve(path20.join(ctx.projectRoot, result.path));
-      const absParent = await resolveReal(path20.dirname(absResolved));
-      const abs = path20.join(absParent, path20.basename(absResolved));
-      const rel = path20.relative(root, abs);
-      if (rel.startsWith("..") || path20.isAbsolute(rel)) {
+      const absResolved = path21.isAbsolute(result.path) ? path21.resolve(result.path) : path21.resolve(path21.join(ctx.projectRoot, result.path));
+      const absParent = await resolveReal(path21.dirname(absResolved));
+      const abs = path21.join(absParent, path21.basename(absResolved));
+      const rel = path21.relative(root, abs);
+      if (rel.startsWith("..") || path21.isAbsolute(rel)) {
         throw new Error(
           `design: materialize path "${result.path}" would escape the project root`
         );
@@ -12111,7 +12945,7 @@ ${result.content}
 \`\`\``
         };
       }
-      await fs16.mkdir(path20.dirname(abs), { recursive: true });
+      await fs16.mkdir(path21.dirname(abs), { recursive: true });
       await fs16.writeFile(abs, result.content);
       return {
         action,
@@ -12163,8 +12997,8 @@ init_util();
 import { spawn as spawn7 } from "node:child_process";
 import { statSync as statSync2 } from "node:fs";
 import * as fs17 from "node:fs/promises";
-import * as path21 from "node:path";
-import { buildChildEnv as buildChildEnv3 } from "@wrongstack/core";
+import * as path22 from "node:path";
+import { buildChildEnv as buildChildEnv3 } from "@wrongstack/core/utils";
 var diffTool = {
   name: "diff",
   category: "Filesystem",
@@ -12247,11 +13081,11 @@ function findGitDir(cwd) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat18 = statSync2(path21.join(dir, ".git"));
+      const stat18 = statSync2(path22.join(dir, ".git"));
       if (stat18.isDirectory()) return dir;
     } catch {
     }
-    const parent = path21.dirname(dir);
+    const parent = path22.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -12465,7 +13299,7 @@ function processFile(content, absPath, _style, _overwrite, target) {
 // src/e2e.ts
 init_util();
 import { open, readdir as readdir5 } from "node:fs/promises";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 async function readBoundedText(filePath, maxBytes) {
   let handle;
   try {
@@ -12515,8 +13349,8 @@ var MAX_PACKAGE_BYTES = 512 * 1024;
 var MAX_CONFIG_BYTES = 512 * 1024;
 var MAX_SPEC_SAMPLES = 20;
 function relativePath(root, target) {
-  const value = path22.relative(root, target) || ".";
-  return value.split(path22.sep).join("/");
+  const value = path23.relative(root, target) || ".";
+  return value.split(path23.sep).join("/");
 }
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -12588,7 +13422,7 @@ async function scanWorkspace(root, maxDepth, signal) {
     }
     for (const entry of entries) {
       signal.throwIfAborted();
-      const absolutePath = path22.join(current.directory, entry.name);
+      const absolutePath = path23.join(current.directory, entry.name);
       if (entry.isFile()) {
         if (entry.name === "package.json") result.packageFiles.push(absolutePath);
         const framework = CONFIG_NAMES.get(entry.name);
@@ -12649,9 +13483,9 @@ async function detectPackageManager3(projectRoot, scanRoot, declared) {
     if (names.has("bun.lock") || names.has("bun.lockb")) return "bun";
     if (names.has("package-lock.json") || names.has("npm-shrinkwrap.json")) return "npm";
     if (directory === scanRoot) break;
-    const parent = path22.dirname(directory);
-    const relativeParent = path22.relative(scanRoot, parent);
-    if (parent === directory || relativeParent.startsWith("..") || path22.isAbsolute(relativeParent)) {
+    const parent = path23.dirname(directory);
+    const relativeParent = path23.relative(scanRoot, parent);
+    if (parent === directory || relativeParent.startsWith("..") || path23.isAbsolute(relativeParent)) {
       break;
     }
     directory = parent;
@@ -12696,7 +13530,7 @@ function isSpec(framework, filename) {
   return /\.(?:spec|test)\.(?:[cm]?[jt]sx?)$/i.test(filename);
 }
 async function collectSpecs(root, framework, testDirectory, signal) {
-  const roots = testDirectory ? [path22.resolve(root, testDirectory)] : framework === "cypress" ? [path22.join(root, "cypress", "e2e"), path22.join(root, "cypress", "integration")] : [path22.join(root, "tests")];
+  const roots = testDirectory ? [path23.resolve(root, testDirectory)] : framework === "cypress" ? [path23.join(root, "cypress", "e2e"), path23.join(root, "cypress", "integration")] : [path23.join(root, "tests")];
   const samples = [];
   let count = 0;
   let scanned = 0;
@@ -12715,7 +13549,7 @@ async function collectSpecs(root, framework, testDirectory, signal) {
     }
     for (const entry of entries) {
       signal.throwIfAborted();
-      const target = path22.join(directory, entry.name);
+      const target = path23.join(directory, entry.name);
       if (entry.isDirectory() && !SKIP_DIRECTORIES.has(entry.name)) queue.push(target);
       else if (entry.isFile() && isSpec(framework, entry.name)) {
         count += 1;
@@ -12735,7 +13569,7 @@ function nearestPackage(projectRoot, packagesByDirectory, scanRoot) {
     const found = packagesByDirectory.get(directory);
     if (found) return found;
     if (directory === scanRoot) return void 0;
-    const parent = path22.dirname(directory);
+    const parent = path23.dirname(directory);
     if (parent === directory || relativePath(scanRoot, parent).startsWith("..")) return void 0;
     directory = parent;
   }
@@ -12746,13 +13580,13 @@ async function discoverE2EProjects(root, options) {
   const packages = (await Promise.all(scan.packageFiles.map(readPackageInfo))).filter(
     (info) => Boolean(info)
   );
-  const packagesByDirectory = new Map(packages.map((info) => [path22.dirname(info.path), info]));
+  const packagesByDirectory = new Map(packages.map((info) => [path23.dirname(info.path), info]));
   const candidates = /* @__PURE__ */ new Map();
   for (const config of scan.configs) {
     if (options.framework && options.framework !== "all" && config.framework !== options.framework) {
       continue;
     }
-    const projectRoot = path22.dirname(config.absolutePath);
+    const projectRoot = path23.dirname(config.absolutePath);
     candidates.set(`${config.framework}:${projectRoot}`, {
       framework: config.framework,
       root: projectRoot,
@@ -12760,7 +13594,7 @@ async function discoverE2EProjects(root, options) {
     });
   }
   for (const info of packages) {
-    const projectRoot = path22.dirname(info.path);
+    const projectRoot = path23.dirname(info.path);
     for (const framework of frameworkFromPackage(info)) {
       if (options.framework && options.framework !== "all" && framework !== options.framework)
         continue;
@@ -12776,10 +13610,10 @@ async function discoverE2EProjects(root, options) {
     const scripts = matchingScripts(info, candidate.framework);
     const manager = await detectPackageManager3(candidate.root, root, info?.packageManager);
     const testDirectory = candidate.framework === "playwright" ? staticString(source, "testDir") : void 0;
-    const resolvedTestDirectory = testDirectory ? path22.resolve(candidate.root, testDirectory) : void 0;
-    const relativeTestDirectory = resolvedTestDirectory ? path22.relative(root, resolvedTestDirectory) : void 0;
+    const resolvedTestDirectory = testDirectory ? path23.resolve(candidate.root, testDirectory) : void 0;
+    const relativeTestDirectory = resolvedTestDirectory ? path23.relative(root, resolvedTestDirectory) : void 0;
     const unsafeTestDirectory = Boolean(
-      relativeTestDirectory && (relativeTestDirectory.startsWith("..") || path22.isAbsolute(relativeTestDirectory))
+      relativeTestDirectory && (relativeTestDirectory.startsWith("..") || path23.isAbsolute(relativeTestDirectory))
     );
     const specs = options.includeSpecs === false || unsafeTestDirectory ? { count: 0, samples: [], truncated: false } : await collectSpecs(candidate.root, candidate.framework, testDirectory, options.signal);
     const warnings = [];
@@ -12884,10 +13718,10 @@ import {
   atomicWrite as atomicWrite2,
   detectNewlineStyle,
   normalizeToLf,
-  ToolValidationError,
   toStyle,
   unifiedDiff
-} from "@wrongstack/core";
+} from "@wrongstack/core/utils";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/_edit-match.ts
 var TIER_LABEL = {
@@ -13115,7 +13949,7 @@ function prefixSimilarity(a, b) {
 }
 
 // src/_syntax-check.ts
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 var TS_LIKE = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"]);
 var MAX_CHECK_CHARS = 15e5;
 var MAX_ERRORS = 5;
@@ -13139,15 +13973,15 @@ async function checkSyntax(filePath, content, previousContent) {
   return { errors, preExisting };
 }
 function isJsoncFile(filePath) {
-  const base = path23.basename(filePath).toLowerCase();
+  const base = path24.basename(filePath).toLowerCase();
   if (base.endsWith(".jsonc")) return true;
   if (/^(tsconfig|jsconfig)([.-].*)?\.json$/.test(base)) return true;
-  const dir = path23.basename(path23.dirname(filePath)).toLowerCase();
+  const dir = path24.basename(path24.dirname(filePath)).toLowerCase();
   return dir === ".vscode";
 }
 async function parseErrors(filePath, content) {
   if (content.length > MAX_CHECK_CHARS) return void 0;
-  const ext = path23.extname(filePath).toLowerCase();
+  const ext = path24.extname(filePath).toLowerCase();
   if (ext === ".json" || ext === ".jsonc") {
     try {
       JSON.parse(content);
@@ -13174,7 +14008,7 @@ async function parseErrors(filePath, content) {
     ts2.ScriptKind.JSX
   );
   const sourceFile = ts2.createSourceFile(
-    path23.basename(filePath),
+    path24.basename(filePath),
     content,
     ts2.ScriptTarget.Latest,
     /* setParentNodes */
@@ -13409,7 +14243,7 @@ import {
   emitProcessCompleted as emitProcessCompleted3,
   emitProcessOutput as emitProcessOutput3,
   emitProcessStarted as emitProcessStarted3
-} from "@wrongstack/core";
+} from "@wrongstack/core/observability";
 import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils/error";
 init_output_spool();
 init_util();
@@ -13418,7 +14252,7 @@ init_win32_resolve();
 
