akm-cli 0.9.0 → 0.9.1-beta.1

package/dist/scripts/akm-migrate.js

@@ -6977,12 +6977,21 @@ function rethrowIfTestIsolationError(err) {
     throw err;
   }
 }
+function isDataDirUnreadableError(err) {
+  return err instanceof ConfigError && err.code === "DATA_DIR_UNREADABLE";
+}
+function rethrowIfDataDirUnreadable(err) {
+  if (isDataDirUnreadableError(err)) {
+    throw err;
+  }
+}
 var CONFIG_HINTS, USAGE_HINTS, NOT_FOUND_HINTS, AkmError, ConfigError, UsageError, NotFoundError;
 var init_errors = __esm(() => {
   CONFIG_HINTS = {
     STASH_DIR_NOT_FOUND: "Run `akm setup` to create and configure your bundle, or configure a defaultBundle path.",
     STASH_DIR_NOT_A_DIRECTORY: "The configured default bundle path exists but isn't a directory. Update it to point at a folder.",
     STASH_DIR_UNREADABLE: "Check the path exists and your user has read permission, or update the default bundle path.",
+    DATA_DIR_UNREADABLE: "The data directory is not readable by the user running akm. Check its owner and mode, or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user owns.",
     EMBEDDING_NOT_CONFIGURED: 'Run `akm config set embedding \'{"endpoint":"...","model":"..."}\'` to enable embeddings.',
     LLM_NOT_CONFIGURED: 'Run `akm setup` or configure an `engines` entry with `kind: "llm"`, then select it with `defaults.llmEngine`.',
     TEST_ISOLATION_MISSING: "Under bun test, when AKM_BUNDLE_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",
@@ -7411,13 +7420,23 @@ function hasErrnoCode(error, code) {
     return false;
   return error.code === code;
 }
+function isContainedRelativePath(value) {
+  if (value === "" || value.startsWith("/") || value.startsWith("\\") || value.startsWith("~"))
+    return false;
+  if (/^[A-Za-z]:/.test(value))
+    return false;
+  return !value.split(/[/\\]+/).includes("..");
+}
 function isWithin(candidate, root) {
-  const resolvedRoot = safeRealpath(root);
-  const resolvedCandidate = safeRealpath(candidate);
-  const normalizedRoot = normalizeFsPathForComparison(resolvedRoot);
-  const normalizedCandidate = normalizeFsPathForComparison(resolvedCandidate);
-  const rel = path2.relative(normalizedRoot, normalizedCandidate);
-  return rel === "" || !rel.startsWith("..") && !path2.isAbsolute(rel);
+  return isContainedResolvedPath(safeRealpath(candidate), safeRealpath(root));
+}
+function isContainedResolvedPath(resolvedCandidate, resolvedRoot) {
+  const rel = path2.relative(normalizeFsPathForComparison(resolvedRoot), normalizeFsPathForComparison(resolvedCandidate));
+  if (rel === "")
+    return true;
+  if (path2.isAbsolute(rel))
+    return false;
+  return rel.split(/[/\\]+/)[0] !== "..";
 }
 function safeRealpath(p) {
   const resolved = path2.resolve(p);
@@ -8124,31 +8143,83 @@ var require_main = __commonJS((exports, module) => {
   module.exports = DotenvModule;
 });
 
+// src/core/path-access.ts
+import fs5 from "fs";
+function errnoOf(error) {
+  const code = error?.code;
+  return typeof code === "string" ? code : undefined;
+}
+function classifyPathAccess(target) {
+  try {
+    fs5.statSync(target);
+  } catch (error) {
+    const code = errnoOf(error);
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return { access: "absent" };
+    return { access: "inaccessible", ...code ? { code } : {} };
+  }
+  try {
+    fs5.accessSync(target, fs5.constants.R_OK);
+  } catch (error) {
+    const code = errnoOf(error);
+    return { access: "inaccessible", ...code ? { code } : {} };
+  }
+  return { access: "present" };
+}
+function isPathAbsent(target) {
+  return classifyPathAccess(target).access === "absent";
+}
+function describeInaccessiblePath(target, code) {
+  const parts = [target];
+  if (code)
+    parts.push(`(${code})`);
+  try {
+    const stat = fs5.statSync(target);
+    parts.push(`mode ${(stat.mode & 511).toString(8).padStart(3, "0")}, owner uid ${stat.uid}`);
+  } catch {
+    const parent = target.slice(0, Math.max(0, target.lastIndexOf("/")));
+    if (parent) {
+      try {
+        const stat = fs5.statSync(parent);
+        parts.push(`parent ${parent} is mode ${(stat.mode & 511).toString(8).padStart(3, "0")}, owner uid ${stat.uid}`);
+      } catch {}
+    }
+  }
+  const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+  if (uid !== undefined)
+    parts.push(`running as uid ${uid}`);
+  return parts.join("; ");
+}
+var init_path_access = () => {};
+
 // src/core/migration-operation.ts
 import crypto2 from "crypto";
-import fs5 from "fs";
-import path8 from "path";
+import path9 from "path";
 function installationId() {
-  return crypto2.createHash("sha256").update(path8.resolve(path8.dirname(getConfigPath()))).update("\x00").update(path8.resolve(getDataDir())).digest("hex").slice(0, 24);
+  return crypto2.createHash("sha256").update(path9.resolve(path9.dirname(getConfigPath()))).update("\x00").update(path9.resolve(getDataDir())).digest("hex").slice(0, 24);
 }
 function getMigrationOperationRoot() {
-  return path8.join(getDataDir(), "backups", "migrations", installationId());
+  return path9.join(getDataDir(), "backups", "migrations", installationId());
 }
 function getMigrationRestoreJournalPath() {
-  return path8.join(getMigrationOperationRoot(), "restore-active.json");
+  return path9.join(getMigrationOperationRoot(), "restore-active.json");
 }
 function getMigrationApplyJournalPath() {
-  return path8.join(getMigrationOperationRoot(), "apply-active.json");
+  return path9.join(getMigrationOperationRoot(), "apply-active.json");
 }
 function getMigrationGeneratedConfigPath() {
-  return path8.join(getMigrationOperationRoot(), "generated-config.json");
+  return path9.join(getMigrationOperationRoot(), "generated-config.json");
 }
 function assertNoPendingMigrationOperation() {
   for (const [kind, journalPath] of [
     ["restore", getMigrationRestoreJournalPath()],
     ["migration apply", getMigrationApplyJournalPath()]
   ]) {
-    if (fs5.existsSync(journalPath)) {
+    const { access, code } = classifyPathAccess(journalPath);
+    if (access === "inaccessible") {
+      throw new ConfigError(`Cannot determine whether an AKM ${kind} recovery is pending: ${describeInaccessiblePath(journalPath, code)}. ` + "Refusing canonical config/database access \u2014 proceeding could write on top of a half-applied migration.", "DATA_DIR_UNREADABLE");
+    }
+    if (access === "present") {
       throw new ConfigError(`AKM ${kind} recovery is pending at ${journalPath}; refusing canonical config/database access until recovery completes.`, "INVALID_CONFIG_FILE");
     }
   }
@@ -8159,6 +8230,7 @@ function assertNoPendingMigrationOperation() {
 var afterPendingCheckHook;
 var init_migration_operation = __esm(() => {
   init_errors();
+  init_path_access();
   init_paths();
 });
 
@@ -8171,11 +8243,11 @@ function selectProvider() {
   }
   return provider;
 }
-function openDatabase(path9, opts) {
-  return selectProvider().open(path9, opts);
+function openDatabase(path10, opts) {
+  return selectProvider().open(path10, opts);
 }
-function openDatabaseFinalizing(path9, opts) {
-  const db = selectProvider().open(path9, opts);
+function openDatabaseFinalizing(path10, opts) {
+  const db = selectProvider().open(path10, opts);
   const tracked = new Set;
   const origPrepare = db.prepare.bind(db);
   const origClose = db.close.bind(db);
@@ -8195,9 +8267,9 @@ function openDatabaseFinalizing(path9, opts) {
   };
   return db;
 }
-function openBunDatabase(path9, opts) {
+function openBunDatabase(path10, opts) {
   const { Database: BunDatabase } = loadBunSqlite();
-  const db = opts ? new BunDatabase(path9, bunOptions(opts)) : new BunDatabase(path9);
+  const db = opts ? new BunDatabase(path10, bunOptions(opts)) : new BunDatabase(path10);
   return db;
 }
 function bunOptions(opts) {
@@ -8223,7 +8295,11 @@ function loadBetterSqlite3() {
       mod = nodeRequire2("better-sqlite3");
     } catch (err) {
       throw new Error(`akm could not load 'better-sqlite3', the SQLite driver it needs on Node.js.
-` + `  \u2022 Reinstall akm with a working C/C++ build toolchain so its optional
+` + `  \u2022 If the error below says the module was compiled against a DIFFERENT Node.js
+` + `    version, you upgraded Node after installing akm. Reinstall akm (or run
+` + "    `npm rebuild better-sqlite3` in its install directory) so the binding is\n" + `    rebuilt for the Node you are now running. This is the common case after a
+` + `    Node major upgrade, and it is NOT a broken install.
+` + `  \u2022 Otherwise, reinstall akm with a working C/C++ build toolchain so its optional
 ` + "    'better-sqlite3' native binding rebuilds (a global `npm i -g better-sqlite3`\n" + `    will NOT be resolved \u2014 Node loads it from akm's own node_modules).
 ` + `  \u2022 Or run akm under Bun, which has a built-in SQLite driver and needs no native build.
 ` + `  Underlying load error: ${err instanceof Error ? err.message : String(err)}`);
@@ -8232,14 +8308,14 @@ function loadBetterSqlite3() {
   }
   return betterSqlite3Ctor;
 }
-function openNodeDatabase(path9, opts) {
+function openNodeDatabase(path10, opts) {
   const BetterSqlite3 = loadBetterSqlite3();
   const options = {};
   if (opts?.readonly !== undefined)
     options.readonly = opts.readonly;
   if (opts?.create === false)
     options.fileMustExist = true;
-  const db = opts ? new BetterSqlite3(path9, options) : new BetterSqlite3(path9);
+  const db = opts ? new BetterSqlite3(path10, options) : new BetterSqlite3(path10);
   return {
     prepare: db.prepare.bind(db),
     exec: db.exec.bind(db),
@@ -8271,7 +8347,7 @@ var init_database = __esm(() => {
 // src/core/file-lock.ts
 import { randomUUID } from "crypto";
 import fs6 from "fs";
-import path9 from "path";
+import path10 from "path";
 function readLockSnapshot(lockPath) {
   let fd;
   try {
@@ -8296,7 +8372,7 @@ function sameIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
 function operationMutexPath(lockPath) {
-  return path9.join(path9.dirname(lockPath), `.${path9.basename(lockPath)}.operations.sensitive`);
+  return path10.join(path10.dirname(lockPath), `.${path10.basename(lockPath)}.operations.sensitive`);
 }
 function withLockOperationMutex(lockPath, run) {
   const db = openDatabase(operationMutexPath(lockPath));
@@ -8362,7 +8438,10 @@ function probeLock(lockPath, opts) {
   let snapshot;
   try {
     snapshot = readLockSnapshot(lockPath);
-  } catch {
+  } catch (error) {
+    const code = error?.code;
+    if (code === "EACCES" || code === "EPERM")
+      return { state: "inaccessible", code };
     return { state: "stale", reason: "unreadable" };
   }
   if (!snapshot)
@@ -8529,10 +8608,10 @@ var init_warn = () => {};
 import { AsyncLocalStorage } from "async_hooks";
 import { randomUUID as randomUUID2 } from "crypto";
 import fs10 from "fs";
-import path11 from "path";
+import path12 from "path";
 function tryAcquireMaintenanceBarrier() {
   const lockPath = getMaintenanceBarrierPath();
-  fs10.mkdirSync(path11.dirname(lockPath), { recursive: true });
+  fs10.mkdirSync(path12.dirname(lockPath), { recursive: true });
   for (let attempt = 0;attempt < 2; attempt += 1) {
     const ownership = tryAcquireLockSync(lockPath, createLockPayload({ purpose: "maintenance-start" }));
     if (ownership) {
@@ -8583,9 +8662,9 @@ function withMaintenanceStartBarrierSyncWait(run) {
 }
 function acquireMaintenanceActivitySync(name) {
   return withMaintenanceStartBarrierSyncWait(() => {
-    const directory = path11.join(path11.dirname(getMaintenanceBarrierPath()), "maintenance-activities");
+    const directory = path12.join(path12.dirname(getMaintenanceBarrierPath()), "maintenance-activities");
     fs10.mkdirSync(directory, { recursive: true, mode: 448 });
-    const lockPath = path11.join(directory, `${name}-${process.pid}-${randomUUID2()}.lock`);
+    const lockPath = path12.join(directory, `${name}-${process.pid}-${randomUUID2()}.lock`);
     const ownership = tryAcquireLockSync(lockPath, createLockPayload({ purpose: name }));
     if (!ownership) {
       throw new ConfigError(`Could not register AKM maintenance activity at ${lockPath}.`, "INVALID_CONFIG_FILE");
@@ -15636,33 +15715,33 @@ var require_URL = __commonJS((exports, module) => {
         else
           return basepath.substring(0, lastslash + 1) + refpath;
       }
-      function remove_dot_segments(path42) {
-        if (!path42)
-          return path42;
+      function remove_dot_segments(path43) {
+        if (!path43)
+          return path43;
         var output = "";
-        while (path42.length > 0) {
-          if (path42 === "." || path42 === "..") {
-            path42 = "";
+        while (path43.length > 0) {
+          if (path43 === "." || path43 === "..") {
+            path43 = "";
             break;
           }
-          var twochars = path42.substring(0, 2);
-          var threechars = path42.substring(0, 3);
-          var fourchars = path42.substring(0, 4);
+          var twochars = path43.substring(0, 2);
+          var threechars = path43.substring(0, 3);
+          var fourchars = path43.substring(0, 4);
           if (threechars === "../") {
-            path42 = path42.substring(3);
+            path43 = path43.substring(3);
           } else if (twochars === "./") {
-            path42 = path42.substring(2);
+            path43 = path43.substring(2);
           } else if (threechars === "/./") {
-            path42 = "/" + path42.substring(3);
-          } else if (twochars === "/." && path42.length === 2) {
-            path42 = "/";
-          } else if (fourchars === "/../" || threechars === "/.." && path42.length === 3) {
-            path42 = "/" + path42.substring(4);
+            path43 = "/" + path43.substring(3);
+          } else if (twochars === "/." && path43.length === 2) {
+            path43 = "/";
+          } else if (fourchars === "/../" || threechars === "/.." && path43.length === 3) {
+            path43 = "/" + path43.substring(4);
             output = output.replace(/\/?[^\/]*$/, "");
           } else {
-            var segment = path42.match(/(\/?([^\/]*))/)[0];
+            var segment = path43.match(/(\/?([^\/]*))/)[0];
             output += segment;
-            path42 = path42.substring(segment.length);
+            path43 = path43.substring(segment.length);
           }
         }
         return output;
@@ -26972,9 +27051,9 @@ var init_sqlite_pragmas = __esm(() => {
 
 // src/storage/managed-db.ts
 import fs44 from "fs";
-import path49 from "path";
+import path50 from "path";
 function openManagedDatabase(spec) {
-  const dir = path49.dirname(spec.path);
+  const dir = path50.dirname(spec.path);
   if (spec.create !== false && !fs44.existsSync(dir)) {
     fs44.mkdirSync(dir, { recursive: true });
   }
@@ -27010,14 +27089,14 @@ __export(exports_state_db, {
   getStateDbPath: () => getStateDbPath
 });
 import fs45 from "fs";
-import path50 from "path";
+import path51 from "path";
 function getStateDbPath() {
-  return path50.join(getDataDir(), "state.db");
+  return path51.join(getDataDir(), "state.db");
 }
 function openStateDatabase(dbPath) {
   const canonicalPath = getStateDbPath();
   const resolvedPath = dbPath ?? canonicalPath;
-  const isCanonical = path50.resolve(resolvedPath) === path50.resolve(canonicalPath);
+  const isCanonical = path51.resolve(resolvedPath) === path51.resolve(canonicalPath);
   if (isCanonical)
     assertNoPendingMigrationOperation();
   const releaseActivity = isCanonical ? acquireMaintenanceActivitySync("state-db") : undefined;
@@ -27907,9 +27986,9 @@ __export(exports_index_connection, {
   openReadonlyExistingDatabase: () => openReadonlyExistingDatabase,
   openIndexDatabase: () => openIndexDatabase,
   openExistingDatabase: () => openExistingDatabase,
-  closeDatabase: () => closeDatabase
+  closeDatabase: () => closeDatabase,
+  assertIndexPathReadable: () => assertIndexPathReadable
 });
-import fs46 from "fs";
 import { createRequire as createRequire4 } from "module";
 function openIndexDatabase(dbPath, options) {
   return openManagedDatabase({
@@ -27937,14 +28016,22 @@ function resolveConfiguredEmbeddingDim() {
 }
 function openExistingDatabase(dbPath) {
   const resolvedPath = dbPath ?? getDbPath();
-  if (!fs46.existsSync(resolvedPath)) {
+  assertIndexPathReadable(resolvedPath);
+  if (classifyPathAccess(resolvedPath).access === "absent") {
     throw new Error(`Index database not found at ${resolvedPath}. Run 'akm index' to build it.`);
   }
   return openManagedDatabase({ path: resolvedPath, init: loadVecExtension, create: false });
 }
+function assertIndexPathReadable(resolvedPath) {
+  const { access, code } = classifyPathAccess(resolvedPath);
+  if (access !== "inaccessible")
+    return;
+  throw new ConfigError(`Index database exists but is not readable: ${describeInaccessiblePath(resolvedPath, code)}.`, "DATA_DIR_UNREADABLE");
+}
 function openReadonlyExistingDatabase(dbPath) {
   const resolvedPath = dbPath ?? getDbPath();
-  if (!fs46.existsSync(resolvedPath))
+  assertIndexPathReadable(resolvedPath);
+  if (classifyPathAccess(resolvedPath).access === "absent")
     return;
   return openDatabase(resolvedPath, { readonly: true, create: false });
 }
@@ -27952,6 +28039,8 @@ function closeDatabase(db) {
   db.close();
 }
 var init_index_connection = __esm(() => {
+  init_errors();
+  init_path_access();
   init_paths();
   init_database();
   init_managed_db();
@@ -27971,12 +28060,11 @@ __export(exports_graph_db, {
   drainExtractionQueue: () => drainExtractionQueue,
   deleteStoredGraph: () => deleteStoredGraph
 });
-import fs47 from "fs";
 function withReadableGraphDb(db, fn) {
   if (db)
     return fn(db);
   const dbPath = getDbPath();
-  if (!fs47.existsSync(dbPath))
+  if (isPathAbsent(dbPath))
     throw new Error("GRAPH_DB_MISSING");
   const opened = openExistingDatabase(dbPath);
   try {
@@ -28150,6 +28238,7 @@ function loadGraphFilesOnly(stashPath, db) {
     });
   } catch (err) {
     rethrowIfTestIsolationError(err);
+    rethrowIfDataDirUnreadable(err);
     return [];
   }
 }
@@ -28212,6 +28301,7 @@ function loadStoredGraphMeta(stashPath, db) {
     });
   } catch (err) {
     rethrowIfTestIsolationError(err);
+    rethrowIfDataDirUnreadable(err);
     return null;
   }
 }
@@ -28296,11 +28386,13 @@ function loadStoredGraphSnapshot(stashPath, db) {
     });
   } catch (err) {
     rethrowIfTestIsolationError(err);
+    rethrowIfDataDirUnreadable(err);
     return null;
   }
 }
 var init_graph_db = __esm(() => {
   init_errors();
+  init_path_access();
   init_paths();
   init_index_connection();
 });
@@ -28312,9 +28404,9 @@ __export(exports_migrate_storage, {
   main: () => main,
   MIGRATIONS: () => MIGRATIONS
 });
-import fs48 from "fs";
+import fs46 from "fs";
 import os7 from "os";
-import path51 from "path";
+import path52 from "path";
 import readline from "readline";
 function parseFromArg(args) {
   const idx = args.indexOf("--from");
@@ -28328,14 +28420,14 @@ function parseFromArg(args) {
   return val;
 }
 function ensureDir(dir) {
-  if (!fs48.existsSync(dir)) {
-    fs48.mkdirSync(dir, { recursive: true });
+  if (!fs46.existsSync(dir)) {
+    fs46.mkdirSync(dir, { recursive: true });
   }
 }
 function copyAndVerify(src, dest) {
-  fs48.copyFileSync(src, dest);
-  const srcStat = fs48.statSync(src);
-  const destStat = fs48.statSync(dest);
+  fs46.copyFileSync(src, dest);
+  const srcStat = fs46.statSync(src);
+  const destStat = fs46.statSync(dest);
   return destStat.size === srcStat.size;
 }
 function copyTree(src, dest, opts) {
@@ -28343,9 +28435,9 @@ function copyTree(src, dest, opts) {
   let skipped = 0;
   let failed = 0;
   ensureDir(dest);
-  for (const entry of fs48.readdirSync(src, { withFileTypes: true })) {
-    const srcEntry = path51.join(src, entry.name);
-    const destEntry = path51.join(dest, entry.name);
+  for (const entry of fs46.readdirSync(src, { withFileTypes: true })) {
+    const srcEntry = path52.join(src, entry.name);
+    const destEntry = path52.join(dest, entry.name);
     if (entry.isDirectory()) {
       const sub = copyTree(srcEntry, destEntry, opts);
       copied += sub.copied;
@@ -28353,7 +28445,7 @@ function copyTree(src, dest, opts) {
       failed += sub.failed;
       continue;
     }
-    if (!opts.clobber && fs48.existsSync(destEntry)) {
+    if (!opts.clobber && fs46.existsSync(destEntry)) {
       skipped++;
       continue;
     }
@@ -28371,9 +28463,9 @@ function copyTree(src, dest, opts) {
 }
 function countFilesRecursive(dir) {
   let count = 0;
-  for (const entry of fs48.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs46.readdirSync(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      count += countFilesRecursive(path51.join(dir, entry.name));
+      count += countFilesRecursive(path52.join(dir, entry.name));
     } else {
       count++;
     }
@@ -28386,12 +28478,12 @@ async function runSteps(steps, ctx) {
   }
 }
 function migrateDb(ctx, filename) {
-  const src = path51.join(ctx.paths.cacheDir, filename);
-  const dest = path51.join(ctx.paths.dataDir, filename);
-  if (!fs48.existsSync(src)) {
+  const src = path52.join(ctx.paths.cacheDir, filename);
+  const dest = path52.join(ctx.paths.dataDir, filename);
+  if (!fs46.existsSync(src)) {
     return { name: filename, status: "skipped", detail: "source not found" };
   }
-  if (fs48.existsSync(dest)) {
+  if (fs46.existsSync(dest)) {
     return { name: filename, status: "skipped", detail: "destination already exists" };
   }
   if (ctx.dryRun) {
@@ -28409,8 +28501,8 @@ function migrateDb(ctx, filename) {
   return { name: filename, status: "failed", detail: `size mismatch after copy: ${src} \u2192 ${dest}` };
 }
 async function migrateEventsJsonl(ctx) {
-  const src = path51.join(ctx.paths.cacheDir, "events.jsonl");
-  if (!fs48.existsSync(src)) {
+  const src = path52.join(ctx.paths.cacheDir, "events.jsonl");
+  if (!fs46.existsSync(src)) {
     return { name: "events.jsonl \u2192 state.db", status: "skipped", detail: "source not found" };
   }
   if (ctx.dryRun) {
@@ -28455,13 +28547,13 @@ async function migrateEventsJsonl(ctx) {
   }
 }
 function migrateTaskHistory(ctx) {
-  const src = path51.join(ctx.paths.cacheDir, "tasks", "history");
-  const dest = path51.join(ctx.paths.stateDir, "tasks", "history");
-  if (!fs48.existsSync(src)) {
+  const src = path52.join(ctx.paths.cacheDir, "tasks", "history");
+  const dest = path52.join(ctx.paths.stateDir, "tasks", "history");
+  if (!fs46.existsSync(src)) {
     return { name: "tasks/history/", status: "skipped", detail: "source directory not found" };
   }
   try {
-    const files = fs48.readdirSync(src).filter((f) => f.endsWith(".jsonl"));
+    const files = fs46.readdirSync(src).filter((f) => f.endsWith(".jsonl"));
     if (files.length === 0) {
       return { name: "tasks/history/", status: "skipped", detail: "no *.jsonl files found in source directory" };
     }
@@ -28476,8 +28568,8 @@ function migrateTaskHistory(ctx) {
     let copied = 0;
     let failed = 0;
     for (const file of files) {
-      const srcFile = path51.join(src, file);
-      const destFile = path51.join(dest, file);
+      const srcFile = path52.join(src, file);
+      const destFile = path52.join(dest, file);
       try {
         if (copyAndVerify(srcFile, destFile)) {
           copied++;
@@ -28506,12 +28598,12 @@ function migrateTaskHistory(ctx) {
   }
 }
 function migrateLockfile(ctx) {
-  const src = path51.join(ctx.paths.configDir, "akm.lock");
-  const dest = path51.join(ctx.paths.dataDir, "akm.lock");
-  if (!fs48.existsSync(src)) {
+  const src = path52.join(ctx.paths.configDir, "akm.lock");
+  const dest = path52.join(ctx.paths.dataDir, "akm.lock");
+  if (!fs46.existsSync(src)) {
     return { name: "akm.lock", status: "skipped", detail: "source not found" };
   }
-  if (fs48.existsSync(dest)) {
+  if (fs46.existsSync(dest)) {
     return { name: "akm.lock", status: "skipped", detail: "destination already exists" };
   }
   if (ctx.dryRun) {
@@ -28531,12 +28623,12 @@ function migrateLockfile(ctx) {
   return { name: "akm.lock", status: "failed", detail: `size mismatch after copy: ${src} \u2192 ${dest}` };
 }
 function migrateConfigBackups(ctx) {
-  const src = path51.join(ctx.paths.cacheDir, "config-backups");
-  const dest = path51.join(ctx.paths.dataDir, "config-backups");
-  if (!fs48.existsSync(src)) {
+  const src = path52.join(ctx.paths.cacheDir, "config-backups");
+  const dest = path52.join(ctx.paths.dataDir, "config-backups");
+  if (!fs46.existsSync(src)) {
     return { name: "config-backups/", status: "skipped", detail: "source directory not found" };
   }
-  if (fs48.existsSync(dest)) {
+  if (fs46.existsSync(dest)) {
     return { name: "config-backups/", status: "skipped", detail: "destination already exists" };
   }
   if (ctx.dryRun) {
@@ -28553,7 +28645,7 @@ function migrateConfigBackups(ctx) {
   try {
     const srcCount = countFilesRecursive(src);
     const { copied, failed } = copyTree(src, dest, { clobber: true });
-    const destCount = fs48.existsSync(dest) ? countFilesRecursive(dest) : 0;
+    const destCount = fs46.existsSync(dest) ? countFilesRecursive(dest) : 0;
     if (failed === 0 && destCount === srcCount) {
       return {
         name: "config-backups/",
@@ -28572,11 +28664,11 @@ function migrateConfigBackups(ctx) {
   }
 }
 async function migrateTaskHistoryToDb(ctx) {
-  const src = path51.join(ctx.paths.cacheDir, "tasks", "history");
-  if (!fs48.existsSync(src)) {
+  const src = path52.join(ctx.paths.cacheDir, "tasks", "history");
+  if (!fs46.existsSync(src)) {
     return { name: "tasks/history/ \u2192 state.db", status: "skipped", detail: "source directory not found" };
   }
-  const files = fs48.readdirSync(src).filter((f) => f.endsWith(".jsonl"));
+  const files = fs46.readdirSync(src).filter((f) => f.endsWith(".jsonl"));
   if (files.length === 0) {
     return {
       name: "tasks/history/ \u2192 state.db",
@@ -28600,8 +28692,8 @@ async function migrateTaskHistoryToDb(ctx) {
     let failed = 0;
     try {
       for (const file of files) {
-        const filePath = path51.join(src, file);
-        const text2 = fs48.readFileSync(filePath, "utf8");
+        const filePath = path52.join(src, file);
+        const text2 = fs46.readFileSync(filePath, "utf8");
         const lines = text2.split(`
 `).filter((l) => l.trim().length > 0);
         db.exec("BEGIN");
@@ -28660,15 +28752,15 @@ async function migrateTaskHistoryToDb(ctx) {
   }
 }
 function noteRegistryIndexCache(ctx) {
-  const src = path51.join(ctx.paths.cacheDir, "registry-index");
-  if (!fs48.existsSync(src)) {
+  const src = path52.join(ctx.paths.cacheDir, "registry-index");
+  if (!fs46.existsSync(src)) {
     return {
       name: "registry-index/ (note)",
       status: "skipped",
       detail: "no old $CACHE/registry-index/ directory found"
     };
   }
-  const legacyFiles = fs48.readdirSync(src).filter((f) => f.endsWith(".json") && !f.startsWith("website-"));
+  const legacyFiles = fs46.readdirSync(src).filter((f) => f.endsWith(".json") && !f.startsWith("website-"));
   if (legacyFiles.length === 0) {
     return { name: "registry-index/ (note)", status: "skipped", detail: "no old *.json cache files found" };
   }
@@ -28678,7 +28770,7 @@ function noteRegistryIndexCache(ctx) {
         These are ignored in v0.9 \u2014 data is now stored in the registry_index_cache` + `
         table in $DATA/index.db and will be rebuilt on next 'akm search --from registry'.
         You may safely delete these files after migration:
-` + legacyFiles.map((f) => `          ${path51.join(src, f)}`).join(`
+` + legacyFiles.map((f) => `          ${path52.join(src, f)}`).join(`
 `));
   }
   return {
@@ -28689,20 +28781,20 @@ function noteRegistryIndexCache(ctx) {
 }
 function legacyGraphCandidatePaths(ctx) {
   return [
-    path51.join(ctx.paths.cacheDir, "graph-snapshot.json"),
-    path51.join(ctx.paths.dataDir, "graph-snapshot.json"),
-    path51.join(ctx.paths.dataDir, "graph-export.json")
+    path52.join(ctx.paths.cacheDir, "graph-snapshot.json"),
+    path52.join(ctx.paths.dataDir, "graph-snapshot.json"),
+    path52.join(ctx.paths.dataDir, "graph-export.json")
   ];
 }
 function findLegacyGraphFile(ctx) {
   for (const candidate of legacyGraphCandidatePaths(ctx)) {
-    if (fs48.existsSync(candidate) && fs48.statSync(candidate).isFile())
+    if (fs46.existsSync(candidate) && fs46.statSync(candidate).isFile())
       return candidate;
   }
-  const graphDir = path51.join(ctx.paths.cacheDir, "graph");
-  if (fs48.existsSync(graphDir) && fs48.statSync(graphDir).isDirectory()) {
+  const graphDir = path52.join(ctx.paths.cacheDir, "graph");
+  if (fs46.existsSync(graphDir) && fs46.statSync(graphDir).isDirectory()) {
     try {
-      const json = fs48.readdirSync(graphDir).filter((f) => f.endsWith(".json")).map((f) => path51.join(graphDir, f));
+      const json = fs46.readdirSync(graphDir).filter((f) => f.endsWith(".json")).map((f) => path52.join(graphDir, f));
       const [first] = json;
       if (first)
         return first;
@@ -28739,7 +28831,7 @@ async function migrateGraphFileToDb(ctx) {
   if (!legacyFile) {
     return { name, status: "skipped", detail: "no legacy graph file found" };
   }
-  if (!fs48.existsSync(ctx.paths.indexDbPath)) {
+  if (!fs46.existsSync(ctx.paths.indexDbPath)) {
     return {
       name,
       status: "skipped",
@@ -28754,7 +28846,7 @@ async function migrateGraphFileToDb(ctx) {
     };
   }
   try {
-    const raw = fs48.readFileSync(legacyFile, "utf8");
+    const raw = fs46.readFileSync(legacyFile, "utf8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -28832,7 +28924,7 @@ async function migrateGraphFileToDb(ctx) {
       }
       const renamed = `${legacyFile}.migrated`;
       try {
-        fs48.renameSync(legacyFile, renamed);
+        fs46.renameSync(legacyFile, renamed);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         return {
@@ -28856,9 +28948,9 @@ async function migrateGraphFileToDb(ctx) {
 }
 function resolvePrimaryStashDir(configDirPath) {
   try {
-    const cfgPath = path51.join(configDirPath, "config.json");
-    if (fs48.existsSync(cfgPath)) {
-      const cfg = JSON.parse(fs48.readFileSync(cfgPath, "utf8"));
+    const cfgPath = path52.join(configDirPath, "config.json");
+    if (fs46.existsSync(cfgPath)) {
+      const cfg = JSON.parse(fs46.readFileSync(cfgPath, "utf8"));
       if (typeof cfg.stashDir === "string" && cfg.stashDir.length > 0)
         return cfg.stashDir;
     }
@@ -28867,8 +28959,8 @@ function resolvePrimaryStashDir(configDirPath) {
 }
 function countEnvFilesRecursive(dir) {
   let count = 0;
-  for (const entry of fs48.readdirSync(dir, { withFileTypes: true })) {
-    const full = path51.join(dir, entry.name);
+  for (const entry of fs46.readdirSync(dir, { withFileTypes: true })) {
+    const full = path52.join(dir, entry.name);
     if (entry.isDirectory()) {
       count += countEnvFilesRecursive(full);
     } else if (entry.name === ".env" || entry.name.endsWith(".env")) {
@@ -28880,13 +28972,13 @@ function countEnvFilesRecursive(dir) {
 function chmodTreeSecure(dir) {
   const isWin = process.platform === "win32";
   try {
-    fs48.chmodSync(dir, 448);
+    fs46.chmodSync(dir, 448);
   } catch (err) {
     if (!isWin)
       return { ok: false, detail: `chmod 0700 ${dir} failed: ${err instanceof Error ? err.message : err}` };
   }
-  for (const entry of fs48.readdirSync(dir, { withFileTypes: true })) {
-    const full = path51.join(dir, entry.name);
+  for (const entry of fs46.readdirSync(dir, { withFileTypes: true })) {
+    const full = path52.join(dir, entry.name);
     if (entry.isDirectory()) {
       const sub = chmodTreeSecure(full);
       if (!sub.ok)
@@ -28894,8 +28986,8 @@ function chmodTreeSecure(dir) {
       continue;
     }
     try {
-      fs48.chmodSync(full, 384);
-      if (!isWin && (fs48.statSync(full).mode & 511) !== 384) {
+      fs46.chmodSync(full, 384);
+      if (!isWin && (fs46.statSync(full).mode & 511) !== 384) {
         return { ok: false, detail: `mode verification failed for ${full}` };
       }
     } catch (err) {
@@ -28908,13 +29000,13 @@ function chmodTreeSecure(dir) {
 async function migrateVaultsToEnv(ctx) {
   const name = "vaults/ \u2192 env/";
   const stashDir = resolvePrimaryStashDir(ctx.paths.configDir);
-  const vaultsDir = path51.join(stashDir, "vaults");
-  const envDir = path51.join(stashDir, "env");
-  const marker = path51.join(vaultsDir, MIGRATED_MARKER);
-  if (!fs48.existsSync(vaultsDir)) {
+  const vaultsDir = path52.join(stashDir, "vaults");
+  const envDir = path52.join(stashDir, "env");
+  const marker = path52.join(vaultsDir, MIGRATED_MARKER);
+  if (!fs46.existsSync(vaultsDir)) {
     return { name, status: "skipped", detail: `no vaults/ directory under ${stashDir}` };
   }
-  if (fs48.existsSync(marker)) {
+  if (fs46.existsSync(marker)) {
     return { name, status: "skipped", detail: "already migrated (.migrated marker present)" };
   }
   const vaultEnvCount = countEnvFilesRecursive(vaultsDir);
@@ -28945,7 +29037,7 @@ async function migrateVaultsToEnv(ctx) {
         detail: `post-copy count ${envEnvCount} < source ${vaultEnvCount}; no marker written`
       };
     }
-    fs48.writeFileSync(marker, `migrated vaults/ -> env/ at ${new Date().toISOString()}
+    fs46.writeFileSync(marker, `migrated vaults/ -> env/ at ${new Date().toISOString()}
 `, { mode: 384 });
     return {
       name,
@@ -29039,12 +29131,12 @@ task_history: task_id PK).
 Migration complete. No errors.`);
   console.log(`
 Old files at the original locations are safe to delete manually after verifying akm works:
-  ${path51.join(cacheDir, "index.db")}
-  ${path51.join(cacheDir, "workflow.db")}
-  ${path51.join(cacheDir, "events.jsonl")}
-  ${path51.join(cacheDir, "tasks", "history")}
-  ${path51.join(cacheDir, "config-backups")}
-  ${path51.join(configDir, "akm.lock")}
+  ${path52.join(cacheDir, "index.db")}
+  ${path52.join(cacheDir, "workflow.db")}
+  ${path52.join(cacheDir, "events.jsonl")}
+  ${path52.join(cacheDir, "tasks", "history")}
+  ${path52.join(cacheDir, "config-backups")}
+  ${path52.join(configDir, "akm.lock")}
 
