akm-cli 0.9.10 → 0.9.11

package/dist/scripts/akm-migrate-node.js

@@ -7124,6 +7124,136 @@ var init_errors = __esm(() => {
   };
 });
 
+// src/core/asset/asset-ref.ts
+import path from "node:path";
+function validateName(name) {
+  if (!name)
+    throw new UsageError("Empty asset name.", "MISSING_REQUIRED_ARGUMENT");
+  if (name.includes("\x00"))
+    throw new UsageError("Null byte in asset name.", "MISSING_REQUIRED_ARGUMENT");
+  if (/^[A-Za-z]:/.test(name))
+    throw new UsageError("Windows drive path in asset name.", "MISSING_REQUIRED_ARGUMENT");
+  const slashName = name.replace(/\\/g, "/");
+  if (slashName === ".." || slashName.startsWith("../")) {
+    throw new UsageError("Path traversal in asset name.", "MISSING_REQUIRED_ARGUMENT");
+  }
+  if (slashName.split("/").some((seg) => seg === "." || seg === "..")) {
+    throw new UsageError("Asset name cannot contain relative path segments.", "MISSING_REQUIRED_ARGUMENT");
+  }
+  const normalized = path.posix.normalize(slashName);
+  if (path.posix.isAbsolute(normalized))
+    throw new UsageError("Absolute path in asset name.", "MISSING_REQUIRED_ARGUMENT");
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new UsageError("Path traversal in asset name.", "MISSING_REQUIRED_ARGUMENT");
+  }
+}
+function normalizeName(name) {
+  return path.posix.normalize(name.replace(/\\/g, "/"));
+}
+function isBundleSlug(s) {
+  return BUNDLE_SLUG_RE.test(s);
+}
+function normalizeConceptId(raw) {
+  const nfc = raw.normalize("NFC");
+  if (nfc.includes("#")) {
+    throw new UsageError("`#` is reserved for the export fragment in a concept id.", "MISSING_REQUIRED_ARGUMENT");
+  }
+  validateName(nfc);
+  return normalizeName(nfc);
+}
+function makeBundleRef(bundle, conceptId, fragment) {
+  const normalized = normalizeConceptId(conceptId);
+  let out = normalized;
+  if (bundle) {
+    if (!BUNDLE_SLUG_RE.test(bundle)) {
+      throw new UsageError(`Invalid bundle slug "${bundle}". A bundle slug may not contain ':', '.', '#', '/', or whitespace.`, "MISSING_REQUIRED_ARGUMENT");
+    }
+    out = `${bundle}//${normalized}`;
+  }
+  if (fragment)
+    out = `${out}#${fragment}`;
+  return out;
+}
+function bundleRefToString(ref) {
+  return makeBundleRef(ref.bundle, ref.conceptId, ref.fragment);
+}
+function parseBundleRef(ref) {
+  const trimmed = ref.trim();
+  if (!trimmed)
+    throw new UsageError("Empty ref.", "MISSING_REQUIRED_ARGUMENT");
+  let bundle;
+  let body = trimmed;
+  const boundary = trimmed.indexOf("//");
+  if (boundary >= 0) {
+    bundle = trimmed.slice(0, boundary);
+    body = trimmed.slice(boundary + 2);
+    if (!bundle)
+      throw new UsageError("Empty bundle in ref.", "MISSING_REQUIRED_ARGUMENT");
+    if (!BUNDLE_SLUG_RE.test(bundle)) {
+      throw new UsageError(`Invalid bundle slug "${bundle}" in ref "${trimmed}". A bundle slug may not contain ':', '.', '#', '/', or whitespace.`, "MISSING_REQUIRED_ARGUMENT");
+    }
+  }
+  let fragment;
+  const hash = body.indexOf("#");
+  if (hash >= 0) {
+    fragment = body.slice(hash + 1) || undefined;
+    body = body.slice(0, hash);
+  }
+  if (!body) {
+    throw new UsageError(`Invalid ref "${trimmed}". Expected [bundle//]conceptId, e.g. knowledge/guide or core//skills/review`, "MISSING_REQUIRED_ARGUMENT");
+  }
+  const conceptId = normalizeConceptId(body);
+  return { bundle: bundle || undefined, conceptId, fragment };
+}
+var BUNDLE_SLUG_RE;
+var init_asset_ref = __esm(() => {
+  init_errors();
+  BUNDLE_SLUG_RE = /^[^\s:.#/]+$/;
+});
+
+// src/core/bundle-id.ts
+import crypto2 from "node:crypto";
+import path2 from "node:path";
+function slugForPath(sourcePath) {
+  const resolved = path2.resolve(sourcePath);
+  const base = path2.basename(resolved).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (base.length > 0)
+    return base;
+  return `bundle-${shortHash(resolved)}`;
+}
+function deriveBundleId(registryId, sourcePath, usedIds) {
+  const preferred = registryId && registryId.length > 0 && isBundleSlug(registryId) ? registryId : slugForPath(sourcePath);
+  const id = ensureUniqueId(preferred, sourcePath, usedIds);
+  usedIds.add(id);
+  return id;
+}
+function deriveBundleIds(sources) {
+  const usedIds = new Set;
+  const reservedIds = new Set(sources.flatMap((source) => source.registryId && isBundleSlug(source.registryId) ? [source.registryId] : []));
+  return sources.map((source) => {
+    const id = source.registryId && isBundleSlug(source.registryId) ? deriveBundleId(source.registryId, source.path, usedIds) : deriveBundleId(undefined, source.path, new Set([...usedIds, ...reservedIds]));
+    usedIds.add(id);
+    return id;
+  });
+}
+function ensureUniqueId(preferred, sourcePath, used) {
+  if (!used.has(preferred))
+    return preferred;
+  const suffixed = `${preferred}-${shortHash(path2.resolve(sourcePath))}`;
+  if (!used.has(suffixed))
+    return suffixed;
+  let n = 2;
+  while (used.has(`${suffixed}-${n}`))
+    n++;
+  return `${suffixed}-${n}`;
+}
+function shortHash(input) {
+  return crypto2.createHash("sha256").update(input).digest("hex").slice(0, 8);
+}
+var init_bundle_id = __esm(() => {
+  init_asset_ref();
+});
+
 // src/core/platform.ts
 var IS_WINDOWS;
 var init_platform = __esm(() => {
@@ -7132,7 +7262,7 @@ var init_platform = __esm(() => {
 
 // src/core/paths.ts
 import os from "node:os";
-import path from "node:path";
+import path3 from "node:path";
 function isUnderBunTest(env) {
   return env.BUN_TEST === "1" || env.NODE_ENV === "test";
 }
@@ -7149,37 +7279,37 @@ function getConfigDir(env = process.env, platform = process.platform) {
   if (platform === "win32") {
     const appData = env.APPDATA?.trim();
     if (appData)
-      return path.join(appData, "akm");
+      return path3.join(appData, "akm");
   } else {
     const xdgConfigHome2 = env.XDG_CONFIG_HOME?.trim();
     if (xdgConfigHome2)
-      return path.join(xdgConfigHome2, "akm");
+      return path3.join(xdgConfigHome2, "akm");
   }
   const stashOverride = env.AKM_BUNDLE_DIR?.trim();
   if (stashOverride && isTransientStashPath(stashOverride)) {
-    return path.join(stashOverride, ".akm");
+    return path3.join(stashOverride, ".akm");
   }
   if (platform === "win32") {
     const appData = env.APPDATA?.trim();
     if (appData)
-      return path.join(appData, "akm");
+      return path3.join(appData, "akm");
     const userProfile = env.USERPROFILE?.trim();
     if (!userProfile) {
       throw new ConfigError("Unable to determine config directory. Set APPDATA or USERPROFILE.", "CONFIG_DIR_UNRESOLVABLE");
     }
-    return path.join(userProfile, "AppData", "Roaming", "akm");
+    return path3.join(userProfile, "AppData", "Roaming", "akm");
   }
   const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
   if (xdgConfigHome)
-    return path.join(xdgConfigHome, "akm");
+    return path3.join(xdgConfigHome, "akm");
   const home = env.HOME?.trim();
   if (!home) {
     throw new ConfigError("Unable to determine config directory. Set XDG_CONFIG_HOME or HOME.", "CONFIG_DIR_UNRESOLVABLE");
   }
-  return path.join(home, ".config", "akm");
+  return path3.join(home, ".config", "akm");
 }
 function getConfigPath(env = process.env) {
-  return path.join(getConfigDir(env), "config.json");
+  return path3.join(getConfigDir(env), "config.json");
 }
 function getCacheDir(env = process.env) {
   const override = env.AKM_CACHE_DIR?.trim();
@@ -7188,22 +7318,22 @@ function getCacheDir(env = process.env) {
   if (IS_WINDOWS) {
     const localAppData = env.LOCALAPPDATA?.trim();
     if (localAppData)
-      return path.join(localAppData, "akm");
+      return path3.join(localAppData, "akm");
     const userProfile = env.USERPROFILE?.trim();
     if (userProfile)
-      return path.join(userProfile, "AppData", "Local", "akm");
+      return path3.join(userProfile, "AppData", "Local", "akm");
     const appData = env.APPDATA?.trim();
     if (appData) {
-      return path.join(appData, "..", "Local", "akm");
+      return path3.join(appData, "..", "Local", "akm");
     }
   } else {
     const xdgCacheHome = env.XDG_CACHE_HOME?.trim();
     if (xdgCacheHome)
-      return path.join(xdgCacheHome, "akm");
+      return path3.join(xdgCacheHome, "akm");
   }
   const stashOverride = env.AKM_BUNDLE_DIR?.trim();
   if (stashOverride && isTransientStashPath(stashOverride)) {
-    return path.join(stashOverride, ".akm", "cache");
+    return path3.join(stashOverride, ".akm", "cache");
   }
   if (IS_WINDOWS) {
     throw new ConfigError("Unable to determine cache directory. Set LOCALAPPDATA, USERPROFILE, or APPDATA.", "CONFIG_DIR_UNRESOLVABLE");
@@ -7211,11 +7341,11 @@ function getCacheDir(env = process.env) {
   const home = env.HOME?.trim();
   if (!home)
     return homelessFallbackDir("akm-cache");
-  return path.join(home, ".cache", "akm");
+  return path3.join(home, ".cache", "akm");
 }
 function homelessFallbackDir(kind) {
   const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-  return path.join(os.tmpdir(), uid === undefined ? kind : `${kind}-${uid}`);
+  return path3.join(os.tmpdir(), uid === undefined ? kind : `${kind}-${uid}`);
 }
 function getDataDir(env = process.env, platform = process.platform) {
   const override = env.AKM_DATA_DIR?.trim();
@@ -7227,38 +7357,83 @@ function getDataDir(env = process.env, platform = process.platform) {
   if (platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
     if (localAppData)
-      return path.join(localAppData, "akm", "data");
+      return path3.join(localAppData, "akm", "data");
     const userProfile = env.USERPROFILE?.trim();
     if (userProfile)
-      return path.join(userProfile, "AppData", "Local", "akm", "data");
+      return path3.join(userProfile, "AppData", "Local", "akm", "data");
     const appData = env.APPDATA?.trim();
     if (!appData) {
       throw new ConfigError("Unable to determine data directory. Set LOCALAPPDATA, USERPROFILE, or APPDATA.", "CONFIG_DIR_UNRESOLVABLE");
     }
-    return path.join(appData, "..", "Local", "akm", "data");
+    return path3.join(appData, "..", "Local", "akm", "data");
   }
   const xdgDataHome = env.XDG_DATA_HOME?.trim();
   if (xdgDataHome)
-    return path.join(xdgDataHome, "akm");
+    return path3.join(xdgDataHome, "akm");
   const home = env.HOME?.trim();
   if (!home)
     return homelessFallbackDir("akm-data");
-  return path.join(home, ".local", "share", "akm");
+  return path3.join(home, ".local", "share", "akm");
 }
 function getDbPath(env = process.env) {
-  return path.join(getDataDir(env), "index.db");
+  return path3.join(getDataDir(env), "index.db");
 }
 function getMaintenanceBarrierPath() {
-  return path.join(getDataDir(), "maintenance.barrier.lock");
+  return path3.join(getDataDir(), "maintenance.barrier.lock");
 }
 function getLockfilePath() {
-  return path.join(getDataDir(), "akm.lock");
+  return path3.join(getDataDir(), "akm.lock");
 }
 function getRegistryCacheDir() {
-  return path.join(getCacheDir(), "registry");