 // src/exec-kill-guard.ts
 import * as os7 from "node:os";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 var isWin3 = os7.platform() === "win32";
 async function checkExecKillCommand(cmd, args) {
   if (!cmd) return { blocked: false };
@@ -13631,7 +14465,7 @@ async function checkKillTarget(target) {
         reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
       };
     }
-    const currentImage = path24.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+    const currentImage = path25.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
     const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
     if (targetsNodeRuntime && currentImage === "node") {
       return {
@@ -14447,7 +15281,7 @@ var execTool = {
         command: cmd,
         args: input.args ?? [],
         stdout: "",
-        stderr: `Command "${cmd}" not in allowlist. Add it to your ~/.wrongstack/config.json under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
+        stderr: `Command "${cmd}" not in allowlist. Add it to your active profile config (~/.wrongstack/profiles/<name>/config.json) under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
         exitCode: 1,
         truncated: false,
         allowed: false,
@@ -14659,18 +15493,17 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
 }
 
 // src/fetch.ts
-import { FetchError as FetchError2, ToolError, ToolValidationError as ToolValidationError3 } from "@wrongstack/core";
+import { FetchError as FetchError2, ToolError, ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
 import TurndownService from "turndown";
 
 // src/_fetch-guard.ts
 import * as dns2 from "node:dns/promises";
 import * as net3 from "node:net";
 import {
-  FetchError,
-  ToolValidationError as ToolValidationError2,
   isPrivateIPv4 as isPrivateIPv42,
   isPrivateIPv6 as isPrivateIPv62
-} from "@wrongstack/core";
+} from "@wrongstack/core/utils";
+import { FetchError, ToolValidationError as ToolValidationError2 } from "@wrongstack/core/types";
 import { Agent, fetch as undiciFetch } from "undici";
 var nativeGlobalFetch = globalThis.fetch;
 var ALLOW_PRIVATE = process.env["WRONGSTACK_FETCH_ALLOW_PRIVATE"] === "1";
@@ -15168,7 +16001,8 @@ init_util();
 import { spawn as spawn9 } from "node:child_process";
 import { statSync as statSync3 } from "node:fs";
 import { dirname as dirname12, resolve as resolve11, sep as sep5 } from "node:path";
-import { assessCommitSafety, buildChildEnv as buildChildEnv4 } from "@wrongstack/core";
+import { assessCommitSafety } from "@wrongstack/core/coordination";
+import { buildChildEnv as buildChildEnv4 } from "@wrongstack/core/utils";
 var TIMEOUT_MS2 = 3e4;
 var MAX_OUTPUT3 = 1e5;
 var gitTool = {
@@ -15448,8 +16282,8 @@ function runGit2(args, cwd, signal) {
 
 // src/glob.ts
 import * as fs20 from "node:fs/promises";
-import * as path25 from "node:path";
-import { compileGlob as compileGlob3 } from "@wrongstack/core";
+import * as path26 from "node:path";
+import { compileGlob as compileGlob2, DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS2 } from "@wrongstack/core/utils";
 
 // src/_concurrency.ts
 async function mapWithConcurrency(items, limit, fn) {
@@ -15470,7 +16304,7 @@ async function mapWithConcurrency(items, limit, fn) {
 
 // src/glob.ts
 init_util();
-var DEFAULT_IGNORE2 = ["node_modules", ".git", "dist", "build", ".next", "coverage", ".turbo"];
+var DEFAULT_IGNORE2 = DEFAULT_WALK_IGNORE_DIRS2;
 var WALK_CONCURRENCY = 16;
 var globTool = {
   name: "glob",
@@ -15510,8 +16344,8 @@ var globTool = {
     const signal = opts?.signal;
     const base = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
     const limit = Math.max(1, Math.min(input.limit ?? 1e3, 5e3));
-    const ignored = await readGitignore(base);
-    const re = compileGlob3(input.pattern);
+    const isGitIgnored = await loadGitignoreMatcher(base);
+    const re = compileGlob2(input.pattern);
     const results = [];
     let truncated = false;
     const pushResult = async (full) => {
@@ -15550,12 +16384,13 @@ var globTool = {
       for (const e of entries) {
         const name = e.name;
         if (DEFAULT_IGNORE2.includes(name)) continue;
-        if (ignored.includes(name)) continue;
         const rel = relPrefix ? `${relPrefix}/${name}` : name;
-        const full = path25.join(dir, name);
+        const full = path26.join(dir, name);
         if (e.isDirectory()) {
+          if (isGitIgnored(rel, true)) continue;
           subdirs.push({ full, rel });
         } else if (e.isFile()) {
+          if (isGitIgnored(rel, false)) continue;
           re.lastIndex = 0;
           const relMatch = re.test(rel);
           re.lastIndex = 0;
@@ -15567,10 +16402,12 @@ var globTool = {
           try {
             const st = await fs20.stat(full);
             if (st.isDirectory()) {
+              if (isGitIgnored(rel, true)) continue;
               const real = await fs20.realpath(full);
               await assertRealInsideRoot(real, ctx);
               subdirs.push({ full, rel });
             } else if (st.isFile()) {
+              if (isGitIgnored(rel, false)) continue;
               const real = await fs20.realpath(full);
               await assertRealInsideRoot(real, ctx);
               re.lastIndex = 0;
@@ -15594,21 +16431,14 @@ var globTool = {
     return { files: results.map((r) => r.rel), truncated };
   }
 };
-async function readGitignore(dir) {
-  try {
-    const raw = await fs20.readFile(path25.join(dir, ".gitignore"), "utf8");
-    return raw.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
-  } catch {
-    return [];
-  }
-}
 
 // src/grep.ts
-import { expectDefined as expectDefined7 } from "@wrongstack/core";
+import { expectDefined as expectDefined7 } from "@wrongstack/core/utils";
 import { spawn as spawn10 } from "node:child_process";
 import * as fs21 from "node:fs/promises";
-import * as path26 from "node:path";
-import { buildChildEnv as buildChildEnv5, compileGlob as compileGlob4, ToolValidationError as ToolValidationError4 } from "@wrongstack/core";
+import * as path27 from "node:path";
+import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
+import { buildChildEnv as buildChildEnv5, compileGlob as compileGlob3, DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS3 } from "@wrongstack/core/utils";
 
 // src/_regex.ts
 var MAX_PATTERN_LEN = 256;
@@ -15657,7 +16487,7 @@ function capSubject(line) {
 