 Next step \u2014 repopulate graph data (if migrating from 0.7):
   The 0.8.0 graph schema redesign (DB_VERSION 12 \u2192 13) rebuilds the graph
@@ -29138,12 +29230,12 @@ async function main(args = process.argv.slice(2)) {
 var MIGRATED_MARKER = ".migrated", dataDir, stateDir, cacheDir, configDir, stateDbPath, indexDbPath, PATHS, versionReports, v07To08Migration, v08To09Migration, MIGRATIONS;
 var init_migrate_storage = __esm(() => {
   init_paths();
-  dataDir = process.env.AKM_DATA_DIR?.trim() ?? (process.env.XDG_DATA_HOME?.trim() ? path51.join(process.env.XDG_DATA_HOME.trim(), "akm") : path51.join(os7.homedir(), ".local", "share", "akm"));
-  stateDir = process.env.AKM_STATE_DIR?.trim() ?? (process.env.XDG_STATE_HOME?.trim() ? path51.join(process.env.XDG_STATE_HOME.trim(), "akm") : path51.join(os7.homedir(), ".local", "state", "akm"));
+  dataDir = process.env.AKM_DATA_DIR?.trim() ?? (process.env.XDG_DATA_HOME?.trim() ? path52.join(process.env.XDG_DATA_HOME.trim(), "akm") : path52.join(os7.homedir(), ".local", "share", "akm"));
+  stateDir = process.env.AKM_STATE_DIR?.trim() ?? (process.env.XDG_STATE_HOME?.trim() ? path52.join(process.env.XDG_STATE_HOME.trim(), "akm") : path52.join(os7.homedir(), ".local", "state", "akm"));
   cacheDir = getCacheDir();
   configDir = getConfigDir();
-  stateDbPath = path51.join(dataDir, "state.db");
-  indexDbPath = path51.join(dataDir, "index.db");
+  stateDbPath = path52.join(dataDir, "state.db");
+  indexDbPath = path52.join(dataDir, "index.db");
   PATHS = {
     cacheDir,
     configDir,
@@ -29158,15 +29250,15 @@ var init_migrate_storage = __esm(() => {
     sourceVersion: "0.7",
     isNeeded: (paths) => {
       const candidates = [
-        path51.join(paths.cacheDir, "index.db"),
-        path51.join(paths.cacheDir, "workflow.db"),
-        path51.join(paths.cacheDir, "events.jsonl"),
-        path51.join(paths.cacheDir, "tasks", "history"),
-        path51.join(paths.configDir, "akm.lock"),
-        path51.join(paths.cacheDir, "config-backups"),
-        path51.join(paths.cacheDir, "registry-index")
+        path52.join(paths.cacheDir, "index.db"),
+        path52.join(paths.cacheDir, "workflow.db"),
+        path52.join(paths.cacheDir, "events.jsonl"),
+        path52.join(paths.cacheDir, "tasks", "history"),
+        path52.join(paths.configDir, "akm.lock"),
+        path52.join(paths.cacheDir, "config-backups"),
+        path52.join(paths.cacheDir, "registry-index")
       ];
-      return candidates.some((p) => fs48.existsSync(p));
+      return candidates.some((p) => fs46.existsSync(p));
     },
     steps: [
       { id: "index-db", title: "index.db", run: (ctx) => migrateDb(ctx, "index.db") },
@@ -30641,9 +30733,12 @@ function glyphFor(fixed) {
     return { glyph: "\u2713", severityRank: 2 };
   return { glyph: "\u26A0", severityRank: 1 };
 }
+function locationOf(issue) {
+  return typeof issue.line === "number" ? `${issue.file}:${issue.line}` : issue.file;
+}
 function issueEntry(issue) {
   const { glyph, severityRank } = glyphFor(issue.fixed);
-  return { severityRank, glyph, headline: `${issue.file}  [${issue.issue}]  ${issue.detail}` };
+  return { severityRank, glyph, headline: `${locationOf(issue)}  [${issue.issue}]  ${issue.detail}` };
 }
 function renderIssueSection(title, issues) {
   if (issues.length === 0)
@@ -30655,12 +30750,14 @@ function formatLintPlain(r) {
     return null;
   const fixed = Array.isArray(r.fixed) ? r.fixed : [];
   const flagged = Array.isArray(r.flagged) ? r.flagged : [];
+  const warnings = Array.isArray(r.warnings) ? r.warnings : [];
   const summary = r.summary;
   const lines = [];
   if (typeof r.ok === "boolean")
     lines.push(`ok: ${r.ok}`);
-  lines.push(`summary: fixed=${summary?.fixed ?? fixed.length} flagged=${summary?.flagged ?? flagged.length}`);
+  lines.push(`summary: fixed=${summary?.fixed ?? fixed.length} flagged=${summary?.flagged ?? flagged.length}` + ` warnings=${summary?.warnings ?? warnings.length}`);
   lines.push("", ...renderIssueSection("flagged", flagged));
+  lines.push("", ...renderIssueSection("warnings", warnings));
   lines.push("", ...renderIssueSection("fixed", fixed));
   return lines.join(`
 `).trim();
@@ -31758,10 +31855,10 @@ init_errors();
 import { randomUUID as randomUUID5 } from "crypto";
 import fs43 from "fs";
 import os6 from "os";
-import path48 from "path";
+import path49 from "path";
 
 // src/core/adapter/adapters/akm-lint.ts
-import path7 from "path";
+import path8 from "path";
 
 // src/commands/env/env.ts
 import fs3 from "fs";
@@ -31854,8 +31951,48 @@ function isDangerousEnvKey(key) {
   return false;
 }
 
+// src/workflows/resource-limits.ts
+var WORKFLOW_MAX_PLAN_BYTES = 2 * 1024 * 1024;
+var WORKFLOW_MAX_SOURCE_BYTES = 1024 * 1024;
+var WORKFLOW_MAX_STEPS = 256;
+var WORKFLOW_MAX_PARAMS = 128;
+var WORKFLOW_MAX_ROUTE_BRANCHES = 256;
+var WORKFLOW_MAX_INSTRUCTION_BYTES = 256 * 1024;
+var WORKFLOW_MAX_SCHEMA_BYTES = 256 * 1024;
+var WORKFLOW_MAX_EXTRA_PARAMS_BYTES = 64 * 1024;
+var WORKFLOW_MAX_MAP_EXPANSION = 1e4;
+var WORKFLOW_MAX_INPUTS = 64;
+var WORKFLOW_MAX_CONCURRENCY = 64;
+var WORKFLOW_MAX_GATE_LOOPS = 100;
+var WORKFLOW_MAX_RETRIES = 100;
+var WORKFLOW_MAX_TIMEOUT_MS = 2 ** 31 - 1;
+var WORKFLOW_ENGINE_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+var WORKFLOW_MAX_ENGINE_NAME_LENGTH = 63;
+var WORKFLOW_MAX_EXEC_ARGV = 64;
+var WORKFLOW_MAX_EXEC_ARG_BYTES = 4096;
+var WORKFLOW_MAX_EXEC_CWD_LENGTH = 1024;
+var WORKFLOW_MAX_EXEC_PASS_ENV = 32;
+var WORKFLOW_ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var WORKFLOW_MAX_EXEC_OUTPUT_BYTES = 8 * 1024 * 1024;
+var EXEC_CONTEXT_LIMITS_POSIX = {
+  perVarBytes: 96 * 1024,
+  totalBytes: 128 * 1024,
+  source: "Linux caps one argv/environ string at MAX_ARG_STRLEN (32 pages = 131 072 bytes) and macOS caps argv+environ at ARG_MAX (256 KiB)"
+};
+var WORKFLOW_MAX_EVIDENCE_JSON_BYTES = 1024 * 1024;
+function utf8Bytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function jsonBytes(value) {
+  return utf8Bytes(JSON.stringify(value));
+}
+
 // src/tasks/schema.ts
 var TASK_SCHEMA_VERSION = 2;
+var TASK_EXTENSION = ".yml";
+var TASK_NEAR_MISS_EXTENSION = ".yaml";
+var TASK_MAX_TIMEOUT_MS = WORKFLOW_MAX_TIMEOUT_MS;
+var TASK_MAX_REDACT_NAMES = WORKFLOW_MAX_EXEC_PASS_ENV;
 function taskFieldProblems(data) {
   const problems = [];
   if (data.version !== TASK_SCHEMA_VERSION)
@@ -31866,6 +32003,25 @@ function taskFieldProblems(data) {
     problems.push("enabled (must be a boolean when present)");
   return problems;
 }
+function parseTaskYaml(raw) {
+  try {
+    const doc = $parse(raw);
+    if (doc && typeof doc === "object" && !Array.isArray(doc))
+      return { ok: true, data: doc };
+    return { ok: true, data: {} };
+  } catch (e) {
+    const message = (e instanceof Error ? e.message : String(e)).split(`
+`)[0]?.trim() ?? "unknown parse error";
+    return { ok: false, data: {}, error: message };
+  }
+}
+function taskYamlParseDetail(error) {
+  return `task YAML does not parse: ${error}`;
+}
+function taskExtensionDetail(relPath) {
+  const base = relPath.replace(/\.yaml$/i, "");
+  return `task file uses the ${TASK_NEAR_MISS_EXTENSION} extension; akm recognizes tasks only as ` + `${TASK_EXTENSION}, so this file is never indexed or scheduled \u2014 rename it to ${base}${TASK_EXTENSION}.`;
+}
 
 // src/workflows/program/expressions.ts
 var GRAMMAR_HINT = "allowed forms: params.<name>, steps.<id>.output(.<ident>|[<int>])*";
@@ -31970,6 +32126,36 @@ function formatReference(expr) {
   }
 }
 
+// src/workflows/program/schema.ts
+var PROGRAM_REDUCERS = ["collect", "vote"];
+var PROGRAM_ON_ERROR = ["fail", "continue"];
+var PROGRAM_ISOLATION_KINDS = ["none", "worktree"];
+var RETRY_REASON_SET = {
+  timeout: true,
+  spawn_failed: true,
+  non_zero_exit: true,
+  parse_error: true,
+  cooldown: true,
+  llm_rate_limit: true,
+  llm_content_filter: true,
+  llm_invalid_json: true,
+  content_policy_reject: true,
+  unsupported_type: true,
+  no_change: true,
+  aborted: true
+};
+var PROGRAM_RETRY_REASONS = Object.keys(RETRY_REASON_SET);
+var PROGRAM_STEP_ID_PATTERN = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+var PROGRAM_PARAM_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function projectExecCore(exec) {
+  return {
+    command: [...exec.command],
+    ...exec.cwd ? { cwd: exec.cwd } : {},
+    ...exec.passEnv && exec.passEnv.length > 0 ? { passEnv: [...exec.passEnv] } : {},
+    ...exec.inheritEnv ? { inheritEnv: true } : {}
+  };
+}
+
 // src/workflows/ir/compile.ts
 function compileWorkflowPlan(document, title) {
   const errors2 = [];
@@ -32069,6 +32255,7 @@ function compileUnit(unit, id, instructions, defaults, inputs, source) {
     instructions,
     templating: "verbatim",
     ...inputs && inputs.length > 0 ? { inputs: [...inputs] } : {},
+    ...unit?.exec ? { exec: projectExecCore(unit.exec) } : {},
     ...unit?.output !== undefined ? { schema: unit.output } : {},
     ...unit?.retry ? { retry: { max: unit.retry.max, on: [...unit.retry.on] } } : {},
     onError: unit?.onError ?? defaults?.onError ?? "fail",
@@ -32116,6 +32303,14 @@ function collectWorkflowWarnings(document) {
   const warnings = [];
   const declaredParams = document.params ? new Set(Object.keys(document.params)) : undefined;
   for (const step of document.steps) {
+    const maxLoops = step.gate?.maxLoops ?? 1;
+    const execUnit = step.map ? step.map.unit?.exec : step.unit?.exec;
+    if (maxLoops > 1 && execUnit && step.gateRubric?.text.trim()) {
+      warnings.push({
+        line: step.source.start,
+        message: `Step "${step.id}" declares \`gate.max_loops: ${maxLoops}\` on an \`exec\` step \u2014 it runs its command ` + `ONCE. A gate loop re-executes the step so it can address the judge's feedback, and a frozen argv cannot ` + `read that feedback; looping would only repeat the command's side effects. The gate still evaluates and ` + `can still fail the step.`
+      });
+    }
     if ((step.map || step.route === undefined) && step.output === undefined) {
       warnings.push({
         line: step.source.start,
@@ -32147,6 +32342,22 @@ function collectWorkflowWarnings(document) {
 // src/core/asset/frontmatter.ts
 import fs4 from "fs";
 
+// src/core/write-provenance.ts
+import path7 from "path";
+var activeJournals = new Set;
+function recordWrittenPath(filePath) {
+  if (activeJournals.size === 0 || !filePath)
+    return;
+  let absolute;
+  try {
+    absolute = path7.resolve(filePath);
+  } catch {
+    return;
+  }
+  for (const journal of activeJournals)
+    journal.touched.add(absolute);
+}
+
 // src/core/asset/asset-serialize.ts
 function serializeFrontmatter(frontmatter) {
   return $stringify(frontmatter).trimEnd();
@@ -32249,6 +32460,7 @@ ${serializeFrontmatter(nextFrontmatter)}
 ---
 ${parsed.content}` : assembleAsset(nextFrontmatter, parsed.content);
   fs4.writeFileSync(filePath, next, "utf8");
+  recordWrittenPath(filePath);
   return true;
 }
 function parseFrontmatterBlock(raw) {
@@ -32300,6 +32512,9 @@ function parseMarkdownToc(content) {
   return { headings, totalLines: lines.length };
 }
 
+// src/workflows/parser.ts
+init_common();
+
 // src/core/extra-params.ts
 var EXTRA_PARAMS_PROTECTED_TOP_LEVEL_KEYS = [
   "model",
@@ -32332,10 +32547,10 @@ function validateExtraParams(value) {
     return [{ path: [], message: "must be an object" }];
   }
   const issues = [];
-  const visit2 = (entry, path7) => {
+  const visit2 = (entry, path8) => {
     if (Array.isArray(entry)) {
       entry.forEach((child, index) => {
-        visit2(child, [...path7, index]);
+        visit2(child, [...path8, index]);
       });
       return;
     }
@@ -32343,13 +32558,13 @@ function validateExtraParams(value) {
       return;
     for (const [key, child] of Object.entries(entry)) {
       const normalized = normalizeExtraParamKey(key);
-      if (path7.length === 0 && PROTECTED_TOP_LEVEL_KEYS.has(normalized)) {
+      if (path8.length === 0 && PROTECTED_TOP_LEVEL_KEYS.has(normalized)) {
         issues.push({ path: [key], message: `${key} is protected by AKM` });
       }
       if (CREDENTIAL_KEYS.has(normalized)) {
-        issues.push({ path: [...path7, key], message: `${key} cannot carry credentials` });
+        issues.push({ path: [...path8, key], message: `${key} cannot carry credentials` });
       }
-      visit2(child, [...path7, key]);
+      visit2(child, [...path8, key]);
     }
   };
   visit2(value, []);
@@ -32360,44 +32575,179 @@ function formatExtraParamsIssue(label, issue) {
   return `${label}${suffix} ${issue.message}`;
 }
 
-// src/workflows/program/schema.ts
-var PROGRAM_REDUCERS = ["collect", "vote"];
-var PROGRAM_ON_ERROR = ["fail", "continue"];
-var PROGRAM_ISOLATION_KINDS = ["none", "worktree"];
-var RETRY_REASON_SET = {
-  timeout: true,
-  spawn_failed: true,
-  non_zero_exit: true,
-  parse_error: true,
-  cooldown: true,
-  llm_rate_limit: true,
-  llm_content_filter: true,
-  llm_invalid_json: true,
-  content_policy_reject: true,
-  unsupported_type: true,
-  no_change: true,
-  aborted: true
-};
-var PROGRAM_RETRY_REASONS = Object.keys(RETRY_REASON_SET);
-var PROGRAM_STEP_ID_PATTERN = /^[A-Za-z_][A-Za-z0-9_-]*$/;
-var PROGRAM_PARAM_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-// src/workflows/resource-limits.ts
-var WORKFLOW_MAX_PLAN_BYTES = 2 * 1024 * 1024;
-var WORKFLOW_MAX_SOURCE_BYTES = 1024 * 1024;
-var WORKFLOW_MAX_STEPS = 256;
-var WORKFLOW_MAX_PARAMS = 128;
-var WORKFLOW_MAX_ROUTE_BRANCHES = 256;
-var WORKFLOW_MAX_INSTRUCTION_BYTES = 256 * 1024;
-var WORKFLOW_MAX_SCHEMA_BYTES = 256 * 1024;
-var WORKFLOW_MAX_EXTRA_PARAMS_BYTES = 64 * 1024;
-var WORKFLOW_MAX_MAP_EXPANSION = 1e4;
-var WORKFLOW_MAX_INPUTS = 64;
-function utf8Bytes(value) {
-  return Buffer.byteLength(value, "utf8");
+// src/core/json-schema.ts
+var MAX_DEFINITION_DEPTH = 64;
+var JSON_SCHEMA_SUBSET_SUPPORTED_KEYWORDS = "type, enum, properties, required, items, additionalProperties: false, minItems, maxItems, " + "minLength, maxLength, minimum, maximum, allOf, anyOf, oneOf, not";
+var KNOWN_TYPE_NAMES = new Set(["string", "number", "integer", "boolean", "object", "array", "null"]);
+var UNSUPPORTED_KEYWORDS = new Set([
+  "$ref",
+  "$defs",
+  "definitions",
+  "$anchor",
+  "$dynamicRef",
+  "$dynamicAnchor",
+  "if",
+  "then",
+  "else",
+  "const",
+  "pattern",
+  "format",
+  "patternProperties",
+  "propertyNames",
+  "additionalItems",
+  "prefixItems",
+  "contains",
+  "minContains",
+  "maxContains",
+  "uniqueItems",
+  "multipleOf",
+  "exclusiveMinimum",
+  "exclusiveMaximum",
+  "minProperties",
+  "maxProperties",
+  "dependencies",
+  "dependentRequired",
+  "dependentSchemas",
+  "unevaluatedItems",
+  "unevaluatedProperties",
+  "contentEncoding",
+  "contentMediaType",
+  "contentSchema"
+]);
+var UNSUPPORTED_KEYWORD_HINTS = new Map([
+  ["$ref", `inline the referenced schema (the subset resolves no references, so it cannot follow "$ref")`],
+  ["$defs", `inline the definitions at their use sites \u2014 "$ref" is not resolved, so "$defs" can never be reached`],
+  [
+    "definitions",
+    `inline the definitions at their use sites \u2014 "$ref" is not resolved, so "definitions" can never be reached`
+  ],
+  ["const", `use a single-value "enum" (e.g. enum: [pass])`],
+  [
+    "pattern",
+    `use "enum" when the allowed strings can be listed, or "minLength"/"maxLength" for a size bound \u2014 ` + `a regular-expression constraint is not expressible in the subset; check the shape in the step's gate rubric instead`
+  ],
+  [
+    "format",
+    `"format" is annotation-only in JSON Schema 2020-12 and the subset enforces no string-shape keyword \u2014 ` + `use "enum" when the allowed values can be listed, otherwise check the shape in the step's gate rubric`
+  ],
+  ["patternProperties", `declare the properties explicitly under "properties", or drop the constraint`],
+  ["if", `use "anyOf"/"oneOf" to express the alternatives directly`],
+  ["then", `use "anyOf"/"oneOf" to express the alternatives directly`],
+  ["else", `use "anyOf"/"oneOf" to express the alternatives directly`],
+  ["uniqueItems", `drop the constraint, or validate uniqueness in the step's gate rubric`]
+]);
+function checkJsonSchemaDefinition(schema) {
+  const issues = [];
+  checkDefinitionNode(schema, [], issues, 0);
+  return issues;
 }
-function jsonBytes(value) {
-  return utf8Bytes(JSON.stringify(value));
+function pointerFor(path8) {
+  return path8.length === 0 ? "$" : `$.${path8.map(String).join(".")}`;
+}
+function pushIssue(issues, path8, keyword, kind, message) {
+  issues.push({ path: [...path8], pointer: pointerFor(path8), keyword, kind, message });
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function checkDefinitionNode(schema, path8, issues, depth) {
+  if (depth > MAX_DEFINITION_DEPTH) {
+    pushIssue(issues, path8, "(depth)", "malformed", `schema nesting exceeds the depth limit of ${MAX_DEFINITION_DEPTH}`);
+    return;
+  }
+  for (const keyword of Object.keys(schema)) {
+    if (UNSUPPORTED_KEYWORDS.has(keyword)) {
+      const hint = UNSUPPORTED_KEYWORD_HINTS.get(keyword);
+      pushIssue(issues, [...path8, keyword], keyword, "unsupported", `keyword "${keyword}" is not enforced by the workflow schema subset \u2014 the schema would silently not ` + `constrain what it looks like it constrains${hint ? `; ${hint}` : ""}`);
+    }
+  }
+  const declared = schema.type;
+  if (declared !== undefined) {
+    const names = Array.isArray(declared) ? declared : [declared];
+    if (names.length === 0) {
+      pushIssue(issues, [...path8, "type"], "type", "malformed", `"type" must name at least one type`);
+    }
+    for (const [index, name] of names.entries()) {
+      const namePath = Array.isArray(declared) ? [...path8, "type", index] : [...path8, "type"];
+      if (typeof name !== "string") {
+        pushIssue(issues, namePath, "type", "malformed", `"type" must be a string or an array of strings`);
+      } else if (!KNOWN_TYPE_NAMES.has(name)) {
+        pushIssue(issues, namePath, "type", "malformed", `unknown type ${JSON.stringify(name)} (valid types: ${[...KNOWN_TYPE_NAMES].join(", ")})`);
+      }
+    }
+  }
+  if (schema.enum !== undefined && (!Array.isArray(schema.enum) || schema.enum.length === 0)) {
+    pushIssue(issues, [...path8, "enum"], "enum", "malformed", `"enum" must be a non-empty array of allowed values`);
+  }
+  for (const keyword of ["allOf", "anyOf", "oneOf"]) {
+    const branches = schema[keyword];
+    if (branches === undefined)
+      continue;
+    if (!Array.isArray(branches) || branches.length === 0) {
+      pushIssue(issues, [...path8, keyword], keyword, "malformed", `"${keyword}" must be a non-empty array of schema objects`);
+      continue;
+    }
+    branches.forEach((branch, index) => {
+      if (isPlainObject(branch)) {
+        checkDefinitionNode(branch, [...path8, keyword, index], issues, depth + 1);
+      } else {
+        pushIssue(issues, [...path8, keyword, index], keyword, "malformed", `"${keyword}[${index}]" must be a schema object`);
+      }
+    });
+  }
+  if (schema.not !== undefined) {
+    if (isPlainObject(schema.not)) {
+      checkDefinitionNode(schema.not, [...path8, "not"], issues, depth + 1);
+    } else {
+      pushIssue(issues, [...path8, "not"], "not", "malformed", `"not" must be a schema object`);
+    }
+  }
+  if (schema.required !== undefined) {
+    if (!Array.isArray(schema.required) || !schema.required.every((key) => typeof key === "string")) {
+      pushIssue(issues, [...path8, "required"], "required", "malformed", `"required" must be an array of property-name strings`);
+    }
+  }
+  if (schema.properties !== undefined) {
+    if (!isPlainObject(schema.properties)) {
+      pushIssue(issues, [...path8, "properties"], "properties", "malformed", `"properties" must be an object mapping property names to schemas`);
+    } else {
+      for (const [key, propSchema] of Object.entries(schema.properties)) {
+        if (isPlainObject(propSchema)) {
+          checkDefinitionNode(propSchema, [...path8, "properties", key], issues, depth + 1);
+        } else {
+          pushIssue(issues, [...path8, "properties", key], "properties", "malformed", `property ${JSON.stringify(key)} must be a schema object`);
+        }
+      }
+    }
+  }
+  if (schema.items !== undefined) {
+    if (isPlainObject(schema.items)) {
+      checkDefinitionNode(schema.items, [...path8, "items"], issues, depth + 1);
+    } else if (Array.isArray(schema.items)) {
+      pushIssue(issues, [...path8, "items"], "items", "unsupported", `tuple-form "items" (an array of schemas) is not enforced by the workflow schema subset \u2014 use a single schema object`);
+    } else {
+      pushIssue(issues, [...path8, "items"], "items", "malformed", `"items" must be a schema object`);
+    }
+  }
+  if (schema.additionalProperties !== undefined && typeof schema.additionalProperties !== "boolean") {
+    if (isPlainObject(schema.additionalProperties)) {
+      pushIssue(issues, [...path8, "additionalProperties"], "additionalProperties", "unsupported", `schema-form "additionalProperties" is not enforced by the workflow schema subset \u2014 only "additionalProperties: false" is`);
+    } else {
+      pushIssue(issues, [...path8, "additionalProperties"], "additionalProperties", "malformed", `"additionalProperties" must be a boolean (only "false" is enforced)`);
+    }
+  }
+  for (const keyword of ["minItems", "maxItems", "minLength", "maxLength"]) {
+    const value = schema[keyword];
+    if (value !== undefined && (typeof value !== "number" || !Number.isInteger(value) || value < 0)) {
+      pushIssue(issues, [...path8, keyword], keyword, "malformed", `"${keyword}" must be a non-negative integer`);
+    }
+  }
+  for (const keyword of ["minimum", "maximum"]) {
+    const value = schema[keyword];
+    if (value !== undefined && (typeof value !== "number" || !Number.isFinite(value))) {
+      pushIssue(issues, [...path8, keyword], keyword, "malformed", `"${keyword}" must be a finite number`);
+    }
+  }
 }
 