+  return path3.join(getCacheDir(), "registry");
 }
 function getRegistryIndexCacheDir() {
-  return path.join(getCacheDir(), "registry-index");
+  return path3.join(getCacheDir(), "registry-index");
+}
+function getStateDir(env = process.env, platform = process.platform) {
+  const override = env.AKM_STATE_DIR?.trim();
+  if (override)
+    return override;
+  if (platform === "win32") {
+    const localAppData = env.LOCALAPPDATA?.trim();
+    if (localAppData)
+      return path3.join(localAppData, "akm", "state");
+    const userProfile = env.USERPROFILE?.trim();
+    if (userProfile)
+      return path3.join(userProfile, "AppData", "Local", "akm", "state");
+    const appData = env.APPDATA?.trim();
+    if (!appData) {
+      throw new ConfigError("Unable to determine state directory. Set LOCALAPPDATA, USERPROFILE, or APPDATA.", "CONFIG_DIR_UNRESOLVABLE");
+    }
+    return path3.join(appData, "..", "Local", "akm", "state");
+  }
+  const xdgStateHome = env.XDG_STATE_HOME?.trim();
+  if (xdgStateHome)
+    return path3.join(xdgStateHome, "akm");
+  const home = env.HOME?.trim();
+  if (!home)
+    return homelessFallbackDir("akm-state");
+  return path3.join(home, ".local", "state", "akm");
+}
+function getStashStateKey(stashDir) {
+  const resolved = path3.resolve(stashDir).replace(/\\/g, "/");
+  const normalized = IS_WINDOWS ? resolved.toLowerCase() : resolved;
+  return shortHash(normalized);
+}
+function stashScopedDir(base, stashDir) {
+  return path3.join(base, getStashStateKey(stashDir));
+}
+function getDistillRejectedDir(stashDir) {
+  return stashScopedDir(path3.join(getStateDir(), "improve", "distill-rejected"), stashDir);
+}
+function getEvalCasesDir(stashDir) {
+  return stashScopedDir(path3.join(getStateDir(), "improve", "eval-cases"), stashDir);
+}
+function getMeasurementVerdictsDir(stashDir) {
+  return stashScopedDir(path3.join(getStateDir(), "improve", "measurement", "verdicts"), stashDir);
+}
+function getUnresolvedSourcesDir(stashDir) {
+  return stashScopedDir(path3.join(getCacheDir(), "index", "unresolved-sources"), stashDir);
 }
 function getDefaultStashDir(env = process.env) {
   const override = env.AKM_BUNDLE_DIR?.trim();
@@ -7267,24 +7442,25 @@ function getDefaultStashDir(env = process.env) {
   if (IS_WINDOWS) {
     const userProfile = env.USERPROFILE?.trim();
     if (userProfile)
-      return path.join(userProfile, "Documents", "akm");
-    return path.join("C:\\", "akm");
+      return path3.join(userProfile, "Documents", "akm");
+    return path3.join("C:\\", "akm");
   }
   const home = env.HOME?.trim();
   if (!home) {
     throw new ConfigError("Unable to determine default bundle directory. Set HOME.", "STASH_DIR_NOT_FOUND");
   }
-  return path.join(home, "akm");
+  return path3.join(home, "akm");
 }
 var init_paths = __esm(() => {
+  init_bundle_id();
   init_errors();
   init_platform();
 });
 
 // src/core/common.ts
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 import fs from "node:fs";
-import path2 from "node:path";
+import path4 from "node:path";
 function isHttpUrl(value) {
   return !!value && /^https?:\/\//.test(value);
 }
@@ -7362,7 +7538,7 @@ function stripJsonComments(text) {
   return result;
 }
 function writeFileAtomic(target, content, mode) {
-  const tmp = `${target}.tmp.${process.pid}.${crypto2.randomBytes(8).toString("hex")}`;
+  const tmp = `${target}.tmp.${process.pid}.${crypto3.randomBytes(8).toString("hex")}`;
   const data = typeof content === "string" ? Buffer.from(content) : content;
   const fileMode = mode ?? 384;
   let fd;
@@ -7417,7 +7593,7 @@ function writeFileAtomic(target, content, mode) {
   if (process.platform !== "win32") {
     let dirFd;
     try {
-      dirFd = fs.openSync(path2.dirname(target), "r");
+      dirFd = fs.openSync(path4.dirname(target), "r");
     } catch (error) {
       if (hasErrnoCode(error, "EINVAL") || hasErrnoCode(error, "ENOTSUP"))
         return;
@@ -7450,7 +7626,7 @@ function resolveStashDir(env = process.env) {
   throw new ConfigError(`No bundle directory found. Run "akm bundle create" to create one at ${defaultDir}.`, "STASH_DIR_NOT_FOUND");
 }
 function validateStashDir(raw) {
-  const stashDir = path2.resolve(raw);
+  const stashDir = path4.resolve(raw);
   let stat;
   try {
     stat = fs.statSync(stashDir);
@@ -7496,8 +7672,8 @@ function readStashDirFromConfig() {
           const componentConfig = component;
           if (typeof componentConfig.root !== "string")
             return bundlePath;
-          const bundleRoot = path2.resolve(bundlePath);
-          const componentRoot = path2.resolve(bundleRoot, componentConfig.root);
+          const bundleRoot = path4.resolve(bundlePath);
+          const componentRoot = path4.resolve(bundleRoot, componentConfig.root);
           if (!isWithin(componentRoot, bundleRoot)) {
             throw new ConfigError(`Component root "${componentConfig.root}" escapes bundle "${defaultBundle}".`, "INVALID_CONFIG_FILE");
           }
@@ -7542,30 +7718,30 @@ function isAkmRegistryCachePath(filePath) {
   return isWithin(filePath, getRegistryCacheDir()) || isWithin(filePath, getRegistryIndexCacheDir());
 }
 function isContainedResolvedPath(resolvedCandidate, resolvedRoot) {
-  const rel = path2.relative(normalizeFsPathForComparison(resolvedRoot), normalizeFsPathForComparison(resolvedCandidate));
+  const rel = path4.relative(normalizeFsPathForComparison(resolvedRoot), normalizeFsPathForComparison(resolvedCandidate));
   if (rel === "")
     return true;
-  if (path2.isAbsolute(rel))
+  if (path4.isAbsolute(rel))
     return false;
   return rel.split(/[/\\]+/)[0] !== "..";
 }
 function safeRealpath(p) {
-  const resolved = path2.resolve(p);
+  const resolved = path4.resolve(p);
   try {
     return fs.realpathSync(resolved);
   } catch {
     const suffix = [];
     let current = resolved;
     for (;; ) {
-      const parent = path2.dirname(current);
+      const parent = path4.dirname(current);
       if (parent === current) {
         return resolved;
       }
-      suffix.unshift(path2.basename(current));
+      suffix.unshift(path4.basename(current));
       current = parent;
       try {
         const realParent = fs.realpathSync(current);
-        return path2.join(realParent, ...suffix);
+        return path4.join(realParent, ...suffix);
       } catch {}
     }
   }
@@ -7879,7 +8055,7 @@ var init_recognition_util = __esm(() => {
 
 // src/core/asset/asset-placement.ts
 import fs2 from "node:fs";
-import path5 from "node:path";
+import path7 from "node:path";
 function placementSpecFor(type) {
   return PLACEMENT_SPECS[type];
 }
@@ -7903,10 +8079,10 @@ function deriveCanonicalAssetName(assetType, typeRoot, filePath) {
   return PLACEMENT_SPECS[assetType]?.toCanonicalName(typeRoot, filePath);
 }
 function deriveCanonicalAssetNameFromStashRoot(assetType, stashRoot, filePath) {
-  const relPath = toPosix(path5.relative(stashRoot, filePath));
+  const relPath = toPosix(path7.relative(stashRoot, filePath));
   const segments = relPath.split("/").filter(Boolean);
   const firstSegment = segments[0];
-  const typeRoot = firstSegment !== undefined && firstSegment === stashDirFor(assetType) ? path5.join(stashRoot, firstSegment) : stashRoot;
+  const typeRoot = firstSegment !== undefined && firstSegment === stashDirFor(assetType) ? path7.join(stashRoot, firstSegment) : stashRoot;
   return deriveCanonicalAssetName(assetType, typeRoot, filePath);
 }
 function assetPathForName(assetType, typeRoot, name) {
@@ -7925,8 +8101,8 @@ function assetPathCandidatesForName(assetType, typeRoot, name) {
   const base = name === "default" ? "" : name.endsWith("/default") ? name.slice(0, -"default".length) : undefined;
   if (base === undefined)
     return [primary];
-  const dotForm = path5.join(typeRoot, base, ".env");
-  const namedForm = path5.join(typeRoot, base, "default.env");
+  const dotForm = path7.join(typeRoot, base, ".env");
+  const namedForm = path7.join(typeRoot, base, "default.env");
   return [...new Set([primary, dotForm, namedForm])];
 }
 var workflowSpec, markdownSpec, scriptSpec, BUILTIN_PLACEMENT_SPECS, PLACEMENT_SPECS;
@@ -7934,9 +8110,9 @@ var init_asset_placement = __esm(() => {
   init_common();
   init_recognition_util();
   workflowSpec = {
-    isRelevantFile: (fileName) => WORKFLOW_EXTENSIONS.includes(path5.extname(fileName).toLowerCase()),
+    isRelevantFile: (fileName) => WORKFLOW_EXTENSIONS.includes(path7.extname(fileName).toLowerCase()),
     toCanonicalName: (typeRoot, filePath) => {
-      const rel = toPosix(path5.relative(typeRoot, filePath));
+      const rel = toPosix(path7.relative(typeRoot, filePath));
       for (const ext of WORKFLOW_EXTENSIONS) {
         if (rel.toLowerCase().endsWith(ext))
           return rel.slice(0, -ext.length);
@@ -7947,43 +8123,43 @@ var init_asset_placement = __esm(() => {
       const lower = name.toLowerCase();
       for (const ext of WORKFLOW_EXTENSIONS) {
         if (lower.endsWith(ext))
-          return path5.join(typeRoot, name);
+          return path7.join(typeRoot, name);
       }
       for (const ext of WORKFLOW_EXTENSIONS) {
-        const candidate = path5.join(typeRoot, `${name}${ext}`);
+        const candidate = path7.join(typeRoot, `${name}${ext}`);
         if (fs2.existsSync(candidate))
           return candidate;
       }
-      return path5.join(typeRoot, `${name}.md`);
+      return path7.join(typeRoot, `${name}.md`);
     }
   };
   markdownSpec = {
-    isRelevantFile: (fileName) => path5.extname(fileName).toLowerCase() === ".md",
+    isRelevantFile: (fileName) => path7.extname(fileName).toLowerCase() === ".md",
     toCanonicalName: (typeRoot, filePath) => {
-      const rel = toPosix(path5.relative(typeRoot, filePath));
+      const rel = toPosix(path7.relative(typeRoot, filePath));
       return rel.endsWith(".md") ? rel.slice(0, -3) : rel;
     },
     toAssetPath: (typeRoot, name) => {
       const withExt = name.endsWith(".md") ? name : `${name}.md`;
-      return path5.join(typeRoot, withExt);
+      return path7.join(typeRoot, withExt);
     }
   };
   scriptSpec = {
-    isRelevantFile: (fileName) => SCRIPT_EXTENSIONS.has(path5.extname(fileName).toLowerCase()),
-    toCanonicalName: (typeRoot, filePath) => toPosix(path5.relative(typeRoot, filePath)),
-    toAssetPath: (typeRoot, name) => path5.join(typeRoot, name)
+    isRelevantFile: (fileName) => SCRIPT_EXTENSIONS.has(path7.extname(fileName).toLowerCase()),
+    toCanonicalName: (typeRoot, filePath) => toPosix(path7.relative(typeRoot, filePath)),
+    toAssetPath: (typeRoot, name) => path7.join(typeRoot, name)
   };
   BUILTIN_PLACEMENT_SPECS = {
     skill: {
       stashDir: "skills",
       isRelevantFile: (fileName) => fileName === "SKILL.md",
       toCanonicalName: (typeRoot, filePath) => {
-        const relDir = toPosix(path5.dirname(path5.relative(typeRoot, filePath)));
+        const relDir = toPosix(path7.dirname(path7.relative(typeRoot, filePath)));
         if (!relDir || relDir === ".")