 // src/grep.ts
 init_util();
-var DEFAULT_IGNORE3 = ["node_modules", ".git", "dist", "build", ".next", "coverage"];
+var DEFAULT_IGNORE3 = DEFAULT_WALK_IGNORE_DIRS3;
 var NATIVE_SCAN_CONCURRENCY = 32;
 var NATIVE_READ_CHUNK_BYTES = 64 * 1024;
 var NATIVE_MAX_FILE_BYTES = 1e6;
@@ -15774,6 +16604,10 @@ async function* runRgStream(input, base, mode, limit, signal) {
   for (const ignored of DEFAULT_IGNORE3) {
     args.push("--glob", `!${ignored}/**`, "--glob", `!**/${ignored}/**`);
   }
+  const gitignorePath = path27.join(base, ".gitignore");
+  if (await fs21.access(gitignorePath).then(() => true, () => false)) {
+    args.push("--ignore-file", gitignorePath);
+  }
   if (input.glob) args.push("--glob", input.glob);
   args.push("--", input.pattern, base);
   const matches = [];
@@ -15898,7 +16732,8 @@ async function runNative(input, base, mode, limit, signal) {
     });
   }
   const re = compiled.regex;
-  const globRe = input.glob ? compileGlob4(input.glob) : null;
+  const globRe = input.glob ? compileGlob3(input.glob) : null;
+  const isGitIgnored = await loadGitignoreMatcher(base);
   const matches = [];
   const countOnlyFirstHit = mode === "count" && limit === 1;
   const maxBytes = mode === "content" ? NATIVE_MAX_FILE_BYTES : Math.min(NATIVE_MAX_FILE_BYTES, 256 * 1024);
@@ -15986,7 +16821,7 @@ async function runNative(input, base, mode, limit, signal) {
     } catch {
     }
   };
-  const walk2 = async (dir) => {
+  const walk2 = async (dir, relPrefix) => {
     if (stopped || signal.aborted) return;
     let entries;
     try {
@@ -16000,17 +16835,24 @@ async function runNative(input, base, mode, limit, signal) {
       if (stopped) return;
       if (DEFAULT_IGNORE3.includes(e.name)) continue;
       if (e.isSymbolicLink()) continue;
-      const full = path26.join(dir, e.name);
+      const rel = relPrefix ? `${relPrefix}/${e.name}` : e.name;
+      const full = path27.join(dir, e.name);
       if (e.isDirectory()) {
-        subdirs.push(full);
+        if (isGitIgnored(rel, true)) continue;
+        subdirs.push({ full, rel });
       } else if (e.isFile()) {
+        if (isGitIgnored(rel, false)) continue;
         files.push({ full, name: e.name });
       }
     }
     await mapWithConcurrency(files, NATIVE_SCAN_CONCURRENCY, ({ full, name }) => scanFile(full, name));
-    await mapWithConcurrency(subdirs, Math.min(16, NATIVE_SCAN_CONCURRENCY), walk2);
+    await mapWithConcurrency(
+      subdirs,
+      Math.min(16, NATIVE_SCAN_CONCURRENCY),
+      ({ full, rel }) => walk2(full, rel)
+    );
   };
-  await walk2(base);
+  await walk2(base, "");
   return {
     matches,
     count: total,
@@ -16024,7 +16866,10 @@ init_spawn_stream();
 init_util();
 init_legacy_bridge();
 import { join as join21 } from "node:path";
-import { detectPackageEcosystem, recordPackageAction } from "@wrongstack/core";
+import {
+  detectEcosystem as detectPackageEcosystem,
+  recordPackageAction
+} from "@wrongstack/core/coordination";
 var installTool = {
   name: "install",
   category: "Package Management",
@@ -16210,7 +17055,7 @@ function resolveManifestPath(cwd, pkgManager) {
 // src/json.ts
 init_util();
 import * as fs22 from "node:fs/promises";
-import { deepMerge as deepMergeCore } from "@wrongstack/core";
+import { deepMerge as deepMergeCore } from "@wrongstack/core/utils";
 var jsonTool = {
   name: "json",
   category: "Data",
@@ -16588,56 +17433,56 @@ function jmespathSearch(data, query) {
 }
 function validateJsonSchema(data, schema) {
   const errors = [];
-  function check(value, s, path34) {
+  function check(value, s, path35) {
     if (s["type"]) {
       const expectedType = s["type"];
       const actualType = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
       if (expectedType === "integer") {
-        if (!Number.isInteger(value)) errors.push(`${path34}: expected integer, got ${actualType}`);
+        if (!Number.isInteger(value)) errors.push(`${path35}: expected integer, got ${actualType}`);
       } else if (expectedType !== actualType) {
-        errors.push(`${path34}: expected ${expectedType}, got ${actualType}`);
+        errors.push(`${path35}: expected ${expectedType}, got ${actualType}`);
       }
     }
     if (typeof value === "string" && s["format"] === "uri" && value) {
       try {
         new URL(value);
       } catch {
-        errors.push(`${path34}: not a valid URI`);
+        errors.push(`${path35}: not a valid URI`);
       }
     }
     if (typeof value === "string" && s["pattern"]) {
       const re = new RegExp(s["pattern"]);
-      if (!re.test(value)) errors.push(`${path34}: does not match pattern ${s["pattern"]}`);
+      if (!re.test(value)) errors.push(`${path35}: does not match pattern ${s["pattern"]}`);
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
-      errors.push(`${path34}: string too short (min ${s["minLength"]})`);
+      errors.push(`${path35}: string too short (min ${s["minLength"]})`);
     }
     if (typeof value === "string" && s["maxLength"] !== void 0 && value.length > s["maxLength"]) {
-      errors.push(`${path34}: string too long (max ${s["maxLength"]})`);
+      errors.push(`${path35}: string too long (max ${s["maxLength"]})`);
     }
     if (typeof value === "number" && s["minimum"] !== void 0 && value < s["minimum"]) {
-      errors.push(`${path34}: below minimum ${s["minimum"]}`);
+      errors.push(`${path35}: below minimum ${s["minimum"]}`);
     }
     if (typeof value === "number" && s["maximum"] !== void 0 && value > s["maximum"]) {
-      errors.push(`${path34}: above maximum ${s["maximum"]}`);
+      errors.push(`${path35}: above maximum ${s["maximum"]}`);
     }
     if (Array.isArray(value) && s["items"] && Array.isArray(s["items"])) {
       for (let i = 0; i < value.length; i++) {
-        check(value[i], s["items"], `${path34}[${i}]`);
+        check(value[i], s["items"], `${path35}[${i}]`);
       }
     }
     if (typeof value === "object" && value !== null && !Array.isArray(value) && s["properties"]) {
       const props = s["properties"];
       for (const [k, propSchema] of Object.entries(props)) {
-        check(value[k], propSchema, `${path34}.${k}`);
+        check(value[k], propSchema, `${path35}.${k}`);
       }
     }
   }
   check(data, schema, "$");
   return { valid: errors.length === 0, errors };
 }
-function simpleQuery(data, path34) {
-  const parts = path34.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+function simpleQuery(data, path35) {
+  const parts = path35.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
   let current = data;
   for (const part of parts) {
     if (current === null || current === void 0) return void 0;
@@ -16688,7 +17533,8 @@ function toYaml(data, indent = 0) {
 
 // src/kanban.ts
 import { randomUUID } from "node:crypto";
-import { deserializeTaskGraph as deserializeTaskGraph2, loadTasks as loadTasks2, serializeTaskGraph } from "@wrongstack/core";
+import { deserializeTaskGraph as deserializeTaskGraph2, serializeTaskGraph } from "@wrongstack/core/tasking";
+import { loadTasks as loadTasks2 } from "@wrongstack/core/storage";
 import {
   addCheckToTask,
   addColumn,
@@ -16735,20 +17581,47 @@ import {
   updateColumn,
   updateGoalMetricOnTask,
   updateTask,
-  updateTaskAssignment
+  updateTaskAssignment,
+  verifyTaskCompletion,
+  finalizeTaskCompletion,
+  assessTaskAtomicity,
+  proposeTaskDecomposition
 } from "@wrongstack/kanban";
 