 // src/workflows/schema.ts
@@ -32471,7 +32821,9 @@ var TOP_LEVEL_KEYS = [...ENVELOPE_KEYS, ...WORKFLOW_KEYS];
 var DEFAULTS_KEYS = ["engine", "model", "timeout", "on_error", "llm"];
 var BUDGET_KEYS = ["max_tokens", "max_units"];
 var STEP_KEYS = ["id", "unit", "map", "route", "inputs", "output", "gate"];
-var UNIT_KEYS = ["engine", "model", "llm", "timeout", "retry", "on_error", "output", "env", "isolation"];
+var UNIT_KEYS = ["exec", "engine", "model", "llm", "timeout", "retry", "on_error", "output", "env", "isolation"];
+var EXEC_KEYS = ["command", "cwd", "pass_env", "inherit_env"];
+var UNIT_ENGINE_KEYS = ["engine", "model", "llm"];
 var MAP_KEYS = ["over", "concurrency", "reducer", "unit"];
 var ROUTE_KEYS = ["input", "when", "default"];
 var RETRY_KEYS = ["max", "on"];
@@ -32489,7 +32841,7 @@ function parseWorkflow(markdown, source) {
     };
   }
   const errors2 = [];
-  const path7 = source.path;
+  const path8 = source.path;
   const lines = markdown.split(/\r?\n/);
   const totalLines = lines.length;
   const fmBlock = parseFrontmatterBlock(markdown);
@@ -32541,7 +32893,7 @@ function parseWorkflow(markdown, source) {
     return 2;
   };
   const ctx = {
-    filePath: path7,
+    filePath: path8,
     errors: errors2,
     lineAt,
     lineAtOffset: (offset) => Math.max(1, lineCounter2.linePos(offset).line + lineOffset),
@@ -32553,10 +32905,10 @@ function parseWorkflow(markdown, source) {
         if (range) {
           const start = Math.max(1, lineCounter2.linePos(range[0]).line + lineOffset);
           const end = Math.max(start, lineCounter2.linePos(Math.max(range[0], range[1] - 1)).line + lineOffset);
-          return { path: path7, start, end };
+          return { path: path8, start, end };
         }
       }
-      return { path: path7, start: frontmatterEndLine, end: frontmatterEndLine };
+      return { path: path8, start: frontmatterEndLine, end: frontmatterEndLine };
     },
     err: (p, message) => errors2.push({ line: lineAt(p), message }),
     errAtLine: (line, message) => errors2.push({ line, message })
@@ -32579,7 +32931,7 @@ function parseWorkflow(markdown, source) {
   const parsedSteps = parseSteps(ctx, root.steps);
   const toc = parseMarkdownToc(markdown);
   const declaredIds = new Set(parsedSteps.map((s) => s.id));
-  const { sections, preamble } = bindStepSections(toc.headings, lines, fmBlock.bodyStartLine, totalLines, path7, declaredIds, errors2);
+  const { sections, preamble } = bindStepSections(toc.headings, lines, fmBlock.bodyStartLine, totalLines, path8, declaredIds, errors2);
   const steps = parsedSteps.map((step, index) => {
     const section = sections.get(step.id);
     if (!section) {
@@ -32622,14 +32974,14 @@ function parseWorkflow(markdown, source) {
     ...budget ? { budget } : {},
     steps,
     ...preamble ? { preamble } : {},
-    source: { path: path7, lineCount: totalLines }
+    source: { path: path8, lineCount: totalLines }
   };
   runSemanticChecks(draft, root, frontmatterEndLine, errors2);
   if (errors2.length > 0)
     return { ok: false, errors: sortErrors(errors2) };
   return { ok: true, document: draft };
 }
-function bindStepSections(headings, lines, bodyStartLine, totalLines, path7, declaredIds, errors2) {
+function bindStepSections(headings, lines, bodyStartLine, totalLines, path8, declaredIds, errors2) {
   const sections = new Map;
   const h2s = headings.filter((h) => h.level === 2);
   const firstH2Line = h2s[0]?.line;
@@ -32653,24 +33005,24 @@ function bindStepSections(headings, lines, bodyStartLine, totalLines, path7, dec
       continue;
     }
     const sectionEnd = findNextHeadingAtOrAboveLevel(headings, i, 2, totalLines);
-    const gate = findGateSubsection(headings, i, sectionEnd, path7, h.text, errors2);
+    const gate = findGateSubsection(headings, i, sectionEnd, path8, h.text, errors2);
     const instructionsEnd = gate ? gate.headingLine - 1 : sectionEnd;
     const instructionsText = sliceProseLines(lines, h.line + 1, instructionsEnd);
     const section = { headingLine: h.line };
     if (instructionsText) {
-      section.instructions = { text: instructionsText, source: { path: path7, start: h.line + 1, end: instructionsEnd } };
+      section.instructions = { text: instructionsText, source: { path: path8, start: h.line + 1, end: instructionsEnd } };
     }
     if (gate) {
       const gateText = sliceProseLines(lines, gate.bodyStart, gate.bodyEnd);
       if (gateText) {
-        section.gateRubric = { text: gateText, source: { path: path7, start: gate.bodyStart, end: gate.bodyEnd } };
+        section.gateRubric = { text: gateText, source: { path: path8, start: gate.bodyStart, end: gate.bodyEnd } };
       }
     }
     sections.set(h.text, section);
   }
   return { sections, preamble: preambleRaw || undefined };
 }
-function findGateSubsection(headings, stepHeadingIndex, sectionEnd, path7, stepId, errors2) {
+function findGateSubsection(headings, stepHeadingIndex, sectionEnd, path8, stepId, errors2) {
   let found;
   for (let j = stepHeadingIndex + 1;j < headings.length; j++) {
     const h = headings[j];
@@ -32752,19 +33104,19 @@ function checkEnvelopeFields(ctx, root, fmEndLine) {
     ctx.err(["stale_after"], `Workflow frontmatter "stale_after" must be a string.`);
   }
 }
-function checkActorStamp(ctx, value, path7, label) {
+function checkActorStamp(ctx, value, path8, label) {
   if (value === undefined)
     return;
   if (!isPlainRecord(value)) {
-    ctx.err(path7, `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
+    ctx.err(path8, `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
     return;
   }
-  checkUnknownKeys(ctx, value, path7, ACTOR_STAMP_KEYS, `${label} actor stamp`);
+  checkUnknownKeys(ctx, value, path8, ACTOR_STAMP_KEYS, `${label} actor stamp`);
   if (typeof value.by !== "string" || value.by.length === 0) {
-    ctx.err([...path7, "by"], `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
+    ctx.err([...path8, "by"], `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
   }
   if (value.at !== undefined && typeof value.at !== "string") {
-    ctx.err([...path7, "at"], `Workflow frontmatter ${label} actor stamp "at" must be a string.`);
+    ctx.err([...path8, "at"], `Workflow frontmatter ${label} actor stamp "at" must be a string.`);
   }
 }
 function readTags(ctx, value, fmEndLine) {
@@ -32803,6 +33155,10 @@ function parseParams(ctx, raw) {
       ctx.err(["params", paramName], `Param "${paramName}" must be a JSON Schema object (e.g. { type: string }).`);
       continue;
     }
+    if (jsonBytes(value) > WORKFLOW_MAX_SCHEMA_BYTES) {
+      ctx.err(["params", paramName], `Param "${paramName}" schema exceeds the 256 KiB resource limit.`);
+    }
+    checkSchemaDefinition(ctx, value, ["params", paramName], `Param "${paramName}" schema`);
     params[paramName] = value;
   }
   return Object.keys(params).length > 0 ? params : undefined;
@@ -32810,32 +33166,31 @@ function parseParams(ctx, raw) {
 function parseDefaults(ctx, raw) {
   if (raw === undefined)
     return;
-  const path7 = ["defaults"];
+  const path8 = ["defaults"];
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `"defaults" must be a mapping with any of: ${DEFAULTS_KEYS.join(", ")}.`);
+    ctx.err(path8, `"defaults" must be a mapping with any of: ${DEFAULTS_KEYS.join(", ")}.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path7, DEFAULTS_KEYS, `"defaults"`);
+  checkUnknownKeys(ctx, raw, path8, DEFAULTS_KEYS, `"defaults"`);
   const defaults = {};
   if (raw.engine !== undefined) {
-    if (typeof raw.engine === "string" && raw.engine.trim() !== "")
-      defaults.engine = raw.engine.trim();
-    else
-      ctx.err([...path7, "engine"], `"defaults.engine" must be a non-empty engine name.`);
+    const engine = parseEngineName(ctx, raw.engine, [...path8, "engine"], `"defaults.engine"`);
+    if (engine !== undefined)
+      defaults.engine = engine;
   }
   if (raw.model !== undefined) {
     if (typeof raw.model === "string" && raw.model.trim() !== "")
       defaults.model = raw.model.trim();
     else
-      ctx.err([...path7, "model"], `"defaults.model" must be a non-empty string (a model alias or exact id).`);
+      ctx.err([...path8, "model"], `"defaults.model" must be a non-empty string (a model alias or exact id).`);
   }
-  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path7, "timeout"], `"defaults.timeout"`);
+  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path8, "timeout"], `"defaults.timeout"`);
   if (timeoutMs !== undefined)
     defaults.timeoutMs = timeoutMs;
-  const onError = parseEnumField(ctx, raw.on_error, [...path7, "on_error"], `"defaults.on_error"`, PROGRAM_ON_ERROR);
+  const onError = parseEnumField(ctx, raw.on_error, [...path8, "on_error"], `"defaults.on_error"`, PROGRAM_ON_ERROR);
   if (onError !== undefined)
     defaults.onError = onError;
-  const llm = parseLlmOverrides(ctx, raw.llm, [...path7, "llm"], `"defaults.llm"`);
+  const llm = parseLlmOverrides(ctx, raw.llm, [...path8, "llm"], `"defaults.llm"`);
   if (llm !== undefined)
     defaults.llm = llm;
   return Object.keys(defaults).length > 0 ? defaults : undefined;
@@ -32843,25 +33198,25 @@ function parseDefaults(ctx, raw) {
 function parseBudget(ctx, raw) {
   if (raw === undefined)
     return;
-  const path7 = ["budget"];
+  const path8 = ["budget"];
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `"budget" must be a mapping with any of: ${BUDGET_KEYS.join(", ")}.`);
+    ctx.err(path8, `"budget" must be a mapping with any of: ${BUDGET_KEYS.join(", ")}.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path7, BUDGET_KEYS, `"budget"`);
+  checkUnknownKeys(ctx, raw, path8, BUDGET_KEYS, `"budget"`);
   const budget = {};
   if (raw.max_tokens !== undefined) {
     if (typeof raw.max_tokens === "number" && Number.isInteger(raw.max_tokens) && raw.max_tokens >= 1) {
       budget.maxTokens = raw.max_tokens;
     } else {
-      ctx.err([...path7, "max_tokens"], `"budget.max_tokens" must be an integer >= 1.`);
+      ctx.err([...path8, "max_tokens"], `"budget.max_tokens" must be an integer >= 1.`);
     }
   }
   if (raw.max_units !== undefined) {
     if (typeof raw.max_units === "number" && Number.isInteger(raw.max_units) && raw.max_units >= 1 && raw.max_units <= WORKFLOW_MAX_MAP_EXPANSION) {
       budget.maxUnits = raw.max_units;
     } else {
-      ctx.err([...path7, "max_units"], `"budget.max_units" must be an integer from 1 through ${WORKFLOW_MAX_MAP_EXPANSION}.`);
+      ctx.err([...path8, "max_units"], `"budget.max_units" must be an integer from 1 through ${WORKFLOW_MAX_MAP_EXPANSION}.`);
     }
   }
   return Object.keys(budget).length > 0 ? budget : undefined;
@@ -32884,49 +33239,49 @@ function parseSteps(ctx, raw) {
   const seenIds = new Map;
   const routeChecks = [];
   raw.forEach((rawStep, index) => {
-    const path7 = ["steps", index];
+    const path8 = ["steps", index];
     if (!isPlainRecord(rawStep)) {
-      ctx.err(path7, `Step ${index + 1} must be a mapping with an "id".`);
+      ctx.err(path8, `Step ${index + 1} must be a mapping with an "id".`);
       return;
     }
     const label = typeof rawStep.id === "string" && rawStep.id !== "" ? `Step "${rawStep.id}"` : `Step ${index + 1}`;
-    checkUnknownKeys(ctx, rawStep, path7, STEP_KEYS, label);
+    checkUnknownKeys(ctx, rawStep, path8, STEP_KEYS, label);
     let id = "";
     if (typeof rawStep.id !== "string" || rawStep.id === "") {
-      ctx.err([...path7, "id"], `${label} requires a non-empty string "id".`);
+      ctx.err([...path8, "id"], `${label} requires a non-empty string "id".`);
     } else if (!PROGRAM_STEP_ID_PATTERN.test(rawStep.id)) {
-      ctx.err([...path7, "id"], `${label} has an invalid id "${rawStep.id}". A step id cannot be referenced from steps.${rawStep.id}.output ` + `unless it matches [A-Za-z_][A-Za-z0-9_-]* (a letter or underscore first, then letters, digits, ` + `underscores, or dashes; no dots, no leading digit).`);
+      ctx.err([...path8, "id"], `${label} has an invalid id "${rawStep.id}". A step id cannot be referenced from steps.${rawStep.id}.output ` + `unless it matches [A-Za-z_][A-Za-z0-9_-]* (a letter or underscore first, then letters, digits, ` + `underscores, or dashes; no dots, no leading digit).`);
     } else {
       id = rawStep.id;
       const firstIndex = seenIds.get(id);
       if (firstIndex !== undefined) {
-        ctx.err([...path7, "id"], `Duplicate step id "${id}" (first used by step ${firstIndex + 1}). Step ids must be unique.`);
+        ctx.err([...path8, "id"], `Duplicate step id "${id}" (first used by step ${firstIndex + 1}). Step ids must be unique.`);
       } else {
         seenIds.set(id, index);
       }
     }
     const declaredKinds = ["map", "route"].filter((kind) => rawStep[kind] !== undefined);
     if (declaredKinds.length > 1) {
-      ctx.err(path7, `${label} must declare at most one of "map" or "route" (found ${declaredKinds.join(" + ")}).`);
+      ctx.err(path8, `${label} must declare at most one of "map" or "route" (found ${declaredKinds.join(" + ")}).`);
     }
     const isRoute = rawStep.route !== undefined;
     const isMapStep = rawStep.map !== undefined;
     if (isRoute && rawStep.unit !== undefined) {
-      ctx.err(path7, `${label} is a route step and cannot also declare "unit" (route steps dispatch no unit).`);
+      ctx.err(path8, `${label} is a route step and cannot also declare "unit" (route steps dispatch no unit).`);
     }
     if (isMapStep && rawStep.unit !== undefined) {
-      ctx.err(path7, `${label} is a map step; the per-item dispatch-override bag belongs at "map.unit", not top-level "unit".`);
+      ctx.err(path8, `${label} is a map step; the per-item dispatch-override bag belongs at "map.unit", not top-level "unit".`);
     }
     if (isRoute && rawStep.inputs !== undefined) {
-      ctx.err(path7, `${label} is a route step and cannot declare "inputs" (route steps dispatch no unit).`);
-    }
-    const unit = rawStep.unit !== undefined && !isRoute && !isMapStep ? parseUnit(ctx, rawStep.unit, [...path7, "unit"], label) : undefined;
-    const map = isMapStep ? parseMap(ctx, rawStep.map, [...path7, "map"], label) : undefined;
-    const route = isRoute ? parseRoute(ctx, rawStep.route, [...path7, "route"], label, index, routeChecks) : undefined;
-    const inputs = !isRoute ? parseInputs(ctx, rawStep.inputs, [...path7, "inputs"], label) : undefined;
-    const output = parseSchemaObject(ctx, rawStep.output, [...path7, "output"], `${label} "output"`);
-    const gate = rawStep.gate !== undefined ? parseGate(ctx, rawStep.gate, [...path7, "gate"], label) : undefined;
-    const step = { id, source: ctx.refAt(path7) };
+      ctx.err(path8, `${label} is a route step and cannot declare "inputs" (route steps dispatch no unit).`);
+    }
+    const unit = rawStep.unit !== undefined && !isRoute && !isMapStep ? parseUnit(ctx, rawStep.unit, [...path8, "unit"], label) : undefined;
+    const map = isMapStep ? parseMap(ctx, rawStep.map, [...path8, "map"], label) : undefined;
+    const route = isRoute ? parseRoute(ctx, rawStep.route, [...path8, "route"], label, index, routeChecks) : undefined;
+    const inputs = !isRoute ? parseInputs(ctx, rawStep.inputs, [...path8, "inputs"], label) : undefined;
+    const output = parseSchemaObject(ctx, rawStep.output, [...path8, "output"], `${label} "output"`);
+    const gate = rawStep.gate !== undefined ? parseGate(ctx, rawStep.gate, [...path8, "gate"], label) : undefined;
+    const step = { id, source: ctx.refAt(path8) };
     if (unit)
       step.unit = unit;
     if (map)
@@ -32958,75 +33313,175 @@ function parseSteps(ctx, raw) {
   }
   return steps;
 }
-function parseUnit(ctx, raw, path7, stepLabel) {
+function parseUnit(ctx, raw, path8, stepLabel) {
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `${stepLabel} "unit" must be a mapping (a dispatch-override bag).`);
+    ctx.err(path8, `${stepLabel} "unit" must be a mapping (a dispatch-override bag).`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path7, UNIT_KEYS, `${stepLabel} "unit"`);
-  const unit = { source: ctx.refAt(path7) };
+  checkUnknownKeys(ctx, raw, path8, UNIT_KEYS, `${stepLabel} "unit"`);
+  const unit = { source: ctx.refAt(path8) };
+  if (raw.exec !== undefined) {
+    const exec = parseExec(ctx, raw.exec, [...path8, "exec"], stepLabel);
+    if (exec !== undefined)
+      unit.exec = exec;
+    for (const key of UNIT_ENGINE_KEYS) {
+      if (raw[key] === undefined)
+        continue;
+      ctx.err([...path8, key], `${stepLabel} "unit" declares both "exec" and "${key}". An exec unit runs a shell command and never ` + `reaches an engine, so "${key}" would have no effect \u2014 remove one of the two.`);
+    }
+  }
   if (raw.engine !== undefined) {
-    if (typeof raw.engine === "string" && raw.engine.trim() !== "")
-      unit.engine = raw.engine.trim();
-    else
-      ctx.err([...path7, "engine"], `${stepLabel} "engine" must be a non-empty engine name.`);
+    const engine = parseEngineName(ctx, raw.engine, [...path8, "engine"], `${stepLabel} "engine"`);
+    if (engine !== undefined)
+      unit.engine = engine;
   }
   if (raw.model !== undefined) {
     if (typeof raw.model === "string" && raw.model.trim() !== "")
       unit.model = raw.model.trim();
     else
-      ctx.err([...path7, "model"], `${stepLabel} "model" must be a non-empty string (a model alias or exact id).`);
+      ctx.err([...path8, "model"], `${stepLabel} "model" must be a non-empty string (a model alias or exact id).`);
   }
-  const llm = parseLlmOverrides(ctx, raw.llm, [...path7, "llm"], `${stepLabel} "llm"`);
+  const llm = parseLlmOverrides(ctx, raw.llm, [...path8, "llm"], `${stepLabel} "llm"`);
   if (llm !== undefined)
     unit.llm = llm;
-  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path7, "timeout"], `${stepLabel} "timeout"`);
+  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path8, "timeout"], `${stepLabel} "timeout"`);
   if (timeoutMs !== undefined)
     unit.timeoutMs = timeoutMs;
-  const retry = parseRetry(ctx, raw.retry, [...path7, "retry"], stepLabel);
+  const retry = parseRetry(ctx, raw.retry, [...path8, "retry"], stepLabel);
   if (retry !== undefined)
     unit.retry = retry;
-  const onError = parseEnumField(ctx, raw.on_error, [...path7, "on_error"], `${stepLabel} "on_error"`, PROGRAM_ON_ERROR);
+  const onError = parseEnumField(ctx, raw.on_error, [...path8, "on_error"], `${stepLabel} "on_error"`, PROGRAM_ON_ERROR);
   if (onError !== undefined)
     unit.onError = onError;
-  const output = parseSchemaObject(ctx, raw.output, [...path7, "output"], `${stepLabel} unit "output"`);
+  const output = parseSchemaObject(ctx, raw.output, [...path8, "output"], `${stepLabel} unit "output"`);
   if (output !== undefined)
     unit.output = output;
   if (raw.env !== undefined) {
     if (Array.isArray(raw.env) && raw.env.every((entry) => typeof entry === "string" && entry.trim() !== "")) {
       unit.env = raw.env.map((entry) => entry.trim());
     } else {
-      ctx.err([...path7, "env"], `${stepLabel} "env" must be a list of non-empty env asset refs.`);
+      ctx.err([...path8, "env"], `${stepLabel} "env" must be a list of non-empty env asset refs.`);
     }
   }
-  const isolation = parseEnumField(ctx, raw.isolation, [...path7, "isolation"], `${stepLabel} "isolation"`, PROGRAM_ISOLATION_KINDS);
+  const isolation = parseEnumField(ctx, raw.isolation, [...path8, "isolation"], `${stepLabel} "isolation"`, PROGRAM_ISOLATION_KINDS);
   if (isolation !== undefined)
     unit.isolation = isolation;
   return unit;
 }
-function parseMap(ctx, raw, path7, stepLabel) {
+function parseExec(ctx, raw, path8, stepLabel) {
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `${stepLabel} "map" must be a mapping with an "over" key.`);
+    ctx.err(path8, `${stepLabel} "exec" must be a mapping with a "command" argv list.`);
+    return;
+  }
+  checkUnknownKeys(ctx, raw, path8, EXEC_KEYS, `${stepLabel} "exec"`);
+  const command = parseExecCommand(ctx, raw.command, [...path8, "command"], stepLabel);
+  if (command === undefined)
+    return;
+  const exec = { command };
+  const cwd = parseExecCwd(ctx, raw.cwd, [...path8, "cwd"], stepLabel);
+  if (cwd !== undefined)
+    exec.cwd = cwd;
+  const passEnv = parseExecPassEnv(ctx, raw.pass_env, [...path8, "pass_env"], stepLabel);
+  if (passEnv !== undefined)
+    exec.passEnv = passEnv;
+  if (raw.inherit_env !== undefined) {
+    if (typeof raw.inherit_env !== "boolean") {
+      ctx.err([...path8, "inherit_env"], `${stepLabel} "exec.inherit_env" must be true or false. true gives the command akm's whole environment ` + `instead of the default allowlist; omit it (or write false) to keep the allowlist.`);
+    } else if (raw.inherit_env) {
+      exec.inheritEnv = true;
+    }
+  }
+  return exec;
+}
+function parseExecPassEnv(ctx, raw, path8, stepLabel) {
+  if (raw === undefined)
+    return;
+  if (!Array.isArray(raw) || raw.length === 0) {
+    ctx.err(path8, `${stepLabel} "exec.pass_env" must be a non-empty list of environment variable NAMES to copy through from ` + `akm's own environment, e.g. pass_env: [CARGO_HOME]. Values never appear here \u2014 use "env:" bindings for those.`);
+    return;
+  }
+  if (raw.length > WORKFLOW_MAX_EXEC_PASS_ENV) {
+    ctx.err(path8, `${stepLabel} "exec.pass_env" must have at most ${WORKFLOW_MAX_EXEC_PASS_ENV} entries. A command needing ` + `more than that wants "inherit_env: true", which says so explicitly.`);
+    return;
+  }
+  const names = [];
+  for (const [index, entry] of raw.entries()) {
+    if (typeof entry !== "string" || !WORKFLOW_ENV_VAR_NAME_PATTERN.test(entry)) {
+      ctx.err(path8, `${stepLabel} "exec.pass_env[${index}]" must be an environment variable name matching ` + `${WORKFLOW_ENV_VAR_NAME_PATTERN.source}.`);
+      return;
+    }
+    if (names.includes(entry)) {
+      ctx.err(path8, `${stepLabel} "exec.pass_env" lists "${entry}" more than once.`);
+      return;
+    }
+    names.push(entry);
+  }
+  return names;
+}
+function parseExecCommand(ctx, raw, path8, stepLabel) {
+  if (!Array.isArray(raw) || raw.length === 0) {
+    ctx.err(path8, `${stepLabel} "exec" requires "command": a non-empty argv list, e.g. command: ["bun", "run", "test:unit"]. ` + `A single shell string is not accepted \u2014 the command is spawned directly, never through a shell.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path7, MAP_KEYS, `${stepLabel} "map"`);
+  if (raw.length > WORKFLOW_MAX_EXEC_ARGV) {
+    ctx.err(path8, `${stepLabel} "exec.command" must have at most ${WORKFLOW_MAX_EXEC_ARGV} entries.`);
+    return;
+  }
+  const argv = [];
+  for (const [index, entry] of raw.entries()) {
+    if (typeof entry !== "string" || entry === "") {
+      ctx.err(path8, `${stepLabel} "exec.command[${index}]" must be a non-empty string.`);
+      return;
+    }
+    if (utf8Bytes(entry) > WORKFLOW_MAX_EXEC_ARG_BYTES) {
+      ctx.err(path8, `${stepLabel} "exec.command[${index}]" exceeds ${WORKFLOW_MAX_EXEC_ARG_BYTES} bytes.`);
+      return;
+    }
+    argv.push(entry);
+  }
+  return argv;
+}
+function parseExecCwd(ctx, raw, path8, stepLabel) {
+  if (raw === undefined)
+    return;
+  if (typeof raw !== "string" || raw.trim() === "") {
+    ctx.err(path8, `${stepLabel} "exec.cwd" must be a non-empty relative path inside the unit's working directory.`);
+    return;
+  }
+  const value = raw.trim();
+  if (value.length > WORKFLOW_MAX_EXEC_CWD_LENGTH) {
+    ctx.err(path8, `${stepLabel} "exec.cwd" exceeds ${WORKFLOW_MAX_EXEC_CWD_LENGTH} characters.`);
+    return;
+  }
+  if (!isContainedRelativePath(value)) {
+    ctx.err(path8, `${stepLabel} "exec.cwd" (${JSON.stringify(value)}) must be a RELATIVE path inside the unit's working ` + `directory \u2014 absolute paths, Windows drive letters, "~", and ".." segments are rejected.`);
+    return;
+  }
+  return value;
+}
+function parseMap(ctx, raw, path8, stepLabel) {
+  if (!isPlainRecord(raw)) {
+    ctx.err(path8, `${stepLabel} "map" must be a mapping with an "over" key.`);
+    return;
+  }
+  checkUnknownKeys(ctx, raw, path8, MAP_KEYS, `${stepLabel} "map"`);
   let over = "";
   if (typeof raw.over === "string" && raw.over.trim() !== "") {
     over = raw.over.trim();
-    checkReferenceSyntax(ctx, over, [...path7, "over"], `${stepLabel} "over"`);
+    checkReferenceSyntax(ctx, over, [...path8, "over"], `${stepLabel} "over"`);
   } else {
-    ctx.err([...path7, "over"], `${stepLabel} "map" requires "over": a reference naming the item list (e.g. steps.discover.output.files).`);
+    ctx.err([...path8, "over"], `${stepLabel} "map" requires "over": a reference naming the item list (e.g. steps.discover.output.files).`);
   }
   let concurrency;
   if (raw.concurrency !== undefined) {
-    if (typeof raw.concurrency === "number" && Number.isInteger(raw.concurrency) && raw.concurrency > 0) {
+    if (typeof raw.concurrency === "number" && Number.isInteger(raw.concurrency) && raw.concurrency > 0 && raw.concurrency <= WORKFLOW_MAX_CONCURRENCY) {
       concurrency = raw.concurrency;
     } else {
-      ctx.err([...path7, "concurrency"], `${stepLabel} "concurrency" must be a positive integer.`);
+      ctx.err([...path8, "concurrency"], `${stepLabel} "concurrency" must be an integer from 1 through ${WORKFLOW_MAX_CONCURRENCY}.`);
     }
   }
-  const reducer = parseEnumField(ctx, raw.reducer, [...path7, "reducer"], `${stepLabel} "reducer"`, PROGRAM_REDUCERS);
-  const unit = raw.unit !== undefined ? parseUnit(ctx, raw.unit, [...path7, "unit"], stepLabel) : undefined;
+  const reducer = parseEnumField(ctx, raw.reducer, [...path8, "reducer"], `${stepLabel} "reducer"`, PROGRAM_REDUCERS);
+  const unit = raw.unit !== undefined ? parseUnit(ctx, raw.unit, [...path8, "unit"], stepLabel) : undefined;
   const map = { over };
   if (concurrency !== undefined)
     map.concurrency = concurrency;
@@ -33036,21 +33491,21 @@ function parseMap(ctx, raw, path7, stepLabel) {
     map.unit = unit;
   return map;
 }
-function parseRoute(ctx, raw, path7, stepLabel, stepIndex, routeChecks) {
+function parseRoute(ctx, raw, path8, stepLabel, stepIndex, routeChecks) {
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `${stepLabel} "route" must be a mapping with "input" and "when" keys.`);
+    ctx.err(path8, `${stepLabel} "route" must be a mapping with "input" and "when" keys.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path7, ROUTE_KEYS, `${stepLabel} "route"`);
+  checkUnknownKeys(ctx, raw, path8, ROUTE_KEYS, `${stepLabel} "route"`);
   let input = "";
   if (typeof raw.input === "string" && raw.input.trim() !== "") {
     input = raw.input.trim();
-    checkReferenceSyntax(ctx, input, [...path7, "input"], `${stepLabel} "route.input"`);
+    checkReferenceSyntax(ctx, input, [...path8, "input"], `${stepLabel} "route.input"`);
   } else {
-    ctx.err([...path7, "input"], `${stepLabel} "route" requires "input": a reference naming the value to route on.`);
+    ctx.err([...path8, "input"], `${stepLabel} "route" requires "input": a reference naming the value to route on.`);
   }
   const check = { stepIndex, stepLabel, branches: [] };
-  const whenPath = [...path7, "when"];
+  const whenPath = [...path8, "when"];
   if (!Array.isArray(raw.when) || raw.when.length === 0) {
     ctx.err(whenPath, `${stepLabel} "route" requires "when": a non-empty list of { match, step } branches (e.g. when: [{ match: pass, step: ship }]).`);
   } else {
@@ -33090,9 +33545,9 @@ function parseRoute(ctx, raw, path7, stepLabel, stepIndex, routeChecks) {
   if (raw.default !== undefined) {
     if (typeof raw.default === "string" && raw.default.trim() !== "") {
       defaultStepId = raw.default.trim();
-      check.defaultTarget = { stepId: defaultStepId, line: ctx.lineAt([...path7, "default"]) };
+      check.defaultTarget = { stepId: defaultStepId, line: ctx.lineAt([...path8, "default"]) };
     } else {
-      ctx.err([...path7, "default"], `${stepLabel} "route.default" must be a step id string.`);
+      ctx.err([...path8, "default"], `${stepLabel} "route.default" must be a step id string.`);
     }
   }
   routeChecks.push(check);
@@ -33101,55 +33556,67 @@ function parseRoute(ctx, raw, path7, stepLabel, stepIndex, routeChecks) {
     route.defaultStepId = defaultStepId;
   return route;
 }
-function parseInputs(ctx, raw, path7, stepLabel) {
+function parseInputs(ctx, raw, path8, stepLabel) {
   if (raw === undefined)
     return;
   if (!Array.isArray(raw) || raw.length === 0) {
-    ctx.err(path7, `${stepLabel} "inputs" must be a non-empty list of reference strings.`);
+    ctx.err(path8, `${stepLabel} "inputs" must be a non-empty list of reference strings.`);
     return;
   }
   if (raw.length > WORKFLOW_MAX_INPUTS) {
-    ctx.err(path7, `${stepLabel} "inputs" must contain at most ${WORKFLOW_MAX_INPUTS} entries.`);
+    ctx.err(path8, `${stepLabel} "inputs" must contain at most ${WORKFLOW_MAX_INPUTS} entries.`);
   }
   const out = [];
   raw.forEach((entry, i) => {
     if (typeof entry !== "string" || entry.trim() === "") {
-      ctx.err([...path7, i], `${stepLabel} "inputs[${i}]" must be a non-empty reference string.`);
+      ctx.err([...path8, i], `${stepLabel} "inputs[${i}]" must be a non-empty reference string.`);
       return;
     }
     const value = entry.trim();
-    checkReferenceSyntax(ctx, value, [...path7, i], `${stepLabel} "inputs[${i}]"`);
+    checkReferenceSyntax(ctx, value, [...path8, i], `${stepLabel} "inputs[${i}]"`);
     out.push(value);
   });
   return out.length > 0 ? out : undefined;
 }
-function parseGate(ctx, raw, path7, stepLabel) {
+function parseGate(ctx, raw, path8, stepLabel) {
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `${stepLabel} "gate" must be a mapping with any of: ${GATE_KEYS.join(", ")}.`);
+    ctx.err(path8, `${stepLabel} "gate" must be a mapping with any of: ${GATE_KEYS.join(", ")}.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path7, GATE_KEYS, `${stepLabel} "gate"`);
+  checkUnknownKeys(ctx, raw, path8, GATE_KEYS, `${stepLabel} "gate"`);
   const gate = {};
   if (raw.max_loops !== undefined) {
-    if (typeof raw.max_loops === "number" && Number.isInteger(raw.max_loops) && raw.max_loops >= 1) {
+    if (typeof raw.max_loops === "number" && Number.isInteger(raw.max_loops) && raw.max_loops >= 1 && raw.max_loops <= WORKFLOW_MAX_GATE_LOOPS) {
       gate.maxLoops = raw.max_loops;
     } else {
-      ctx.err([...path7, "max_loops"], `${stepLabel} "gate.max_loops" must be an integer >= 1.`);
+      ctx.err([...path8, "max_loops"], `${stepLabel} "gate.max_loops" must be an integer from 1 through ${WORKFLOW_MAX_GATE_LOOPS}.`);
     }
   }
   return gate;
 }
-function parseRetry(ctx, raw, path7, stepLabel) {
+function parseEngineName(ctx, raw, path8, label) {
+  if (typeof raw !== "string" || raw.trim() === "") {
+    ctx.err(path8, `${label} must be a non-empty engine name.`);
+    return;
+  }
+  const name = raw.trim();
+  if (!WORKFLOW_ENGINE_NAME_PATTERN.test(name) || name.length > WORKFLOW_MAX_ENGINE_NAME_LENGTH) {
+    ctx.err(path8, `${label} has an invalid engine name ${JSON.stringify(name)}. Engine names are lowercase words of letters ` + `and digits separated by single dashes, starting with a letter (e.g. "code-review-llm"), at most ` + `${WORKFLOW_MAX_ENGINE_NAME_LENGTH} characters.`);
+    return;
+  }
+  return name;
+}
+function parseRetry(ctx, raw, path8, stepLabel) {
   if (raw === undefined)
     return;
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `${stepLabel} "retry" must be a mapping: { max: <n>, on: [<failure_reason>, \u2026] }.`);
+    ctx.err(path8, `${stepLabel} "retry" must be a mapping: { max: <n>, on: [<failure_reason>, \u2026] }.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path7, RETRY_KEYS, `${stepLabel} "retry"`);
+  checkUnknownKeys(ctx, raw, path8, RETRY_KEYS, `${stepLabel} "retry"`);
   let ok = true;
-  if (!(typeof raw.max === "number" && Number.isInteger(raw.max) && raw.max >= 0)) {
-    ctx.err([...path7, "max"], `${stepLabel} "retry.max" is required and must be a non-negative integer.`);
+  if (!(typeof raw.max === "number" && Number.isInteger(raw.max) && raw.max >= 0 && raw.max <= WORKFLOW_MAX_RETRIES)) {
+    ctx.err([...path8, "max"], `${stepLabel} "retry.max" is required and must be an integer from 0 through ${WORKFLOW_MAX_RETRIES}.`);
     ok = false;
   }
   const on = [];
@@ -33158,27 +33625,27 @@ function parseRetry(ctx, raw, path7, stepLabel) {
       if (typeof reason === "string" && PROGRAM_RETRY_REASONS.includes(reason)) {
         on.push(reason);
       } else {
-        ctx.err([...path7, "on", i], `${stepLabel} "retry.on" has unknown failure reason ${JSON.stringify(reason)}. Valid reasons: ${PROGRAM_RETRY_REASONS.join(", ")}.`);
+        ctx.err([...path8, "on", i], `${stepLabel} "retry.on" has unknown failure reason ${JSON.stringify(reason)}. Valid reasons: ${PROGRAM_RETRY_REASONS.join(", ")}.`);
         ok = false;
       }
     });
   } else {
-    ctx.err([...path7, "on"], `${stepLabel} "retry.on" is required and must be a non-empty list of failure reasons (${PROGRAM_RETRY_REASONS.join(", ")}).`);
+    ctx.err([...path8, "on"], `${stepLabel} "retry.on" is required and must be a non-empty list of failure reasons (${PROGRAM_RETRY_REASONS.join(", ")}).`);
     ok = false;
   }
   return ok ? { max: raw.max, on } : undefined;
 }
-function parseTimeoutField(ctx, raw, path7, label) {
+function parseTimeoutField(ctx, raw, path8, label) {
   if (raw === undefined)
     return;
   if (typeof raw === "number") {
     if (Number.isInteger(raw) && raw > 0)
-      return raw;
-    ctx.err(path7, `${label} has a non-positive timeout ${JSON.stringify(raw)}. ${TIMEOUT_HINT}.`);
+      return checkTimeoutCeiling(ctx, raw, path8, label, String(raw));
+    ctx.err(path8, `${label} has a non-positive timeout ${JSON.stringify(raw)}. ${TIMEOUT_HINT}.`);
     return;
   }
   if (typeof raw !== "string") {
-    ctx.err(path7, `${label} must be a duration string. ${TIMEOUT_HINT}.`);
+    ctx.err(path8, `${label} must be a duration string. ${TIMEOUT_HINT}.`);
     return;
   }
   const value = raw.trim().toLowerCase();
@@ -33186,31 +33653,37 @@ function parseTimeoutField(ctx, raw, path7, label) {
     return null;
   const match = value.match(TIMEOUT_VALUE);
   if (!match) {
-    ctx.err(path7, `${label} has an invalid timeout "${raw}". ${TIMEOUT_HINT}.`);
+    ctx.err(path8, `${label} has an invalid timeout "${raw}". ${TIMEOUT_HINT}.`);
     return;
   }
   const n = Number.parseInt(match[1], 10);
   const unit = match[2] ?? "ms";
   const timeoutMs = unit === "m" ? n * 60000 : unit === "s" ? n * 1000 : n;
   if (timeoutMs <= 0) {
-    ctx.err(path7, `${label} has a non-positive timeout "${raw}". Use a positive duration or "none".`);
+    ctx.err(path8, `${label} has a non-positive timeout "${raw}". Use a positive duration or "none".`);
     return;
   }
-  return timeoutMs;
+  return checkTimeoutCeiling(ctx, timeoutMs, path8, label, raw);
+}
+function checkTimeoutCeiling(ctx, timeoutMs, path8, label, raw) {
+  if (timeoutMs <= WORKFLOW_MAX_TIMEOUT_MS)
+    return timeoutMs;
+  ctx.err(path8, `${label} has a timeout "${raw}" above the maximum of ${WORKFLOW_MAX_TIMEOUT_MS} ms (about 24.8 days). ` + `Use a shorter duration or "none" for no timeout.`);
+  return;
 }
-function parseEnumField(ctx, raw, path7, label, allowed) {
+function parseEnumField(ctx, raw, path8, label, allowed) {
   if (raw === undefined)
     return;
   if (typeof raw === "string" && allowed.includes(raw))
     return raw;
-  ctx.err(path7, `${label} must be one of: ${allowed.join(" | ")} (got ${JSON.stringify(raw)}).`);
+  ctx.err(path8, `${label} must be one of: ${allowed.join(" | ")} (got ${JSON.stringify(raw)}).`);
   return;
 }
-function parseLlmOverrides(ctx, raw, path7, label) {
+function parseLlmOverrides(ctx, raw, path8, label) {
   if (raw === undefined)
     return;
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `${label} must be a mapping of LLM invocation overrides.`);
+    ctx.err(path8, `${label} must be a mapping of LLM invocation overrides.`);
     return;
   }
   const keys = [
@@ -33221,36 +33694,36 @@ function parseLlmOverrides(ctx, raw, path7, label) {
     "context_length",
     "enable_thinking"
   ];
-  checkUnknownKeys(ctx, raw, path7, keys, label);
+  checkUnknownKeys(ctx, raw, path8, keys, label);
   const result = {};
   if (raw.temperature !== undefined) {
     if (typeof raw.temperature === "number" && Number.isFinite(raw.temperature))
       result.temperature = raw.temperature;
     else
-      ctx.err([...path7, "temperature"], `${label}.temperature must be a finite number.`);
+      ctx.err([...path8, "temperature"], `${label}.temperature must be a finite number.`);
   }
   if (raw.max_tokens !== undefined) {
     if (typeof raw.max_tokens === "number" && Number.isInteger(raw.max_tokens) && raw.max_tokens > 0) {
       result.maxTokens = raw.max_tokens;
     } else
-      ctx.err([...path7, "max_tokens"], `${label}.max_tokens must be a positive integer.`);
+      ctx.err([...path8, "max_tokens"], `${label}.max_tokens must be a positive integer.`);
   }
   if (raw.supports_json_schema !== undefined) {
     if (typeof raw.supports_json_schema === "boolean")
       result.supportsJsonSchema = raw.supports_json_schema;
     else
-      ctx.err([...path7, "supports_json_schema"], `${label}.supports_json_schema must be a boolean.`);
+      ctx.err([...path8, "supports_json_schema"], `${label}.supports_json_schema must be a boolean.`);
   }
   if (raw.extra_params !== undefined) {
     if (!isPlainRecord(raw.extra_params)) {
-      ctx.err([...path7, "extra_params"], `${label}.extra_params must be a JSON object.`);
+      ctx.err([...path8, "extra_params"], `${label}.extra_params must be a JSON object.`);
     } else {
       const issues = validateExtraParams(raw.extra_params);
       for (const issue of issues) {
-        ctx.err([...path7, "extra_params", ...issue.path], `${formatExtraParamsIssue(`${label}.extra_params`, issue)}.`);
+        ctx.err([...path8, "extra_params", ...issue.path], `${formatExtraParamsIssue(`${label}.extra_params`, issue)}.`);
       }
       if (jsonBytes(raw.extra_params) > WORKFLOW_MAX_EXTRA_PARAMS_BYTES) {
-        ctx.err([...path7, "extra_params"], `${label}.extra_params exceeds the 64 KiB resource limit.`);
+        ctx.err([...path8, "extra_params"], `${label}.extra_params exceeds the 64 KiB resource limit.`);
       }
       if (issues.length === 0 && jsonBytes(raw.extra_params) <= WORKFLOW_MAX_EXTRA_PARAMS_BYTES) {
         result.extraParams = raw.extra_params;
@@ -33261,37 +33734,48 @@ function parseLlmOverrides(ctx, raw, path7, label) {
     if (typeof raw.context_length === "number" && Number.isInteger(raw.context_length) && raw.context_length > 0) {
       result.contextLength = raw.context_length;
     } else
-      ctx.err([...path7, "context_length"], `${label}.context_length must be a positive integer.`);
+      ctx.err([...path8, "context_length"], `${label}.context_length must be a positive integer.`);
   }
   if (raw.enable_thinking !== undefined) {
     if (typeof raw.enable_thinking === "boolean")
       result.enableThinking = raw.enable_thinking;
     else
-      ctx.err([...path7, "enable_thinking"], `${label}.enable_thinking must be a boolean.`);
+      ctx.err([...path8, "enable_thinking"], `${label}.enable_thinking must be a boolean.`);
   }
   return Object.keys(result).length > 0 ? result : undefined;
 }
-function parseSchemaObject(ctx, raw, path7, label) {
+function parseSchemaObject(ctx, raw, path8, label) {
   if (raw === undefined)
     return;
   if (!isPlainRecord(raw)) {
-    ctx.err(path7, `${label} must be a JSON Schema object (e.g. { type: object, properties: { \u2026 } }).`);
+    ctx.err(path8, `${label} must be a JSON Schema object (e.g. { type: object, properties: { \u2026 } }).`);
     return;
   }
   if (jsonBytes(raw) > WORKFLOW_MAX_SCHEMA_BYTES) {
-    ctx.err(path7, `${label} exceeds the 256 KiB resource limit.`);
+    ctx.err(path8, `${label} exceeds the 256 KiB resource limit.`);
   }
+  checkSchemaDefinition(ctx, raw, path8, label);
   return raw;
 }
-function checkReferenceSyntax(ctx, text, path7, label) {
+function checkSchemaDefinition(ctx, schema, path8, label) {
+  for (const issue of checkJsonSchemaDefinition(schema)) {
+    const issuePath = [...path8, ...issue.path];
+    if (issue.kind === "unsupported") {
+      ctx.err(issuePath, `${label} (at ${issue.pointer}): ${issue.message}. Supported JSON Schema keywords: ` + `${JSON_SCHEMA_SUBSET_SUPPORTED_KEYWORDS}.`);
+    } else {
+      ctx.err(issuePath, `${label} is not a valid JSON Schema (at ${issue.pointer}): ${issue.message}.`);
+    }
+  }
+}
+function checkReferenceSyntax(ctx, text, path8, label) {
   const result = parseReference(text);
   if (!result.ok)
-    ctx.err(path7, `${label}: ${result.message}`);
+    ctx.err(path8, `${label}: ${result.message}`);
 }
-function checkUnknownKeys(ctx, obj, path7, allowed, label) {
+function checkUnknownKeys(ctx, obj, path8, allowed, label) {
   for (const key of Object.keys(obj)) {
     if (!allowed.includes(key)) {
-      ctx.err([...path7, key], `Unknown ${label} key "${key}". Allowed keys: ${allowed.join(", ")}.`);
+      ctx.err([...path8, key], `Unknown ${label} key "${key}". Allowed keys: ${allowed.join(", ")}.`);
     }
   }
 }
@@ -33335,7 +33819,7 @@ function checkInvalidTypeValue(data, allowedTypes) {
   return `type field has invalid value '${value}'; expected one of: ${allowedTypes.join(", ")}`;
 }
 function suggestSlug(filePath) {
-  return path7.basename(filePath, ".md").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return path8.basename(filePath, ".md").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function nameOrTypeDiagnostics(relPath, data, frontmatter, allowedTypes) {
   const missingFieldDetail = checkMissingNameOrType(data, frontmatter);
@@ -33391,7 +33875,7 @@ function collectSuppressedKeys(raw) {
 function dangerousEnvKeyDiagnostics(type, relPath, raw) {
   if (type !== "env" && type !== "secret")
     return [];
-  const baseNameWithExt = path7.basename(relPath);
+  const baseNameWithExt = path8.basename(relPath);
   if (!baseNameWithExt.endsWith(".env"))
     return [];
   const ref = conceptIdForStashFile(type, ".", relPath);
@@ -33412,9 +33896,10 @@ function dangerousEnvKeyDiagnostics(type, relPath, raw) {
   }
   return diagnostics;
 }
-async function skillDirectoryDiagnostics(relPath, seen, ctx) {
+var AKM_SKILL_DIRS = new Set(["skills"]);
+async function skillDirectoryDiagnostics(relPath, seen, ctx, skillDirs = AKM_SKILL_DIRS) {
   const segments = relPath.replace(/\\/g, "/").split("/").filter((s) => s.length > 0);
-  if (segments.length < 3 || segments[0] !== "skills")
+  if (segments.length < 3 || !skillDirs.has(segments[0]))
     return [];
   const skillDir = `${segments[0]}/${segments[1]}`;
   if (seen.has(skillDir))
@@ -33494,42 +33979,62 @@ function matchWorkflowPlaceholder(body) {
   return PLACEHOLDER_STRINGS.find((p) => body.includes(p)) ?? null;
 }
 function workflowStructureDiagnostics(relPath, raw, parsePath2) {
+  return workflowFrontendDiagnostics(relPath, raw, parsePath2).errors;
+}
+function lineOf(err) {
+  return typeof err.line === "number" && Number.isFinite(err.line) && err.line > 0 ? { line: err.line } : {};
+}
+function workflowFrontendDiagnostics(relPath, raw, parsePath2) {
+  const none = { errors: [], warnings: [] };
   if (parsePath2.includes("/.cache/") || parsePath2.includes("/registry/"))
-    return [];
-  const diagnostics = [];
+    return none;
+  const errors2 = [];
+  const warnings = [];
   try {
     const result = parseWorkflow(raw, { path: parsePath2 });
     if (!result.ok) {
       for (const err of result.errors ?? []) {
-        diagnostics.push({
+        errors2.push({
           file: relPath,
           issue: "invalid-workflow-structure",
           detail: err.message ?? String(err),
-          fixed: false
+          fixed: false,
+          ...lineOf(err)
         });
       }
-      return diagnostics;
+      return { errors: errors2, warnings };
     }
-    const compiled = compileWorkflowPlan(result.document, path7.basename(parsePath2, path7.extname(parsePath2)));
+    const compiled = compileWorkflowPlan(result.document, path8.basename(parsePath2, path8.extname(parsePath2)));
     if (!compiled.ok) {
       for (const err of compiled.errors) {
-        diagnostics.push({
+        errors2.push({
           file: relPath,
           issue: "invalid-workflow-structure",
           detail: err.message,
-          fixed: false
+          fixed: false,
+          ...lineOf(err)
         });
       }
+      return { errors: errors2, warnings };
+    }
+    for (const warning of compiled.warnings) {
+      warnings.push({
+        file: relPath,
+        issue: "workflow-warning",
+        detail: warning.message,
+        fixed: false,
+        ...lineOf(warning)
+      });
     }
   } catch (e) {
-    diagnostics.push({
+    errors2.push({
       file: relPath,
       issue: "invalid-workflow-structure",
       detail: `workflow parser error: ${e instanceof Error ? e.message : String(e)}`,
       fixed: false
     });
   }
-  return diagnostics;
+  return { errors: errors2, warnings };
 }
 function workflowDiagnostics(relPath, raw, body) {
   const diagnostics = [];
@@ -33574,7 +34079,7 @@ init_errors();
 init_file_lock();
 init_paths();
 import fs7 from "fs";
-import path10 from "path";
+import path11 from "path";
 function readConfigText(configPath) {
   try {
     return readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
@@ -33613,7 +34118,7 @@ function describeJsonRoot(value) {
   return typeof value;
 }
 function getConfigLockPath() {
-  return path10.join(getConfigDir(), "config.json.lck");
+  return path11.join(getConfigDir(), "config.json.lck");
 }
 var CONFIG_LOCK_MAX_RETRIES = 40;
 var CONFIG_LOCK_RETRY_DELAY_MS = 50;
@@ -33623,7 +34128,7 @@ function sleepSyncMs(ms) {
 function acquireConfigLock() {
   const lockPath = getConfigLockPath();
   try {
-    fs7.mkdirSync(path10.dirname(lockPath), { recursive: true });
+    fs7.mkdirSync(path11.dirname(lockPath), { recursive: true });
   } catch {}
   for (let attempt = 0;attempt < CONFIG_LOCK_MAX_RETRIES; attempt++) {
     try {
@@ -34170,8 +34675,8 @@ function getErrorMap() {
 }
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path11, errorMaps, issueData } = params;
-  const fullPath = [...path11, ...issueData.path || []];
+  const { data, path: path12, errorMaps, issueData } = params;
+  const fullPath = [...path12, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -34283,11 +34788,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 class ParseInputLazyPath {
-  constructor(parent, value, path11, key) {
+  constructor(parent, value, path12, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path11;
+    this._path = path12;
     this._key = key;
   }
   get path() {
@@ -38337,6 +38842,7 @@ var BundlesConfigSchema = exports_external.record(exports_external.string().min(
 // src/core/config/schema/workflow.ts
 var WorkflowConfigSchema = exports_external.object({
   maxConcurrency: positiveInt.optional(),
+  defaultMapConcurrency: positiveInt.optional(),
   judgeEngine: engineName.optional()
 }).passthrough();
 