           return;
         return relDir;
       },
-      toAssetPath: (typeRoot, name) => path5.join(typeRoot, name, "SKILL.md")
+      toAssetPath: (typeRoot, name) => path7.join(typeRoot, name, "SKILL.md")
     },
     command: { stashDir: "commands", ...markdownSpec },
     agent: { stashDir: "agents", ...markdownSpec },
@@ -7996,10 +8172,10 @@ var init_asset_placement = __esm(() => {
       stashDir: "env",
       isRelevantFile: (fileName) => fileName === ".env" || fileName.endsWith(".env"),
       toCanonicalName: (typeRoot, filePath) => {
-        const rel = toPosix(path5.relative(typeRoot, filePath));
-        const fileName = path5.basename(rel);
+        const rel = toPosix(path7.relative(typeRoot, filePath));
+        const fileName = path7.basename(rel);
         if (fileName === ".env") {
-          const dir = path5.dirname(rel);
+          const dir = path7.dirname(rel);
           return dir === "." || dir === "" ? "default" : `${dir}/default`;
         }
         const stripped = rel.endsWith(".env") ? rel.slice(0, -4) : rel;
@@ -8007,27 +8183,27 @@ var init_asset_placement = __esm(() => {
       },
       toAssetPath: (typeRoot, name) => {
         if (name === "default")
-          return path5.join(typeRoot, ".env");
-        return path5.join(typeRoot, name.endsWith(".env") ? name : `${name}.env`);
+          return path7.join(typeRoot, ".env");
+        return path7.join(typeRoot, name.endsWith(".env") ? name : `${name}.env`);
       }
     },
     secret: {
       stashDir: "secrets",
       isRelevantFile: (fileName) => !fileName.endsWith(".lock") && !fileName.endsWith(".sensitive"),
-      toCanonicalName: (typeRoot, filePath) => toPosix(path5.relative(typeRoot, filePath)),
-      toAssetPath: (typeRoot, name) => path5.join(typeRoot, name)
+      toCanonicalName: (typeRoot, filePath) => toPosix(path7.relative(typeRoot, filePath)),
+      toAssetPath: (typeRoot, name) => path7.join(typeRoot, name)
     },
     lesson: { stashDir: "lessons", ...markdownSpec },
     task: {
       stashDir: "tasks",
-      isRelevantFile: (fileName) => path5.extname(fileName).toLowerCase() === ".yml",
+      isRelevantFile: (fileName) => path7.extname(fileName).toLowerCase() === ".yml",
       toCanonicalName: (typeRoot, filePath) => {
-        const rel = toPosix(path5.relative(typeRoot, filePath));
+        const rel = toPosix(path7.relative(typeRoot, filePath));
         return rel.toLowerCase().endsWith(".yml") ? rel.slice(0, -4) : rel;
       },
       toAssetPath: (typeRoot, name) => {
         const withExt = name.toLowerCase().endsWith(".yml") ? name : `${name}.yml`;
-        return path5.join(typeRoot, withExt);
+        return path7.join(typeRoot, withExt);
       }
     },
     session: { stashDir: "sessions", ...markdownSpec },
@@ -8036,93 +8212,6 @@ var init_asset_placement = __esm(() => {
   PLACEMENT_SPECS = { ...BUILTIN_PLACEMENT_SPECS };
 });
 
-// src/core/asset/asset-ref.ts
-import path6 from "node:path";
-function validateName(name) {
-  if (!name)
-    throw new UsageError("Empty asset name.", "MISSING_REQUIRED_ARGUMENT");
-  if (name.includes("\x00"))
-    throw new UsageError("Null byte in asset name.", "MISSING_REQUIRED_ARGUMENT");
-  if (/^[A-Za-z]:/.test(name))
-    throw new UsageError("Windows drive path in asset name.", "MISSING_REQUIRED_ARGUMENT");
-  const slashName = name.replace(/\\/g, "/");
-  if (slashName === ".." || slashName.startsWith("../")) {
-    throw new UsageError("Path traversal in asset name.", "MISSING_REQUIRED_ARGUMENT");
-  }
-  if (slashName.split("/").some((seg) => seg === "." || seg === "..")) {
-    throw new UsageError("Asset name cannot contain relative path segments.", "MISSING_REQUIRED_ARGUMENT");
-  }
-  const normalized = path6.posix.normalize(slashName);
-  if (path6.posix.isAbsolute(normalized))
-    throw new UsageError("Absolute path in asset name.", "MISSING_REQUIRED_ARGUMENT");
-  if (normalized === ".." || normalized.startsWith("../")) {
-    throw new UsageError("Path traversal in asset name.", "MISSING_REQUIRED_ARGUMENT");
-  }
-}
-function normalizeName(name) {
-  return path6.posix.normalize(name.replace(/\\/g, "/"));
-}
-function isBundleSlug(s) {
-  return BUNDLE_SLUG_RE.test(s);
-}
-function normalizeConceptId(raw) {
-  const nfc = raw.normalize("NFC");
-  if (nfc.includes("#")) {
-    throw new UsageError("`#` is reserved for the export fragment in a concept id.", "MISSING_REQUIRED_ARGUMENT");
-  }
-  validateName(nfc);
-  return normalizeName(nfc);
-}
-function makeBundleRef(bundle, conceptId, fragment) {
-  const normalized = normalizeConceptId(conceptId);
-  let out = normalized;
-  if (bundle) {
-    if (!BUNDLE_SLUG_RE.test(bundle)) {
-      throw new UsageError(`Invalid bundle slug "${bundle}". A bundle slug may not contain ':', '.', '#', '/', or whitespace.`, "MISSING_REQUIRED_ARGUMENT");
-    }
-    out = `${bundle}//${normalized}`;
-  }
-  if (fragment)
-    out = `${out}#${fragment}`;
-  return out;
-}
-function bundleRefToString(ref) {
-  return makeBundleRef(ref.bundle, ref.conceptId, ref.fragment);
-}
-function parseBundleRef(ref) {
-  const trimmed = ref.trim();
-  if (!trimmed)
-    throw new UsageError("Empty ref.", "MISSING_REQUIRED_ARGUMENT");
-  let bundle;
-  let body = trimmed;
-  const boundary = trimmed.indexOf("//");
-  if (boundary >= 0) {
-    bundle = trimmed.slice(0, boundary);
-    body = trimmed.slice(boundary + 2);
-    if (!bundle)
-      throw new UsageError("Empty bundle in ref.", "MISSING_REQUIRED_ARGUMENT");
-    if (!BUNDLE_SLUG_RE.test(bundle)) {
-      throw new UsageError(`Invalid bundle slug "${bundle}" in ref "${trimmed}". A bundle slug may not contain ':', '.', '#', '/', or whitespace.`, "MISSING_REQUIRED_ARGUMENT");
-    }
-  }
-  let fragment;
-  const hash = body.indexOf("#");
-  if (hash >= 0) {
-    fragment = body.slice(hash + 1) || undefined;
-    body = body.slice(0, hash);
-  }
-  if (!body) {
-    throw new UsageError(`Invalid ref "${trimmed}". Expected [bundle//]conceptId, e.g. knowledge/guide or core//skills/review`, "MISSING_REQUIRED_ARGUMENT");
-  }
-  const conceptId = normalizeConceptId(body);
-  return { bundle: bundle || undefined, conceptId, fragment };
-}
-var BUNDLE_SLUG_RE;
-var init_asset_ref = __esm(() => {
-  init_errors();
-  BUNDLE_SLUG_RE = /^[^\s:.#/]+$/;
-});
-
 // src/core/asset/resolve-ref.ts
 function conceptIdFromTypeName(type, name) {
   const stashDir = stashDirFor(type);
@@ -8186,13 +8275,13 @@ function validateExtraParams(value) {
   }
   const issues = [];
   const seen = new WeakSet;
-  const visit2 = (entry, path7) => {
+  const visit2 = (entry, path8) => {
     if (Array.isArray(entry)) {
       if (seen.has(entry))
         return;
       seen.add(entry);
       entry.forEach((child, index) => {
-        visit2(child, [...path7, index]);
+        visit2(child, [...path8, index]);
       });
       return;
     }
@@ -8203,7 +8292,7 @@ function validateExtraParams(value) {
     seen.add(entry);
     for (const [key, child] of Object.entries(entry)) {
       const normalized = normalizeExtraParamKey(key);
-      if (path7.length === 0 && PROTECTED_TOP_LEVEL_KEYS.has(normalized)) {
+      if (path8.length === 0 && PROTECTED_TOP_LEVEL_KEYS.has(normalized)) {
         const remedy = protectedKeyRemedy(normalized);
         issues.push({
           path: [key],
@@ -8211,9 +8300,9 @@ function validateExtraParams(value) {
         });
       }
       if (CREDENTIAL_KEYS.has(normalized)) {
-        issues.push({ path: [...path7, key], message: `${key} cannot carry credentials` });
+        issues.push({ path: [...path8, key], message: `${key} cannot carry credentials` });
       }
-      visit2(child, [...path7, key]);
+      visit2(child, [...path8, key]);
     }
   };
   visit2(value, []);
@@ -8406,13 +8495,13 @@ var init_warn = __esm(() => {
 });
 
 // src/core/write-provenance.ts
-import path15 from "node:path";
+import path16 from "node:path";
 function recordWrittenPath(filePath) {
   if (activeJournals.size === 0 || !filePath)
     return;
   let absolute;
   try {
-    absolute = path15.resolve(filePath);
+    absolute = path16.resolve(filePath);
   } catch {
     return;
   }
@@ -8520,7 +8609,7 @@ var init_frontmatter = __esm(() => {
 
 // src/indexer/passes/metadata.ts
 import fs13 from "node:fs";
-import path17 from "node:path";
+import path18 from "node:path";
 function normalizeQuality(raw) {
   if (KNOWN_QUALITY_VALUES.has(raw))
     return raw;
@@ -9280,7 +9369,7 @@ function projectMarkdownContent(body, truncationInfo) {
   return truncateUnicodeSafe(text, MARKDOWN_CONTENT_MAX_CHARS);
 }
 function applyPreContributorFields(entry, file, ctx, pkgMeta) {
-  const ext = path17.extname(file).toLowerCase();
+  const ext = path18.extname(file).toLowerCase();
   if (pkgMeta) {
     if (pkgMeta.description && !entry.description) {
       entry.description = pkgMeta.description;
@@ -9326,8 +9415,8 @@ function applyPreContributorFields(entry, file, ctx, pkgMeta) {
   }
 }
 function applyPostContributorFields(entry, file, canonicalName, dirPath) {
-  const ext = path17.extname(file).toLowerCase();
-  const baseName = path17.basename(file, ext);
+  const ext = path18.extname(file).toLowerCase();
+  const baseName = path18.basename(file, ext);
   if (!entry.description) {
     entry.description = fileNameToDescription(baseName);
     entry.source = "filename";
@@ -9339,7 +9428,7 @@ function applyPostContributorFields(entry, file, canonicalName, dirPath) {
   entry.tags = [...entry.tags ?? [], ...extractDirTagsFromName(canonicalName)];
   entry.tags = normalizeTerms(entry.tags ?? []);
   entry.aliases = mergeAliases(entry.aliases, buildAliases(canonicalName, entry.tags));
-  entry.filename = path17.basename(file);
+  entry.filename = path18.basename(file);
 }
 function buildMetadataSkipWarning(filePath, assetType, error) {
   const detail = error instanceof Error ? error.message : String(error);
@@ -9371,7 +9460,7 @@ function buildAliases(name, tags) {
   return Array.from(aliases);
 }
 function extractPackageMetadata(dirPath) {
-  const pkgPath = path17.join(dirPath, "package.json");
+  const pkgPath = path18.join(dirPath, "package.json");
   if (!fs13.existsSync(pkgPath))
     return null;
   try {
@@ -9393,11 +9482,11 @@ function fileNameToDescription(fileName) {
   return fileName.replace(/[-_]+/g, " ").replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().trim();
 }
 function extractTagsFromPath(filePath, rootDir) {