+// src/kanban-evidence-bridge.ts
+import { recordCompletedWorkEvidence } from "@wrongstack/core/utils";
+function kanbanEvidenceKey(boardId, taskId) {
+  return `kanban:${boardId}:${taskId}`;
+}
+function kanbanEvidencePointer(boardId, taskId) {
+  return `kanban://${boardId}/${taskId}#verificationReport`;
+}
+function recordKanbanVerificationEvidence(ctx, report) {
+  try {
+    const passed = report.checks.filter((check) => check.status === "passed").length;
+    const completedAt = Date.parse(report.completedAt);
+    recordCompletedWorkEvidence(ctx, {
+      key: kanbanEvidenceKey(report.boardId, report.taskId),
+      source: "verification",
+      summary: `${report.taskTitle} \u2014 verification ${report.verdict} (${passed}/${report.checks.length} checks)`,
+      ...Number.isFinite(completedAt) ? { completedAt } : {},
+      evidence: kanbanEvidencePointer(report.boardId, report.taskId)
+    });
+  } catch {
+  }
+}
+
 // src/session-kanban.ts
 import { watch } from "node:fs";
-import { basename as basename10, dirname as dirname13 } from "node:path";
+import { basename as basename11, dirname as dirname13 } from "node:path";
+import { GlobalMailbox } from "@wrongstack/core/coordination";
 import {
-  deserializeTaskGraph,
-  GlobalMailbox,
   loadPlan,
   loadTasks,
   mutatePlan,
   mutateTasks
-} from "@wrongstack/core";
+} from "@wrongstack/core/storage";
+import { deserializeTaskGraph } from "@wrongstack/core/tasking";
 import { resolveWstackPaths as resolveWstackPaths3 } from "@wrongstack/core/utils";
 import {
   createBoard,
@@ -17062,8 +17935,10 @@ function projectSessionPlanToKanban(projectRoot, items, sessionId) {
     "session-plan"
   );
 }
-function fireAndForget(work) {
-  void work.catch(() => {
+function fireAndForget(context, work) {
+  void work.catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    console.warn(JSON.stringify({ level: "warn", event: "session-kanban", context, message, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
   });
 }
 function broadcastTodoUpdate(context, todos) {
@@ -17137,7 +18012,10 @@ function attachSessionKanbanMirror(context) {
     if (currentSessionId === registeredSessionId) return;
     if (registeredSessionId) {
       releaseActiveSessionBoard(attachedProjectRoot, registeredSessionId);
-      fireAndForget(cleanupSessionKanbanBoardIfEmpty(attachedProjectRoot, registeredSessionId));
+      fireAndForget(
+        "cleanup-board",
+        cleanupSessionKanbanBoardIfEmpty(attachedProjectRoot, registeredSessionId)
+      );
     }
     registeredSessionId = currentSessionId;
     if (registeredSessionId) {
@@ -17187,7 +18065,7 @@ function attachSessionKanbanMirror(context) {
         (_event, filename) => {
           if (filename?.toString() !== boardFileName) return;
           if (boardTimer) clearTimeout(boardTimer);
-          boardTimer = setTimeout(() => fireAndForget(refreshBoard()), 60);
+          boardTimer = setTimeout(() => fireAndForget("refresh-board", refreshBoard()), 60);
         }
       );
       const touchPresence = () => touchKanbanPresence(context.projectRoot, board.id, {
@@ -17195,9 +18073,9 @@ function attachSessionKanbanMirror(context) {
         agentId: context.agentId,
         agentName: context.agentName
       });
-      fireAndForget(touchPresence());
+      fireAndForget("touch-presence", touchPresence());
       if (presenceTimer) clearInterval(presenceTimer);
-      presenceTimer = setInterval(() => fireAndForget(touchPresence()), 6e4);
+      presenceTimer = setInterval(() => fireAndForget("touch-presence", touchPresence()), 6e4);
       presenceTimer.unref?.();
       boardWatcher.on("error", () => {
         boardWatcher?.close();
@@ -17222,11 +18100,11 @@ function attachSessionKanbanMirror(context) {
         const name = filename?.toString();
         const currentPlanPath = context.meta["plan.path"];
         const currentTaskPath = context.meta["task.path"];
-        const planName = typeof currentPlanPath === "string" ? basename10(currentPlanPath) : "";
-        const taskName = typeof currentTaskPath === "string" ? basename10(currentTaskPath) : "";
+        const planName = typeof currentPlanPath === "string" ? basename11(currentPlanPath) : "";
+        const taskName = typeof currentTaskPath === "string" ? basename11(currentTaskPath) : "";
         if (name && name !== planName && name !== taskName) return;
         if (timer) clearTimeout(timer);
-        timer = setTimeout(() => fireAndForget(refreshFiles()), 60);
+        timer = setTimeout(() => fireAndForget("refresh-files", refreshFiles()), 60);
       });
       watcher.on("error", () => watcher?.close());
     } catch {
@@ -17246,13 +18124,13 @@ function attachSessionKanbanMirror(context) {
     if (change.kind === "meta_set" && (change.key === "plan.path" || change.key === "task.path")) {
       syncActiveSessionRegistration();
       configureWatcher();
-      fireAndForget(ensureSessionKanbanBoard(context.projectRoot, sessionId()));
-      fireAndForget(configureBoardWatcher());
-      fireAndForget(refreshFiles());
+      fireAndForget("ensure-board", ensureSessionKanbanBoard(context.projectRoot, sessionId()));
+      fireAndForget("configure-watcher", configureBoardWatcher());
+      fireAndForget("refresh-files", refreshFiles());
     }
   });
   configureWatcher();
-  fireAndForget(configureBoardWatcher());
+  fireAndForget("configure-watcher", configureBoardWatcher());
   const detach = () => {
     unsubscribe();
     if (timer) clearTimeout(timer);
@@ -17263,7 +18141,10 @@ function attachSessionKanbanMirror(context) {
     bindings.delete(context);
     if (attachedProjectRoot && registeredSessionId) {
       releaseActiveSessionBoard(attachedProjectRoot, registeredSessionId);
-      fireAndForget(cleanupSessionKanbanBoardIfEmpty(attachedProjectRoot, registeredSessionId));
+      fireAndForget(
+        "cleanup-board",
+        cleanupSessionKanbanBoardIfEmpty(attachedProjectRoot, registeredSessionId)
+      );
       registeredSessionId = "";
     }
   };
@@ -17406,8 +18287,8 @@ async function applySessionKanbanTaskToSource(context, task, options = {}) {
 var kanbanTool = {
   name: "kanban",
   category: "Project",
-  description: "Manage and audit project-scoped multi-kanban boards stored under .wrongstack/kanbans. Managed cards enforce fully specified details and adjacent Backlog \u2192 Todo \u2192 Running \u2192 Review \u2192 Done transitions with persistent comments and evidence. Successful board access records live agent/session presence.",
-  usageHint: "Use this for durable project kanban state. Reassess with get_board whenever evidence changes; agents may add, update, split, merge, reprioritize, or remove tasks so the board remains a live plan. Presence includes active/last-seen session and agent metadata. For managed boards, fully fill card details, use transition_task after every material step, attach truthful evidence, and never use update_task/move_task to bypass lifecycle guards. Worker completion enters Review; only passed acceptance criteria plus review evidence allow Done.",
+  description: "Manage and audit project-scoped multi-kanban boards stored under .wrongstack/kanbans. Managed cards enforce fully specified details and adjacent Backlog \u2192 Todo \u2192 Running \u2192 Review \u2192 Done transitions with persistent comments and evidence. Successful board access records live agent/session presence. Use verify_completion to validate a task against its success criteria and persist the verification report. Use split_atomic to split a task into child tasks with parent.atomic=true in a single atomic board mutation, enforcing subtree verification before the parent can complete.",
+  usageHint: "Use this for durable project kanban state. Reassess with get_board whenever evidence changes; agents may add, update, split, merge, reprioritize, or remove tasks so the board remains a live plan. Presence includes active/last-seen session and agent metadata. For managed boards, fully fill card details, use transition_task after every material step, attach truthful evidence, and never use update_task/move_task to bypass lifecycle guards. Worker completion enters Review; only passed acceptance criteria plus review evidence allow Done. Use verify_completion to generate a verification report (persisted automatically) and split_atomic to atomically create child subtasks with the atomic flag pre-set.",
   permission: "confirm",
   mutating: true,
   capabilities: ["fs.write"],
@@ -17463,7 +18344,11 @@ var kanbanTool = {
           "add_check",
           "update_check",
           "add_note",
-          "add_link"
+          "add_link",
+          "verify_completion",
+          "split_atomic",
+          "assess_atomicity",
+          "propose_decomposition"
         ]
       },
       boardId: { type: "string" },
@@ -17518,6 +18403,7 @@ var kanbanTool = {
       runTaskId: { type: "string" },
       lastResult: { type: "string" },
       error: { type: "string" },
+      expectedLeaseId: { type: "string" },
       assignmentStatus: {
         type: "string",
         enum: ["assigned", "queued", "running", "completed", "failed", "cancelled"]
@@ -17552,6 +18438,7 @@ var kanbanTool = {
       lastFailureKind: { type: "string" },
       dependsOn: { type: "array", items: { type: "string" } },
       estimatedHours: { type: "number" },
+      actualHours: { type: "number" },
       taskGraph: { type: "object" },
       graphId: { type: "string" },
       specId: { type: "string" },
@@ -17597,7 +18484,24 @@ var kanbanTool = {
       includeCompletedTasks: { type: "boolean" },
       preserveAssignment: { type: "boolean" },
       preserveDependencies: { type: "boolean" },
-      moveTasksToColumnId: { type: "string" }
+      moveTasksToColumnId: { type: "string" },
+      atomicityMode: { type: "string", enum: ["off", "assess", "enforce"] },
+      atomicityDecomposition: { type: "string", enum: ["auto", "propose"] },
+      gateEnforcement: { type: "string", enum: ["strict", "soft", "off"] },
+      subtasks: {
+        type: "array",
+        minItems: 2,
+        items: {
+          type: "object",
+          properties: {
+            title: { type: "string" },
+            description: { type: "string" },
+            successCriteria: { type: "array", items: { type: "string" } },
+            dependsOnIndex: { type: "array", items: { type: "number" } }
+          },
+          required: ["title"]
+        }
+      }
     },
     required: ["action"]
   },
@@ -17637,7 +18541,14 @@ var kanbanTool = {
               title: input.title,
               ...input.description !== void 0 ? { description: input.description } : {},
               ...input.tags !== void 0 ? { tags: input.tags } : {},
-              ...input.generatedBy !== void 0 ? { generatedBy: input.generatedBy } : {}
+              ...input.generatedBy !== void 0 ? { generatedBy: input.generatedBy } : {},
+              ...input.atomicityMode !== void 0 ? {
+                atomicity: {
+                  mode: input.atomicityMode,
+                  decomposition: input.atomicityDecomposition ?? "propose"
+                }
+              } : {},
+              ...input.gateEnforcement !== void 0 ? { completionGate: { enforcement: input.gateEnforcement } } : {}
             });
             return { ok: true, message: `Board created: ${board.title}`, board };
           }
@@ -17646,7 +18557,14 @@ var kanbanTool = {
             const board = await updateBoard2(projectRoot, input.boardId, {
               ...input.title !== void 0 ? { title: input.title } : {},
               ...input.description !== void 0 ? { description: input.description } : {},
-              ...input.tags !== void 0 ? { tags: input.tags } : {}
+              ...input.tags !== void 0 ? { tags: input.tags } : {},
+              ...input.atomicityMode !== void 0 ? {
+                atomicity: {
+                  mode: input.atomicityMode,
+                  decomposition: input.atomicityDecomposition ?? "propose"
+                }
+              } : {},
+              ...input.gateEnforcement !== void 0 ? { completionGate: { enforcement: input.gateEnforcement } } : {}
             });
             return board ? okBoard(board, "Board updated.") : fail("Board not found.");
           }
@@ -17854,30 +18772,18 @@ var kanbanTool = {
           case "add_task": {
             if (!input.boardId || !input.title) return fail("add_task requires boardId and title.");
             const result2 = await addTask(projectRoot, input.boardId, taskInput(input));
-            return result2 ? okTask(result2.board, result2.task, "Task added.") : fail("Board not found.");
+            if (!result2) return fail("Board not found.");
+            return okTask(
+              result2.board,
+              result2.task,
+              `Task added.${atomicityNudge(result2.task)}`
+            );
           }
           case "split_task": {
             if (!input.boardId || !input.taskId || !input.childTitles?.length) {
               return fail("split_task requires boardId, taskId, and childTitles.");
             }
-            const result2 = await splitTask(projectRoot, input.boardId, input.taskId, {
-              titles: input.childTitles,
-              ...input.targetColumnId !== void 0 ? { columnId: input.targetColumnId } : {},
-              ...input.inheritAssignment !== void 0 ? { inheritAssignment: input.inheritAssignment } : {},
-              ...input.inheritLabels !== void 0 ? { inheritLabels: input.inheritLabels } : {},
-              ...input.inheritSuccessCriteria !== void 0 ? { inheritSuccessCriteria: input.inheritSuccessCriteria } : {},
-              ...input.inheritGoalMetrics !== void 0 ? { inheritGoalMetrics: input.inheritGoalMetrics } : {},
-              ...input.inheritDependencies !== void 0 ? { inheritDependencies: input.inheritDependencies } : {},
-              ...input.chainChildren !== void 0 ? { chainChildren: input.chainChildren } : {},
-              ...input.rewireDependents !== void 0 ? { rewireDependents: input.rewireDependents } : {}
-            });
-            return result2 ? {
-              ok: true,
-              message: `${result2.children.length} child task(s) created.`,
-              board: result2.board,
-              task: result2.parent,
-              children: result2.children
-            } : fail("Task not found.");
+            return handleSplitTask(projectRoot, input, {});
           }
           case "merge_tasks": {
             if (!input.boardId || !input.taskIds?.length || !input.title) {
@@ -17951,6 +18857,19 @@ var kanbanTool = {
                 "transition_task requires boardId, taskId, lifecycleStage, author, and transitionComment."
               );
             }
+            if (input.lifecycleStage === "done") {
+              const boardBefore = await getBoard2(projectRoot, input.boardId);
+              const taskBefore = boardBefore ? await getTask(projectRoot, input.boardId, input.taskId) : null;
+              if (boardBefore && taskBefore && !taskBefore.verificationReport && (taskBefore.atomic || Boolean(taskBefore.successCriteria?.length))) {
+                const preGate = await verifyTaskCompletion(projectRoot, input.boardId, taskBefore.id, {
+                  persist: false
+                });
+                await updateTask(projectRoot, input.boardId, taskBefore.id, {
+                  verificationReport: preGate.report,
+                  successCriteria: preGate.task.successCriteria
+                });
+              }
+            }
             const result2 = await transitionTask(projectRoot, input.boardId, input.taskId, {
               to: input.lifecycleStage,
               actor: input.author,
@@ -17965,6 +18884,9 @@ var kanbanTool = {
               } : {},
               patch: taskPatch(input)
             });
+            if (result2 && input.lifecycleStage === "done" && result2.task.verificationReport) {
+              recordKanbanVerificationEvidence(ctx, result2.task.verificationReport);
+            }
             return result2 ? okTask(result2.board, result2.task, `Task advanced to ${result2.transition.to}.`) : fail("Board or task not found.");
           }
           case "move_task": {
@@ -18078,7 +19000,31 @@ var kanbanTool = {
               // is atomic inside updateTaskAssignment's mutateBoard lock.
               input.expectedLeaseId !== void 0 ? { expectedLeaseId: input.expectedLeaseId } : {}
             );
-            return board ? okBoard(board, "Assignment updated.") : fail("Task not found.");
+            if (!board) return fail("Task not found.");
+            if (assignmentStatus === "completed") {
+              const envGate = readEnvGateEnforcement();
+              const finalized = await finalizeTaskCompletion(projectRoot, board.id, input.taskId, {
+                ...board.completionGate === void 0 && envGate !== void 0 ? { enforcement: envGate } : {},
+                ...ctx.agentId !== void 0 ? { eventContext: { actor: ctx.agentId } } : {}
+              });
+              if (finalized) {
+                if (finalized.gate.report) {
+                  recordKanbanVerificationEvidence(ctx, finalized.gate.report);
+                }
+                const gateSummary = {
+                  enforcement: finalized.gate.enforcement,
+                  allowed: finalized.gate.allowed,
+                  verdict: finalized.gate.verdict,
+                  issues: finalized.gate.issues.map((issue) => issue.message)
+                };
+                const gateMessage = finalized.gate.allowed ? `Completion gate ${finalized.gate.verdict === "skipped" ? "skipped" : "passed"}; task completed.` : finalized.gate.enforcement === "strict" ? `Completion gate BLOCKED (verdict: ${finalized.gate.verdict}); task parked in review. Issues: ${gateSummary.issues.join(" | ")}` : `Completion gate failed softly (verdict: ${finalized.gate.verdict}); task completed with warnings. Issues: ${gateSummary.issues.join(" | ")}`;
+                return {
+                  ...okTask(finalized.board, finalized.task, `Assignment updated. ${gateMessage}`),
+                  gate: gateSummary
+                };
+              }
+            }
+            return okBoard(board, "Assignment updated.");
           }
           case "heartbeat_assignment": {
             if (!input.boardId || !input.taskId) {
@@ -18242,6 +19188,83 @@ var kanbanTool = {
             });
             return board ? okBoard(board, "Link added.") : fail("Task not found.");
           }
+          case "assess_atomicity": {
+            if (!input.boardId || !input.taskId) {
+              return fail("assess_atomicity requires boardId and taskId.");
+            }
+            const result2 = await assessTaskAtomicity(projectRoot, input.boardId, input.taskId, {
+              assessedBy: "agent",
+              ...ctx.agentId !== void 0 ? { eventContext: { actor: ctx.agentId } } : {}
+            });
+            if (!result2) return fail("Task not found.");
+            const failing = result2.assessment.criteria.filter((entry) => entry.score < 1).map((entry) => entry.reason);
+            const guidance = result2.assessment.verdict === "needs_decomposition" ? ` This task should be split before dispatch \u2014 call propose_decomposition with 2+ subtasks (each with one verifiable success criterion). Reasons: ${failing.join(" | ")}` : result2.assessment.verdict === "composite" ? " Container task: work happens in its children; it is verified via subtask aggregation." : "";
+            return okTask(
+              result2.board,
+              result2.task,
+              `Atomicity verdict: ${result2.assessment.verdict} (score ${result2.assessment.score}).${guidance}`
+            );
+          }
+          case "propose_decomposition": {
+            if (!input.boardId || !input.taskId || !input.subtasks?.length) {
+              return fail("propose_decomposition requires boardId, taskId, and subtasks (2+).");
+            }
+            if (input.subtasks.length < 2) {
+              return fail("propose_decomposition requires at least two subtasks.");
+            }
+            const invalid = input.subtasks.find(
+              (subtask) => typeof subtask?.title !== "string" || !subtask.title.trim()
+            );
+            if (invalid) return fail("Every proposed subtask needs a non-blank title.");
+            const result2 = await proposeTaskDecomposition(
+              projectRoot,
+              input.boardId,
+              input.taskId,
+              {
+                subtasks: input.subtasks,
+                ...input.note !== void 0 ? { rationale: input.note } : {},
+                ...ctx.agentId !== void 0 ? { proposedBy: ctx.agentId } : {}
+              },
+              ctx.agentId !== void 0 ? { actor: ctx.agentId } : {}
+            );
+            if (!result2) return fail("Task not found.");
+            const message = result2.proposal.status === "applied" ? `Decomposition applied: ${result2.proposal.appliedChildTaskIds?.length ?? 0} child tasks created (parent marked atomic).` : 'Decomposition proposal recorded \u2014 awaiting approval (board policy is "propose"). It can be approved from the WebUI or via update_task.';
+            return okTask(result2.board, result2.task, message);
+          }
+          case "verify_completion": {
+            if (!input.boardId || !input.taskId) {
+              return fail("verify_completion requires boardId and taskId.");
+            }
+            const verResult = await verifyTaskCompletion(projectRoot, input.boardId, input.taskId);
+            const persistedBoard = await updateTask(projectRoot, input.boardId, input.taskId, {
+              verificationReport: verResult.report,
+              successCriteria: verResult.task.successCriteria
+            });
+            if (!persistedBoard) {
+              return {
+                ok: false,
+                verdict: verResult.report.verdict,
+                message: `Verification succeeded but persist failed: ${verResult.report.markdownSummary}. Board may be stale \u2014 re-run verify_completion.`,
+                board: verResult.board
+              };
+            }
+            recordKanbanVerificationEvidence(ctx, verResult.report);
+            const freshTask = persistedBoard.tasks?.find((t) => t.id === input.taskId);
+            const deterministicVerdicts = ["passed", "failed", "needs_human", "incomplete"];
+            return {
+              ok: deterministicVerdicts.includes(verResult.report.verdict),
+              verdict: verResult.report.verdict,
+              message: verResult.report.markdownSummary,
+              board: persistedBoard,
+              task: freshTask ?? verResult.task
+            };
+          }
+          case "split_atomic": {
+            if (!input.boardId || !input.taskId || !input.childTitles?.length) {
+              return fail("split_atomic requires boardId, taskId, and childTitles (at least one).");
+            }
+            return handleSplitTask(projectRoot, input, { atomic: true });
+          }
           default:
             return fail(`Unknown kanban action: ${input.action}`);
         }
@@ -18252,6 +19275,15 @@ var kanbanTool = {
     }
   }
 };
+function atomicityNudge(task) {
+  if (task.atomicityAssessment?.verdict !== "needs_decomposition") return "";
+  const reasons = task.atomicityAssessment.criteria.filter((entry) => entry.score < 1).map((entry) => entry.reason).join(" | ");
+  return ` Atomicity: needs_decomposition (score ${task.atomicityAssessment.score}) \u2014 call propose_decomposition with 2+ subtasks before dispatch. Reasons: ${reasons}`;
+}
+function readEnvGateEnforcement() {
+  const raw = process.env["WRONGSTACK_KANBAN_GATE"]?.trim().toLowerCase();
+  return raw === "strict" || raw === "soft" || raw === "off" ? raw : void 0;
+}
 function fail(message) {
   return { ok: false, message };
 }
@@ -18261,6 +19293,50 @@ function okBoard(board, message = "Board loaded.") {
 function okTask(board, task, message) {
   return { ok: true, message, board, task };
 }
+async function handleSplitTask(projectRoot, input, extraSplitOptions) {
+  const boardId = input.boardId;
+  const taskId = input.taskId;
+  const childTitles = input.childTitles;
+  if (!boardId || !taskId || !childTitles?.length) {
+    return fail("split requires boardId, taskId, and at least one childTitles.");
+  }
+  const {
+    targetColumnId,
+    inheritAssignment,
+    inheritLabels,
+    inheritSuccessCriteria,
+    inheritGoalMetrics,
+    inheritDependencies,
+    chainChildren,
+    rewireDependents
+  } = input;
+  const result = await splitTask(projectRoot, boardId, taskId, {
+    titles: childTitles,
+    ...extraSplitOptions,
+    ...targetColumnId !== void 0 ? { columnId: targetColumnId } : {},
+    ...inheritAssignment !== void 0 ? { inheritAssignment } : {},
+    ...inheritLabels !== void 0 ? { inheritLabels } : {},
+    ...inheritSuccessCriteria !== void 0 ? { inheritSuccessCriteria } : {},
+    ...inheritGoalMetrics !== void 0 ? { inheritGoalMetrics } : {},
+    ...inheritDependencies !== void 0 ? { inheritDependencies } : {},
+    ...chainChildren !== void 0 ? { chainChildren } : {},
+    ...rewireDependents !== void 0 ? { rewireDependents } : {}
+  });
+  if (!result) return fail("Task not found.");
+  const freshParent = result.board.tasks?.find((t) => t.id === taskId);
+  if (!freshParent) {
+    return fail(
+      `Split succeeded but parent ${taskId} not found in returned board. Children: [${result.children.map((c) => c.id).join(", ")}].`
+    );
+  }
+  return {
+    ok: true,
+    message: `${result.children.length} child task(s) created.`,
+    board: result.board,
+    task: freshParent,
+    children: result.children
+  };
+}
 async function requireBoard(projectRoot, boardId) {
   return boardId ? getBoard2(projectRoot, boardId) : null;
 }
@@ -18362,7 +19438,8 @@ function taskPatch(input) {
     labels: input.labels,
     assignedAgent: input.agentId,
     ...mergedDependsOn(input) ? { dependsOn: mergedDependsOn(input) } : {},
-    ...input.estimatedHours !== void 0 ? { estimatedHours: input.estimatedHours } : {}
+    ...input.estimatedHours !== void 0 ? { estimatedHours: input.estimatedHours } : {},
+    ...input.actualHours !== void 0 ? { actualHours: input.actualHours } : {}
   };
 }
 function assignmentInput(input) {
@@ -18544,7 +19621,7 @@ async function detectLinter(cwd) {
 