@@ -38633,7 +39139,7 @@ function normalizeInstalledGitRef(source, ref) {
 
 // src/core/config/deep-merge.ts
 var UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
-function isPlainObject(value) {
+function isPlainObject2(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     return false;
   const prototype = Object.getPrototypeOf(value);
@@ -38642,7 +39148,7 @@ function isPlainObject(value) {
 function copyConfigValue(value) {
   if (Array.isArray(value))
     return value.map(copyConfigValue);
-  if (!isPlainObject(value))
+  if (!isPlainObject2(value))
     return value;
   const copy = {};
   for (const key of Object.keys(value)) {
@@ -38661,7 +39167,7 @@ function deepMergeConfig(base, override) {
     if (next === undefined)
       continue;
     const current = result[key];
-    result[key] = isPlainObject(current) && isPlainObject(next) ? deepMergeConfig(current, next) : copyConfigValue(next);
+    result[key] = isPlainObject2(current) && isPlainObject2(next) ? deepMergeConfig(current, next) : copyConfigValue(next);
   }
   return result;
 }
@@ -38803,9 +39309,10 @@ init_common();
 init_errors();
 init_file_lock();
 init_maintenance_barrier();
+init_path_access();
 init_paths();
 import fs11 from "fs";
-import path12 from "path";
+import path13 from "path";
 function readLockfile() {
   const lockfilePath = getLockfilePath();
   try {
@@ -38818,6 +39325,12 @@ function readLockfile() {
     return [];
   }
 }
+function assertLockfilePathReadable(target) {
+  const { access, code } = classifyPathAccess(target);
+  if (access !== "inaccessible")
+    return;
+  throw new ConfigError(`Refusing to modify the lockfile: ${describeInaccessiblePath(target, code)}. akm cannot read the existing lock ` + "records, and writing over them would destroy every bundle they track. Fix the ownership or mode of that " + "path (or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user owns) and retry.", "DATA_DIR_UNREADABLE");
+}
 function lockContentRootFor(bundleId, type) {
   if (!bundleId || type !== "git" && type !== "npm")
     return;
@@ -38830,7 +39343,7 @@ function lockContentRootFor(bundleId, type) {
 }
 function writeLockfileUnlocked(entries) {
   const lockfilePath = getLockfilePath();
-  const dir = path12.dirname(lockfilePath);
+  const dir = path13.dirname(lockfilePath);
   fs11.mkdirSync(dir, { recursive: true });
   writeFileAtomic(lockfilePath, `${JSON.stringify(entries, null, 2)}
 `);
@@ -38838,6 +39351,7 @@ function writeLockfileUnlocked(entries) {
 function readLockEntriesForMigration() {
   let existing = [];
   const lockfilePath = getLockfilePath();
+  assertLockfilePathReadable(lockfilePath);
   if (fs11.existsSync(lockfilePath)) {
     let raw;
     try {
@@ -38879,10 +39393,10 @@ init_database();
 
 // src/core/bundle-id.ts
 import crypto3 from "crypto";
-import path13 from "path";
+import path14 from "path";
 function slugForPath(sourcePath) {
-  const resolved = path13.resolve(sourcePath);
-  const base = path13.basename(resolved).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const resolved = path14.resolve(sourcePath);
+  const base = path14.basename(resolved).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   if (base.length > 0)
     return base;
   return `bundle-${shortHash(resolved)}`;
@@ -38905,7 +39419,7 @@ function deriveBundleIds(sources) {
 function ensureUniqueId(preferred, sourcePath, used) {
   if (!used.has(preferred))
     return preferred;
-  const suffixed = `${preferred}-${shortHash(path13.resolve(sourcePath))}`;
+  const suffixed = `${preferred}-${shortHash(path14.resolve(sourcePath))}`;
   if (!used.has(suffixed))
     return suffixed;
   let n = 2;
@@ -38938,11 +39452,11 @@ function inferLegacyBundleIds(sources) {
 // scripts/akm-migrate/migrate/legacy/config-source-migration.ts
 import fs24 from "fs";
 import os from "os";
-import path27 from "path";
+import path28 from "path";
 
 // src/core/adapter/adapters/agent-skills-adapter.ts
 import fs12 from "fs";
-import path14 from "path";
+import path15 from "path";
 
 // src/core/adapter/adapters/shared.ts
 import { createHash } from "crypto";
@@ -39185,6 +39699,36 @@ function skillFieldDiagnostics(relPath, dirName, data) {
   }
   return diagnostics;
 }
+var MAX_PACKAGE_PROBE_DEPTH = 3;
+async function subtreeHasManifest(dir, entries, ctx, depth) {
+  if (entries.includes(SKILL_MANIFEST))
+    return true;
+  if (depth >= MAX_PACKAGE_PROBE_DEPTH)
+    return false;
+  for (const entry of entries) {
+    const child = `${dir}/${entry}`;
+    const childEntries = await ctx.list(child);
+    if (childEntries.length === 0)
+      continue;
+    if (await subtreeHasManifest(child, childEntries, ctx, depth + 1))
+      return true;
+  }
+  return false;
+}
+async function missingManifestDiagnostics(ctx) {
+  const diagnostics = [];
+  for (const name of await ctx.list(".")) {
+    if (name.startsWith("."))
+      continue;
+    const entries = await ctx.list(name);
+    if (entries.length === 0)
+      continue;
+    if (await subtreeHasManifest(name, entries, ctx, 1))
+      continue;
+    diagnostics.push({ file: name, issue: "missing-skill-md", detail: `no SKILL.md in ${name}/`, fixed: false });
+  }
+  return diagnostics;
+}
 async function validate(_c, changes, ctx) {
   const diagnostics = [];
   const seenDirs = new Set;
@@ -39202,6 +39746,7 @@ async function validate(_c, changes, ctx) {
     seenDirs.add(pkg.conceptId);
     diagnostics.push(...skillFieldDiagnostics(toPosix2(change.path), pkg.dirName, parseFrontmatter(raw).data));
   }
+  diagnostics.push(...await missingManifestDiagnostics(ctx));
   return diagnostics;
 }
 var agentSkillsAdapter = {
@@ -39211,7 +39756,7 @@ var agentSkillsAdapter = {
   recognize,
   validate,
   placeNew(c, conceptId) {
-    return path14.join(c.root, conceptId, SKILL_MANIFEST);
+    return path15.join(c.root, conceptId, SKILL_MANIFEST);
   },
   looksLikeRoot(root) {
     let entries;
@@ -39224,7 +39769,7 @@ var agentSkillsAdapter = {
       if (!entry.isDirectory())
         return false;
       try {
-        return fs12.existsSync(path14.join(root, entry.name, SKILL_MANIFEST));
+        return fs12.existsSync(path15.join(root, entry.name, SKILL_MANIFEST));
       } catch {
         return false;
       }
@@ -39234,11 +39779,11 @@ var agentSkillsAdapter = {
 
 // src/core/adapter/adapters/akm-adapter.ts
 import fs15 from "fs";
-import path16 from "path";
+import path17 from "path";
 