-  const rel = path17.relative(rootDir, filePath);
-  const parts = rel.split(path17.sep);
+  const rel = path18.relative(rootDir, filePath);
+  const parts = rel.split(path18.sep);
   const tags = new Set;
   for (const part of parts) {
-    const name = part.replace(path17.extname(part), "");
+    const name = part.replace(path18.extname(part), "");
     for (const token of name.split(/[-_./\\]+/)) {
       const clean = token.toLowerCase().trim();
       if (clean && clean.length > 1)
@@ -9429,27 +9518,27 @@ var init_metadata = __esm(() => {
 });
 
 // src/execution/record.ts
-function snapshotStrictRecord(value, path18, options = {}) {
+function snapshotStrictRecord(value, path19, options = {}) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new TypeError(`${path18} must be an object`);
+    throw new TypeError(`${path19} must be an object`);
   }
   const prototype = Object.getPrototypeOf(value);
   if (prototype !== Object.prototype && prototype !== null) {
-    throw new TypeError(`${path18} must use a plain or null prototype`);
+    throw new TypeError(`${path19} must use a plain or null prototype`);
   }
   const out = Object.create(null);
   for (const key of Reflect.ownKeys(value)) {
     const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
     if (!descriptor)
-      throw new TypeError(`${path18}.${String(key)} must have a stable own descriptor`);
+      throw new TypeError(`${path19}.${String(key)} must have a stable own descriptor`);
     if (typeof key === "symbol" && !options.allowedSymbols?.has(key)) {
-      throw new TypeError(`${path18} contains unsupported symbol field: ${String(key)}`);
+      throw new TypeError(`${path19} contains unsupported symbol field: ${String(key)}`);
     }
     if (!("value" in descriptor)) {
-      throw new TypeError(`${path18}.${String(key)} must be an enumerable data property, not an accessor`);
+      throw new TypeError(`${path19}.${String(key)} must be an enumerable data property, not an accessor`);
     }
     if (typeof key === "string" && !descriptor.enumerable) {
-      throw new TypeError(`${path18}.${key} must be an enumerable data property, not a non-enumerable field`);
+      throw new TypeError(`${path19}.${key} must be an enumerable data property, not a non-enumerable field`);
     }
     Object.defineProperty(out, key, {
       value: descriptor.value,
@@ -9460,14 +9549,14 @@ function snapshotStrictRecord(value, path18, options = {}) {
   }
   return Object.freeze(out);
 }
-function assertSnapshotKeys(value, allowed, path18, allowedSymbols = new Set) {
+function assertSnapshotKeys(value, allowed, path19, allowedSymbols = new Set) {
   const allowedKeys = new Set(allowed);
   for (const key of Reflect.ownKeys(value)) {
     if (typeof key === "symbol") {
       if (!allowedSymbols.has(key))
-        throw new TypeError(`${path18} contains unsupported field: ${String(key)}`);
+        throw new TypeError(`${path19} contains unsupported field: ${String(key)}`);
     } else if (!allowedKeys.has(key)) {
-      throw new TypeError(`${path18} contains unsupported field: ${key}`);
+      throw new TypeError(`${path19} contains unsupported field: ${key}`);
     }
   }
 }
@@ -9475,9 +9564,9 @@ function assertSnapshotKeys(value, allowed, path18, allowedSymbols = new Set) {
 // node_modules/dotenv/lib/main.js
 var require_main = __commonJS((exports, module) => {
   var fs14 = __require("fs");
-  var path18 = __require("path");
+  var path19 = __require("path");
   var os2 = __require("os");
-  var crypto3 = __require("crypto");
+  var crypto4 = __require("crypto");
   var TIPS = [
     "◈ encrypted .env [www.dotenvx.com]",
     "◈ secrets for agents [www.dotenvx.com]",
@@ -9616,7 +9705,7 @@ var require_main = __commonJS((exports, module) => {
         possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
       }
     } else {
-      possibleVaultPath = path18.resolve(process.cwd(), ".env.vault");
+      possibleVaultPath = path19.resolve(process.cwd(), ".env.vault");
     }
     if (fs14.existsSync(possibleVaultPath)) {
       return possibleVaultPath;
@@ -9624,7 +9713,7 @@ var require_main = __commonJS((exports, module) => {
     return null;
   }
   function _resolveHome(envPath) {
-    return envPath[0] === "~" ? path18.join(os2.homedir(), envPath.slice(1)) : envPath;
+    return envPath[0] === "~" ? path19.join(os2.homedir(), envPath.slice(1)) : envPath;
   }
   function _configVault(options) {
     const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || options && options.debug);
@@ -9641,7 +9730,7 @@ var require_main = __commonJS((exports, module) => {
     return { parsed };
   }
   function configDotenv(options) {
-    const dotenvPath = path18.resolve(process.cwd(), ".env");
+    const dotenvPath = path19.resolve(process.cwd(), ".env");
     let encoding = "utf8";
     let processEnv = process.env;
     if (options && options.processEnv != null) {
@@ -9669,13 +9758,13 @@ var require_main = __commonJS((exports, module) => {
     }
     let lastError;
     const parsedAll = {};
-    for (const path19 of optionPaths) {
+    for (const path20 of optionPaths) {
       try {
-        const parsed = DotenvModule.parse(fs14.readFileSync(path19, { encoding }));
+        const parsed = DotenvModule.parse(fs14.readFileSync(path20, { encoding }));
         DotenvModule.populate(parsedAll, parsed, options);
       } catch (e) {
         if (debug) {
-          _debug(`failed to load ${path19} ${e.message}`);
+          _debug(`failed to load ${path20} ${e.message}`);
         }
         lastError = e;
       }
@@ -9688,7 +9777,7 @@ var require_main = __commonJS((exports, module) => {
       const shortPaths = [];
       for (const filePath of optionPaths) {
         try {
-          const relative = path18.relative(process.cwd(), filePath);
+          const relative = path19.relative(process.cwd(), filePath);
           shortPaths.push(relative);
         } catch (e) {
           if (debug) {
@@ -9723,7 +9812,7 @@ var require_main = __commonJS((exports, module) => {
     const authTag = ciphertext.subarray(-16);
     ciphertext = ciphertext.subarray(12, -16);
     try {
-      const aesgcm = crypto3.createDecipheriv("aes-256-gcm", key, nonce);
+      const aesgcm = crypto4.createDecipheriv("aes-256-gcm", key, nonce);
       aesgcm.setAuthTag(authTag);
       return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
     } catch (error) {
@@ -9827,7 +9916,7 @@ var init_time = __esm(() => {
 
 // src/tasks/source/bounded-document.ts
 import fs14 from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 import { types as utilTypes } from "node:util";
 function own2(value, key) {
   return Object.hasOwn(value, key);
@@ -9998,7 +10087,7 @@ function parseTools(value, ctx) {
   sourceError(ctx, ["akm", "tools"], "must be a string, string array, mapping, or null.");
 }
 function validateWorkingDirectory(value, ctx) {
-  if (value.trim().length === 0 || value.includes("\x00") || path18.posix.isAbsolute(value.replaceAll("\\", "/")) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\")) {
+  if (value.trim().length === 0 || value.includes("\x00") || path19.posix.isAbsolute(value.replaceAll("\\", "/")) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\")) {
     sourceError(ctx, ["working-directory"], "must be a non-empty relative path contained by the workspace root.");
   }
   const segments = value.replaceAll("\\", "/").split("/");
@@ -10012,7 +10101,7 @@ function validateWorkingDirectory(value, ctx) {
   let realCandidate;
   try {
     realRoot = fs14.realpathSync(ctx.workspaceRoot);
-    const candidate = path18.resolve(realRoot, value);
+    const candidate = path19.resolve(realRoot, value);
     const stat = fs14.statSync(candidate);
     if (!stat.isDirectory())
       sourceError(ctx, ["working-directory"], "must resolve to a directory.");
@@ -10022,8 +10111,8 @@ function validateWorkingDirectory(value, ctx) {
       throw cause;
     sourceError(ctx, ["working-directory"], `cannot be physically verified: ${cause instanceof Error ? cause.message : String(cause)}.`);
   }
-  const relative = path18.relative(realRoot, realCandidate);
-  if (relative.startsWith("..") || path18.isAbsolute(relative)) {
+  const relative = path19.relative(realRoot, realCandidate);
+  if (relative.startsWith("..") || path19.isAbsolute(relative)) {
     sourceError(ctx, ["working-directory"], "resolves outside the workspace root and is not physically contained.");
   }
 }
@@ -10192,34 +10281,34 @@ function checkJsonSchemaDefinition(schema) {
   checkDefinitionNode(schema, [], issues, 0);
   return issues;
 }
-function pointerFor(path19) {
-  return path19.length === 0 ? "$" : `$.${path19.map(String).join(".")}`;
+function pointerFor(path20) {
+  return path20.length === 0 ? "$" : `$.${path20.map(String).join(".")}`;
 }
-function pushIssue(issues, path19, keyword, kind, message) {
-  issues.push({ path: [...path19], pointer: pointerFor(path19), keyword, kind, message });
+function pushIssue(issues, path20, keyword, kind, message) {
+  issues.push({ path: [...path20], pointer: pointerFor(path20), keyword, kind, message });
 }
 function isSupportedEnumValue(value) {
   return value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
 }
-function checkDefinitionNode(schema, path19, issues, depth) {
+function checkDefinitionNode(schema, path20, issues, depth) {
   if (depth > MAX_DEFINITION_DEPTH) {
-    pushIssue(issues, path19, "(depth)", "malformed", `schema nesting exceeds the depth limit of ${MAX_DEFINITION_DEPTH}`);
+    pushIssue(issues, path20, "(depth)", "malformed", `schema nesting exceeds the depth limit of ${MAX_DEFINITION_DEPTH}`);
     return;
   }
   for (const keyword of Object.keys(schema)) {
     if (UNSUPPORTED_KEYWORDS.has(keyword)) {
       const hint = UNSUPPORTED_KEYWORD_HINTS.get(keyword);
-      pushIssue(issues, [...path19, keyword], keyword, "unsupported", `keyword "${keyword}" is not enforced by the workflow schema subset — the schema would silently not ` + `constrain what it looks like it constrains${hint ? `; ${hint}` : ""}`);
+      pushIssue(issues, [...path20, keyword], keyword, "unsupported", `keyword "${keyword}" is not enforced by the workflow schema subset — the schema would silently not ` + `constrain what it looks like it constrains${hint ? `; ${hint}` : ""}`);
     }
   }
   const declared = schema.type;
   if (declared !== undefined) {
     const names = Array.isArray(declared) ? declared : [declared];
     if (names.length === 0) {