 // src/logs.ts
 import { spawn as spawn11 } from "node:child_process";
-import { buildChildEnv as buildChildEnv6 } from "@wrongstack/core";
+import { buildChildEnv as buildChildEnv6 } from "@wrongstack/core/utils";
 init_util();
 var logsTool = {
   name: "logs",
@@ -18683,7 +19760,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
 }
 var DOCKER_LOGS_TIMEOUT_MS = 3e3;
 var MAX_TAIL_LINES = 1e5;
-async function fileLogs(path34, lines, filterRe, stream) {
+async function fileLogs(path35, lines, filterRe, stream) {
   const { createInterface } = await import("node:readline");
   const { createReadStream: createReadStream2 } = await import("node:fs");
   const entries = [];
@@ -18692,7 +19769,7 @@ async function fileLogs(path34, lines, filterRe, stream) {
   let writeIdx = 0;
   let totalLines = 0;
   const rl = createInterface({
-    input: createReadStream2(path34),
+    input: createReadStream2(path35),
     crlfDelay: Number.POSITIVE_INFINITY
   });
   for await (const line of rl) {
@@ -18713,7 +19790,7 @@ async function fileLogs(path34, lines, filterRe, stream) {
     if (parsed) entries.push(parsed);
   }
   return {
-    source: path34,
+    source: path35,
     entries,
     total: entries.length,
     truncated: totalLines > effLines,
@@ -18760,7 +19837,7 @@ function parseLine(line) {
 init_util();
 init_win32_resolve();
 import { spawn as spawn12 } from "node:child_process";
-import { buildChildEnv as buildChildEnv7 } from "@wrongstack/core";
+import { buildChildEnv as buildChildEnv7 } from "@wrongstack/core/utils";
 var outdatedTool = {
   name: "outdated",
   category: "Package Management",
@@ -18945,8 +20022,8 @@ init_util();
 import { spawn as spawn13 } from "node:child_process";
 import * as fs23 from "node:fs/promises";
 import * as os8 from "node:os";
-import * as path27 from "node:path";
-import { buildChildEnv as buildChildEnv8 } from "@wrongstack/core";
+import * as path28 from "node:path";
+import { buildChildEnv as buildChildEnv8 } from "@wrongstack/core/utils";
 var patchTool = {
   name: "patch",
   category: "Filesystem",
@@ -18981,9 +20058,9 @@ var patchTool = {
     for (const t of targets) {
       const stripped = stripPathComponents(t, strip);
       if (!stripped) continue;
-      const candidate = path27.resolve(dir, stripped);
-      const rel = path27.relative(ctx.projectRoot, candidate);
-      if (rel.startsWith("..") || path27.isAbsolute(rel)) {
+      const candidate = path28.resolve(dir, stripped);
+      const rel = path28.relative(ctx.projectRoot, candidate);
+      if (rel.startsWith("..") || path28.isAbsolute(rel)) {
         return {
           applied: 0,
           rejected: 1,
@@ -19000,11 +20077,11 @@ var patchTool = {
         beforeContents.set(target, await readTextForTracking(target));
       }
     }
-    const tmpDir = await fs23.mkdtemp(path27.join(os8.tmpdir(), ".wstack_patch_"));
+    const tmpDir = await fs23.mkdtemp(path28.join(os8.tmpdir(), ".wstack_patch_"));
     try {
       await fs23.chmod(tmpDir, 448).catch(() => {
       });
-      const patchFile = path27.join(tmpDir, "in.diff");
+      const patchFile = path28.join(tmpDir, "in.diff");
       await fs23.writeFile(patchFile, input.patch, { mode: 384 });
       const args = [`-p${strip}`, "--merge", ...dryRun ? ["--dry-run"] : [], "-i", patchFile];
       const result = await runPatch(args, dir, opts.signal);
@@ -19110,11 +20187,11 @@ import {
   mutatePlan as mutatePlan2,
   removePlanItem,
   setPlanItemStatus
-} from "@wrongstack/core";
+} from "@wrongstack/core/storage";
 import {
-  mutateTasks as mutateTasks2,
-  formatTaskList
-} from "@wrongstack/core";
+  mutateTasks as mutateTasks2
+} from "@wrongstack/core/storage";
+import { formatTaskList } from "@wrongstack/core/utils";
 import { randomUUID as randomUUID2 } from "node:crypto";
 var planTool = {
   name: "plan",
@@ -19381,7 +20458,8 @@ function mkResult(plan, ok, message, todos) {
 // src/read.ts
 init_util();
 import * as fs24 from "node:fs/promises";
-import { FsError, toErrorMessage as toErrorMessage4, ToolValidationError as ToolValidationError5 } from "@wrongstack/core";
+import { FsError, ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
 var MAX_BYTES2 = 5 * 1024 * 1024;
 var readTool = {
   name: "read",
@@ -19587,20 +20665,20 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 }
 