 // src/indexer/passes/metadata.ts
 import fs13 from "fs";
-import path15 from "path";
+import path16 from "path";
 init_common();
 init_warn();
 var SCOPE_KEYS = ["user", "agent", "run", "channel"];
@@ -39979,7 +40524,7 @@ function extractBodyOpening(body) {
   return `${cut.trimEnd()}\u2026`;
 }
 function applyPreContributorFields(entry, file, ctx, pkgMeta) {
-  const ext = path15.extname(file).toLowerCase();
+  const ext = path16.extname(file).toLowerCase();
   if (pkgMeta) {
     if (pkgMeta.description && !entry.description) {
       entry.description = pkgMeta.description;
@@ -40019,8 +40564,8 @@ function applyPreContributorFields(entry, file, ctx, pkgMeta) {
   }
 }
 function applyPostContributorFields(entry, file, canonicalName, dirPath) {
-  const ext = path15.extname(file).toLowerCase();
-  const baseName = path15.basename(file, ext);
+  const ext = path16.extname(file).toLowerCase();
+  const baseName = path16.basename(file, ext);
   if (!entry.description) {
     entry.description = fileNameToDescription(baseName);
     entry.source = "filename";
@@ -40032,7 +40577,7 @@ function applyPostContributorFields(entry, file, canonicalName, dirPath) {
   entry.tags = [...entry.tags ?? [], ...extractDirTagsFromName(canonicalName)];
   entry.tags = normalizeTerms(entry.tags ?? []);
   entry.aliases = mergeAliases(entry.aliases, buildAliases(canonicalName, entry.tags));
-  entry.filename = path15.basename(file);
+  entry.filename = path16.basename(file);
 }
 function normalizeTerms(values) {
   const normalized = new Set;
@@ -40054,7 +40599,7 @@ function buildAliases(name, tags) {
   return Array.from(aliases);
 }
 function extractPackageMetadata(dirPath) {
-  const pkgPath = path15.join(dirPath, "package.json");
+  const pkgPath = path16.join(dirPath, "package.json");
   if (!fs13.existsSync(pkgPath))
     return null;
   try {
@@ -40076,11 +40621,11 @@ function fileNameToDescription(fileName) {
   return fileName.replace(/[-_]+/g, " ").replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().trim();
 }
 function extractTagsFromPath(filePath, rootDir) {
-  const rel = path15.relative(rootDir, filePath);
-  const parts = rel.split(path15.sep);
+  const rel = path16.relative(rootDir, filePath);
+  const parts = rel.split(path16.sep);
   const tags = new Set;
   for (const part of parts) {
-    const name = part.replace(path15.extname(part), "");
+    const name = part.replace(path16.extname(part), "");
     for (const token of name.split(/[-_./\\]+/)) {
       const clean = token.toLowerCase().trim();
       if (clean && clean.length > 1)
@@ -40609,13 +41154,13 @@ function isReservedFileName(name) {
 }
 var WIKI_INFRA_FILES = new Set(["schema.md", "index.md", "log.md"]);
 function akmStashAbstains(root, absPath) {
-  const relPath = path16.relative(root, absPath);
-  if (!relPath || relPath.startsWith("..") || path16.isAbsolute(relPath))
+  const relPath = path17.relative(root, absPath);
+  if (!relPath || relPath.startsWith("..") || path17.isAbsolute(relPath))
     return false;
   const segments = relPath.split(/[\\/]+/).filter(Boolean);
   if (segments.length === 0)
     return false;
-  if (segments[0] === "env" && (absPath.endsWith(".env") || path16.basename(absPath) === ".env")) {
+  if (segments[0] === "env" && (absPath.endsWith(".env") || path17.basename(absPath) === ".env")) {
     if (fs15.existsSync(absPath.replace(/\.env$/, ".sensitive")))
       return true;
   }
@@ -40713,7 +41258,7 @@ function recognize2(c, file) {
   const canonicalName = derived;
   const stashDir = stashDirFor(match.type);
   const conceptId = stashDir !== undefined ? `${stashDir}/${canonicalName}` : canonicalName;
-  const dirPath = path16.dirname(file.absPath);
+  const dirPath = path17.dirname(file.absPath);
   const entry = {
     name: canonicalName,
     type: match.type,
@@ -40736,13 +41281,13 @@ function recognize2(c, file) {
   }, match.renderer);
 }
 function buildOverlayContext(root, relPathInput, raw) {
-  const absPath = path16.join(root, relPathInput);
-  const relPath = path16.relative(root, absPath).replace(/\\/g, "/");
-  const ext = path16.extname(absPath).toLowerCase();
-  const fileName = path16.basename(absPath);
-  const parentDirAbs = path16.dirname(absPath);
-  const parentDir = path16.basename(parentDirAbs);
-  const relDir = path16.dirname(relPath).replace(/\\/g, "/");
+  const absPath = path17.join(root, relPathInput);
+  const relPath = path17.relative(root, absPath).replace(/\\/g, "/");
+  const ext = path17.extname(absPath).toLowerCase();
+  const fileName = path17.basename(absPath);
+  const parentDirAbs = path17.dirname(absPath);
+  const parentDir = path17.basename(parentDirAbs);
+  const relDir = path17.dirname(relPath).replace(/\\/g, "/");
   const ancestorDirs = relDir === "." ? [] : relDir.split("/").filter((seg) => seg.length > 0);
   let cachedFrontmatter;
   let frontmatterComputed = false;
@@ -40783,15 +41328,16 @@ async function validate2(c, changes, ctx) {
     const type = match?.type;
     let parsed;
     if (type === "task") {
-      let data = {};
-      try {
-        const doc = $parse(raw);
-        if (doc && typeof doc === "object" && !Array.isArray(doc))
-          data = doc;
-      } catch {
-        data = {};
+      const task = parseTaskYaml(raw);
+      if (!task.ok) {
+        diagnostics.push({
+          file: change.path,
+          issue: "invalid-task-yaml",
+          detail: taskYamlParseDetail(task.error),
+          fixed: false
+        });
       }
-      parsed = { data, content: raw, frontmatter: null };
+      parsed = { data: task.data, content: raw, frontmatter: null };
     } else {
       const p = parseFrontmatter(raw);
       parsed = { data: p.data, content: p.content, frontmatter: p.frontmatter };
@@ -40846,18 +41392,18 @@ var akmAdapter = {
       const rest = posix.slice(slash + 1);
       const type = stashDirToType(head);
       if (type !== undefined && rest.length > 0) {
-        const typeDir = path16.join(c.root, head);
+        const typeDir = path17.join(c.root, head);
         return assetPathForName(type, typeDir, rest);
       }
     }
-    return path16.join(c.root, `${posix}.md`);
+    return path17.join(c.root, `${posix}.md`);
   },
   directoryList(_c) {
     return [...new Set(stashDirNames())];
   },
   looksLikeRoot(root) {
     try {
-      if (fs15.statSync(path16.join(root, ".stash")).isDirectory())
+      if (fs15.statSync(path17.join(root, ".stash")).isDirectory())
         return true;
     } catch {}
     const ownedDirNames = new Set(stashDirNames());
@@ -40875,10 +41421,10 @@ var akmAdapter = {
       return false;
     const expectedType = stashDirToType(only.name);
     try {
-      const markdown = fs15.readdirSync(path16.join(root, only.name), { withFileTypes: true }).find((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".md"));
+      const markdown = fs15.readdirSync(path17.join(root, only.name), { withFileTypes: true }).find((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".md"));
       if (!markdown)
         return true;
-      const data = parseFrontmatter(fs15.readFileSync(path16.join(root, only.name, markdown.name), "utf8")).data;
+      const data = parseFrontmatter(fs15.readFileSync(path17.join(root, only.name, markdown.name), "utf8")).data;
       const declaredType = typeof data.type === "string" ? data.type.trim() : "";
       return !declaredType || declaredType === expectedType;
     } catch {
@@ -40889,9 +41435,9 @@ var akmAdapter = {
 
 // src/core/adapter/adapters/akm-task-adapter.ts
 import fs16 from "fs";
-import path17 from "path";
+import path18 from "path";
 var COMPONENT_ID2 = "main";
-var TASK_EXT = ".yml";
+var TASK_EXT = TASK_EXTENSION;
 var TARGET_KEYS = ["prompt", "workflow", "command"];
 var MAX_CONTENT_CHARS2 = 1e5;
 function toPosix3(p) {
@@ -40916,14 +41462,6 @@ function recognize3(c, file) {
     content: raw.length > MAX_CONTENT_CHARS2 ? raw.slice(0, MAX_CONTENT_CHARS2) : raw
   };
 }
-function parseTaskYaml(raw) {
-  try {
-    const doc = $parse(raw);
-    if (doc && typeof doc === "object" && !Array.isArray(doc))
-      return doc;
-  } catch {}
-  return {};
-}
 function taskDiagnostics2(relPath, data) {
   if (Object.keys(data).length === 0)
     return [];
@@ -40947,21 +41485,41 @@ async function validate3(_c, changes, ctx) {
     const raw = change.after ?? await ctx.readFile(change.path);
     if (typeof raw !== "string")
       continue;
-    if (path17.extname(change.path).toLowerCase() !== TASK_EXT)
+    const ext = path18.extname(change.path).toLowerCase();
+    if (ext !== TASK_EXT && ext !== TASK_NEAR_MISS_EXTENSION)
       continue;
-    diagnostics.push(...taskDiagnostics2(toPosix3(change.path), parseTaskYaml(raw)));
+    const relPath = toPosix3(change.path);
+    if (ext === TASK_NEAR_MISS_EXTENSION) {
+      diagnostics.push({
+        file: relPath,
+        issue: "invalid-task-yaml",
+        detail: taskExtensionDetail(relPath),
+        fixed: false
+      });
+    }
+    const parsed = parseTaskYaml(raw);
+    if (!parsed.ok) {
+      diagnostics.push({
+        file: relPath,
+        issue: "invalid-task-yaml",
+        detail: taskYamlParseDetail(parsed.error),
+        fixed: false
+      });
+      continue;
+    }
+    diagnostics.push(...taskDiagnostics2(relPath, parsed.data));
   }
   return diagnostics;
 }
 var akmTaskAdapter = {
   id: "akm-task",
   version: "0.9.0",
-  extensions: [TASK_EXT],
+  extensions: [TASK_EXT, TASK_NEAR_MISS_EXTENSION],
   recognize: recognize3,
   validate: validate3,
   placeNew(c, conceptId) {
     const posix = toPosix3(conceptId);
-    return path17.join(c.root, /\.yml$/i.test(posix) ? posix : `${posix}.yml`);
+    return path18.join(c.root, /\.yml$/i.test(posix) ? posix : `${posix}.yml`);
   },
   directoryList() {
     return ["."];
@@ -40974,15 +41532,15 @@ var akmTaskAdapter = {
       return false;
     }
     for (const entry of entries) {
-      if (!entry.isFile() || path17.extname(entry.name).toLowerCase() !== TASK_EXT)
+      if (!entry.isFile() || path18.extname(entry.name).toLowerCase() !== TASK_EXT)
         continue;
       let raw;
       try {
-        raw = fs16.readFileSync(path17.join(root, entry.name), "utf8");
+        raw = fs16.readFileSync(path18.join(root, entry.name), "utf8");
       } catch {
         continue;
       }
-      const data = parseTaskYaml(raw);
+      const { data } = parseTaskYaml(raw);
       if (typeof data.schedule === "string" && data.schedule.trim() !== "")
         return true;
     }
@@ -40992,7 +41550,7 @@ var akmTaskAdapter = {
 
 // src/core/adapter/adapters/akm-workflow-adapter.ts
 import fs17 from "fs";
-import path18 from "path";
+import path19 from "path";
 var COMPONENT_ID3 = "main";
 var WORKFLOW_EXTS = new Set([".md"]);
 var MAX_CONTENT_CHARS3 = 1e5;
@@ -41050,8 +41608,8 @@ async function validate4(c, changes, ctx) {
     const raw = change.after ?? await ctx.readFile(change.path);
     if (typeof raw !== "string")
       continue;
-    const ext = path18.extname(change.path).toLowerCase();
-    if (!WORKFLOW_EXTS.has(ext) || isReservedDocFile(path18.basename(change.path)) || !isWorkflowFile(raw))
+    const ext = path19.extname(change.path).toLowerCase();
+    if (!WORKFLOW_EXTS.has(ext) || isReservedDocFile(path19.basename(change.path)) || !isWorkflowFile(raw))
       continue;
     const relPath = toPosix4(change.path);
     const p = parseFrontmatter(raw);
@@ -41074,12 +41632,12 @@ function hasTopLevelWorkflowFile(root, entries) {
   for (const entry of entries) {
     if (!entry.isFile())
       continue;
-    const ext = path18.extname(entry.name).toLowerCase();
+    const ext = path19.extname(entry.name).toLowerCase();
     if (!WORKFLOW_EXTS.has(ext) || isReservedDocFile(entry.name))
       continue;
     let raw;
     try {
-      raw = fs17.readFileSync(path18.join(root, entry.name), "utf8");
+      raw = fs17.readFileSync(path19.join(root, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -41097,8 +41655,8 @@ var akmWorkflowAdapter = {
   placeNew(c, conceptId) {
     const posix = toPosix4(conceptId);
     if (/\.md$/i.test(posix))
-      return path18.join(c.root, posix);
-    return path18.join(c.root, `${posix}.md`);
+      return path19.join(c.root, posix);
+    return path19.join(c.root, `${posix}.md`);
   },
   directoryList() {
     return ["."];
@@ -41116,10 +41674,10 @@ var akmWorkflowAdapter = {
 
 // src/core/adapter/adapters/claude-adapter.ts
 import fs18 from "fs";
-import path20 from "path";
+import path21 from "path";
 
 // src/core/adapter/adapters/tool-dir-shared.ts
-import path19 from "path";
+import path20 from "path";
 var RESERVED_FILES2 = new Set(["index.md", "log.md"]);
 var MAX_CONTENT_CHARS4 = 1e5;
 var CANONICAL_COMMAND_DIR = "commands";
@@ -41144,7 +41702,7 @@ function classify(relPath, layout) {
     return { type: "instruction", conceptId: layout.instructionConceptId, name: layout.instructionConceptId };
   }
   const head = segs[0];
-  const ext = path19.extname(base).toLowerCase();
+  const ext = path20.extname(base).toLowerCase();
   if (layout.skillDirs.has(head)) {
     if (segs.length >= 3 && base === SKILL_MANIFEST2) {
       return { type: "skill", conceptId: `${segs[0]}/${segs[1]}`, name: segs[1] };
@@ -41193,19 +41751,19 @@ function recognizeToolDir(layout, c, file) {
 function placeNewToolDir(layout, c, conceptId) {
   const posix = toPosix5(conceptId);
   if (posix === layout.instructionConceptId)
-    return path19.join(c.root, layout.instructionFile);
+    return path20.join(c.root, layout.instructionFile);
   const segs = posix.split("/").filter((s) => s.length > 0);
   const head = segs[0];
   const rest = segs.slice(1).join("/");
   if (rest.length > 0) {
     if (layout.skillDirs.has(head))
-      return path19.join(c.root, CANONICAL_SKILL_DIR, rest, SKILL_MANIFEST2);
+      return path20.join(c.root, CANONICAL_SKILL_DIR, rest, SKILL_MANIFEST2);
     if (layout.commandDirs.has(head))
-      return path19.join(c.root, CANONICAL_COMMAND_DIR, `${rest}.md`);
+      return path20.join(c.root, CANONICAL_COMMAND_DIR, `${rest}.md`);
     if (layout.agentDirs.has(head))
-      return path19.join(c.root, CANONICAL_AGENT_DIR, `${rest}.md`);
+      return path20.join(c.root, CANONICAL_AGENT_DIR, `${rest}.md`);
   }
-  return path19.join(c.root, `${posix}.md`);
+  return path20.join(c.root, `${posix}.md`);
 }
 function nameOrSignalDiagnostics(type, relPath, data, body) {
   if (nonEmptyString2(data.name) !== undefined || nonEmptyString2(data.description) !== undefined)
@@ -41232,7 +41790,7 @@ async function validateToolDir(layout, c, changes, ctx) {
     if (typeof raw !== "string")
       continue;
     const relPath = toPosix5(change.path);
-    diagnostics.push(...await skillDirectoryDiagnostics(relPath, seenSkillDirs, ctx));
+    diagnostics.push(...await skillDirectoryDiagnostics(relPath, seenSkillDirs, ctx, layout.skillDirs));
     const cls = classify(change.path, layout);
     if (cls === null)
       continue;
@@ -41277,18 +41835,18 @@ function dirExists(p) {
 }
 function claudeLooksLikeRoot(root) {
   try {
-    if (!fs18.existsSync(path20.join(root, "CLAUDE.md")))
+    if (!fs18.existsSync(path21.join(root, "CLAUDE.md")))
       return false;
   } catch {
     return false;
   }
-  return ["commands", "agents", "skills"].some((d) => dirExists(path20.join(root, d)));
+  return ["commands", "agents", "skills"].some((d) => dirExists(path21.join(root, d)));
 }
 var claudeAdapter = makeToolDirAdapter(LAYOUT, claudeLooksLikeRoot);
 
 // src/core/adapter/adapters/dotenv-adapter.ts
 import fs19 from "fs";
-import path21 from "path";
+import path22 from "path";
 var COMPONENT_ID4 = "main";
 var ENV_DIR = "env";
 var SECRETS_DIR = "secrets";
@@ -41394,10 +41952,10 @@ var dotenvAdapter = {
       const rest = posix.slice(slash + 1);
       const type = typeForStashDir(head);
       if ((type === "env" || type === "secret") && rest.length > 0) {
-        return assetPathForName(type, path21.join(c.root, head), rest);
+        return assetPathForName(type, path22.join(c.root, head), rest);
       }
     }
-    return path21.join(c.root, posix);
+    return path22.join(c.root, posix);
   },
   directoryList() {
     return [ENV_DIR, SECRETS_DIR];
@@ -41419,7 +41977,7 @@ var dotenvAdapter = {
 };
 
 // src/core/adapter/adapters/generic-files-adapter.ts
-import path22 from "path";
+import path23 from "path";
 var COMPONENT_ID5 = "main";
 var DOCUMENT_EXTENSIONS = new Set([".md", ".markdown", ".txt", ".text"]);
 var RESERVED_FILES3 = new Set(["index.md", "log.md"]);
@@ -41490,8 +42048,8 @@ var genericFilesAdapter = {
   validate: validate6,
   placeNew(c, conceptId) {
     const posix = toPosix7(conceptId);
-    const hasExt = path22.extname(posix) !== "";
-    return path22.join(c.root, hasExt ? posix : `${posix}.md`);
+    const hasExt = path23.extname(posix) !== "";
+    return path23.join(c.root, hasExt ? posix : `${posix}.md`);
   },
   looksLikeRoot() {
     return false;
@@ -41500,7 +42058,7 @@ var genericFilesAdapter = {
 
 // src/core/adapter/adapters/llm-wiki-adapter.ts
 import fs20 from "fs";
-import path23 from "path";
+import path24 from "path";
 var WIKI_COMPONENT_ID = "main";
 var WIKI_SOURCE_TYPE = "wiki-source";
 var DEFAULT_PAGE_KIND = "note";
@@ -41562,7 +42120,7 @@ function resolveXref(xref, bundleId) {
   return target.length > 0 ? target : null;
 }
 function resolveBodyLinks(body, fileRelPath) {
-  const dir = path23.posix.dirname(toPosix8(fileRelPath));
+  const dir = path24.posix.dirname(toPosix8(fileRelPath));
   const linkRe = /\[[^\]]*\]\(([^)]+)\)/g;
   const out = [];
   const seen = new Set;
@@ -41588,10 +42146,10 @@ function resolveBodyLinks(body, fileRelPath) {
       continue;
     let resolved;
     if (target.startsWith("/")) {
-      resolved = path23.posix.normalize(target.slice(1));
+      resolved = path24.posix.normalize(target.slice(1));
     } else {
       const base = dir === "." ? "" : dir;
-      resolved = path23.posix.normalize(path23.posix.join(base, target));
+      resolved = path24.posix.normalize(path24.posix.join(base, target));
     }
     if (resolved.startsWith("../") || resolved === ".." || resolved.startsWith("/"))
       continue;
@@ -41772,16 +42330,16 @@ var llmWikiAdapter = {
   recognize: recognize7,
   validate: validate7,
   placeNew(c, conceptId) {
-    return path23.join(c.root, `${conceptId}.md`);
+    return path24.join(c.root, `${conceptId}.md`);
   },
   directoryList(_c) {
     return ["."];
   },
   looksLikeRoot(root) {
     try {
-      if (!fs20.existsSync(path23.join(root, "schema.md")))
+      if (!fs20.existsSync(path24.join(root, "schema.md")))
         return false;
-      return fs20.statSync(path23.join(root, PAGES_SUBDIR)).isDirectory();
+      return fs20.statSync(path24.join(root, PAGES_SUBDIR)).isDirectory();
     } catch {
       return false;
     }
@@ -41790,7 +42348,7 @@ var llmWikiAdapter = {
 
 // src/core/adapter/adapters/okf-adapter.ts
 import fs21 from "fs";
-import path24 from "path";
+import path25 from "path";
 var CONSUMED_FRONTMATTER_KEYS = [
   "type",
   "title",
@@ -41804,11 +42362,11 @@ var CONSUMED_FRONTMATTER_KEYS = [
   "stale_after",
   "okf_version"
 ];
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function parseActorMapping(value) {
-  if (!isPlainObject2(value))
+  if (!isPlainObject3(value))
     return;
   const by = nonEmptyString2(value.by);
   if (by === undefined)
@@ -41833,7 +42391,7 @@ function parseOkfSources(value) {
     return;
   const out = [];
   for (const item of value) {
-    if (!isPlainObject2(item))
+    if (!isPlainObject3(item))
       continue;
     const resource = nonEmptyString2(item.resource);
     if (resource === undefined)
@@ -41870,7 +42428,7 @@ function isReservedFileName2(name) {
   return RESERVED_FILES4.has(name.toLowerCase());
 }
 function resolveOkfLinks(body, fileRelPath) {
-  const dir = path24.posix.dirname(toPosix9(fileRelPath));
+  const dir = path25.posix.dirname(toPosix9(fileRelPath));
   const definitions = new Map;
   for (const match of body.matchAll(/^\s*\[([^\]]+)\]:\s*(\S+)/gm)) {
     definitions.set(match[1].trim().toLowerCase(), match[2]);
@@ -41908,10 +42466,10 @@ function resolveOkfLinks(body, fileRelPath) {
       continue;
     let resolved;
     if (target.startsWith("/")) {
-      resolved = path24.posix.normalize(target.slice(1));
+      resolved = path25.posix.normalize(target.slice(1));
     } else {
       const base = dir === "." ? "" : dir;
-      resolved = path24.posix.normalize(path24.posix.join(base, target));
+      resolved = path25.posix.normalize(path25.posix.join(base, target));
     }
     if (resolved.startsWith("../") || resolved === ".." || resolved.startsWith("/"))
       continue;
@@ -41939,7 +42497,7 @@ function recognize8(c, file) {
   const description = nonEmptyString2(data.description);
   const tags = readTags2(data.tags);
   const links = resolveOkfLinks(body, file.relPath);
-  const generatedMapping = isPlainObject2(data.generated) ? data.generated : undefined;
+  const generatedMapping = isPlainObject3(data.generated) ? data.generated : undefined;
   const generatedAt = generatedMapping ? nonEmptyString2(generatedMapping.at) : undefined;
   const generatedBy = generatedMapping ? nonEmptyString2(generatedMapping.by) : undefined;
   const legacyTimestamp = nonEmptyString2(data.timestamp);
@@ -42041,7 +42599,7 @@ var okfAdapter = {
     return ["."];
   },
   looksLikeRoot(root) {
-    if (fs21.existsSync(path24.join(root, "index.md")))
+    if (fs21.existsSync(path25.join(root, "index.md")))
       return true;
     const stack = [root];
     while (stack.length > 0) {
@@ -42057,7 +42615,7 @@ var okfAdapter = {
       for (const entry of entries) {
         if (entry.isSymbolicLink() || entry.name === ".git")
           continue;
-        const absolute = path24.join(current, entry.name);
+        const absolute = path25.join(current, entry.name);
         if (entry.isDirectory()) {
           stack.push(absolute);
           continue;
@@ -42075,7 +42633,7 @@ var okfAdapter = {
 
 // src/core/adapter/adapters/opencode-adapter.ts
 import fs22 from "fs";
-import path25 from "path";
+import path26 from "path";
 var LAYOUT2 = {
   adapterId: "opencode",
   componentId: ".opencode",
@@ -42102,17 +42660,17 @@ function dirExists2(p) {
   }
 }
 function opencodeLooksLikeRoot(root) {
-  if (CONFIG_FILES.some((f) => fileExists(path25.join(root, f))))
+  if (CONFIG_FILES.some((f) => fileExists(path26.join(root, f))))
     return true;
-  if (!fileExists(path25.join(root, "AGENTS.md")))
+  if (!fileExists(path26.join(root, "AGENTS.md")))
     return false;
-  return TOOL_DIRS.some((d) => dirExists2(path25.join(root, d)));
+  return TOOL_DIRS.some((d) => dirExists2(path26.join(root, d)));
 }
 var opencodeAdapter = makeToolDirAdapter(LAYOUT2, opencodeLooksLikeRoot);
 
 // src/core/adapter/adapters/website-snapshot-adapter.ts
 import fs23 from "fs";
-import path26 from "path";
+import path27 from "path";
 var COMPONENT_ID6 = "main";
 var PAGES_PREFIX = "stash/knowledge/";
 var MANIFEST_FILE = "manifest.json";
@@ -42205,7 +42763,7 @@ var websiteSnapshotAdapter = {
   looksLikeRoot(root) {
     let raw;
     try {
-      raw = fs23.readFileSync(path26.join(root, MANIFEST_FILE), "utf8");
+      raw = fs23.readFileSync(path27.join(root, MANIFEST_FILE), "utf8");
     } catch {
       return false;
     }
@@ -42247,7 +42805,7 @@ function expandTilde(p) {
   if (p === "~")
     return os.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\"))
-    return path27.join(os.homedir(), p.slice(2));
+    return path28.join(os.homedir(), p.slice(2));
   return p;
 }
 function readString(value) {
@@ -42292,7 +42850,7 @@ function oldConfigMigratableSources(raw, pathResolutionBase = process.cwd()) {
     const p = readString(primaryEntry.path);
     if (descriptor) {
       out.push({
-        derivationPath: p ? path27.resolve(pathResolutionBase, expandTilde(p)) : readString(primaryEntry.url) ?? "",
+        derivationPath: p ? path28.resolve(pathResolutionBase, expandTilde(p)) : readString(primaryEntry.url) ?? "",
         registryId: readString(primaryEntry.name),
         writable: typeof primaryEntry.writable === "boolean" ? primaryEntry.writable : undefined,
         ...typeof primaryEntry.enabled === "boolean" ? { enabled: primaryEntry.enabled } : {},
@@ -42303,7 +42861,7 @@ function oldConfigMigratableSources(raw, pathResolutionBase = process.cwd()) {
   }
   if (!out.some((source) => source.primary) && stashDir) {
     out.push({
-      derivationPath: path27.resolve(pathResolutionBase, expandTilde(stashDir)),
+      derivationPath: path28.resolve(pathResolutionBase, expandTilde(stashDir)),
       writable: true,
       primary: true,
       descriptor: { path: stashDir }
@@ -42317,7 +42875,7 @@ function oldConfigMigratableSources(raw, pathResolutionBase = process.cwd()) {
       continue;
     const p = readString(entry.path);
     out.push({
-      derivationPath: p ? path27.resolve(pathResolutionBase, expandTilde(p)) : readString(entry.url) ?? "",
+      derivationPath: p ? path28.resolve(pathResolutionBase, expandTilde(p)) : readString(entry.url) ?? "",
       registryId: readString(entry.name),
       writable: typeof entry.writable === "boolean" ? entry.writable : undefined,
       ...typeof entry.enabled === "boolean" ? { enabled: entry.enabled } : {},
@@ -42331,7 +42889,7 @@ function oldConfigMigratableSources(raw, pathResolutionBase = process.cwd()) {
     const source = readString(entry.source);
     const ref = readString(entry.ref);
     const descriptor = source ? installedSourceDescriptor(source, ref, stashRoot) : { path: stashRoot };
-    const resolvedRoot = path27.resolve(pathResolutionBase, expandTilde(stashRoot));
+    const resolvedRoot = path28.resolve(pathResolutionBase, expandTilde(stashRoot));
     const needsLock = (("git" in descriptor) || ("npm" in descriptor)) && !!source && !!ref;
     out.push({
       derivationPath: resolvedRoot,
@@ -42346,8 +42904,8 @@ function oldConfigMigratableSources(raw, pathResolutionBase = process.cwd()) {
   const byPath = new Map;
   for (const source of out) {
     let pathIdentity;
-    if (path27.isAbsolute(source.derivationPath)) {
-      const resolved = path27.resolve(source.derivationPath);
+    if (path28.isAbsolute(source.derivationPath)) {
+      const resolved = path28.resolve(source.derivationPath);
       try {
         pathIdentity = fs24.realpathSync(resolved);
       } catch {
@@ -42479,14 +43037,14 @@ function generateTargetConfig(raw, currentConfigVersion) {
 import { randomBytes } from "crypto";
 import fs27 from "fs";
 import os3 from "os";
-import path30 from "path";
+import path31 from "path";
 init_common();
 init_warn();
 