-      pushIssue(issues, [...path19, "type"], "type", "malformed", `"type" must name at least one type`);
+      pushIssue(issues, [...path20, "type"], "type", "malformed", `"type" must name at least one type`);
     }
     for (const [index, name] of names.entries()) {
-      const namePath = Array.isArray(declared) ? [...path19, "type", index] : [...path19, "type"];
+      const namePath = Array.isArray(declared) ? [...path20, "type", index] : [...path20, "type"];
       if (typeof name !== "string") {
         pushIssue(issues, namePath, "type", "malformed", `"type" must be a string or an array of strings`);
       } else if (!KNOWN_TYPE_NAMES.has(name)) {
@@ -10229,12 +10318,12 @@ function checkDefinitionNode(schema, path19, issues, depth) {
   }
   if (schema.enum !== undefined) {
     if (!Array.isArray(schema.enum) || schema.enum.length === 0) {
-      pushIssue(issues, [...path19, "enum"], "enum", "malformed", `"enum" must be a non-empty array of allowed values`);
+      pushIssue(issues, [...path20, "enum"], "enum", "malformed", `"enum" must be a non-empty array of allowed values`);
     } else {
       schema.enum.forEach((value, index) => {
         if (isSupportedEnumValue(value))
           return;
-        pushIssue(issues, [...path19, "enum", index], "enum", "unsupported", `"enum" values must be JSON primitives (string, finite number, boolean, or null) in the workflow ` + `schema subset — object and array enum members cannot be matched by the runtime subset`);
+        pushIssue(issues, [...path20, "enum", index], "enum", "unsupported", `"enum" values must be JSON primitives (string, finite number, boolean, or null) in the workflow ` + `schema subset — object and array enum members cannot be matched by the runtime subset`);
       });
     }
   }
@@ -10243,68 +10332,68 @@ function checkDefinitionNode(schema, path19, issues, depth) {
     if (branches === undefined)
       continue;
     if (!Array.isArray(branches) || branches.length === 0) {
-      pushIssue(issues, [...path19, keyword], keyword, "malformed", `"${keyword}" must be a non-empty array of schema objects`);
+      pushIssue(issues, [...path20, keyword], keyword, "malformed", `"${keyword}" must be a non-empty array of schema objects`);
       continue;
     }
     branches.forEach((branch, index) => {
       if (isRecord(branch)) {
-        checkDefinitionNode(branch, [...path19, keyword, index], issues, depth + 1);
+        checkDefinitionNode(branch, [...path20, keyword, index], issues, depth + 1);
       } else {
-        pushIssue(issues, [...path19, keyword, index], keyword, "malformed", `"${keyword}[${index}]" must be a schema object`);
+        pushIssue(issues, [...path20, keyword, index], keyword, "malformed", `"${keyword}[${index}]" must be a schema object`);
       }
     });
   }
   if (schema.not !== undefined) {
     if (isRecord(schema.not)) {
-      checkDefinitionNode(schema.not, [...path19, "not"], issues, depth + 1);
+      checkDefinitionNode(schema.not, [...path20, "not"], issues, depth + 1);
     } else {
-      pushIssue(issues, [...path19, "not"], "not", "malformed", `"not" must be a schema object`);
+      pushIssue(issues, [...path20, "not"], "not", "malformed", `"not" must be a schema object`);
     }
   }
   if (schema.required !== undefined) {
     if (!Array.isArray(schema.required) || !schema.required.every((key) => typeof key === "string")) {
-      pushIssue(issues, [...path19, "required"], "required", "malformed", `"required" must be an array of property-name strings`);
+      pushIssue(issues, [...path20, "required"], "required", "malformed", `"required" must be an array of property-name strings`);
     }
   }
   if (schema.properties !== undefined) {
     if (!isRecord(schema.properties)) {
-      pushIssue(issues, [...path19, "properties"], "properties", "malformed", `"properties" must be an object mapping property names to schemas`);
+      pushIssue(issues, [...path20, "properties"], "properties", "malformed", `"properties" must be an object mapping property names to schemas`);
     } else {
       for (const [key, propSchema] of Object.entries(schema.properties)) {
         if (isRecord(propSchema)) {
-          checkDefinitionNode(propSchema, [...path19, "properties", key], issues, depth + 1);
+          checkDefinitionNode(propSchema, [...path20, "properties", key], issues, depth + 1);
         } else {
-          pushIssue(issues, [...path19, "properties", key], "properties", "malformed", `property ${JSON.stringify(key)} must be a schema object`);
+          pushIssue(issues, [...path20, "properties", key], "properties", "malformed", `property ${JSON.stringify(key)} must be a schema object`);
         }
       }
     }
   }
   if (schema.items !== undefined) {
     if (isRecord(schema.items)) {
-      checkDefinitionNode(schema.items, [...path19, "items"], issues, depth + 1);
+      checkDefinitionNode(schema.items, [...path20, "items"], issues, depth + 1);
     } else if (Array.isArray(schema.items)) {
-      pushIssue(issues, [...path19, "items"], "items", "unsupported", `tuple-form "items" (an array of schemas) is not enforced by the workflow schema subset — use a single schema object`);
+      pushIssue(issues, [...path20, "items"], "items", "unsupported", `tuple-form "items" (an array of schemas) is not enforced by the workflow schema subset — use a single schema object`);
     } else {
-      pushIssue(issues, [...path19, "items"], "items", "malformed", `"items" must be a schema object`);
+      pushIssue(issues, [...path20, "items"], "items", "malformed", `"items" must be a schema object`);
     }
   }
   if (schema.additionalProperties !== undefined && typeof schema.additionalProperties !== "boolean") {
     if (isRecord(schema.additionalProperties)) {
-      pushIssue(issues, [...path19, "additionalProperties"], "additionalProperties", "unsupported", `schema-form "additionalProperties" is not enforced by the workflow schema subset — only "additionalProperties: false" is`);
+      pushIssue(issues, [...path20, "additionalProperties"], "additionalProperties", "unsupported", `schema-form "additionalProperties" is not enforced by the workflow schema subset — only "additionalProperties: false" is`);
     } else {
-      pushIssue(issues, [...path19, "additionalProperties"], "additionalProperties", "malformed", `"additionalProperties" must be a boolean (only "false" is enforced)`);
+      pushIssue(issues, [...path20, "additionalProperties"], "additionalProperties", "malformed", `"additionalProperties" must be a boolean (only "false" is enforced)`);
     }
   }
   for (const keyword of ["minItems", "maxItems", "minLength", "maxLength"]) {
     const value = schema[keyword];
     if (value !== undefined && (typeof value !== "number" || !Number.isInteger(value) || value < 0)) {
-      pushIssue(issues, [...path19, keyword], keyword, "malformed", `"${keyword}" must be a non-negative integer`);
+      pushIssue(issues, [...path20, keyword], keyword, "malformed", `"${keyword}" must be a non-negative integer`);
     }
   }
   for (const keyword of ["minimum", "maximum"]) {
     const value = schema[keyword];
     if (value !== undefined && (typeof value !== "number" || !Number.isFinite(value))) {
-      pushIssue(issues, [...path19, keyword], keyword, "malformed", `"${keyword}" must be a finite number`);
+      pushIssue(issues, [...path20, keyword], keyword, "malformed", `"${keyword}" must be a finite number`);
     }
   }
 }
@@ -10329,9 +10418,9 @@ function matchesType(actual, expected) {
     return true;
   return expected === "number" && actual === "integer";
 }
-function branchErrors(value, schema, path19, ctx) {
+function branchErrors(value, schema, path20, ctx) {
   const errors3 = [];
-  validateNode(value, schema, path19, { ...ctx, errors: errors3, depth: ctx.depth + 1 });
+  validateNode(value, schema, path20, { ...ctx, errors: errors3, depth: ctx.depth + 1 });
   return errors3;
 }
 function combinatorBranches(schema, keyword) {
@@ -10346,9 +10435,9 @@ function summarizeBranchFailures(failures) {
     shown.push(`…${failures.length - shown.length} more`);
   return shown.join("; ");
 }
-function validateCombinators(value, schema, path19, ctx) {
+function validateCombinators(value, schema, path20, ctx) {
   for (const branch of combinatorBranches(schema, "allOf")) {
-    ctx.errors.push(...branchErrors(value, branch, path19, ctx));
+    ctx.errors.push(...branchErrors(value, branch, path20, ctx));
   }
   for (const keyword of ["anyOf", "oneOf"]) {
     const branches = combinatorBranches(schema, keyword);
@@ -10357,27 +10446,27 @@ function validateCombinators(value, schema, path19, ctx) {
     const failures = [];
     const matched = [];
     branches.forEach((branch, index) => {
-      const errors3 = branchErrors(value, branch, path19, ctx);
+      const errors3 = branchErrors(value, branch, path20, ctx);
       if (errors3.length === 0)
         matched.push(index + 1);
       else
         failures.push({ index, errors: errors3 });
     });
     if (matched.length === 0) {
-      ctx.errors.push(`${path19}: value matches none of the ${branches.length} "${keyword}" schemas (${summarizeBranchFailures(failures)})`);
+      ctx.errors.push(`${path20}: value matches none of the ${branches.length} "${keyword}" schemas (${summarizeBranchFailures(failures)})`);
     } else if (keyword === "oneOf" && matched.length > 1) {
-      ctx.errors.push(`${path19}: value matches ${matched.length} "oneOf" schemas (branches ${matched.join(", ")}); exactly one must match`);
+      ctx.errors.push(`${path20}: value matches ${matched.length} "oneOf" schemas (branches ${matched.join(", ")}); exactly one must match`);
     }
   }
   const not = schema.not;
-  if (isRecord(not) && branchErrors(value, not, path19, ctx).length === 0) {
-    ctx.errors.push(`${path19}: value must not match the "not" schema`);
+  if (isRecord(not) && branchErrors(value, not, path20, ctx).length === 0) {
+    ctx.errors.push(`${path20}: value must not match the "not" schema`);
   }
 }
-function validateNode(value, schema, path19, ctx) {
+function validateNode(value, schema, path20, ctx) {
   const errors3 = ctx.errors;
   if (ctx.depth > MAX_DEFINITION_DEPTH) {
-    errors3.push(`${path19}: schema nesting exceeds the depth limit of ${MAX_DEFINITION_DEPTH}`);
+    errors3.push(`${path20}: schema nesting exceeds the depth limit of ${MAX_DEFINITION_DEPTH}`);
     return;
   }
   if (--ctx.budget.nodes < 0)