 // src/replace.ts
-import { expectDefined as expectDefined8 } from "@wrongstack/core";
+import { expectDefined as expectDefined8 } from "@wrongstack/core/utils";
 import { spawn as spawn14 } from "node:child_process";
 import * as fs25 from "node:fs/promises";
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 import {
   atomicWrite as atomicWrite3,
   buildChildEnv as buildChildEnv9,
-  compileGlob as compileGlob5,
+  compileGlob as compileGlob4,
   detectNewlineStyle as detectNewlineStyle2,
   normalizeToLf as normalizeToLf2,
   toStyle as toStyle2,
-  ToolValidationError as ToolValidationError6,
   unifiedDiff as unifiedDiff2
-} from "@wrongstack/core";
+} from "@wrongstack/core/utils";
+import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
 init_util();
 var DEFAULT_IGNORE4 = ["node_modules", ".git", "dist", "build", ".next", "coverage"];
 var replaceTool = {
@@ -19659,7 +20737,7 @@ var replaceTool = {
       });
     }
     const re = compiled.regex;
-    const globRe = input.glob ? compileGlob5(input.glob) : null;
+    const globRe = input.glob ? compileGlob4(input.glob) : null;
     const dryRun = input.dry_run ?? true;
     const filesInput = Array.isArray(input.files) ? input.files.join(",") : input.files;
     const fileList = await resolveFiles2(filesInput, ctx, globRe);
@@ -19679,8 +20757,8 @@ var replaceTool = {
       } catch {
         continue;
       }
-      const rel = path28.relative(realRoot, realPath);
-      if (rel.startsWith("..") || path28.isAbsolute(rel)) continue;
+      const rel = path29.relative(realRoot, realPath);
+      if (rel.startsWith("..") || path29.isAbsolute(rel)) continue;
       const stat18 = await fs25.stat(realPath).catch(() => null);
       if (!stat18?.isFile()) continue;
       let content;
@@ -19799,7 +20877,7 @@ function spawnRgFind(pattern, base) {
 }
 async function globNative(pattern, base, extraGlob) {
   const results = [];
-  const globRe = compileGlob5(pattern);
+  const globRe = compileGlob4(pattern);
   const walk2 = async (dir) => {
     let entries;
     try {
@@ -19809,7 +20887,7 @@ async function globNative(pattern, base, extraGlob) {
     }
     for (const e of entries) {
       if (DEFAULT_IGNORE4.includes(e.name)) continue;
-      const full = path28.join(dir, e.name);
+      const full = path29.join(dir, e.name);
       try {
         const stat18 = await fs25.lstat(full);
         if (stat18.isSymbolicLink()) continue;
@@ -19836,8 +20914,8 @@ async function globNative(pattern, base, extraGlob) {
 // src/scaffold.ts
 init_util();
 import * as fs26 from "node:fs/promises";
-import * as path29 from "node:path";
-import { atomicWrite as atomicWrite4 } from "@wrongstack/core";
+import * as path30 from "node:path";
+import { atomicWrite as atomicWrite4 } from "@wrongstack/core/utils";
 var BUILT_IN_TEMPLATES = {
   "npm-package": {
     description: "Basic npm package with ESM",
@@ -19986,16 +21064,16 @@ async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
   let filesCreated = 0;
   for (const [filePath, content] of Object.entries(templateFiles)) {
     const resolvedPath = substituteVars(filePath, name, vars);
-    const joinedPath = path29.join(cwd, resolvedPath);
-    const root = path29.resolve(ctx.projectRoot);
-    const target = path29.resolve(joinedPath);
-    const rel = path29.relative(root, target);
-    if (rel.startsWith("..") || path29.isAbsolute(rel)) {
+    const joinedPath = path30.join(cwd, resolvedPath);
+    const root = path30.resolve(ctx.projectRoot);
+    const target = path30.resolve(joinedPath);
+    const rel = path30.relative(root, target);
+    if (rel.startsWith("..") || path30.isAbsolute(rel)) {
       throw new Error(`scaffold: generated path "${resolvedPath}" would escape project root`);
     }
     const fullPath = target;
     if (!dryRun) {
-      await fs26.mkdir(path29.dirname(fullPath), { recursive: true });
+      await fs26.mkdir(path30.dirname(fullPath), { recursive: true });
       await atomicWrite4(fullPath, substituteVars(content, name, vars));
     }
     files.push(resolvedPath);
@@ -20024,7 +21102,8 @@ function substituteVars(content, name, vars) {
 }
 