 // scripts/akm-migrate/migrate/legacy/legacy-layout.ts
 import fs25 from "fs";
 import os2 from "os";
-import path28 from "path";
+import path29 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 class LegacyResolverError extends Error {
@@ -42545,9 +43103,9 @@ function toPosix11(input) {
   return input.replace(/\\/g, "/");
 }
 var workflowSpec2 = {
-  isRelevantFile: (fileName) => WORKFLOW_EXTENSIONS2.includes(path28.extname(fileName).toLowerCase()),
+  isRelevantFile: (fileName) => WORKFLOW_EXTENSIONS2.includes(path29.extname(fileName).toLowerCase()),
   toCanonicalName: (typeRoot, filePath) => {
-    const rel = toPosix11(path28.relative(typeRoot, filePath));
+    const rel = toPosix11(path29.relative(typeRoot, filePath));
     for (const ext of WORKFLOW_EXTENSIONS2) {
       if (rel.toLowerCase().endsWith(ext))
         return rel.slice(0, -ext.length);
@@ -42558,43 +43116,43 @@ var workflowSpec2 = {
     const lower = name.toLowerCase();
     for (const ext of WORKFLOW_EXTENSIONS2) {
       if (lower.endsWith(ext))
-        return path28.join(typeRoot, name);
+        return path29.join(typeRoot, name);
     }
     for (const ext of WORKFLOW_EXTENSIONS2) {
-      const candidate = path28.join(typeRoot, `${name}${ext}`);
+      const candidate = path29.join(typeRoot, `${name}${ext}`);
       if (fs25.existsSync(candidate))
         return candidate;
     }
-    return path28.join(typeRoot, `${name}.md`);
+    return path29.join(typeRoot, `${name}.md`);
   }
 };
 var markdownSpec2 = {
-  isRelevantFile: (fileName) => path28.extname(fileName).toLowerCase() === ".md",
+  isRelevantFile: (fileName) => path29.extname(fileName).toLowerCase() === ".md",
   toCanonicalName: (typeRoot, filePath) => {
-    const rel = toPosix11(path28.relative(typeRoot, filePath));
+    const rel = toPosix11(path29.relative(typeRoot, filePath));
     return rel.endsWith(".md") ? rel.slice(0, -3) : rel;
   },
   toAssetPath: (typeRoot, name) => {
     const withExt = name.endsWith(".md") ? name : `${name}.md`;
-    return path28.join(typeRoot, withExt);
+    return path29.join(typeRoot, withExt);
   }
 };
 var scriptSpec2 = {
-  isRelevantFile: (fileName) => SCRIPT_EXTENSIONS2.has(path28.extname(fileName).toLowerCase()),
-  toCanonicalName: (typeRoot, filePath) => toPosix11(path28.relative(typeRoot, filePath)),
-  toAssetPath: (typeRoot, name) => path28.join(typeRoot, name)
+  isRelevantFile: (fileName) => SCRIPT_EXTENSIONS2.has(path29.extname(fileName).toLowerCase()),
+  toCanonicalName: (typeRoot, filePath) => toPosix11(path29.relative(typeRoot, filePath)),
+  toAssetPath: (typeRoot, name) => path29.join(typeRoot, name)
 };
 var ASSET_SPECS_INTERNAL = {
   skill: {
     stashDir: "skills",
     isRelevantFile: (fileName) => fileName === "SKILL.md",
     toCanonicalName: (typeRoot, filePath) => {
-      const relDir = toPosix11(path28.dirname(path28.relative(typeRoot, filePath)));
+      const relDir = toPosix11(path29.dirname(path29.relative(typeRoot, filePath)));
       if (!relDir || relDir === ".")
         return;
       return relDir;
     },
-    toAssetPath: (typeRoot, name) => path28.join(typeRoot, name, "SKILL.md")
+    toAssetPath: (typeRoot, name) => path29.join(typeRoot, name, "SKILL.md")
   },
   command: { stashDir: "commands", ...markdownSpec2 },
   agent: { stashDir: "agents", ...markdownSpec2 },
@@ -42606,10 +43164,10 @@ var ASSET_SPECS_INTERNAL = {
     stashDir: "env",
     isRelevantFile: (fileName) => fileName === ".env" || fileName.endsWith(".env"),
     toCanonicalName: (typeRoot, filePath) => {
-      const rel = toPosix11(path28.relative(typeRoot, filePath));
-      const fileName = path28.basename(rel);
+      const rel = toPosix11(path29.relative(typeRoot, filePath));
+      const fileName = path29.basename(rel);
       if (fileName === ".env") {
-        const dir = path28.dirname(rel);
+        const dir = path29.dirname(rel);
         return dir === "." || dir === "" ? "default" : `${dir}/default`;
       }
       const stripped = rel.endsWith(".env") ? rel.slice(0, -4) : rel;
@@ -42617,15 +43175,15 @@ var ASSET_SPECS_INTERNAL = {
     },
     toAssetPath: (typeRoot, name) => {
       if (name === "default")
-        return path28.join(typeRoot, ".env");
-      return path28.join(typeRoot, name.endsWith(".env") ? name : `${name}.env`);
+        return path29.join(typeRoot, ".env");
+      return path29.join(typeRoot, name.endsWith(".env") ? name : `${name}.env`);
     }
   },
   secret: {
     stashDir: "secrets",
     isRelevantFile: (fileName) => !fileName.endsWith(".lock") && !fileName.endsWith(".sensitive"),
-    toCanonicalName: (typeRoot, filePath) => toPosix11(path28.relative(typeRoot, filePath)),
-    toAssetPath: (typeRoot, name) => path28.join(typeRoot, name)
+    toCanonicalName: (typeRoot, filePath) => toPosix11(path29.relative(typeRoot, filePath)),
+    toAssetPath: (typeRoot, name) => path29.join(typeRoot, name)
   },
   wiki: {
     stashDir: "wikis",
@@ -42637,14 +43195,14 @@ var ASSET_SPECS_INTERNAL = {
   },
   task: {
     stashDir: "tasks",
-    isRelevantFile: (fileName) => path28.extname(fileName).toLowerCase() === ".yml",
+    isRelevantFile: (fileName) => path29.extname(fileName).toLowerCase() === ".yml",
     toCanonicalName: (typeRoot, filePath) => {
-      const rel = toPosix11(path28.relative(typeRoot, filePath));
+      const rel = toPosix11(path29.relative(typeRoot, filePath));
       return rel.endsWith(".yml") ? rel.slice(0, -4) : rel;
     },
     toAssetPath: (typeRoot, name) => {
       const withExt = name.endsWith(".yml") ? name : `${name}.yml`;
-      return path28.join(typeRoot, withExt);
+      return path29.join(typeRoot, withExt);
     }
   },
   session: {
@@ -42685,8 +43243,8 @@ function resolveSourcesForOrigin(origin, allSources) {
     if (byParsedId.length > 0)
       return byParsedId;
   } catch {}
-  const resolvedOrigin = path28.resolve(origin);
-  const byPath = allSources.filter((s) => path28.resolve(s.path) === resolvedOrigin);
+  const resolvedOrigin = path29.resolve(origin);
+  const byPath = allSources.filter((s) => path29.resolve(s.path) === resolvedOrigin);
   if (byPath.length > 0)
     return byPath;
   return [];
@@ -42827,7 +43385,7 @@ function parseGitUrl(input, originalRef) {
   };
 }
 function tryParseLocalRef(rawRef, explicitPath) {
-  const resolvedPath = path28.resolve(rawRef);
+  const resolvedPath = path29.resolve(rawRef);
   let stat;
   try {
     stat = fs25.statSync(resolvedPath);
@@ -42855,7 +43413,7 @@ function isPathLikeRef(ref) {
     return false;
   if (ref === "." || ref === "..")
     return true;
-  if (path28.isAbsolute(ref))
+  if (path29.isAbsolute(ref))
     return true;
   if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith(".\\") || ref.startsWith("..\\")) {
     return true;
@@ -42924,7 +43482,7 @@ function toReadableLocalId(absolutePath) {
   const home = os2.homedir();
   if (absolutePath === home)
     return "~";
-  if (absolutePath.startsWith(home + path28.sep)) {
+  if (absolutePath.startsWith(home + path29.sep)) {
     return `~/${absolutePath.slice(home.length + 1)}`;
   }
   return absolutePath;
@@ -42934,10 +43492,10 @@ function toReadableLocalId(absolutePath) {
 init_common();
 init_warn();
 import fs26 from "fs";
-import path29 from "path";
+import path30 from "path";
 var LEGACY_STASH_FILENAME = ".stash.json";
 function legacyStashFilePath(dirPath) {
-  return path29.join(dirPath, LEGACY_STASH_FILENAME);
+  return path30.join(dirPath, LEGACY_STASH_FILENAME);
 }
 function inspectLegacyStashOverrides(dirPath, options) {
   const filePath = legacyStashFilePath(dirPath);
@@ -43051,7 +43609,7 @@ function collectDirs(root) {
     }
     for (const entry of entries) {
       if (entry.isDirectory() && !entry.name.startsWith("."))
-        walk(path30.join(dir, entry.name));
+        walk(path31.join(dir, entry.name));
     }
   };
   walk(root);
@@ -43062,7 +43620,7 @@ function runContentMigration(stashRoots, options = {}) {
   const seen = new Set;
   const roots = [];
   for (const root of stashRoots) {
-    const resolved = path30.resolve(root);
+    const resolved = path31.resolve(root);
     if (seen.has(resolved) || !safeIsDir(resolved))
       continue;
     seen.add(resolved);
@@ -43076,7 +43634,7 @@ function runContentMigration(stashRoots, options = {}) {
       rewriteSourceBackrefsInDir(dir, report);
   }
   const operationId = options.operationId ?? `direct-${process.pid}-${randomBytes(8).toString("hex")}`;
-  const batchPath = options.renameBatchPath ?? path30.join(os3.tmpdir(), `akm-reserved-renames-${operationId}-${randomBytes(8).toString("hex")}.json`);
+  const batchPath = options.renameBatchPath ?? path31.join(os3.tmpdir(), `akm-reserved-renames-${operationId}-${randomBytes(8).toString("hex")}.json`);
   let batch;
   try {
     batch = loadReservedRenameBatch(batchPath, operationId);
@@ -43101,9 +43659,9 @@ function rewriteSourceBackrefsInDir(dir, report) {
     throw error2;
   }
   for (const entry of entries) {
-    if (!entry.isFile() || path30.extname(entry.name).toLowerCase() !== ".md")
+    if (!entry.isFile() || path31.extname(entry.name).toLowerCase() !== ".md")
       continue;
-    const filePath = path30.join(dir, entry.name);
+    const filePath = path31.join(dir, entry.name);
     try {
       const source = asNonEmptyString(parseFrontmatter(fs27.readFileSync(filePath, "utf8")).data.source);
       const rewritten = legacyMemoryBackrefToConceptId(source);
@@ -43159,9 +43717,9 @@ function foldEntry(dir, entry, report) {
     report.entriesSkipped++;
     return false;
   }
-  const target = path30.resolve(dir, entry.filename);
-  const relative = path30.relative(path30.resolve(dir), target);
-  if (relative.startsWith("..") || path30.isAbsolute(relative)) {
+  const target = path31.resolve(dir, entry.filename);
+  const relative = path31.relative(path31.resolve(dir), target);
+  if (relative.startsWith("..") || path31.isAbsolute(relative)) {
     report.entriesSkipped++;
     return false;
   }
@@ -43173,13 +43731,13 @@ function foldEntry(dir, entry, report) {
       throw error2;
     targetExists = false;
   }
-  if (!targetExists || path30.extname(target).toLowerCase() !== ".md") {
+  if (!targetExists || path31.extname(target).toLowerCase() !== ".md") {
     report.entriesSkipped++;
     return false;
   }
   try {
-    const realRelative = path30.relative(fs27.realpathSync(dir), fs27.realpathSync(target));
-    if (realRelative.startsWith("..") || path30.isAbsolute(realRelative)) {
+    const realRelative = path31.relative(fs27.realpathSync(dir), fs27.realpathSync(target));
+    if (realRelative.startsWith("..") || path31.isAbsolute(realRelative)) {
       report.entriesSkipped++;
       return false;
     }
@@ -43205,8 +43763,8 @@ function foldCuratedFields(existing, entry) {
   return next;
 }
 function mutateFrontmatterAtomic(filePath, mutate) {
-  const directory = path30.dirname(filePath);
-  const temporary = path30.join(directory, `.${path30.basename(filePath)}.akm-migrate-${process.pid}-${randomBytes(8).toString("hex")}`);
+  const directory = path31.dirname(filePath);
+  const temporary = path31.join(directory, `.${path31.basename(filePath)}.akm-migrate-${process.pid}-${randomBytes(8).toString("hex")}`);
   try {
     const mode = fs27.statSync(filePath).mode & 511;
     fs27.copyFileSync(filePath, temporary, fs27.constants.COPYFILE_EXCL);
@@ -43229,7 +43787,7 @@ function reservedConceptsInDir(root, dir) {
   for (const entry of entries) {
     if (!entry.isFile() || !RESERVED_BASENAMES.has(entry.name.toLowerCase()))
       continue;
-    const filePath = path30.join(dir, entry.name);
+    const filePath = path31.join(dir, entry.name);
     const legacyType = legacyTypeForDirectory(root, dir);
     if (legacyType === "wiki")
       continue;
@@ -43241,13 +43799,13 @@ function reservedConceptsInDir(root, dir) {
 }
 function planReservedRenameBatch(stashRoots, batchPath, operationId) {
   const entries = [];
-  for (const root of stashRoots.map((value) => path30.resolve(value))) {
+  for (const root of stashRoots.map((value) => path31.resolve(value))) {
     for (const dir of collectDirs(root)) {
       entries.push(...reservedConceptsInDir(root, dir));
     }
   }
   const batch = { formatVersion: 1, operationId, entries };
-  fs27.mkdirSync(path30.dirname(batchPath), { recursive: true, mode: 448 });
+  fs27.mkdirSync(path31.dirname(batchPath), { recursive: true, mode: 448 });
   writeFileAtomic(batchPath, `${JSON.stringify(batch, null, 2)}
 `, 384);
   return batch;
@@ -43287,21 +43845,21 @@ function applyReservedRenameBatch(batch, operationId) {
     if (targetExists)
       throw new Error(`Reserved rename target already exists: ${entry.to}`);
     fs27.renameSync(entry.from, entry.to);
-    syncRenameDirectory(path30.dirname(entry.to));
+    syncRenameDirectory(path31.dirname(entry.to));
   }
 }
 function legacyTypeForDirectory(root, dir) {
-  const [top] = path30.relative(root, dir).split(path30.sep);
+  const [top] = path31.relative(root, dir).split(path31.sep);
   if (!top || top === "..")
     return;
   const exact = Object.entries(TYPE_DIRS).find(([, typeDir]) => typeDir === top)?.[0];
   if (exact)
     return exact;
-  const actualRoot = path30.join(root, top);
+  const actualRoot = path31.join(root, top);
   try {
     const actualIdentity = fs27.realpathSync(actualRoot);
     return Object.entries(TYPE_DIRS).find(([, typeDir]) => {
-      const canonicalRoot = path30.join(root, typeDir);
+      const canonicalRoot = path31.join(root, typeDir);
       return fs27.existsSync(canonicalRoot) && fs27.realpathSync(canonicalRoot) === actualIdentity;
     })?.[0];
   } catch (error2) {
@@ -43319,10 +43877,10 @@ function carriesAssetFrontmatter(filePath) {
 }
 function collisionSafeTarget(dir, basename) {
   const stem = basename.slice(0, basename.length - ".md".length);
-  let candidate = path30.join(dir, `${stem}-content.md`);
+  let candidate = path31.join(dir, `${stem}-content.md`);
   let suffix = 2;
   while (pathExists(candidate)) {
-    candidate = path30.join(dir, `${stem}-content-${suffix}.md`);
+    candidate = path31.join(dir, `${stem}-content-${suffix}.md`);
     suffix++;
   }
   return candidate;
@@ -43343,14 +43901,14 @@ function errMsg(error2) {
 
 // scripts/akm-migrate/migrate/legacy/legacy-paths.ts
 init_paths();
-import path31 from "path";
+import path32 from "path";
 function getLegacyWorkflowDbPath() {
-  return path31.join(getDataDir(), "workflow.db");
+  return path32.join(getDataDir(), "workflow.db");
 }
 
 // scripts/akm-migrate/migrate/legacy/proposal-fs-import.ts
 import fs29 from "fs";
-import path34 from "path";
+import path35 from "path";
 init_warn();
 
 // src/registry/resolve.ts
@@ -43359,7 +43917,7 @@ init_errors();
 import { spawnSync as spawnSync3 } from "child_process";
 import fs28 from "fs";
 import os4 from "os";
-import path32 from "path";
+import path33 from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 
 // src/integrations/github.ts
@@ -43598,7 +44156,7 @@ function parseGitUrl2(input, originalRef) {
   };
 }
 function tryParseLocalRef2(rawRef, explicitPath) {
-  const resolvedPath = path32.resolve(rawRef);
+  const resolvedPath = path33.resolve(rawRef);
   let stat;
   try {
     stat = fs28.statSync(resolvedPath);
@@ -43628,7 +44186,7 @@ function isPathLikeRef2(ref) {
     return false;
   if (ref === "." || ref === "..")
     return true;
-  if (path32.isAbsolute(ref))
+  if (path33.isAbsolute(ref))
     return true;
   if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith(".\\") || ref.startsWith("..\\")) {
     return true;
@@ -43881,18 +44439,18 @@ function toReadableLocalId2(absolutePath) {
   const home = os4.homedir();
   if (absolutePath === home)
     return "~";
-  if (absolutePath.startsWith(home + path32.sep)) {
+  if (absolutePath.startsWith(home + path33.sep)) {
     return `~/${absolutePath.slice(home.length + 1)}`;
   }
   return absolutePath;
 }
 function findGitRepoRoot(startDir) {
-  let current = path32.resolve(startDir);
+  let current = path33.resolve(startDir);
   while (true) {
-    if (fs28.existsSync(path32.join(current, ".git"))) {
+    if (fs28.existsSync(path33.join(current, ".git"))) {
       return current;
     }
-    const parent = path32.dirname(current);
+    const parent = path33.dirname(current);
     if (parent === current)
       return;
     current = parent;
@@ -43924,7 +44482,7 @@ async function tryFetchJson(url, headers) {
 init_database();
 
 // scripts/akm-migrate/migrate/legacy-ref-grammar.ts
-import path33 from "path";
+import path34 from "path";
 init_errors();
 var TYPE_ALIASES = {
   environment: "env"
@@ -43969,8 +44527,8 @@ function validateName2(name) {
     throw new UsageError("Null byte in asset name.", "MISSING_REQUIRED_ARGUMENT");
   if (/^[A-Za-z]:/.test(name))
     throw new UsageError("Windows drive path in asset name.", "MISSING_REQUIRED_ARGUMENT");
-  const normalized = path33.posix.normalize(name.replace(/\\/g, "/"));
-  if (path33.posix.isAbsolute(normalized))
+  const normalized = path34.posix.normalize(name.replace(/\\/g, "/"));
+  if (path34.posix.isAbsolute(normalized))
     throw new UsageError("Absolute path in asset name.", "MISSING_REQUIRED_ARGUMENT");
   if (normalized === ".." || normalized.startsWith("../")) {
     throw new UsageError("Path traversal in asset name.", "MISSING_REQUIRED_ARGUMENT");
@@ -43981,7 +44539,7 @@ function validateName2(name) {
   }
 }
 function normalizeName2(name) {
-  return path33.posix.normalize(name.replace(/\\/g, "/"));
+  return path34.posix.normalize(name.replace(/\\/g, "/"));
 }
 function classifyRefGrammar(raw) {
   const trimmed = raw.trim();
@@ -44029,8 +44587,8 @@ function parseStoredRef(raw) {
 
 // scripts/akm-migrate/migrate/legacy/proposal-fs-import.ts
 function legacyProposalsRoot(stashDir, archive) {
-  const root = path34.join(stashDir, ".akm", "proposals");
-  return archive ? path34.join(root, "archive") : root;
+  const root = path35.join(stashDir, ".akm", "proposals");
+  return archive ? path35.join(root, "archive") : root;
 }
 function importLegacyProposalsIntoState(stateDbPath, stashRoots, finalRefMap = new Map) {
   try {
@@ -44055,7 +44613,7 @@ function importLegacyProposalsIntoState(stateDbPath, stashRoots, finalRefMap = n
       aliasCandidates.set(alias, candidates);
     };
     for (const root of stashRoots) {
-      const resolvedRoot = path34.resolve(root.path);
+      const resolvedRoot = path35.resolve(root.path);
       const roots = bundleRootCandidates.get(root.bundleId) ?? new Set;
       roots.add(resolvedRoot);
       bundleRootCandidates.set(root.bundleId, roots);
@@ -44091,7 +44649,7 @@ function importLegacyProposalsIntoState(stateDbPath, stashRoots, finalRefMap = n
         bundleAliases.set(alias, bundleId);
     }
     for (const root of stashRoots) {
-      const resolved = path34.resolve(root.path);
+      const resolved = path35.resolve(root.path);
       if (seen.has(resolved))
         continue;
       seen.add(resolved);
@@ -44125,7 +44683,7 @@ function importLegacyProposalsForStash(db, stash, bundleAliases, bundleRoots, fi
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name === "archive")
         continue;
-      const proposalDir = path34.join(root, entry.name);
+      const proposalDir = path35.join(root, entry.name);
       const proposal = readLegacyProposalFile(proposalDir, stash, bundleAliases, bundleRoots);
       if (!proposal)
         continue;
@@ -44192,7 +44750,7 @@ function insertProposalIfAbsent(db, proposal, stashDir) {
   return false;
 }
 function readLegacyProposalFile(proposalDir, stash, bundleAliases, bundleRoots) {
-  const filePath = path34.join(proposalDir, "proposal.json");
+  const filePath = path35.join(proposalDir, "proposal.json");
   let parsed;
   let source;
   try {
@@ -44227,7 +44785,7 @@ function readLegacyProposalFile(proposalDir, stash, bundleAliases, bundleRoots)
           normalizedOrigin = parseRegistryRef2(legacyOrigin).id;
         } catch {}
       }
-      const bundle = explicitOrigin ? bundleAliases.get(legacyOrigin) ?? (normalizedOrigin ? bundleAliases.get(normalizedOrigin) : undefined) ?? bundleAliases.get(path34.resolve(legacyOrigin)) : translated.bundle ? bundleAliases.get(translated.bundle) : stash.bundleId;
+      const bundle = explicitOrigin ? bundleAliases.get(legacyOrigin) ?? (normalizedOrigin ? bundleAliases.get(normalizedOrigin) : undefined) ?? bundleAliases.get(path35.resolve(legacyOrigin)) : translated.bundle ? bundleAliases.get(translated.bundle) : stash.bundleId;
       if (!bundle || !bundleRoots.has(bundle))
         throw new Error(`unmapped legacy proposal origin: ${legacyOrigin}`);
       migratedBundle = bundle;
@@ -44252,13 +44810,13 @@ function readLegacyProposalFile(proposalDir, stash, bundleAliases, bundleRoots)
   let backupContent;
   if (typeof backup === "string" && backup.length > 0) {
     try {
-      backupContent = fs29.readFileSync(path34.join(proposalDir, backup), "utf8");
+      backupContent = fs29.readFileSync(path35.join(proposalDir, backup), "utf8");
     } catch (error2) {
       if (error2.code !== "ENOENT")
         throw error2;
     }
   }
-  const migratedRoot = path34.resolve(bundleRoots.get(migratedBundle));
+  const migratedRoot = path35.resolve(bundleRoots.get(migratedBundle));
   return {
     ...rest,
     ref: migratedRef,
@@ -44284,12 +44842,12 @@ function errMsg2(error2) {
 import crypto4 from "crypto";
 import fs40 from "fs";
 import os5 from "os";
-import path45 from "path";
+import path46 from "path";
 init_errors();
 
 // src/core/write-source.ts
 import fs35 from "fs";
-import path39 from "path";
+import path40 from "path";
 
 // src/indexer/index-writer-lock.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
@@ -44307,23 +44865,23 @@ init_paths();
 import { spawnSync as spawnSync4 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 import fs32 from "fs";
-import path37 from "path";
+import path38 from "path";
 
 // src/sources/providers/provider-utils.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import fs31 from "fs";
-import path36 from "path";
+import path37 from "path";
 init_common();
 init_runtime();
 
 // src/sources/include.ts
 init_common();
 import fs30 from "fs";
-import path35 from "path";
+import path36 from "path";
 var INCLUDE_CONFIG_KEYS = ["akm"];
 function readPackageJsonAt(dirPath) {
   try {
-    const raw = fs30.readFileSync(path35.join(dirPath, "package.json"), "utf8");
+    const raw = fs30.readFileSync(path36.join(dirPath, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
       return parsed;
@@ -44350,8 +44908,8 @@ function extractIncludeList(pkg) {
   return;
 }
 function findNearestIncludeConfig(startDir, boundary) {
-  let current = path35.resolve(startDir);
-  const resolvedBoundary = path35.resolve(boundary);
+  let current = path36.resolve(startDir);
+  const resolvedBoundary = path36.resolve(boundary);
   while (isWithin(current, resolvedBoundary)) {
     const pkg = readPackageJsonAt(current);
     const include = extractIncludeList(pkg);
@@ -44360,7 +44918,7 @@ function findNearestIncludeConfig(startDir, boundary) {
     }
     if (current === resolvedBoundary)
       break;
-    const parent = path35.dirname(current);
+    const parent = path36.dirname(current);
     if (parent === current)
       break;
     current = parent;
@@ -44369,29 +44927,29 @@ function findNearestIncludeConfig(startDir, boundary) {
 }
 function copyIncludedPaths(includeGlobs, sourceDir, destDir) {
   for (const entry of includeGlobs) {
-    const resolvedSource = path35.resolve(sourceDir, entry);
+    const resolvedSource = path36.resolve(sourceDir, entry);
     if (!isWithin(resolvedSource, sourceDir)) {
       throw new Error(`Path in akm.include escapes the package root: ${entry}`);
     }
     if (!fs30.existsSync(resolvedSource)) {
       throw new Error(`Path in akm.include does not exist: ${entry}`);
     }
-    if (path35.basename(resolvedSource) === ".git") {
+    if (path36.basename(resolvedSource) === ".git") {
       continue;
     }
-    const relativePath = path35.relative(sourceDir, resolvedSource);
+    const relativePath = path36.relative(sourceDir, resolvedSource);
     if (!relativePath || relativePath === ".") {
       copyDirectoryContents(sourceDir, destDir);
       continue;
     }
-    copyPath(resolvedSource, path35.join(destDir, relativePath));
+    copyPath(resolvedSource, path36.join(destDir, relativePath));
   }
 }
 function copyDirectoryContents(sourceDir, destinationDir) {
   for (const entry of fs30.readdirSync(sourceDir, { withFileTypes: true })) {
     if (entry.name === ".git")
       continue;
-    copyPath(path35.join(sourceDir, entry.name), path35.join(destinationDir, entry.name));
+    copyPath(path36.join(sourceDir, entry.name), path36.join(destinationDir, entry.name));
   }
 }
 function copyPath(sourcePath, destinationPath) {
@@ -44399,7 +44957,7 @@ function copyPath(sourcePath, destinationPath) {
   if (stat.isSymbolicLink()) {
     throw new Error(`Path in akm.include must not be a symlink: ${sourcePath}`);
   }
-  fs30.mkdirSync(path35.dirname(destinationPath), { recursive: true });
+  fs30.mkdirSync(path36.dirname(destinationPath), { recursive: true });
   if (stat.isDirectory()) {
     fs30.mkdirSync(destinationPath, { recursive: true });
     copyDirectoryContents(sourcePath, destinationPath);
@@ -44428,7 +44986,7 @@ function looksLikeAnyBundleRoot(root) {
   return false;
 }
 function detectStashRoot(extractedDir) {
-  const root = path36.resolve(extractedDir);
+  const root = path37.resolve(extractedDir);
   if (looksLikeAnyBundleRoot(root)) {
     return root;
   }
@@ -44445,13 +45003,13 @@ function buildInstallCacheDir(cacheRootDir, source, id, version) {
   const identitySuffix = version === "writable" ? `-${createHash2("sha256").update(`${source}:${id}`).digest("hex").slice(0, 12)}` : "";
   const slug = `${source}-${safeId}${identitySuffix}`;
   const versionSlug = source === "local" ? uniqueSlug() : version?.replace(/[^a-zA-Z0-9_.-]+/g, "-") ?? uniqueSlug();
-  return path36.join(cacheRootDir, slug || source, versionSlug);
+  return path37.join(cacheRootDir, slug || source, versionSlug);
 }
 function applyAkmIncludeConfig(sourceRoot, cacheDir, searchRoot = sourceRoot) {
   const includeConfig = findNearestIncludeConfig(sourceRoot, searchRoot);
   if (!includeConfig)
     return;
-  const selectedDir = path36.join(cacheDir, "selected");
+  const selectedDir = path37.join(cacheDir, "selected");
   fs31.rmSync(selectedDir, { recursive: true, force: true });
   fs31.mkdirSync(selectedDir, { recursive: true });
   copyIncludedPaths(includeConfig.include, includeConfig.baseDir, selectedDir);
@@ -44492,7 +45050,7 @@ function findShallowestStashRoot(root) {
     }
     const { dir: current, depth } = item;
     if (current !== root) {
-      if (isDirectory(path36.join(current, ".stash"))) {
+      if (isDirectory(path37.join(current, ".stash"))) {
         return current;
       }
       if (countStashDirs(current) >= 2) {
@@ -44512,7 +45070,7 @@ function findShallowestStashRoot(root) {
         continue;
       if (child.name === ".git" || child.name === "node_modules")
         continue;
-      queue.push({ dir: path36.join(current, child.name), depth: depth + 1 });
+      queue.push({ dir: path37.join(current, child.name), depth: depth + 1 });
     }
   }
   return;
@@ -44565,7 +45123,7 @@ function assertNoIgnoredPathOverwrite(repoDir, targetRevision) {
   const changedPaths = changed.stdout.split("\x00").filter(Boolean);
   const conflict = ignoredPaths.find((ignoredPath) => changedPaths.some((changedPath) => changedPath === ignoredPath || changedPath.startsWith(`${ignoredPath}/`) || ignoredPath.startsWith(`${changedPath}/`)));
   if (conflict) {
-    throw new UsageError(`Git update would overwrite ignored local path ${path37.join(repoDir, conflict)}; move or remove it before update.`);
+    throw new UsageError(`Git update would overwrite ignored local path ${path38.join(repoDir, conflict)}; move or remove it before update.`);
   }
 }
 function replaceDirectory(stagedDir, destination) {
@@ -44601,7 +45159,7 @@ function cloneRepo(cloneUrl, ref, destDir, writable = false) {
   }
   try {
     if (!writable) {
-      const gitDir = path37.join(tmpDir, ".git");
+      const gitDir = path38.join(tmpDir, ".git");
       if (fs32.existsSync(gitDir))
         fs32.rmSync(gitDir, { recursive: true, force: true });
     }
@@ -44639,7 +45197,7 @@ function redactUrlUserinfo(text) {
 // src/sources/providers/git-provider.ts
 import { createHash as createHash3 } from "crypto";
 import fs34 from "fs";
-import path38 from "path";
+import path39 from "path";
 init_errors();
 init_paths();
 
@@ -44725,11 +45283,11 @@ registerSourceProvider("git", (config) => new GitSourceProvider(config));
 function getCachePaths(repoUrl) {
   const key = createHash3("sha256").update(repoUrl).digest("hex").slice(0, 16);
   const cacheRoot = getRegistryIndexCacheDir();
-  const rootDir = path38.join(cacheRoot, `git-${key}`);
+  const rootDir = path39.join(cacheRoot, `git-${key}`);
   return {
     rootDir,
-    repoDir: path38.join(rootDir, "repo"),
-    indexPath: path38.join(rootDir, "index.json")
+    repoDir: path39.join(rootDir, "repo"),
+    indexPath: path39.join(rootDir, "index.json")
   };
 }
 async function ensureGitMirror(repo, cachePaths, options) {
@@ -44744,7 +45302,7 @@ async function ensureGitMirror(repo, cachePaths, options) {
     isUsable: () => !requireRepoDir || hasExtractedRepo(cachePaths.repoDir),
     refresh: async () => {
       fs34.mkdirSync(cachePaths.rootDir, { recursive: true });
-      if (writable && fs34.existsSync(path38.join(cachePaths.repoDir, ".git"))) {
+      if (writable && fs34.existsSync(path39.join(cachePaths.repoDir, ".git"))) {
         pullRepo(cachePaths.repoDir);
       } else {
         cloneRepo(repo.cloneUrl, repo.ref, cachePaths.repoDir, writable);
@@ -44805,14 +45363,14 @@ function hasExtractedRepo(repoDir) {
   try {
     if (!fs34.statSync(repoDir).isDirectory())
       return false;
-    if (fs34.statSync(path38.join(repoDir, "content")).isDirectory())
+    if (fs34.statSync(path39.join(repoDir, "content")).isDirectory())
       return true;
   } catch {}
   try {
     if (!fs34.statSync(repoDir).isDirectory())
       return false;
     const ownedDirs = akmAdapter.directoryList?.({ id: "akm", adapter: "akm", root: repoDir, writable: false }) ?? stashDirNames();
-    return ownedDirs.some((dirName) => fs34.existsSync(path38.join(repoDir, dirName)));
+    return ownedDirs.some((dirName) => fs34.existsSync(path39.join(repoDir, dirName)));
   } catch {
     return false;
   }
@@ -44888,7 +45446,7 @@ function resolveWritable(entry) {
   return entry.type === "filesystem";
 }
 function resolveGitContentRoot(repoPath) {
-  const contentPath = path39.join(repoPath, "content");
+  const contentPath = path40.join(repoPath, "content");
   return fs35.existsSync(contentPath) && fs35.statSync(contentPath).isDirectory() ? contentPath : repoPath;
 }
 
@@ -44920,7 +45478,7 @@ registerSourceProvider("filesystem", (entry) => {
 init_errors();
 init_paths();
 import fs37 from "fs";
-import path41 from "path";
+import path42 from "path";
 