@@ -10387,47 +10476,47 @@ function validateNode(value, schema, path19, ctx) {
   if (typeof declared === "string" || Array.isArray(declared)) {
     const expected = (Array.isArray(declared) ? declared : [declared]).filter((t) => typeof t === "string");
     if (expected.length > 0 && !expected.some((t) => matchesType(actual, t))) {
-      errors3.push(`${path19}: expected type ${expected.join(" | ")}, got ${actual}`);
+      errors3.push(`${path20}: expected type ${expected.join(" | ")}, got ${actual}`);
       return;
     }
   }
   if (Array.isArray(schema.enum) && schema.enum.length > 0) {
     const allowed = schema.enum;
     if (!allowed.some((candidate) => candidate === value)) {
-      errors3.push(ctx.redactValues ? `${path19}: value is not one of ${JSON.stringify(allowed)}` : `${path19}: value ${JSON.stringify(value)} is not one of ${JSON.stringify(allowed)}`);
+      errors3.push(ctx.redactValues ? `${path20}: value is not one of ${JSON.stringify(allowed)}` : `${path20}: value ${JSON.stringify(value)} is not one of ${JSON.stringify(allowed)}`);
       return;
     }
   }
-  validateCombinators(value, schema, path19, ctx);
+  validateCombinators(value, schema, path20, ctx);
   if (actual === "string" && typeof value === "string") {
     if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-      errors3.push(`${path19}: string shorter than minLength ${schema.minLength}`);
+      errors3.push(`${path20}: string shorter than minLength ${schema.minLength}`);
     }
     if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-      errors3.push(`${path19}: string longer than maxLength ${schema.maxLength}`);
+      errors3.push(`${path20}: string longer than maxLength ${schema.maxLength}`);
     }
     return;
   }
   if ((actual === "number" || actual === "integer") && typeof value === "number") {
     if (typeof schema.minimum === "number" && value < schema.minimum) {
-      errors3.push(ctx.redactValues ? `${path19}: value is below minimum ${schema.minimum}` : `${path19}: ${value} is below minimum ${schema.minimum}`);
+      errors3.push(ctx.redactValues ? `${path20}: value is below minimum ${schema.minimum}` : `${path20}: ${value} is below minimum ${schema.minimum}`);
     }
     if (typeof schema.maximum === "number" && value > schema.maximum) {
-      errors3.push(ctx.redactValues ? `${path19}: value is above maximum ${schema.maximum}` : `${path19}: ${value} is above maximum ${schema.maximum}`);
+      errors3.push(ctx.redactValues ? `${path20}: value is above maximum ${schema.maximum}` : `${path20}: ${value} is above maximum ${schema.maximum}`);
     }
     return;
   }
   if (actual === "array" && Array.isArray(value)) {
     if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-      errors3.push(`${path19}: array has fewer than minItems ${schema.minItems}`);
+      errors3.push(`${path20}: array has fewer than minItems ${schema.minItems}`);
     }
     if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
-      errors3.push(`${path19}: array has more than maxItems ${schema.maxItems}`);
+      errors3.push(`${path20}: array has more than maxItems ${schema.maxItems}`);
     }
     const items = schema.items;
     if (items && typeof items === "object" && !Array.isArray(items)) {
       value.forEach((element, index) => {
-        validateNode(element, items, `${path19}[${index}]`, {
+        validateNode(element, items, `${path20}[${index}]`, {
           ...ctx,
           depth: ctx.depth + 1
         });
@@ -10441,7 +10530,7 @@ function validateNode(value, schema, path19, ctx) {
     if (Array.isArray(schema.required)) {
       for (const key of schema.required) {
         if (typeof key === "string" && !Object.hasOwn(record, key)) {
-          errors3.push(`${path19}: missing required property "${key}"`);
+          errors3.push(`${path20}: missing required property "${key}"`);
         }
       }
     }
@@ -10450,7 +10539,7 @@ function validateNode(value, schema, path19, ctx) {
         if (!Object.hasOwn(record, key))
           continue;
         if (propSchema && typeof propSchema === "object" && !Array.isArray(propSchema)) {
-          validateNode(record[key], propSchema, `${path19}.${key}`, {
+          validateNode(record[key], propSchema, `${path20}.${key}`, {
             ...ctx,
             depth: ctx.depth + 1
           });
@@ -10460,7 +10549,7 @@ function validateNode(value, schema, path19, ctx) {
     if (schema.additionalProperties === false) {
       for (const key of Object.keys(record)) {
         if (!properties || !Object.hasOwn(properties, key)) {
-          errors3.push(`${path19}: unexpected property "${key}" (additionalProperties: false)`);
+          errors3.push(`${path20}: unexpected property "${key}" (additionalProperties: false)`);
         }
       }
     }
@@ -10641,10 +10730,10 @@ function parseReference(source) {
       if (!output || output.name !== "output") {
         return { ok: false, message: `Expected ".output" after "steps.${stepId.name}" in "${text}".` };
       }
-      const path21 = parsePath(text, output.end);
-      if (!path21.ok)
-        return { ok: false, message: path21.message };
-      return { ok: true, expr: { kind: "stepOutput", stepId: stepId.name, path: path21.path } };
+      const path22 = parsePath(text, output.end);
+      if (!path22.ok)
+        return { ok: false, message: path22.message };
+      return { ok: true, expr: { kind: "stepOutput", stepId: stepId.name, path: path22.path } };
     }
     default:
       return { ok: false, message: `Unknown root "${root.name}" in "${text}"; ${GRAMMAR_HINT}.` };
@@ -10659,7 +10748,7 @@ function readIdent(text, start) {
   return { name: text.slice(start, end), end };
 }
 function parsePath(text, start) {
-  const path21 = [];
+  const path22 = [];
   let i = start;
   while (i < text.length) {
     const char = text[i];
@@ -10668,7 +10757,7 @@ function parsePath(text, start) {
       if (!ident) {
         return { ok: false, message: `Invalid path segment after "." at position ${i} in "${text}".` };
       }
-      path21.push(ident.name);
+      path22.push(ident.name);
       i = ident.end;
     } else if (char === "[") {
       let j = i + 1;
@@ -10680,13 +10769,13 @@ function parsePath(text, start) {
           message: `Invalid indexer at position ${i} in "${text}" — expected [<non-negative integer>].`
         };
       }
-      path21.push(Number.parseInt(text.slice(i + 1, j), 10));
+      path22.push(Number.parseInt(text.slice(i + 1, j), 10));
       i = j + 1;
     } else {
       return { ok: false, message: `Unexpected character "${char}" at position ${i} in "${text}".` };
     }
   }
-  return { ok: true, path: path21 };
+  return { ok: true, path: path22 };
 }
 function formatReference(expr) {
   switch (expr.kind) {
@@ -11059,7 +11148,7 @@ var init_uses = __esm(() => {
 
 // src/workflows/source-ir/semantics.ts
 import fs15 from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 function canonicalizeWorkflowCron(value) {
   const canonical = value.trim().split(/\s+/).join(" ");
   if (canonical.startsWith("@") || canonical.split(" ").length !== 5) {
@@ -11095,7 +11184,7 @@ function canonicalizeWorkflowWorkingDirectory(value, workspaceRoot) {
   }
   const portable = value.replaceAll("\\", "/");
   const segments = portable.split("/");
-  if (path21.posix.isAbsolute(portable) || path21.win32.isAbsolute(value) || portable.startsWith("~") || segments.some((segment) => segment === "" || segment === "..")) {
+  if (path22.posix.isAbsolute(portable) || path22.win32.isAbsolute(value) || portable.startsWith("~") || segments.some((segment) => segment === "" || segment === "..")) {
     throw new WorkflowSourceSemanticError("working-directory-escape", "working-directory must be relative and contained.");
   }
   const withoutDots = segments.filter((segment) => segment !== ".");
@@ -11175,13 +11264,13 @@ function verifyPhysicalContainment(workspaceRoot, relative) {
   } catch {
     throw new WorkflowSourceSemanticError("working-directory-unverifiable", "Workspace root cannot be physically verified.");
   }
-  const candidate = path21.resolve(root, ...relative.split("/"));
+  const candidate = path22.resolve(root, ...relative.split("/"));
   if (!contained(root, candidate)) {
     throw new WorkflowSourceSemanticError("working-directory-escape", "working-directory escapes the workspace.");
   }
   let current = root;
   for (const segment of relative === "." ? [] : relative.split("/")) {
-    current = path21.join(current, segment);
+    current = path22.join(current, segment);
     try {
       const entry = fs15.lstatSync(current);
       if (entry.isSymbolicLink()) {
@@ -11224,8 +11313,8 @@ function verifyPhysicalContainment(workspaceRoot, relative) {
   }
 }
 function contained(root, candidate) {
-  const relative = path21.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path21.sep}`) && relative !== ".." && !path21.isAbsolute(relative);
+  const relative = path22.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path22.sep}`) && relative !== ".." && !path22.isAbsolute(relative);
 }
 var TOKEN_SAFE_RUN, WorkflowSourceSemanticError;
 var init_semantics = __esm(() => {
@@ -12059,7 +12148,7 @@ function parseWorkflow(markdown, source) {
     };
   }
   const errors3 = [];
-  const path22 = source.path;
+  const path23 = source.path;
   const lines = markdown.split(/\r?\n/);
   const totalLines = lines.length;
   const fmBlock = parseFrontmatterBlock(markdown);
@@ -12111,7 +12200,7 @@ function parseWorkflow(markdown, source) {
     return 2;
   };
   const ctx = {
-    filePath: path22,
+    filePath: path23,
     errors: errors3,
     ...source.validateExecCwd ? { validateExecCwd: source.validateExecCwd } : {},
     lineAt,
@@ -12124,10 +12213,10 @@ function parseWorkflow(markdown, source) {
         if (range) {
           const start = Math.max(1, lineCounter2.linePos(range[0]).line + lineOffset);
           const end = Math.max(start, lineCounter2.linePos(Math.max(range[0], range[1] - 1)).line + lineOffset);
-          return { path: path22, start, end };
+          return { path: path23, start, end };
         }
       }
-      return { path: path22, start: frontmatterEndLine, end: frontmatterEndLine };
+      return { path: path23, start: frontmatterEndLine, end: frontmatterEndLine };
     },
     err: (p, message) => errors3.push({ line: lineAt(p), message }),
     errAtLine: (line, message) => errors3.push({ line, message })
@@ -12151,7 +12240,7 @@ function parseWorkflow(markdown, source) {