 // src/search.ts
-import { expectDefined as expectDefined9, FetchError as FetchError3, ToolValidationError as ToolValidationError7 } from "@wrongstack/core";
+import { FetchError as FetchError3, ToolValidationError as ToolValidationError7 } from "@wrongstack/core/types";
+import { expectDefined as expectDefined9 } from "@wrongstack/core/utils";
 import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 var DEFAULT_NUM = 10;
 var MAX_RESULTS = 50;
@@ -20474,15 +21553,13 @@ var setWorkingDirTool = {
 import {
   computeTaskItemProgress,
   formatTaskList as formatTaskList2
-} from "@wrongstack/core";
-import {
-  mutateTasks as mutateTasks3
-} from "@wrongstack/core";
+} from "@wrongstack/core/utils";
+import { mutateTasks as mutateTasks3 } from "@wrongstack/core/storage";
 import {
   addPlanItem as addPlanItem2,
   mutatePlan as mutatePlan3,
   formatPlan as formatPlan2
-} from "@wrongstack/core";
+} from "@wrongstack/core/storage";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function findTaskIndex(tasks, query) {
   const asNum = Number.parseInt(query, 10);
@@ -20852,7 +21929,7 @@ ${formatTaskList2(file.tasks)}` : file.tasks.length > 0 ? formatTaskList2(file.t
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 var testTool = {
   name: "test",
   category: "Code Quality",
@@ -20959,7 +22036,7 @@ async function detectRunner(cwd) {
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat18(path30.join(cwd, f));
+      await stat18(path31.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -21036,7 +22113,7 @@ function parseResult(runner, result, duration) {
 }
 
 // src/todo.ts
-import { loadPlan as loadPlan2, loadTasks as loadTasks3, savePlan, saveTasks, setPlanItemStatus as setPlanItemStatus2 } from "@wrongstack/core";
+import { loadPlan as loadPlan2, loadTasks as loadTasks3, savePlan, saveTasks, setPlanItemStatus as setPlanItemStatus2 } from "@wrongstack/core/storage";
 var todoTool = {
   name: "todo",
   category: "Session",
@@ -21428,22 +22505,10 @@ var toolUseTool = {
 
 // src/tree.ts
 init_util();
-import { expectDefined as expectDefined10 } from "@wrongstack/core";
+import { DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS4, expectDefined as expectDefined10 } from "@wrongstack/core/utils";
 import * as fs28 from "node:fs/promises";
-import * as path31 from "node:path";
-var DEFAULT_IGNORE5 = [
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  ".next",
-  "coverage",
-  "__pycache__",
-  ".wrongstack",
-  ".ssh",
-  ".gnupg",
-  ".aws"
-];
+import * as path32 from "node:path";
+var DEFAULT_IGNORE5 = [...DEFAULT_WALK_IGNORE_DIRS4, ".wrongstack", ".ssh", ".gnupg", ".aws"];
 var treeTool = {
   name: "tree",
   category: "Filesystem",
@@ -21601,7 +22666,7 @@ async function walkDir(dir, depth, opts) {
     opts.lines.push(opts.prefix + branch + displayName);
     if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {
       const childPrefix = opts.prefix + connector;
-      await walkDir(path31.join(dir, entry.name), depth + 1, {
+      await walkDir(path32.join(dir, entry.name), depth + 1, {
         ...opts,
         prefix: childPrefix,
         isLast
@@ -21614,7 +22679,7 @@ async function walkDir(dir, depth, opts) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 var typecheckTool = {
   name: "typecheck",
   category: "Code Quality",
@@ -21717,8 +22782,8 @@ async function findTsConfig(cwd) {
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat18(path32.join(cwd, f));
-      if (s.isFile()) return path32.join(cwd, f);
+      const s = await stat18(path33.join(cwd, f));
+      if (s.isFile()) return path33.join(cwd, f);
     } catch {
     }
   }
@@ -21727,7 +22792,8 @@ async function findTsConfig(cwd) {
 
 // src/write.ts
 import * as fs29 from "node:fs/promises";
-import { atomicWrite as atomicWrite5, ToolValidationError as ToolValidationError8, unifiedDiff as unifiedDiff3 } from "@wrongstack/core";
+import { ToolValidationError as ToolValidationError8 } from "@wrongstack/core/types";
+import { atomicWrite as atomicWrite5, unifiedDiff as unifiedDiff3 } from "@wrongstack/core/utils";
 init_util();
 var writeTool = {
   name: "write",
@@ -21951,7 +23017,7 @@ init_circuit_breaker();
 init_languages();
 