 // src/sources/providers/tar-utils.ts
 init_common();
@@ -44928,7 +45486,7 @@ init_warn();
 init_runtime();
 import { createHash as createHash4 } from "crypto";
 import fs36 from "fs";
-import path40 from "path";
+import path41 from "path";
 function verifyArchiveIntegrity(archivePath, expected, source) {
   if (!expected)
     return;
@@ -44988,7 +45546,7 @@ function scanExtractedFiles(dir, root) {
     return;
   }
   for (const entry of entries) {
-    const fullPath = path40.join(dir, entry.name);
+    const fullPath = path41.join(dir, entry.name);
     if (entry.name === ".." || entry.name === ".") {
       throw new Error(`Post-extraction scan: suspicious entry name: ${fullPath}`);
     }
@@ -44999,7 +45557,7 @@ function scanExtractedFiles(dir, root) {
       }
     }
     if (!entry.isSymbolicLink()) {
-      const resolved = path40.resolve(fullPath);
+      const resolved = path41.resolve(fullPath);
       if (!isWithin(resolved, root)) {
         throw new Error(`Post-extraction scan: entry escapes destination directory: ${fullPath}`);
       }
@@ -45019,7 +45577,7 @@ function validateTarEntries(listOutput) {
     if (entry.startsWith("/")) {
       throw new Error(`Archive contains an absolute path entry: ${entry}`);
     }
-    const normalized = path40.posix.normalize(entry);
+    const normalized = path41.posix.normalize(entry);
     if (normalized === ".." || normalized.startsWith("../")) {
       throw new Error(`Archive contains a path traversal entry: ${entry}`);
     }
@@ -45027,8 +45585,8 @@ function validateTarEntries(listOutput) {
     const stripped = parts.slice(1).join("/");
     if (!stripped)
       continue;
-    const normalizedStripped = path40.posix.normalize(stripped);
-    if (normalizedStripped === ".." || normalizedStripped.startsWith("../") || path40.posix.isAbsolute(normalizedStripped)) {
+    const normalizedStripped = path41.posix.normalize(stripped);
+    if (normalizedStripped === ".." || normalizedStripped.startsWith("../") || path41.posix.isAbsolute(normalizedStripped)) {
       throw new Error(`Archive contains an unsafe entry after strip-components: ${entry}`);
     }
   }
@@ -45073,8 +45631,8 @@ async function doSyncNpm(parsed, options) {
   const syncedAt = (options?.now ?? new Date).toISOString();
   const cacheRootDir = options?.cacheRootDir ?? getRegistryCacheDir();
   const cacheDir = buildInstallCacheDir(cacheRootDir, resolved.source, resolved.id, resolved.resolvedVersion ?? resolved.resolvedRevision);
-  const archivePath = path41.join(cacheDir, "artifact.tar.gz");
-  const extractedDir = path41.join(cacheDir, "extracted");
+  const archivePath = path42.join(cacheDir, "artifact.tar.gz");
+  const extractedDir = path42.join(cacheDir, "extracted");
   if (!options?.force && isDirectory(extractedDir)) {
     try {
       const cachedStashRoot = detectStashRoot(extractedDir);
@@ -45145,9 +45703,9 @@ init_common();
 init_errors();
 init_paths();
 init_warn();
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes3 } from "crypto";
 import fs39 from "fs";
-import path43 from "path";
+import path44 from "path";
 
 // node_modules/node-html-parser/dist/index.mjs
 var __create2 = Object.create;
@@ -50635,7 +51193,7 @@ async function fetchPinnedJson(url, options) {
 // src/sources/snapshot-fetchers/registry.ts
 init_warn();
 import fs38 from "fs";
-import path42 from "path";
+import path43 from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/sources/snapshot-fetchers/bluesky.ts
@@ -52571,24 +53129,24 @@ class MatcherView {
     return this._matcher.separator;
   }
   getCurrentTag() {
-    const path42 = this._matcher.path;
-    return path42.length > 0 ? path42[path42.length - 1].tag : undefined;
+    const path43 = this._matcher.path;
+    return path43.length > 0 ? path43[path43.length - 1].tag : undefined;
   }
   getCurrentNamespace() {
-    const path42 = this._matcher.path;
-    return path42.length > 0 ? path42[path42.length - 1].namespace : undefined;
+    const path43 = this._matcher.path;
+    return path43.length > 0 ? path43[path43.length - 1].namespace : undefined;
   }
   getAttrValue(attrName) {
-    const path42 = this._matcher.path;
-    if (path42.length === 0)
+    const path43 = this._matcher.path;
+    if (path43.length === 0)
       return;
-    return path42[path42.length - 1].values?.[attrName];
+    return path43[path43.length - 1].values?.[attrName];
   }
   hasAttr(attrName) {
-    const path42 = this._matcher.path;
-    if (path42.length === 0)
+    const path43 = this._matcher.path;
+    if (path43.length === 0)
       return false;
-    const current = path42[path42.length - 1];
+    const current = path43[path43.length - 1];
     return current.values !== undefined && attrName in current.values;
   }
   getAnyParentAttr(attrName) {
@@ -52598,16 +53156,16 @@ class MatcherView {
     return this._matcher.hasAnyParentAttr(attrName);
   }
   getPosition() {
-    const path42 = this._matcher.path;
-    if (path42.length === 0)
+    const path43 = this._matcher.path;
+    if (path43.length === 0)
       return -1;
-    return path42[path42.length - 1].position ?? 0;
+    return path43[path43.length - 1].position ?? 0;
   }
   getCounter() {
-    const path42 = this._matcher.path;
-    if (path42.length === 0)
+    const path43 = this._matcher.path;
+    if (path43.length === 0)
       return -1;
-    return path42[path42.length - 1].counter ?? 0;
+    return path43[path43.length - 1].counter ?? 0;
   }
   getIndex() {
     return this.getPosition();
@@ -55620,7 +56178,7 @@ var youtubeFetcher = {
 var youtube_default = youtubeFetcher;
 
 // src/sources/snapshot-fetchers/registry.ts
-var FETCHER_DIR = path42.join("scripts", "wiki-fetchers");
+var FETCHER_DIR = path43.join("scripts", "wiki-fetchers");
 var FETCHER_FILE_PATTERN = /\.(?:ts|js|mjs)$/i;
 var BUILTIN_FETCHERS = [
   github_default,
@@ -55638,14 +56196,14 @@ function isWikiSnapshotFetcher(value) {
 async function loadWikiSnapshotFetchers(stashDir) {
   const fetchers = [];
   if (stashDir) {
-    const fetcherDir = path42.join(stashDir, FETCHER_DIR);
+    const fetcherDir = path43.join(stashDir, FETCHER_DIR);
     try {
       const entries = fs38.readdirSync(fetcherDir).sort();
       for (const entry of entries) {
         if (!FETCHER_FILE_PATTERN.test(entry))
           continue;
         try {
-          const fileUrl = pathToFileURL2(path42.join(fetcherDir, entry)).toString();
+          const fileUrl = pathToFileURL2(path43.join(fetcherDir, entry)).toString();
           const mod = await import(fileUrl);
           if (isWikiSnapshotFetcher(mod.default)) {
             fetchers.push(mod.default);
@@ -55924,11 +56482,11 @@ function resolveFetcherStashDir(explicitStashDir) {
 }
 function getWebsiteCachePaths(siteUrl) {
   const key = createHash5("sha256").update(normalizeSiteUrl(siteUrl)).digest("hex").slice(0, 16);
-  const rootDir = path43.join(getRegistryIndexCacheDir(), `website-${key}`);
+  const rootDir = path44.join(getRegistryIndexCacheDir(), `website-${key}`);
   return {
     rootDir,
-    stashDir: path43.join(rootDir, "stash"),
-    manifestPath: path43.join(rootDir, "manifest.json")
+    stashDir: path44.join(rootDir, "stash"),
+    manifestPath: path44.join(rootDir, "manifest.json")
   };
 }
 async function ensureWebsiteMirror(config, options) {
@@ -55963,7 +56521,7 @@ async function ensureWebsiteMirror(config, options) {
 }
 function hasExtractedSite(stashDir) {
   try {
-    const knowledgeDir = path43.join(stashDir, "knowledge");
+    const knowledgeDir = path44.join(stashDir, "knowledge");
     if (!fs39.statSync(stashDir).isDirectory() || !fs39.statSync(knowledgeDir).isDirectory())
       return false;
     const pending = [knowledgeDir];
@@ -55975,7 +56533,7 @@ function hasExtractedSite(stashDir) {
         if (entry.isFile() && entry.name.endsWith(".md"))
           return true;
         if (entry.isDirectory())
-          pending.push(path43.join(dir, entry.name));
+          pending.push(path44.join(dir, entry.name));
       }
     }
     return false;
@@ -56014,18 +56572,79 @@ async function fetchSnapshotViaRegistry(startUrl, stashDir, allowPrivateHosts, r
   };
   return dispatchSnapshotFetchers(parsed, context, stashDir);
 }
+var snapshotWriteHookForTests;
+function snapshotWriteHook(event) {
+  snapshotWriteHookForTests?.(event);
+}
+function snapshotSiblingPrefix(stashDir, kind) {
+  return `.${path44.basename(stashDir)}.${kind}-`;
+}
+function snapshotSiblingPath(stashDir, kind) {
+  const unique = `${process.pid}-${randomBytes3(6).toString("hex")}`;
+  return path44.join(path44.dirname(stashDir), `${snapshotSiblingPrefix(stashDir, kind)}${unique}`);
+}
+var SNAPSHOT_STAGING_SWEEP_AGE_MS = 60 * 60 * 1000;
+function sweepSnapshotStaging(stashDir) {
+  const parent = path44.dirname(stashDir);
+  let entries;
+  try {
+    entries = fs39.readdirSync(parent);
+  } catch {
+    return;
+  }
+  const prefixes = [snapshotSiblingPrefix(stashDir, "staging"), snapshotSiblingPrefix(stashDir, "retired")];
+  const cutoff = Date.now() - SNAPSHOT_STAGING_SWEEP_AGE_MS;
+  for (const entry of entries) {
+    if (!prefixes.some((prefix) => entry.startsWith(prefix)))
+      continue;
+    const abandoned = path44.join(parent, entry);
+    try {
+      if (fs39.statSync(abandoned).mtimeMs > cutoff)
+        continue;
+    } catch {
+      continue;
+    }
+    fs39.rmSync(abandoned, { recursive: true, force: true });
+  }
+}
+function beginSnapshotStaging(stashDir) {
+  fs39.mkdirSync(path44.dirname(stashDir), { recursive: true });
+  sweepSnapshotStaging(stashDir);
+  const dir = snapshotSiblingPath(stashDir, "staging");
+  fs39.mkdirSync(dir, { recursive: true });
+  return { dir, target: stashDir };
+}
+function publishSnapshotStaging(staging) {
+  let retired;
+  if (fs39.existsSync(staging.target)) {
+    retired = snapshotSiblingPath(staging.target, "retired");
+    fs39.renameSync(staging.target, retired);
+  }
+  fs39.renameSync(staging.dir, staging.target);
+  if (retired)
+    fs39.rmSync(retired, { recursive: true, force: true });
+}
+function discardSnapshotStaging(staging) {
+  fs39.rmSync(staging.dir, { recursive: true, force: true });
+}
 function writeSnapshotToStash(stashDir, snapshot) {
   const preferredName = snapshot.preferredName ?? deriveImportPath(snapshot.url);
   const relPath = avoidReservedBasename2(preferredName);
-  const knowledgeDir = path43.join(stashDir, "knowledge");
-  const filePath = path43.resolve(knowledgeDir, `${relPath}.md`);
-  if (!isWithin(filePath, knowledgeDir)) {
+  const knowledgeDir = path44.join(stashDir, "knowledge");
+  if (!isWithin(path44.resolve(knowledgeDir, `${relPath}.md`), knowledgeDir)) {
     throw new UsageError(`Snapshot fetcher returned an unsafe preferred name: ${JSON.stringify(preferredName)}`);
   }
-  fs39.rmSync(stashDir, { recursive: true, force: true });
-  fs39.mkdirSync(path43.dirname(filePath), { recursive: true });
-  const slug = relPath.split("/").pop() ?? "index";
-  fs39.writeFileSync(filePath, buildMarkdownSnapshot({ url: snapshot.url, title: snapshot.title, markdown: snapshot.markdown }, slug, snapshot.tags), "utf8");
+  const staging = beginSnapshotStaging(stashDir);
+  try {
+    const filePath = path44.resolve(path44.join(staging.dir, "knowledge"), `${relPath}.md`);
+    fs39.mkdirSync(path44.dirname(filePath), { recursive: true });
+    const slug = relPath.split("/").pop() ?? "index";
+    fs39.writeFileSync(filePath, buildMarkdownSnapshot({ url: snapshot.url, title: snapshot.title, markdown: snapshot.markdown }, slug, snapshot.tags), "utf8");
+    snapshotWriteHook({ point: "page-written", index: 1, total: 1, relPath: `knowledge/${relPath}.md` });
+    publishSnapshotStaging(staging);
+  } finally {
+    discardSnapshotStaging(staging);
+  }
 }
 async function scrapeWebsiteToStash(startUrl, stashDir, options) {
   const fetched = await fetchSnapshotViaRegistry(startUrl, options.fetcherStashDir ?? null, options.allowPrivateHosts, options.resolveSecret);
@@ -56037,19 +56656,32 @@ async function scrapeWebsiteToStash(startUrl, stashDir, options) {
   if (pages.length === 0) {
     throw new Error(`No content could be scraped from ${startUrl}`);
   }
-  fs39.rmSync(stashDir, { recursive: true, force: true });
-  const knowledgeDir = path43.join(stashDir, "knowledge");
-  fs39.mkdirSync(knowledgeDir, { recursive: true });
-  const usedPaths = new Set;
-  for (const page of pages) {
-    const relPath = avoidReservedBasename2(urlToRelativePath(page.url));
-    const uniquePath = uniqueSlug2(relPath, usedPaths);
-    const filePath = path43.join(knowledgeDir, `${uniquePath}.md`);
-    const dir = path43.dirname(filePath);
-    if (dir !== knowledgeDir)
-      fs39.mkdirSync(dir, { recursive: true });
-    const slug = uniquePath.split("/").pop() ?? "index";
-    fs39.writeFileSync(filePath, buildMarkdownSnapshot(page, slug), "utf8");
+  const staging = beginSnapshotStaging(stashDir);
+  try {
+    const knowledgeDir = path44.join(staging.dir, "knowledge");
+    fs39.mkdirSync(knowledgeDir, { recursive: true });
+    const usedPaths = new Set;
+    let written = 0;
+    for (const page of pages) {
+      const relPath = avoidReservedBasename2(urlToRelativePath(page.url));
+      const uniquePath = uniqueSlug2(relPath, usedPaths);
+      const filePath = path44.join(knowledgeDir, `${uniquePath}.md`);
+      const dir = path44.dirname(filePath);
+      if (dir !== knowledgeDir)
+        fs39.mkdirSync(dir, { recursive: true });
+      const slug = uniquePath.split("/").pop() ?? "index";
+      fs39.writeFileSync(filePath, buildMarkdownSnapshot(page, slug), "utf8");
+      written++;
+      snapshotWriteHook({
+        point: "page-written",
+        index: written,
+        total: pages.length,
+        relPath: `knowledge/${uniquePath}.md`
+      });
+    }
+    publishSnapshotStaging(staging);
+  } finally {
+    discardSnapshotStaging(staging);
   }
 }
 function sleep(ms) {
@@ -56593,7 +57225,7 @@ function resolveEntryContentDir(entry) {
 var SUSPICIOUS_ROOTS = new Set(["/", "/etc", "/bin", "/sbin", "/usr", "/var", "/tmp", "/dev", "/proc", "/sys"]);
 
 // src/tasks/parser.ts
-import path44 from "path";
+import path45 from "path";
 init_errors();
 
 // src/tasks/task-id.ts
@@ -56666,15 +57298,21 @@ function parseTaskDocument(input) {
   }
   let target;
   if (hasWorkflow) {
-    rejectTargetFields(data, ["params"], id, filePath);
+    rejectTargetFields(data, ["params", "timeoutMs", "maxSteps", "maxRetries"], id, filePath);
     const ref = requireString(data.workflow, "workflow", filePath);
     if (!ref) {
       throw new UsageError(`Task "${id}" has empty \`workflow\`. File: ${filePath}`, "INVALID_FLAG_VALUE");
     }
+    const workflowTimeoutMs = readTimeout(data.timeoutMs, filePath);
+    const maxSteps = readBoundedInteger(data.maxSteps, "maxSteps", 1, undefined, filePath);
+    const maxRetries = readBoundedInteger(data.maxRetries, "maxRetries", 0, WORKFLOW_MAX_RETRIES, filePath);
     target = {
       kind: "workflow",
       ref,
-      params: readParams(data.params, filePath)
+      params: readParams(data.params, filePath),
+      ...workflowTimeoutMs !== undefined ? { timeoutMs: workflowTimeoutMs } : {},
+      ...maxSteps !== undefined ? { maxSteps } : {},
+      ...maxRetries !== undefined ? { maxRetries } : {}
     };
   } else if (hasCommand) {
     rejectTargetFields(data, ["timeoutMs"], id, filePath);
@@ -56699,6 +57337,7 @@ function parseTaskDocument(input) {
     };
   }
   const timeoutMs = hasCommand ? readTimeout(data.timeoutMs, filePath) : undefined;
+  const redact = readRedactNames(data.redact, filePath);
   return {
     version: TASK_SCHEMA_VERSION,
     schemaVersion: TASK_SCHEMA_VERSION,
@@ -56711,7 +57350,8 @@ function parseTaskDocument(input) {
     ...when_to_use ? { when_to_use } : {},
     ...tags ? { tags } : {},
     source: { path: filePath },
-    timeoutMs
+    timeoutMs,
+    ...redact ? { redact } : {}
   };
 }
 var TASK_KEYS = new Set([
@@ -56729,9 +57369,21 @@ var TASK_KEYS = new Set([
   "engine",
   "model",
   "timeoutMs",
-  "llm"
+  "maxSteps",
+  "maxRetries",
+  "llm",
+  "redact"
+]);
+var SHARED_KEYS = new Set([
+  "version",
+  "name",
+  "description",
+  "when_to_use",
+  "tags",
+  "schedule",
+  "enabled",
+  "redact"
 ]);
-var SHARED_KEYS = new Set(["version", "name", "description", "when_to_use", "tags", "schedule", "enabled"]);
 function requireVersion(data, id, filePath) {
   if (data.version === TASK_SCHEMA_VERSION)
     return;
@@ -56755,7 +57407,7 @@ function resolvePromptSource(raw, filePath, id) {
   if (!trimmed) {
     throw new UsageError(`Task "${id}" has empty \`prompt\`. File: ${filePath}`, "MISSING_REQUIRED_ARGUMENT");
   }
-  if (trimmed.startsWith("./") || trimmed.startsWith("../") || path44.isAbsolute(trimmed)) {
+  if (trimmed.startsWith("./") || trimmed.startsWith("../") || path45.isAbsolute(trimmed)) {
     return { kind: "file", path: trimmed };
   }
   if (/^[A-Za-z]:[\\/]/.test(trimmed)) {
@@ -56831,9 +57483,39 @@ function readTimeout(value, filePath) {
     return;
   if (value === null)
     return null;
-  if (typeof value === "number" && Number.isInteger(value) && value > 0)
+  if (typeof value === "number" && Number.isInteger(value) && value > 0 && value <= TASK_MAX_TIMEOUT_MS)
     return value;
-  throw new UsageError(`Key "timeoutMs" must be a positive integer or null. File: ${filePath}`, "INVALID_FLAG_VALUE");
+  throw new UsageError(`Key "timeoutMs" must be an integer from 1 through ${TASK_MAX_TIMEOUT_MS}, or null. File: ${filePath}`, "INVALID_FLAG_VALUE");
+}
+function readRedactNames(value, filePath) {
+  if (value === undefined || value === null)
+    return;
+  const invalid = (detail) => {
+    throw new UsageError(`Key "redact" ${detail}. File: ${filePath}`, "INVALID_FLAG_VALUE");
+  };
+  if (!Array.isArray(value))
+    return invalid("must be a list of environment variable names");
+  if (value.length > TASK_MAX_REDACT_NAMES) {
+    return invalid(`accepts at most ${TASK_MAX_REDACT_NAMES} names (got ${value.length})`);
+  }
+  const names = [];
+  for (const entry of value) {
+    if (typeof entry !== "string" || !WORKFLOW_ENV_VAR_NAME_PATTERN.test(entry)) {
+      return invalid(`takes environment variable NAMES only (matching ${WORKFLOW_ENV_VAR_NAME_PATTERN.source}), not values \u2014 ` + `got ${JSON.stringify(entry)}. A secret written here would be indexed and printed by \`akm show\``);
+    }
+    if (!names.includes(entry))
+      names.push(entry);
+  }
+  return names.length > 0 ? names : undefined;
+}
+function readBoundedInteger(value, key, minimum, maximum, filePath) {
+  if (value === undefined || value === null)
+    return;
+  if (typeof value === "number" && Number.isSafeInteger(value) && value >= minimum && (maximum === undefined || value <= maximum)) {
+    return value;
+  }
+  const range = maximum === undefined ? `at least ${minimum}` : `from ${minimum} through ${maximum}`;
+  throw new UsageError(`Key "${key}" must be an integer ${range}. File: ${filePath}`, "INVALID_FLAG_VALUE");
 }
 function readLlmOverrides(value, filePath) {
   if (value === undefined)
@@ -57099,7 +57781,7 @@ function expandTilde2(value) {
   if (value === "~")
     return os5.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\"))
-    return path45.join(os5.homedir(), value.slice(2));
+    return path46.join(os5.homedir(), value.slice(2));
   return value;
 }
 function bundlesFromConfig(config, pathResolutionBase, migrationLockEntries) {
@@ -57118,7 +57800,7 @@ function bundlesFromConfig(config, pathResolutionBase, migrationLockEntries) {
     const contentDir = lockRoots.get(id) ?? resolveEntryContentDir(sourceEntry);
     if (!contentDir)
       continue;
-    const root2 = path45.resolve(pathResolutionBase, expandTilde2(contentDir));
+    const root2 = path46.resolve(pathResolutionBase, expandTilde2(contentDir));
     const rootIdentity = fs40.existsSync(root2) ? fs40.realpathSync(root2) : root2;
     const prior = roots.get(rootIdentity);
     if (prior && prior !== id) {
@@ -57163,21 +57845,21 @@ function resolveOrigin(origin, bundles, filePath) {
   return candidate;
 }
 function assertWorkflowPathSafe(bundle, name, rawRef, filePath) {
-  const candidate = resolveAssetPathFromName("workflow", path45.join(bundle.root, "workflows"), name);
+  const candidate = resolveAssetPathFromName("workflow", path46.join(bundle.root, "workflows"), name);
   if (!fs40.existsSync(candidate))
     return;
   if (!fs40.statSync(candidate).isFile())
     throw migrationError(filePath, `legacy target "${rawRef}" is not a file in bundle "${bundle.id}".`);
   const realRoot = fs40.realpathSync(bundle.root);
   const realCandidate = fs40.realpathSync(candidate);
-  const relative = path45.relative(realRoot, realCandidate);
-  if (relative.startsWith("..") || path45.isAbsolute(relative)) {
+  const relative = path46.relative(realRoot, realCandidate);
+  if (relative.startsWith("..") || path46.isAbsolute(relative)) {
     throw migrationError(filePath, `legacy target "${rawRef}" resolves outside bundle "${bundle.id}".`);
   }
 }
 function assertRealPathWithin(root2, candidate, filePath, detail) {
-  const relative = path45.relative(fs40.realpathSync(root2), fs40.realpathSync(candidate));
-  if (relative.startsWith("..") || path45.isAbsolute(relative))
+  const relative = path46.relative(fs40.realpathSync(root2), fs40.realpathSync(candidate));
+  if (relative.startsWith("..") || path46.isAbsolute(relative))
     throw migrationError(filePath, detail);
 }
 function planTaskFile(filePath, containing, bundles) {
@@ -57228,7 +57910,7 @@ function planTaskFile(filePath, containing, bundles) {
   }
   const after = Buffer.from($stringify(normalized));
   try {
-    parseTaskDocument({ yaml: after.toString("utf8"), filePath, id: path45.basename(filePath, ".yml") });
+    parseTaskDocument({ yaml: after.toString("utf8"), filePath, id: path46.basename(filePath, ".yml") });
   } catch (error2) {
     throw migrationError(filePath, `the converted v2 task is invalid (${error2 instanceof Error ? error2.message : String(error2)}).`);
   }
@@ -57254,7 +57936,7 @@ function planTaskTargetRefMigration(config, pathResolutionBase = process.cwd(),
       }
       continue;
     }
-    const tasksDir = path45.join(bundle.root, "tasks");
+    const tasksDir = path46.join(bundle.root, "tasks");
     if (!fs40.existsSync(tasksDir))
       continue;
     const tasksStat = fs40.lstatSync(tasksDir);
@@ -57268,7 +57950,7 @@ function planTaskTargetRefMigration(config, pathResolutionBase = process.cwd(),
     for (const entry of fs40.readdirSync(tasksDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.name.endsWith(".yml"))
         continue;
-      const filePath = path45.join(tasksDir, entry.name);
+      const filePath = path46.join(tasksDir, entry.name);
       if (!entry.isFile())
         throw migrationError(filePath, "task migration does not follow symbolic links or special files.");
       assertRealPathWithin(bundle.root, filePath, filePath, "the task file resolves outside its bundle.");
@@ -57280,7 +57962,7 @@ function planTaskTargetRefMigration(config, pathResolutionBase = process.cwd(),
   return { rewrites, durabilityPaths, readOnlyLegacyTasks };
 }
 function legacyTaskFilesIn(bundle) {
-  const tasksDir = path45.join(bundle.root, "tasks");
+  const tasksDir = path46.join(bundle.root, "tasks");
   let entries;
   try {
     entries = fs40.readdirSync(tasksDir, { withFileTypes: true });
@@ -57292,7 +57974,7 @@ function legacyTaskFilesIn(bundle) {
     if (!entry.isFile() || !entry.name.endsWith(".yml"))
       continue;
     try {
-      const doc = $parseDocument(fs40.readFileSync(path45.join(tasksDir, entry.name), "utf8"), { uniqueKeys: true });
+      const doc = $parseDocument(fs40.readFileSync(path46.join(tasksDir, entry.name), "utf8"), { uniqueKeys: true });
       if (doc.errors.length > 0 || !$isMap(doc.contents)) {
         legacy.push(entry.name);
         continue;
@@ -57307,7 +57989,7 @@ function legacyTaskFilesIn(bundle) {
   return legacy;
 }
 function syncParentDirectory(filePath) {
-  const fd = fs40.openSync(path45.dirname(filePath), "r");
+  const fd = fs40.openSync(path46.dirname(filePath), "r");
   try {
     fs40.fsyncSync(fd);
   } finally {
@@ -57367,7 +58049,7 @@ init_database();
 init_sqlite_pragmas();
 import crypto5 from "crypto";
 import fs41 from "fs";
-import path46 from "path";
+import path47 from "path";
 class CutoverIntegrityError extends Error {
   constructor(message) {
     super(message);
@@ -57431,7 +58113,7 @@ function walkLegacyLayoutInto(map, root2) {
   else
     return;
   for (const [type, dirName] of Object.entries(TYPE_DIRS)) {
-    const typeRoot = path46.join(root2.path, dirName);
+    const typeRoot = path47.join(root2.path, dirName);
     let files;
     try {
       files = listFilesRecursive(typeRoot);
@@ -57468,14 +58150,14 @@ function safeDerive(type, typeRoot, filePath) {
   }
 }
 function basenameSlug(sourcePath) {
-  const base = path46.basename(path46.resolve(sourcePath)).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const base = path47.basename(path47.resolve(sourcePath)).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return base.length > 0 ? base : "bundle";
 }
 function listFilesRecursive(dir) {
   const out = [];
   const walk = (current) => {
     for (const entry of fs41.readdirSync(current, { withFileTypes: true })) {
-      const abs = path46.join(current, entry.name);
+      const abs = path47.join(current, entry.name);
       if (entry.isDirectory())
         walk(abs);
       else if (entry.isFile())
@@ -57488,10 +58170,10 @@ function listFilesRecursive(dir) {
 function samePath(a, b) {
   if (!b)
     return false;
-  return path46.resolve(a) === path46.resolve(b);
+  return path47.resolve(a) === path47.resolve(b);
 }
 function persistRefMapJson(outputPath, map) {
-  fs41.mkdirSync(path46.dirname(outputPath), { recursive: true, mode: 448 });
+  fs41.mkdirSync(path47.dirname(outputPath), { recursive: true, mode: 448 });
   const entries = Object.fromEntries([...map.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
   const payload = { formatVersion: CUTOVER_REFMAP_FORMAT, entries };
   writeFileAtomic(outputPath, `${JSON.stringify(payload, null, 2)}
@@ -57529,7 +58211,7 @@ function completeCutoverRefMap(inputPath, outputPath) {
 function loadCompletedCutoverRefMap(inputPath) {
   return { map: loadCutoverRefMap(inputPath) };
 }
-var PILOT_TREATMENT_FILE = path46.join(".akm", "measurement", "treatment-pilot-2026-06-14.txt");
+var PILOT_TREATMENT_FILE = path47.join(".akm", "measurement", "treatment-pilot-2026-06-14.txt");
 function fsyncPilotTreatmentDirectory(directory) {
   let fd;
   try {
@@ -57548,8 +58230,8 @@ function migratePilotTreatmentFiles(stashRoots, refMap) {
   let migrated = 0;
   const seen = new Set;
   for (const root2 of stashRoots) {
-    const file = path46.join(root2.path, PILOT_TREATMENT_FILE);
-    const resolved = path46.resolve(file);
+    const file = path47.join(root2.path, PILOT_TREATMENT_FILE);
+    const resolved = path47.resolve(file);
     if (seen.has(resolved) || !fs41.existsSync(file))
       continue;
     seen.add(resolved);
@@ -57568,7 +58250,7 @@ function migratePilotTreatmentFiles(stashRoots, refMap) {
     }).join(`
 `);
     if (rewritten === original) {
-      fsyncPilotTreatmentDirectory(path46.dirname(file));
+      fsyncPilotTreatmentDirectory(path47.dirname(file));
       continue;
     }
     const mode = fs41.statSync(file).mode & 511;
@@ -57586,7 +58268,7 @@ function migratePilotTreatmentFiles(stashRoots, refMap) {
       }
       fs41.renameSync(tmp, file);
       ownsTmp = false;
-      fsyncPilotTreatmentDirectory(path46.dirname(file));
+      fsyncPilotTreatmentDirectory(path47.dirname(file));
     } catch (error2) {
       if (ownsTmp)
         fs41.rmSync(tmp, { force: true });
@@ -57677,7 +58359,7 @@ function rekeyStateDbCore(db, refMap) {
 function rekeyStateDb(dbPath, refMap) {
   const db = openDatabaseFinalizing(dbPath);
   try {
-    applyStandardPragmas(db, { dataDir: path46.dirname(dbPath) });
+    applyStandardPragmas(db, { dataDir: path47.dirname(dbPath) });
     let report = emptyReport2();
     db.transaction(() => {
       report = rekeyStateDbCore(db, refMap);
@@ -58174,7 +58856,7 @@ assertMigrationRegistry(FROZEN_WORKFLOW_MIGRATIONS);
 // scripts/akm-migrate/migration-backup.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import fs42 from "fs";
-import path47 from "path";
+import path48 from "path";
 init_common();
 