   const parsedSteps = parseSteps(ctx, root.steps);
   const toc = parseMarkdownToc(markdown);
   const declaredIds = new Set(parsedSteps.map((s) => s.id));
-  const { sections, preamble } = bindStepSections(toc.headings, lines, fmBlock.bodyStartLine, totalLines, path22, declaredIds, errors3);
+  const { sections, preamble } = bindStepSections(toc.headings, lines, fmBlock.bodyStartLine, totalLines, path23, declaredIds, errors3);
   const steps = parsedSteps.map((step, index) => {
     const section = sections.get(step.id);
     if (!section) {
@@ -12195,14 +12284,14 @@ function parseWorkflow(markdown, source) {
     ...budget ? { budget } : {},
     steps,
     ...preamble ? { preamble } : {},
-    source: { path: path22, lineCount: totalLines }
+    source: { path: path23, lineCount: totalLines }
   };
   runSemanticChecks(draft, root, frontmatterEndLine, errors3);
   if (errors3.length > 0)
     return { ok: false, errors: sortErrors(errors3) };
   return { ok: true, document: draft };
 }
-function bindStepSections(headings, lines, bodyStartLine, totalLines, path22, declaredIds, errors3) {
+function bindStepSections(headings, lines, bodyStartLine, totalLines, path23, declaredIds, errors3) {
   const sections = new Map;
   const h2s = headings.filter((h) => h.level === 2);
   const firstH2Line = h2s[0]?.line;
@@ -12226,24 +12315,24 @@ function bindStepSections(headings, lines, bodyStartLine, totalLines, path22, de
       continue;
     }
     const sectionEnd = findNextHeadingAtOrAboveLevel(headings, i, 2, totalLines);
-    const gate = findGateSubsection(headings, i, sectionEnd, path22, h.text, errors3);
+    const gate = findGateSubsection(headings, i, sectionEnd, path23, h.text, errors3);
     const instructionsEnd = gate ? gate.headingLine - 1 : sectionEnd;
     const instructionsText = sliceProseLines(lines, h.line + 1, instructionsEnd);
     const section = { headingLine: h.line };
     if (instructionsText) {
-      section.instructions = { text: instructionsText, source: { path: path22, start: h.line + 1, end: instructionsEnd } };
+      section.instructions = { text: instructionsText, source: { path: path23, start: h.line + 1, end: instructionsEnd } };
     }
     if (gate) {
       const gateText = sliceProseLines(lines, gate.bodyStart, gate.bodyEnd);
       if (gateText) {
-        section.gateRubric = { text: gateText, source: { path: path22, start: gate.bodyStart, end: gate.bodyEnd } };
+        section.gateRubric = { text: gateText, source: { path: path23, start: gate.bodyStart, end: gate.bodyEnd } };
       }
     }
     sections.set(h.text, section);
   }
   return { sections, preamble: preambleRaw || undefined };
 }
-function findGateSubsection(headings, stepHeadingIndex, sectionEnd, path22, stepId, errors3) {
+function findGateSubsection(headings, stepHeadingIndex, sectionEnd, path23, stepId, errors3) {
   let found;
   for (let j = stepHeadingIndex + 1;j < headings.length; j++) {
     const h = headings[j];
@@ -12325,19 +12414,19 @@ function checkEnvelopeFields(ctx, root, fmEndLine) {
     ctx.err(["stale_after"], `Workflow frontmatter "stale_after" must be a string.`);
   }
 }
-function checkActorStamp(ctx, value, path22, label) {
+function checkActorStamp(ctx, value, path23, label) {
   if (value === undefined)
     return;
   if (!isRecord(value)) {
-    ctx.err(path22, `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
+    ctx.err(path23, `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
     return;
   }
-  checkUnknownKeys(ctx, value, path22, ACTOR_STAMP_KEYS, `${label} actor stamp`);
+  checkUnknownKeys(ctx, value, path23, ACTOR_STAMP_KEYS, `${label} actor stamp`);
   if (typeof value.by !== "string" || value.by.length === 0) {
-    ctx.err([...path22, "by"], `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
+    ctx.err([...path23, "by"], `Workflow frontmatter ${label} must be a mapping with a non-empty "by".`);
   }
   if (value.at !== undefined && typeof value.at !== "string") {
-    ctx.err([...path22, "at"], `Workflow frontmatter ${label} actor stamp "at" must be a string.`);
+    ctx.err([...path23, "at"], `Workflow frontmatter ${label} actor stamp "at" must be a string.`);
   }
 }
 function readTags2(ctx, value, fmEndLine) {
@@ -12390,38 +12479,38 @@ function parseOutputs(ctx, raw) {
   }
   const outputs = {};
   for (const [outputName, value] of Object.entries(raw)) {
-    const path22 = ["outputs", outputName];
+    const path23 = ["outputs", outputName];
     if (!INPUT_NAME_PATTERN.test(outputName)) {
-      ctx.err(path22, `Output name "${outputName}" is invalid. Use letters, digits, and underscores, starting with a letter or ` + `underscore, so "steps.<child>.output.${outputName}" can address it.`);
+      ctx.err(path23, `Output name "${outputName}" is invalid. Use letters, digits, and underscores, starting with a letter or ` + `underscore, so "steps.<child>.output.${outputName}" can address it.`);
       continue;
     }
     if (!isRecord(value)) {
-      ctx.err(path22, `Output "${outputName}" must be a mapping with "from" (and optional "schema").`);
+      ctx.err(path23, `Output "${outputName}" must be a mapping with "from" (and optional "schema").`);
       continue;
     }
-    checkUnknownKeys(ctx, value, path22, OUTPUT_ENTRY_KEYS, `output "${outputName}"`);
+    checkUnknownKeys(ctx, value, path23, OUTPUT_ENTRY_KEYS, `output "${outputName}"`);
     if (typeof value.from !== "string" || value.from.trim() === "") {
-      ctx.err([...path22, "from"], `Output "${outputName}" must declare "from": a steps.<id>.output(.<seg>)* reference.`);
+      ctx.err([...path23, "from"], `Output "${outputName}" must declare "from": a steps.<id>.output(.<seg>)* reference.`);
       continue;
     }
     const parsedFrom = parseReference(value.from);
     if (!parsedFrom.ok) {
-      ctx.err([...path22, "from"], `Output "${outputName}" "from": ${parsedFrom.message}`);
+      ctx.err([...path23, "from"], `Output "${outputName}" "from": ${parsedFrom.message}`);
       continue;
     }
     if (parsedFrom.expr.kind !== "stepOutput") {
-      ctx.err([...path22, "from"], `Output "${outputName}" "from" must reference a step output (steps.<id>.output...), not a param — an ` + `output projects a step artifact, never a param (got "${value.from}").`);
+      ctx.err([...path23, "from"], `Output "${outputName}" "from" must reference a step output (steps.<id>.output...), not a param — an ` + `output projects a step artifact, never a param (got "${value.from}").`);
       continue;
     }
     const entry = { from: value.from };
     if (value.schema !== undefined) {
       if (!isRecord(value.schema)) {
-        ctx.err([...path22, "schema"], `Output "${outputName}" "schema" must be a JSON Schema object.`);
+        ctx.err([...path23, "schema"], `Output "${outputName}" "schema" must be a JSON Schema object.`);
       } else {
         if (jsonBytes(value.schema) > WORKFLOW_MAX_SCHEMA_BYTES) {
-          ctx.err([...path22, "schema"], `Output "${outputName}" schema exceeds the 256 KiB resource limit.`);
+          ctx.err([...path23, "schema"], `Output "${outputName}" schema exceeds the 256 KiB resource limit.`);
         }
-        checkSchemaDefinition(ctx, value.schema, [...path22, "schema"], `Output "${outputName}" schema`);
+        checkSchemaDefinition(ctx, value.schema, [...path23, "schema"], `Output "${outputName}" schema`);
         entry.schema = value.schema;
       }
     }
@@ -12432,15 +12521,15 @@ function parseOutputs(ctx, raw) {
 function parseDefaults(ctx, raw) {
   if (raw === undefined)
     return;
-  const path22 = ["defaults"];
+  const path23 = ["defaults"];
   if (!isRecord(raw)) {
-    ctx.err(path22, `"defaults" must be a mapping with any of: ${DEFAULTS_KEYS.join(", ")}.`);
+    ctx.err(path23, `"defaults" must be a mapping with any of: ${DEFAULTS_KEYS.join(", ")}.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, DEFAULTS_KEYS, `"defaults"`);
+  checkUnknownKeys(ctx, raw, path23, DEFAULTS_KEYS, `"defaults"`);
   const defaults = {};
   if (raw.engine !== undefined) {
-    const engine = parseEngineName(ctx, raw.engine, [...path22, "engine"], `"defaults.engine"`);
+    const engine = parseEngineName(ctx, raw.engine, [...path23, "engine"], `"defaults.engine"`);
     if (engine !== undefined)
       defaults.engine = engine;
   }
@@ -12448,15 +12537,15 @@ function parseDefaults(ctx, raw) {
     if (typeof raw.model === "string" && raw.model.trim() !== "")
       defaults.model = raw.model.trim();
     else
-      ctx.err([...path22, "model"], `"defaults.model" must be a non-empty string (a model alias or exact id).`);
+      ctx.err([...path23, "model"], `"defaults.model" must be a non-empty string (a model alias or exact id).`);
   }
-  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path22, "timeout"], `"defaults.timeout"`);
+  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path23, "timeout"], `"defaults.timeout"`);
   if (timeoutMs !== undefined)
     defaults.timeoutMs = timeoutMs;
-  const onError = parseEnumField(ctx, raw.on_error, [...path22, "on_error"], `"defaults.on_error"`, PROGRAM_ON_ERROR);
+  const onError = parseEnumField(ctx, raw.on_error, [...path23, "on_error"], `"defaults.on_error"`, PROGRAM_ON_ERROR);
   if (onError !== undefined)
     defaults.onError = onError;
-  const llm = parseLlmOverrides(ctx, raw.llm, [...path22, "llm"], `"defaults.llm"`);
+  const llm = parseLlmOverrides(ctx, raw.llm, [...path23, "llm"], `"defaults.llm"`);
   if (llm !== undefined)
     defaults.llm = llm;
   return Object.keys(defaults).length > 0 ? defaults : undefined;
@@ -12464,25 +12553,25 @@ function parseDefaults(ctx, raw) {
 function parseBudget(ctx, raw) {
   if (raw === undefined)
     return;
-  const path22 = ["budget"];
+  const path23 = ["budget"];
   if (!isRecord(raw)) {
-    ctx.err(path22, `"budget" must be a mapping with any of: ${BUDGET_KEYS.join(", ")}.`);
+    ctx.err(path23, `"budget" must be a mapping with any of: ${BUDGET_KEYS.join(", ")}.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, BUDGET_KEYS, `"budget"`);
+  checkUnknownKeys(ctx, raw, path23, BUDGET_KEYS, `"budget"`);
   const budget = {};
   if (raw.max_tokens !== undefined) {
     if (typeof raw.max_tokens === "number" && Number.isInteger(raw.max_tokens) && raw.max_tokens >= 1) {
       budget.maxTokens = raw.max_tokens;
     } else {
-      ctx.err([...path22, "max_tokens"], `"budget.max_tokens" must be an integer >= 1.`);