 // src/memory.ts
-import { ToolValidationError as ToolValidationError9 } from "@wrongstack/core";
+import { ToolValidationError as ToolValidationError9 } from "@wrongstack/core/types";
 function rememberTool(memory) {
   return {
     name: "remember",
@@ -22260,6 +23326,88 @@ var ProcessGuardian = class {
   isRunning = false;
   instanceId;
   sigtermCount = 0;
+  processHandlersInstalled = false;
+  onProcessExit = (code) => {
+    console.log(JSON.stringify({
+      level: "info",
+      event: "process_guardian.process_exiting",
+      pid: process.pid,
+      code,
+      instanceId: this.instanceId
+    }));
+    this.stop();
+  };
+  onUncaughtException = (err) => {
+    console.error(JSON.stringify({
+      level: "error",
+      event: "process_guardian.uncaught_exception",
+      error: err.message,
+      stack: err.stack,
+      instanceId: this.instanceId,
+      fatal: true
+    }));
+    this.stop();
+    process.exit(1);
+  };
+  onUnhandledRejection = (reason) => {
+    const err = reason instanceof Error ? { message: reason.message, stack: reason.stack } : { value: String(reason) };
+    console.error(JSON.stringify({
+      level: "error",
+      event: "process_guardian.unhandled_rejection",
+      ...err,
+      instanceId: this.instanceId,
+      fatal: true
+    }));
+    this.stop();
+    process.exit(1);
+  };
+  onSigterm = () => {
+    this.sigtermCount++;
+    const threshold = this.config.sigtermThreshold;
+    if (threshold === Infinity) {
+      console.log(JSON.stringify({
+        level: "warn",
+        event: "process_guardian.sigterm_ignored",
+        pid: process.pid,
+        instanceId: this.instanceId,
+        sigtermCount: this.sigtermCount,
+        message: "SIGTERM received but sigtermThreshold is Infinity \u2014 ignoring (use graceful shutdown instead)"
+      }));
+      return;
+    }
+    if (this.sigtermCount < threshold) {
+      console.log(JSON.stringify({
+        level: "warn",
+        event: "process_guardian.sigterm_deferred",
+        pid: process.pid,
+        instanceId: this.instanceId,
+        sigtermCount: this.sigtermCount,
+        threshold,
+        message: `SIGTERM received (${this.sigtermCount}/${threshold}) \u2014 ignoring until threshold is reached`
+      }));
+      return;
+    }
+    console.log(JSON.stringify({
+      level: "warn",
+      event: "process_guardian.sigterm_exiting",
+      pid: process.pid,
+      instanceId: this.instanceId,
+      sigtermCount: this.sigtermCount,
+      threshold,
+      message: `SIGTERM threshold (${threshold}) reached \u2014 shutting down gracefully`
+    }));
+    this.stop();
+    process.exit(0);
+  };
+  onSighup = () => {
+    console.log(JSON.stringify({
+      level: "warn",
+      event: "process_guardian.sighup_received",
+      pid: process.pid,
+      instanceId: this.instanceId,
+      message: "SIGHUP received but ignored - WrongStack continues running"
+    }));
+  };
   constructor(config = {}) {
     this.registry = getPersistentProcessRegistry();
     this.config = {
@@ -22298,6 +23446,7 @@ var ProcessGuardian = class {
    * Stop the guardian gracefully.
    */
   stop() {
+    this.removeProcessHandlers();
     if (!this.isRunning) return;
     this.isRunning = false;
     if (this.heartbeatTimer) {
@@ -22377,87 +23526,22 @@ var ProcessGuardian = class {
    * Set up process-level event handlers.
    */
   setupProcessHandlers() {
-    process.on("exit", (code) => {
-      console.log(JSON.stringify({
-        level: "info",
-        event: "process_guardian.process_exiting",
-        pid: process.pid,
-        code,
-        instanceId: this.instanceId
-      }));
-      this.stop();
-    });
-    process.on("uncaughtException", (err) => {
-      console.error(JSON.stringify({
-        level: "error",
-        event: "process_guardian.uncaught_exception",
-        error: err.message,
-        stack: err.stack,
-        instanceId: this.instanceId,
-        fatal: true
-      }));
-      this.stop();
-      process.exit(1);
-    });
-    process.on("unhandledRejection", (reason) => {
-      const err = reason instanceof Error ? { message: reason.message, stack: reason.stack } : { value: String(reason) };
-      console.error(JSON.stringify({
-        level: "error",
-        event: "process_guardian.unhandled_rejection",
-        ...err,
-        instanceId: this.instanceId,
-        fatal: true
-      }));
-      this.stop();
-      process.exit(1);
-    });
-    process.on("SIGTERM", () => {
-      this.sigtermCount++;
-      const threshold = this.config.sigtermThreshold;
-      if (threshold === Infinity) {
-        console.log(JSON.stringify({
-          level: "warn",
-          event: "process_guardian.sigterm_ignored",
-          pid: process.pid,
-          instanceId: this.instanceId,
-          sigtermCount: this.sigtermCount,
-          message: "SIGTERM received but sigtermThreshold is Infinity \u2014 ignoring (use graceful shutdown instead)"
-        }));
-        return;
-      }
-      if (this.sigtermCount < threshold) {
-        console.log(JSON.stringify({
-          level: "warn",
-          event: "process_guardian.sigterm_deferred",
-          pid: process.pid,
-          instanceId: this.instanceId,
-          sigtermCount: this.sigtermCount,
-          threshold,
-          message: `SIGTERM received (${this.sigtermCount}/${threshold}) \u2014 ignoring until threshold is reached`
-        }));
-        return;
-      }
-      console.log(JSON.stringify({
-        level: "warn",
-        event: "process_guardian.sigterm_exiting",
-        pid: process.pid,
-        instanceId: this.instanceId,
-        sigtermCount: this.sigtermCount,
-        threshold,
-        message: `SIGTERM threshold (${threshold}) reached \u2014 shutting down gracefully`
-      }));
-      this.stop();
-      process.exit(0);
-    });
-    process.on("SIGHUP", () => {
-      console.log(JSON.stringify({
-        level: "warn",
-        event: "process_guardian.sighup_received",
-        pid: process.pid,
-        instanceId: this.instanceId,
-        message: "SIGHUP received but ignored - WrongStack continues running"
-      }));
-    });
+    if (this.processHandlersInstalled) return;
+    this.processHandlersInstalled = true;
+    process.on("exit", this.onProcessExit);
+    process.on("uncaughtException", this.onUncaughtException);
+    process.on("unhandledRejection", this.onUnhandledRejection);
+    process.on("SIGTERM", this.onSigterm);
+    process.on("SIGHUP", this.onSighup);
+  }
+  removeProcessHandlers() {
+    if (!this.processHandlersInstalled) return;
+    this.processHandlersInstalled = false;
+    process.off("exit", this.onProcessExit);
+    process.off("uncaughtException", this.onUncaughtException);
+    process.off("unhandledRejection", this.onUnhandledRejection);
+    process.off("SIGTERM", this.onSigterm);
+    process.off("SIGHUP", this.onSighup);
   }
   /**
    * Check if a PID is protected by this guardian.
@@ -22493,6 +23577,7 @@ function getProcessGuardian() {
   return _guardian;
 }
 function startProcessGuardian(config) {
+  _guardian?.stop();
   const guardian = new ProcessGuardian(config);
   guardian.start();
   _guardian = guardian;
@@ -22823,12 +23908,9 @@ function createGlobalPsSlashCommand() {
 
 // src/skill.ts
 import * as fs30 from "node:fs/promises";
-import * as path33 from "node:path";
-import {
-  SKILL_LIMITS,
-  stripFrontmatter,
-  ToolValidationError as ToolValidationError10
-} from "@wrongstack/core";
+import * as path34 from "node:path";
+import { SKILL_LIMITS, stripFrontmatter } from "@wrongstack/core/skills";
+import { ToolValidationError as ToolValidationError10 } from "@wrongstack/core/types";
 var MAX_BODY_CHARS = SKILL_LIMITS.MAX_SKILL_BODY_CHARS;
 var MAX_RESOURCE_CHARS = SKILL_LIMITS.MAX_RESOURCE_CHARS;
 var MAX_LISTED_RESOURCES = SKILL_LIMITS.MAX_LISTED_RESOURCES;
@@ -22870,7 +23952,7 @@ function makeSkillTool(skillLoader) {
           field: "name"
         });
       }
-      const dir = path33.dirname(manifest.path);
+      const dir = path34.dirname(manifest.path);
       let loadedResource;
       if (input.resource?.trim()) {
         loadedResource = await loadResource(dir, input.resource.trim());
@@ -22920,15 +24002,15 @@ ${listing}`;
 }
 async function loadResource(skillDir, rel) {
   const norm = rel.replace(/\\/g, "/");
-  if (path33.isAbsolute(rel) || norm.split("/").some((seg) => seg === "..")) {
+  if (path34.isAbsolute(rel) || norm.split("/").some((seg) => seg === "..")) {
     throw new ToolValidationError10({
       message: `skill: invalid resource path "${rel}"`,
       field: "resource"
     });
   }
-  const absPath = path33.resolve(skillDir, rel);
-  const root = path33.resolve(skillDir);
-  if (absPath !== root && !absPath.startsWith(root + path33.sep)) {
+  const absPath = path34.resolve(skillDir, rel);
+  const root = path34.resolve(skillDir);
+  if (absPath !== root && !absPath.startsWith(root + path34.sep)) {
     throw new ToolValidationError10({
       message: `skill: resource "${rel}" escapes the skill directory`,
       field: "resource"
@@ -22969,7 +24051,7 @@ async function walk(root, dir, out) {
   }
   for (const e of entries) {
     if (out.length >= MAX_LISTED_RESOURCES) return;
-    const fullPath = path33.join(dir, e.name);
+    const fullPath = path34.join(dir, e.name);
     let isDir = e.isDirectory();
     if (e.isSymbolicLink()) {
       try {
@@ -22985,7 +24067,7 @@ async function walk(root, dir, out) {
       if (e.name === "SKILL.md" || e.name === "SKILL.save.md") continue;
       try {
         const stat18 = await fs30.stat(fullPath);
-        const rel = path33.relative(root, fullPath).split(path33.sep).join("/");
+        const rel = path34.relative(root, fullPath).split(path34.sep).join("/");
         out.push({ path: rel, bytes: stat18.size });
       } catch {
       }
@@ -23160,6 +24242,43 @@ var TOOL_ICON_CONFIG = {
   // gray-light
 };
 var FALLBACK_ICON = "fallback";
+
+// src/tool-tier.ts
+function toolNameSet(tools) {
+  return new Set(tools.flatMap((tool) => tool ? [tool.name] : []));
+}
+function selectBuiltinToolsForTier(tier, allTools) {
+  switch (tier) {
+    case "off":
+      return [...allTools];
+    case "minimal":
+    case "light": {
+      const tier1Names = toolNameSet(TIER1_TOOLS);
+      return allTools.filter((tool) => tier1Names.has(tool.name));
+    }
+    case "medium": {
+      const tier1Names = toolNameSet(TIER1_TOOLS);
+      const tier2Names = toolNameSet(TIER2_TOOLS);
+      return allTools.filter((tool) => tier1Names.has(tool.name) || tier2Names.has(tool.name));
+    }
+    case "aggressive": {
+      const tier1Names = toolNameSet(TIER1_TOOLS);
+      const tier2Names = toolNameSet(TIER2_TOOLS);
+      const tier3Names = toolNameSet(TIER3_TOOLS);
+      return allTools.filter(
+        (tool) => tier1Names.has(tool.name) || tier2Names.has(tool.name) && tool.name !== "task" || tier3Names.has(tool.name) && tool.name !== "setWorkingDir"
+      );
+    }
+  }
+}
+function registerBuiltinToolTier(options) {
+  const tools = selectBuiltinToolsForTier(
+    options.tier,
+    options.tools ?? builtinToolsPack.tools ?? []
+  );
+  options.registry.registerAllOrThrow(tools, options.owner ?? builtinToolsPack.name);
+  return tools;
+}
 export {
   ADDITIONAL_LANGUAGE_PROFILES,
   BrowserArtifactStore,
@@ -23258,6 +24377,8 @@ export {
   isIndexableFile,
   isIndexing,
   jsonTool,
+  kanbanEvidenceKey,
+  kanbanEvidencePointer,
   kanbanTool,
   languageInfoTool,
   languagePackageTool,
@@ -23284,7 +24405,9 @@ export {
   projectSessionTasksToKanban,
   projectSessionTodosToKanban,
   readTool,
+  recordKanbanVerificationEvidence,
   redactBrowserText,
+  registerBuiltinToolTier,
   relatedMemoryTool,
   rememberTool,
   replaceTool,
@@ -23300,6 +24423,7 @@ export {
   searchCodebaseIndex,
   searchMemoryTool,
   searchTool,
+  selectBuiltinToolsForTier,
   shutdownBrowserTools,
   shutdownCodebaseIndexHost,
   startProcessGuardian,