 // src/core/config/config-version.ts
@@ -58225,7 +58907,7 @@ function getMigrationBackupDir(runId) {
   if (!/^[A-Za-z0-9._-]+$/.test(runId)) {
     throw new ConfigError(`Invalid migration backup run ID ${JSON.stringify(runId)}.`, "INVALID_CONFIG_FILE");
   }
-  return path47.join(getMigrationBackupRoot(), runId);
+  return path48.join(getMigrationBackupRoot(), runId);
 }
 function expectedSourcePaths() {
   return {
@@ -58260,7 +58942,7 @@ function fsyncDirectory(directory) {
   }
 }
 function copyFileDurable(source, destination) {
-  fs42.mkdirSync(path47.dirname(destination), { recursive: true, mode: 448 });
+  fs42.mkdirSync(path48.dirname(destination), { recursive: true, mode: 448 });
   fs42.copyFileSync(source, destination, fs42.constants.COPYFILE_EXCL);
   fs42.chmodSync(destination, 384);
   fsyncFile(destination);
@@ -58386,8 +59068,8 @@ function sqliteQuote2(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
 function backupSqlite(source, destination) {
-  const resolved = path47.resolve(source);
-  const releaseActivity = resolved === path47.resolve(getStateDbPathInDataDir()) ? acquireMaintenanceActivitySync("state-db") : resolved === path47.resolve(getLegacyWorkflowDbPath()) ? acquireMaintenanceActivitySync("workflow-db") : undefined;
+  const resolved = path48.resolve(source);
+  const releaseActivity = resolved === path48.resolve(getStateDbPathInDataDir()) ? acquireMaintenanceActivitySync("state-db") : resolved === path48.resolve(getLegacyWorkflowDbPath()) ? acquireMaintenanceActivitySync("workflow-db") : undefined;
   let db;
   try {
     db = openDatabaseFinalizing(source);
@@ -58404,8 +59086,8 @@ function backupSqlite(source, destination) {
   fsyncFile(destination);
 }
 function acquireBackupLock() {
-  const lockPath = path47.join(getMigrationBackupRoot(), ".lock");
-  fs42.mkdirSync(path47.dirname(lockPath), { recursive: true, mode: 448 });
+  const lockPath = path48.join(getMigrationBackupRoot(), ".lock");
+  fs42.mkdirSync(path48.dirname(lockPath), { recursive: true, mode: 448 });
   for (let attempt = 0;attempt < 50; attempt += 1) {
     const ownership = tryAcquireLockSync(lockPath, createLockPayload());
     if (ownership)
@@ -58435,8 +59117,8 @@ function createMigrationBackupUnlocked(options = {}) {
   fs42.mkdirSync(root2, { recursive: true, mode: 448 });
   fs42.chmodSync(root2, 448);
   const runId = newRunId();
-  const bundlePath = path47.join(root2, runId);
-  const temporary = path47.join(root2, `.${runId}.tmp`);
+  const bundlePath = path48.join(root2, runId);
+  const temporary = path48.join(root2, `.${runId}.tmp`);
   fs42.mkdirSync(temporary, { mode: 448 });
   const createdAt = new Date().toISOString();
   const sources = expectedSourcePaths();
@@ -58446,7 +59128,7 @@ function createMigrationBackupUnlocked(options = {}) {
       const sourcePath = sources[name];
       const sourceState = stateForName(state, name);
       const present = sourceState.status !== "missing";
-      const destination = path47.join(temporary, name);
+      const destination = path48.join(temporary, name);
       if (present) {
         if (name === "config.json" || name === "index.db" && sourceState.status === "corrupt") {
           copyFileDurable(sourcePath, destination);
@@ -58464,13 +59146,13 @@ function createMigrationBackupUnlocked(options = {}) {
       formatVersion: MANIFEST_FORMAT_VERSION,
       version: MIGRATION_BACKUP_VERSION,
       targetVersion: MIGRATION_BACKUP_VERSION,
-      installationId: path47.basename(getMigrationOperationRoot()),
+      installationId: path48.basename(getMigrationOperationRoot()),
       runId,
       createdAt,
       complete: true,
       artifacts
     };
-    writeFileAtomic(path47.join(temporary, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    writeFileAtomic(path48.join(temporary, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, 384);
     fsyncDirectory(temporary);
     fs42.renameSync(temporary, bundlePath);
@@ -58482,7 +59164,7 @@ function createMigrationBackupUnlocked(options = {}) {
   }
 }
 function parseManifest(bundlePath) {
-  const manifestPath = path47.join(bundlePath, "manifest.json");
+  const manifestPath = path48.join(bundlePath, "manifest.json");
   let value;
   try {
     value = JSON.parse(readTextFileWithLimit(manifestPath, MAX_LOCAL_METADATA_BYTES, "Migration manifest"));
@@ -58490,7 +59172,7 @@ function parseManifest(bundlePath) {
     throw new ConfigError(`Migration backup at ${bundlePath} is incomplete or unreadable: ${error2 instanceof Error ? error2.message : String(error2)}.`, "INVALID_CONFIG_FILE");
   }
   const manifest = value;
-  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || manifest.formatVersion !== MANIFEST_FORMAT_VERSION || manifest.version !== MIGRATION_BACKUP_VERSION || manifest.targetVersion !== MIGRATION_BACKUP_VERSION || manifest.installationId !== path47.basename(getMigrationOperationRoot()) || typeof manifest.runId !== "string" || path47.basename(bundlePath) !== manifest.runId || typeof manifest.createdAt !== "string" || manifest.complete !== true) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || manifest.formatVersion !== MANIFEST_FORMAT_VERSION || manifest.version !== MIGRATION_BACKUP_VERSION || manifest.targetVersion !== MIGRATION_BACKUP_VERSION || manifest.installationId !== path48.basename(getMigrationOperationRoot()) || typeof manifest.runId !== "string" || path48.basename(bundlePath) !== manifest.runId || typeof manifest.createdAt !== "string" || manifest.complete !== true) {
     throw new ConfigError(`Migration backup manifest at ${manifestPath} is invalid.`, "INVALID_CONFIG_FILE");
   }
   const sources = expectedSourcePaths();
@@ -58514,7 +59196,7 @@ function verifyMigrationBackup(bundlePath = resolveBackupRun()) {
   const expectedFiles = new Set(["manifest.json"]);
   for (const name of ARTIFACT_NAMES) {
     const artifact = manifest.artifacts[name];
-    const artifactPath = path47.join(bundlePath, name);
+    const artifactPath = path48.join(bundlePath, name);
     if (!artifact.present) {
       if (fs42.existsSync(artifactPath)) {
         throw new ConfigError(`Migration backup contains unexpected ${name}.`, "INVALID_CONFIG_FILE");
@@ -58530,7 +59212,7 @@ function verifyMigrationBackup(bundlePath = resolveBackupRun()) {
       throw new ConfigError(`Migration backup artifact ${name} failed semantic verification: expected ${artifact.status}, got ${inspected.status}.`, "INVALID_CONFIG_FILE");
     }
   }
-  if (!ownerOnlyMode(path47.join(bundlePath, "manifest.json"), false)) {
+  if (!ownerOnlyMode(path48.join(bundlePath, "manifest.json"), false)) {
     throw new ConfigError("Migration backup manifest must have mode 0600.", "INVALID_CONFIG_FILE");
   }
   const extras = fs42.readdirSync(bundlePath).filter((name) => !expectedFiles.has(name));
@@ -58552,17 +59234,17 @@ function expandTilde3(value) {
   if (value === "~")
     return process.env.HOME ?? value;
   if (value.startsWith("~/") || value.startsWith("~\\")) {
-    return path47.join(process.env.HOME ?? "~", value.slice(2));
+    return path48.join(process.env.HOME ?? "~", value.slice(2));
   }
   return value;
 }
 function resolveStashRoot(value, pathResolutionBase = process.cwd()) {
-  return path47.resolve(pathResolutionBase, expandTilde3(value));
+  return path48.resolve(pathResolutionBase, expandTilde3(value));
 }
 function configStashRoots(configPath, pathResolutionBase = process.cwd()) {
   try {
     const raw = parseConfigText(readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Migration config"), configPath);
-    const roots = new Set(oldConfigToSearchSources(raw, pathResolutionBase).map((source) => path47.resolve(source.path)));
+    const roots = new Set(oldConfigToSearchSources(raw, pathResolutionBase).map((source) => path48.resolve(source.path)));
     const migrated = migrateConfigSourcesToBundles(raw);
     const bundles = migrated.bundles;
     if (bundles && typeof bundles === "object" && !Array.isArray(bundles)) {
@@ -58605,7 +59287,7 @@ function currentStashRoots() {
 }
 function lockFiles(directory) {
   try {
-    const paths = fs42.readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".lock")).map((entry) => path47.join(directory, entry.name));
+    const paths = fs42.readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".lock")).map((entry) => path48.join(directory, entry.name));
     return { paths: paths.slice(0, LOCK_FILE_SAMPLE_LIMIT), overflow: paths.length > LOCK_FILE_SAMPLE_LIMIT };
   } catch (error2) {
     if (error2.code === "ENOENT")
@@ -58615,19 +59297,19 @@ function lockFiles(directory) {
 }
 function activeLockPaths(stashRoots = []) {
   const dataDir = getDataDir();
-  const configLock = path47.join(path47.dirname(getConfigPath()), "config.json.lck");
-  const roots = new Set([...currentStashRoots(), ...stashRoots.map((root2) => path47.resolve(root2))]);
-  const lockBases = [dataDir, ...[...roots].map((root2) => path47.join(root2, ".akm"))];
+  const configLock = path48.join(path48.dirname(getConfigPath()), "config.json.lck");
+  const roots = new Set([...currentStashRoots(), ...stashRoots.map((root2) => path48.resolve(root2))]);
+  const lockBases = [dataDir, ...[...roots].map((root2) => path48.join(root2, ".akm"))];
   const lockDirectories = lockBases.flatMap((base) => [
-    path47.join(base, "extract-locks"),
-    path47.join(base, "maintenance-activities")
+    path48.join(base, "extract-locks"),
+    path48.join(base, "maintenance-activities")
   ]);
   const samples = lockDirectories.map((directory) => ({ directory, ...lockFiles(directory) }));
   const candidates = new Set([
     configLock,
     getLockfileLockPath(),
     getIndexWriterLockPath(),
-    ...lockBases.flatMap((base) => STATIC_OPERATION_LOCKS.map((name) => path47.join(base, name))),
+    ...lockBases.flatMap((base) => STATIC_OPERATION_LOCKS.map((name) => path48.join(base, name))),
     ...samples.flatMap((sample) => sample.paths)
   ]);
   const blockers = [...candidates].filter((lockPath) => {
@@ -58715,7 +59397,7 @@ function resolveBackupRun(runId) {
   if (runId)
     return getMigrationBackupDir(runId);
   const root2 = getMigrationBackupRoot();
-  const runs = fs42.existsSync(root2) ? fs42.readdirSync(root2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => ({ name: entry.name, mtime: fs42.statSync(path47.join(root2, entry.name)).mtimeMs })).sort((left, right) => left.mtime - right.mtime || left.name.localeCompare(right.name)) : [];
+  const runs = fs42.existsSync(root2) ? fs42.readdirSync(root2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => ({ name: entry.name, mtime: fs42.statSync(path48.join(root2, entry.name)).mtimeMs })).sort((left, right) => left.mtime - right.mtime || left.name.localeCompare(right.name)) : [];
   const latest = runs.at(-1)?.name;
   if (!latest)
     throw new ConfigError(`No migration backup runs exist under ${root2}.`, "INVALID_CONFIG_FILE");
@@ -58739,13 +59421,13 @@ function readRestoreSentinel() {
   return value;
 }
 function writeRestoreSentinel(sentinel) {
-  fs42.mkdirSync(path47.dirname(restoreSentinelPath()), { recursive: true, mode: 448 });
+  fs42.mkdirSync(path48.dirname(restoreSentinelPath()), { recursive: true, mode: 448 });
   writeFileAtomic(restoreSentinelPath(), `${JSON.stringify(sentinel, null, 2)}
 `, 384);
 }
 function clearRestoreSentinel() {
   fs42.rmSync(restoreSentinelPath(), { force: true });
-  fsyncDirectory(path47.dirname(restoreSentinelPath()));
+  fsyncDirectory(path48.dirname(restoreSentinelPath()));
 }
 function failRestoreAfterForTests(name) {
   if (process.env.AKM_TEST_MIGRATION_FAIL_RESTORE_AFTER === name) {
@@ -58758,18 +59440,18 @@ function publishBackup(bundlePath, manifest) {
     const artifact = manifest.artifacts[name];
     const destination = artifact.sourcePath;
     const sidecars = name === "config.json" ? [] : [`${destination}-wal`, `${destination}-shm`];
-    fs42.mkdirSync(path47.dirname(destination), { recursive: true, mode: 448 });
+    fs42.mkdirSync(path48.dirname(destination), { recursive: true, mode: 448 });
     for (const sidecar of sidecars)
       fs42.rmSync(sidecar, { force: true });
     if (!artifact.present) {
       fs42.rmSync(destination, { force: true });
-      fsyncDirectory(path47.dirname(destination));
+      fsyncDirectory(path48.dirname(destination));
       failRestoreAfterForTests(name);
       continue;
     }
     const stage = `${destination}.restore-stage`;
     fs42.rmSync(stage, { force: true });
-    copyFileDurable(path47.join(bundlePath, name), stage);
+    copyFileDurable(path48.join(bundlePath, name), stage);
     const staged = inspectArtifact(name, stage);
     if (!sameState(staged, artifact)) {
       throw new ConfigError(`Staged restore artifact ${name} failed semantic verification.`, "INVALID_CONFIG_FILE");
@@ -58777,7 +59459,7 @@ function publishBackup(bundlePath, manifest) {
     fs42.rmSync(destination, { force: true });
     fs42.renameSync(stage, destination);
     fs42.chmodSync(destination, 384);
-    fsyncDirectory(path47.dirname(destination));
+    fsyncDirectory(path48.dirname(destination));
     failRestoreAfterForTests(name);
   }
   for (const name of ARTIFACT_NAMES) {
@@ -58804,7 +59486,7 @@ function recoverInterruptedRestoreWithLocksHeld() {
   if (!pending)
     return;
   assertNoArtifactReplacementBlockers(undefined, {
-    stashRoots: configStashRoots(path47.join(getMigrationBackupDir(pending.sourceRunId), "config.json"))
+    stashRoots: configStashRoots(path48.join(getMigrationBackupDir(pending.sourceRunId), "config.json"))
   });
   recoverInterruptedRestore();
 }
@@ -58819,7 +59501,7 @@ function restoreMigrationBackup(confirm, runId) {
     const pending = readRestoreSentinel();
     if (pending) {
       assertNoArtifactReplacementBlockers(undefined, {
-        stashRoots: configStashRoots(path47.join(getMigrationBackupDir(pending.sourceRunId), "config.json"))
+        stashRoots: configStashRoots(path48.join(getMigrationBackupDir(pending.sourceRunId), "config.json"))
       });
       recoverInterruptedRestore();
       const backupPath = getMigrationBackupDir(pending.sourceRunId);
@@ -58833,7 +59515,7 @@ function restoreMigrationBackup(confirm, runId) {
     const bundlePath = resolveBackupRun(runId);
     const manifest = verifyMigrationBackup(bundlePath);
     assertNoArtifactReplacementBlockers(undefined, {
-      stashRoots: configStashRoots(path47.join(bundlePath, "config.json"))
+      stashRoots: configStashRoots(path48.join(bundlePath, "config.json"))
     });
     const rescue = createMigrationBackupUnlocked({ allowCorruptIndex: true });
     writeRestoreSentinel({
@@ -58862,7 +59544,7 @@ function readApplySentinel() {
   let sentinel;
   try {
     const value = JSON.parse(readTextFileWithLimit(sentinelPath, MAX_LOCAL_METADATA_BYTES, "Migration apply sentinel"));
-    if (!value || typeof value !== "object" || Array.isArray(value) || value.formatVersion !== APPLY_SENTINEL_FORMAT || value.version !== MIGRATION_BACKUP_VERSION || typeof value.operationId !== "string" || !/^[A-Za-z0-9._-]+$/.test(value.operationId) || value.installationId !== path48.basename(getMigrationBackupRoot()) || typeof value.backupRunId !== "string" || !/^[A-Za-z0-9._-]+$/.test(value.backupRunId) || value.backupPath !== getMigrationBackupDir(value.backupRunId) || !value.targetConfig || typeof value.targetConfig !== "object" || Array.isArray(value.targetConfig) || !isMigrationLockEntries(value.migrationLockEntries) || typeof value.pathResolutionBase !== "string" || !path48.isAbsolute(value.pathResolutionBase)) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || value.formatVersion !== APPLY_SENTINEL_FORMAT || value.version !== MIGRATION_BACKUP_VERSION || typeof value.operationId !== "string" || !/^[A-Za-z0-9._-]+$/.test(value.operationId) || value.installationId !== path49.basename(getMigrationBackupRoot()) || typeof value.backupRunId !== "string" || !/^[A-Za-z0-9._-]+$/.test(value.backupRunId) || value.backupPath !== getMigrationBackupDir(value.backupRunId) || !value.targetConfig || typeof value.targetConfig !== "object" || Array.isArray(value.targetConfig) || !isMigrationLockEntries(value.migrationLockEntries) || typeof value.pathResolutionBase !== "string" || !path49.isAbsolute(value.pathResolutionBase)) {
       return { error: `Invalid migration apply sentinel at ${sentinelPath}.` };
     }
     sentinel = value;
@@ -58873,7 +59555,7 @@ function readApplySentinel() {
   }
   try {
     const backupStat = fs43.lstatSync(sentinel.backupPath);
-    if (backupStat.isSymbolicLink() || !backupStat.isDirectory() || fs43.realpathSync(path48.dirname(sentinel.backupPath)) !== fs43.realpathSync(getMigrationBackupRoot())) {
+    if (backupStat.isSymbolicLink() || !backupStat.isDirectory() || fs43.realpathSync(path49.dirname(sentinel.backupPath)) !== fs43.realpathSync(getMigrationBackupRoot())) {
       throw new ConfigError("Migration apply backup is not a canonical installation run directory.", "INVALID_CONFIG_FILE");
     }
     const config = parseMigrationTargetConfig(JSON.stringify(sentinel.targetConfig), sentinelPath);
@@ -58891,7 +59573,7 @@ function readApplySentinel() {
 }
 function writeApplySentinel(sentinel) {
   const sentinelPath = getMigrationApplyJournalPath();
-  fs43.mkdirSync(path48.dirname(sentinelPath), { recursive: true, mode: 448 });
+  fs43.mkdirSync(path49.dirname(sentinelPath), { recursive: true, mode: 448 });
   const serialized = `${JSON.stringify(sentinel, null, 2)}
 `;
   if (Buffer.byteLength(serialized) > MAX_LOCAL_METADATA_BYTES) {
@@ -58968,7 +59650,7 @@ function unsafeArtifact(name, state) {
   return `${name} is ${state.status}${state.detail ? `: ${state.detail}` : ""}`;
 }
 function completedCutoverRefMapPath() {
-  return path48.join(path48.dirname(getMigrationApplyJournalPath()), "completed-cutover-refmap.json");
+  return path49.join(path49.dirname(getMigrationApplyJournalPath()), "completed-cutover-refmap.json");
 }
 function loadCompletedProposalRefMap() {
   const mapPath = completedCutoverRefMapPath();
@@ -59072,7 +59754,7 @@ function expandTilde4(value) {
   if (value === "~")
     return os6.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\"))
-    return path48.join(os6.homedir(), value.slice(2));
+    return path49.join(os6.homedir(), value.slice(2));
   return value;
 }
 function migrationLockMatchesBundle(lock, bundle) {
@@ -59104,12 +59786,12 @@ function cutoverStashRootsFromConfig(config, migrationLockEntries = [], legacySo
       const bundlePath = bundle.path;
       const lock = locksById.get(id);
       const lockRoot = lock && migrationLockMatchesBundle(lock, bundle) ? lock.localRoot : undefined;
-      const materializedRoot = typeof bundlePath === "string" && bundlePath.length > 0 ? path48.resolve(pathResolutionBase, expandTilde4(bundlePath)) : lockRoot ? path48.resolve(pathResolutionBase, expandTilde4(lockRoot)) : undefined;
+      const materializedRoot = typeof bundlePath === "string" && bundlePath.length > 0 ? path49.resolve(pathResolutionBase, expandTilde4(bundlePath)) : lockRoot ? path49.resolve(pathResolutionBase, expandTilde4(lockRoot)) : undefined;
       const registryId = typeof bundle.registryId === "string" ? bundle.registryId : undefined;
       const identityIndex = identitySources.length;
       identitySources.push({
         id,
-        path: materializedRoot ?? path48.resolve(pathResolutionBase, ".akm", "unresolved-sources", id),
+        path: materializedRoot ?? path49.resolve(pathResolutionBase, ".akm", "unresolved-sources", id),
         ...registryId ? { registryId } : materializedRoot === undefined ? { registryId: id } : {}
       });
       if (!materializedRoot || seenRoots.has(materializedRoot))
@@ -59127,7 +59809,7 @@ function cutoverStashRootsFromConfig(config, migrationLockEntries = [], legacySo
       const configured = bundles[lock.id];
       if (!configured || !migrationLockMatchesBundle(lock, configured) || !lock.localRoot)
         continue;
-      const materializedRoot = path48.resolve(pathResolutionBase, expandTilde4(lock.localRoot));
+      const materializedRoot = path49.resolve(pathResolutionBase, expandTilde4(lock.localRoot));
       if (seenRoots.has(materializedRoot))
         continue;
       seenRoots.add(materializedRoot);
@@ -59149,7 +59831,7 @@ function cutoverStashRootsFromConfig(config, migrationLockEntries = [], legacySo
   if (legacySources.length > 0) {
     const exactLegacyIds = deriveLegacyBundleIds(legacySources);
     legacySources.forEach((source, index) => {
-      const root2 = path48.resolve(pathResolutionBase, source.path);
+      const root2 = path49.resolve(pathResolutionBase, source.path);
       const legacyId = exactLegacyIds[index];
       const existing = legacyIdsByRoot.get(root2);
       if (!legacyId || existing !== undefined && existing !== legacyId) {
@@ -59163,32 +59845,32 @@ function cutoverStashRootsFromConfig(config, migrationLockEntries = [], legacySo
   return candidates.map((candidate) => ({
     path: candidate.path,
     bundleId: candidate.bundleId,
-    legacyBundleId: legacyIdsByRoot.get(path48.resolve(candidate.path)) ?? inferredLegacyBundleIds[candidate.identityIndex],
+    legacyBundleId: legacyIdsByRoot.get(path49.resolve(candidate.path)) ?? inferredLegacyBundleIds[candidate.identityIndex],
     registryId: candidate.registryId,
     primary: candidate.primary
   }));
 }
 function legacyCutoverSources(sentinel) {
-  const backupConfigPath = path48.join(sentinel.backupPath, "config.json");
+  const backupConfigPath = path49.join(sentinel.backupPath, "config.json");
   if (!fs43.existsSync(backupConfigPath))
     return [];
   const text2 = readTextFileWithLimit(backupConfigPath, MAX_CONFIG_FILE_BYTES, "Migration backup config");
   return oldConfigToSearchSources(parseConfigText(text2, backupConfigPath), sentinel.pathResolutionBase);
 }
 function cutoverRefMapPath(sentinel) {
-  return path48.join(path48.dirname(getMigrationApplyJournalPath()), `cutover-refmap-${sentinel.operationId}.json`);
+  return path49.join(path49.dirname(getMigrationApplyJournalPath()), `cutover-refmap-${sentinel.operationId}.json`);
 }
 function contentMigrationReportPath() {
-  return path48.join(path48.dirname(getMigrationApplyJournalPath()), "content-migration-report.json");
+  return path49.join(path49.dirname(getMigrationApplyJournalPath()), "content-migration-report.json");
 }
 function persistContentMigrationReport(report) {
-  fs43.mkdirSync(path48.dirname(contentMigrationReportPath()), { recursive: true, mode: 448 });
+  fs43.mkdirSync(path49.dirname(contentMigrationReportPath()), { recursive: true, mode: 448 });
   writeFileAtomic(contentMigrationReportPath(), `${JSON.stringify(report, null, 2)}
 `, 384);
 }
 function isPathWithin(root2, candidate) {
-  const relative = path48.relative(path48.resolve(root2), path48.resolve(candidate));
-  return relative.length > 0 && !relative.startsWith(`..${path48.sep}`) && relative !== ".." && !path48.isAbsolute(relative);
+  const relative = path49.relative(path49.resolve(root2), path49.resolve(candidate));
+  return relative.length > 0 && !relative.startsWith(`..${path49.sep}`) && relative !== ".." && !path49.isAbsolute(relative);
 }
 function priorReservedRenames(roots) {
   const reportPath = contentMigrationReportPath();
@@ -59212,15 +59894,15 @@ function priorReservedRenames(roots) {
     if (!entry || typeof entry.from !== "string" || typeof entry.to !== "string") {
       throw new ConfigError(`Invalid reserved-file rename history at ${reportPath}.`, "INVALID_CONFIG_FILE");
     }
-    const from = path48.resolve(entry.from);
-    const to = path48.resolve(entry.to);
+    const from = path49.resolve(entry.from);
+    const to = path49.resolve(entry.to);
     const owner = roots.find((root2) => isPathWithin(root2.path, from) && isPathWithin(root2.path, to));
     if (!owner)
       continue;
-    const fromName = path48.basename(from).toLowerCase();
+    const fromName = path49.basename(from).toLowerCase();
     const stem = fromName.endsWith(".md") ? fromName.slice(0, -3) : "";
     const targetPattern = new RegExp(`^${stem}-content(?:-(?:[2-9]|[1-9][0-9]+))?\\.md$`, "i");
-    if (path48.dirname(from) !== path48.dirname(to) || fromName !== "index.md" && fromName !== "log.md" || !targetPattern.test(path48.basename(to))) {
+    if (path49.dirname(from) !== path49.dirname(to) || fromName !== "index.md" && fromName !== "log.md" || !targetPattern.test(path49.basename(to))) {
       throw new ConfigError(`Invalid reserved-file rename history at ${reportPath}.`, "INVALID_CONFIG_FILE");
     }
     if (fs43.existsSync(from) || !fs43.existsSync(to))
@@ -59233,7 +59915,7 @@ function priorReservedRenames(roots) {
   return reusable;
 }
 function mergePriorReservedRenames(report, roots) {
-  const bySource = new Map(report.reservedRenames.map((entry) => [path48.resolve(entry.from), entry]));
+  const bySource = new Map(report.reservedRenames.map((entry) => [path49.resolve(entry.from), entry]));
   for (const entry of priorReservedRenames(roots)) {
     if (!bySource.has(entry.from))
       bySource.set(entry.from, entry);
@@ -59244,11 +59926,11 @@ function mergePriorReservedRenames(report, roots) {
 function reservedRenameRefMap(renames, roots) {
   const map = new Map;
   for (const rename of renames) {
-    const owner = roots.find((root2) => rename.from.startsWith(`${path48.resolve(root2.path)}${path48.sep}`));
+    const owner = roots.find((root2) => rename.from.startsWith(`${path49.resolve(root2.path)}${path49.sep}`));
     if (!owner)
       continue;
     const conceptId = (absolute) => {
-      const relative = path48.relative(path48.resolve(owner.path), absolute).split(path48.sep).join("/");
+      const relative = path49.relative(path49.resolve(owner.path), absolute).split(path49.sep).join("/");
       return relative.endsWith(".md") ? relative.slice(0, -3) : undefined;
     };
     const oldId = conceptId(rename.from);
@@ -59264,7 +59946,7 @@ function reservedRenameRefMap(renames, roots) {
 function runContentMigrationStep(sentinel, roots) {
   const report = mergePriorReservedRenames(runContentMigration(roots.map((root2) => root2.path), {
     operationId: sentinel.operationId,
-    renameBatchPath: path48.join(path48.dirname(getMigrationApplyJournalPath()), `reserved-renames-${sentinel.operationId}.json`)
+    renameBatchPath: path49.join(path49.dirname(getMigrationApplyJournalPath()), `reserved-renames-${sentinel.operationId}.json`)
   }), roots);
   const renameMap = reservedRenameRefMap(report.reservedRenames, roots);
   const proposalRoots = roots.flatMap((root2) => root2.bundleId ? [
@@ -59434,7 +60116,7 @@ function warnOrphanedActiveWorkflowRuns(statePath, roots, defaultBundle) {
       const root2 = rootById.get(parsed.bundle ?? defaultBundle ?? "");
       if (!root2)
         continue;
-      const typeRoot = path48.join(root2.path, stashDirFor("workflow") ?? "workflows");
+      const typeRoot = path49.join(root2.path, stashDirFor("workflow") ?? "workflows");
       const filePath = assetPathForName("workflow", typeRoot, parts.name);
       if (!fs43.existsSync(filePath))
         continue;
@@ -59444,7 +60126,7 @@ function warnOrphanedActiveWorkflowRuns(statePath, roots, defaultBundle) {
       } catch {
         continue;
       }
-      const diagnostics = workflowStructureDiagnostics(path48.relative(root2.path, filePath) || filePath, raw, filePath);
+      const diagnostics = workflowStructureDiagnostics(path49.relative(root2.path, filePath) || filePath, raw, filePath);
       if (diagnostics.length === 0)
         continue;
       warn(`WORKFLOW ACTIVE run ${row.id} targets "${row.workflow_ref}" (${filePath}), which fails 0.9 workflow ` + `structural validation and can no longer be run: ${diagnostics.map((d) => d.detail).join("; ")}. ` + "AKM does not auto-translate workflow definitions between formats \u2014 update the asset to declare " + `frontmatter \`steps:\`, or run \`akm workflow abandon ${row.id}\` to clear the stale run.`);
@@ -59455,7 +60137,7 @@ function writeGeneratedTargetConfig(raw) {
   const { config, droppedKeys } = generateTargetConfig(raw, CURRENT_CONFIG_VERSION);
   const generatedPath = getMigrationGeneratedConfigPath();
   parseAndValidateConfigText(JSON.stringify(config), generatedPath);
-  fs43.mkdirSync(path48.dirname(generatedPath), { recursive: true, mode: 448 });
+  fs43.mkdirSync(path49.dirname(generatedPath), { recursive: true, mode: 448 });
   writeFileAtomic(generatedPath, `${JSON.stringify(config, null, 2)}
 `, 384);
   return { path: generatedPath, status: "written", droppedKeys };
@@ -59496,7 +60178,7 @@ async function runMigrationApply(options = {}) {
     const { plan, target, migrationLockEntries } = requireEligiblePlan(options.preparedConfigPath, existing);
     if (plan.status === "current" && !existing.sentinel)
       return { plan };
-    const pathResolutionBase = existing.sentinel?.pathResolutionBase ?? path48.resolve(process.cwd());
+    const pathResolutionBase = existing.sentinel?.pathResolutionBase ?? path49.resolve(process.cwd());
     const stashRoots = cutoverStashRootsFromConfig(target, migrationLockEntries, [], pathResolutionBase);
     assertNoArtifactReplacementBlockers(undefined, { stashRoots: stashRoots.map((root2) => root2.path) });
     assertMigrationLockfileReadable();
@@ -59510,7 +60192,7 @@ async function runMigrationApply(options = {}) {
       backupPath: backup.path,
       targetConfig: sanitizeConfigForWrite(target),
       migrationLockEntries,
-      pathResolutionBase: path48.resolve(process.cwd())
+      pathResolutionBase: path49.resolve(process.cwd())
     };
     if (!existing.sentinel)
       writeApplySentinel(sentinel);