+      ctx.err([...path23, "max_tokens"], `"budget.max_tokens" must be an integer >= 1.`);
     }
   }
   if (raw.max_units !== undefined) {
     if (typeof raw.max_units === "number" && Number.isInteger(raw.max_units) && raw.max_units >= 1) {
       budget.maxUnits = raw.max_units;
     } else {
-      ctx.err([...path22, "max_units"], `"budget.max_units" must be an integer >= 1.`);
+      ctx.err([...path23, "max_units"], `"budget.max_units" must be an integer >= 1.`);
     }
   }
   return Object.keys(budget).length > 0 ? budget : undefined;
@@ -12502,49 +12591,49 @@ function parseSteps(ctx, raw) {
   const seenIds = new Map;
   const routeChecks = [];
   raw.forEach((rawStep, index) => {
-    const path22 = ["steps", index];
+    const path23 = ["steps", index];
     if (!isRecord(rawStep)) {
-      ctx.err(path22, `Step ${index + 1} must be a mapping with an "id".`);
+      ctx.err(path23, `Step ${index + 1} must be a mapping with an "id".`);
       return;
     }
     const label = typeof rawStep.id === "string" && rawStep.id !== "" ? `Step "${rawStep.id}"` : `Step ${index + 1}`;
-    checkUnknownKeys(ctx, rawStep, path22, STEP_KEYS, label);
+    checkUnknownKeys(ctx, rawStep, path23, STEP_KEYS, label);
     let id = "";
     if (typeof rawStep.id !== "string" || rawStep.id === "") {
-      ctx.err([...path22, "id"], `${label} requires a non-empty string "id".`);
+      ctx.err([...path23, "id"], `${label} requires a non-empty string "id".`);
     } else if (!PROGRAM_STEP_ID_PATTERN.test(rawStep.id)) {
-      ctx.err([...path22, "id"], `${label} has an invalid id "${rawStep.id}". A step id cannot be referenced from steps.${rawStep.id}.output ` + `unless it matches [A-Za-z_][A-Za-z0-9_-]* (a letter or underscore first, then letters, digits, ` + `underscores, or dashes; no dots, no leading digit).`);
+      ctx.err([...path23, "id"], `${label} has an invalid id "${rawStep.id}". A step id cannot be referenced from steps.${rawStep.id}.output ` + `unless it matches [A-Za-z_][A-Za-z0-9_-]* (a letter or underscore first, then letters, digits, ` + `underscores, or dashes; no dots, no leading digit).`);
     } else {
       id = rawStep.id;
       const firstIndex = seenIds.get(id);
       if (firstIndex !== undefined) {
-        ctx.err([...path22, "id"], `Duplicate step id "${id}" (first used by step ${firstIndex + 1}). Step ids must be unique.`);
+        ctx.err([...path23, "id"], `Duplicate step id "${id}" (first used by step ${firstIndex + 1}). Step ids must be unique.`);
       } else {
         seenIds.set(id, index);
       }
     }
     const declaredKinds = ["map", "route"].filter((kind) => rawStep[kind] !== undefined);
     if (declaredKinds.length > 1) {
-      ctx.err(path22, `${label} must declare at most one of "map" or "route" (found ${declaredKinds.join(" + ")}).`);
+      ctx.err(path23, `${label} must declare at most one of "map" or "route" (found ${declaredKinds.join(" + ")}).`);
     }
     const isRoute = rawStep.route !== undefined;
     const isMapStep = rawStep.map !== undefined;
     if (isRoute && rawStep.unit !== undefined) {
-      ctx.err(path22, `${label} is a route step and cannot also declare "unit" (route steps dispatch no unit).`);
+      ctx.err(path23, `${label} is a route step and cannot also declare "unit" (route steps dispatch no unit).`);
     }
     if (isMapStep && rawStep.unit !== undefined) {
-      ctx.err(path22, `${label} is a map step; the per-item dispatch-override bag belongs at "map.unit", not top-level "unit".`);
+      ctx.err(path23, `${label} is a map step; the per-item dispatch-override bag belongs at "map.unit", not top-level "unit".`);
     }
     if (isRoute && rawStep.inputs !== undefined) {
-      ctx.err(path22, `${label} is a route step and cannot declare "inputs" (route steps dispatch no unit).`);
-    }
-    const unit = rawStep.unit !== undefined && !isRoute && !isMapStep ? parseUnit(ctx, rawStep.unit, [...path22, "unit"], label) : undefined;
-    const map = isMapStep ? parseMap(ctx, rawStep.map, [...path22, "map"], label) : undefined;
-    const route = isRoute ? parseRoute(ctx, rawStep.route, [...path22, "route"], label, index, routeChecks) : undefined;
-    const inputs = !isRoute ? parseInputs(ctx, rawStep.inputs, [...path22, "inputs"], label) : undefined;
-    const output = parseSchemaObject(ctx, rawStep.output, [...path22, "output"], `${label} "output"`);
-    const gate = rawStep.gate !== undefined ? parseGate(ctx, rawStep.gate, [...path22, "gate"], label) : undefined;
-    const step = { id, source: ctx.refAt(path22) };
+      ctx.err(path23, `${label} is a route step and cannot declare "inputs" (route steps dispatch no unit).`);
+    }
+    const unit = rawStep.unit !== undefined && !isRoute && !isMapStep ? parseUnit(ctx, rawStep.unit, [...path23, "unit"], label) : undefined;
+    const map = isMapStep ? parseMap(ctx, rawStep.map, [...path23, "map"], label) : undefined;
+    const route = isRoute ? parseRoute(ctx, rawStep.route, [...path23, "route"], label, index, routeChecks) : undefined;
+    const inputs = !isRoute ? parseInputs(ctx, rawStep.inputs, [...path23, "inputs"], label) : undefined;
+    const output = parseSchemaObject(ctx, rawStep.output, [...path23, "output"], `${label} "output"`);
+    const gate = rawStep.gate !== undefined ? parseGate(ctx, rawStep.gate, [...path23, "gate"], label) : undefined;
+    const step = { id, source: ctx.refAt(path23) };
     if (unit)
       step.unit = unit;
     if (map)
@@ -12576,25 +12665,25 @@ function parseSteps(ctx, raw) {
   }
   return steps;
 }
-function parseUnit(ctx, raw, path22, stepLabel) {
+function parseUnit(ctx, raw, path23, stepLabel) {
   if (!isRecord(raw)) {
-    ctx.err(path22, `${stepLabel} "unit" must be a mapping (a dispatch-override bag).`);
+    ctx.err(path23, `${stepLabel} "unit" must be a mapping (a dispatch-override bag).`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, UNIT_KEYS, `${stepLabel} "unit"`);
-  const unit = { source: ctx.refAt(path22) };
+  checkUnknownKeys(ctx, raw, path23, UNIT_KEYS, `${stepLabel} "unit"`);
+  const unit = { source: ctx.refAt(path23) };
   if (raw.exec !== undefined) {
-    const exec = parseExec(ctx, raw.exec, [...path22, "exec"], stepLabel);
+    const exec = parseExec(ctx, raw.exec, [...path23, "exec"], stepLabel);
     if (exec !== undefined)
       unit.exec = exec;
     for (const key of UNIT_ENGINE_KEYS) {
       if (raw[key] === undefined)
         continue;
-      ctx.err([...path22, key], `${stepLabel} "unit" declares both "exec" and "${key}". An exec unit runs a shell command and never ` + `reaches an engine, so "${key}" would have no effect — remove one of the two.`);
+      ctx.err([...path23, key], `${stepLabel} "unit" declares both "exec" and "${key}". An exec unit runs a shell command and never ` + `reaches an engine, so "${key}" would have no effect — remove one of the two.`);
     }
   }
   if (raw.engine !== undefined) {
-    const engine = parseEngineName(ctx, raw.engine, [...path22, "engine"], `${stepLabel} "engine"`);
+    const engine = parseEngineName(ctx, raw.engine, [...path23, "engine"], `${stepLabel} "engine"`);
     if (engine !== undefined)
       unit.engine = engine;
   }
@@ -12602,21 +12691,21 @@ function parseUnit(ctx, raw, path22, stepLabel) {
     if (typeof raw.model === "string" && raw.model.trim() !== "")
       unit.model = raw.model.trim();
     else
-      ctx.err([...path22, "model"], `${stepLabel} "model" must be a non-empty string (a model alias or exact id).`);
+      ctx.err([...path23, "model"], `${stepLabel} "model" must be a non-empty string (a model alias or exact id).`);
   }
-  const llm = parseLlmOverrides(ctx, raw.llm, [...path22, "llm"], `${stepLabel} "llm"`);
+  const llm = parseLlmOverrides(ctx, raw.llm, [...path23, "llm"], `${stepLabel} "llm"`);
   if (llm !== undefined)
     unit.llm = llm;
-  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path22, "timeout"], `${stepLabel} "timeout"`);
+  const timeoutMs = parseTimeoutField(ctx, raw.timeout, [...path23, "timeout"], `${stepLabel} "timeout"`);
   if (timeoutMs !== undefined)
     unit.timeoutMs = timeoutMs;
-  const retry = parseRetry(ctx, raw.retry, [...path22, "retry"], stepLabel);
+  const retry = parseRetry(ctx, raw.retry, [...path23, "retry"], stepLabel);
   if (retry !== undefined)
     unit.retry = retry;
-  const onError = parseEnumField(ctx, raw.on_error, [...path22, "on_error"], `${stepLabel} "on_error"`, PROGRAM_ON_ERROR);
+  const onError = parseEnumField(ctx, raw.on_error, [...path23, "on_error"], `${stepLabel} "on_error"`, PROGRAM_ON_ERROR);
   if (onError !== undefined)
     unit.onError = onError;
-  const output = parseSchemaObject(ctx, raw.output, [...path22, "output"], `${stepLabel} unit "output"`);
+  const output = parseSchemaObject(ctx, raw.output, [...path23, "output"], `${stepLabel} unit "output"`);
   if (output !== undefined)
     unit.output = output;
   if (raw.env !== undefined) {
@@ -12624,87 +12713,87 @@ function parseUnit(ctx, raw, path22, stepLabel) {
       const envRefs = raw.env.map((entry) => entry.trim());
       const duplicate = envRefs.find((ref, i) => envRefs.indexOf(ref) !== i);
       if (duplicate !== undefined) {
-        ctx.err([...path22, "env"], `${stepLabel} "env" contains a duplicate entry: "${duplicate}".`);
+        ctx.err([...path23, "env"], `${stepLabel} "env" contains a duplicate entry: "${duplicate}".`);
       } else {
         unit.env = envRefs;
       }
     } else {
-      ctx.err([...path22, "env"], `${stepLabel} "env" must be a list of non-empty env asset refs.`);
+      ctx.err([...path23, "env"], `${stepLabel} "env" must be a list of non-empty env asset refs.`);
     }
   }
-  const isolation = parseEnumField(ctx, raw.isolation, [...path22, "isolation"], `${stepLabel} "isolation"`, PROGRAM_ISOLATION_KINDS);
+  const isolation = parseEnumField(ctx, raw.isolation, [...path23, "isolation"], `${stepLabel} "isolation"`, PROGRAM_ISOLATION_KINDS);
   if (isolation !== undefined)
     unit.isolation = isolation;
   return unit;
 }
-function parseExec(ctx, raw, path22, stepLabel) {
+function parseExec(ctx, raw, path23, stepLabel) {
   if (!isRecord(raw)) {
-    ctx.err(path22, `${stepLabel} "exec" must be a mapping with a "command" argv list.`);
+    ctx.err(path23, `${stepLabel} "exec" must be a mapping with a "command" argv list.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, EXEC_KEYS, `${stepLabel} "exec"`);
-  const command = parseExecCommand(ctx, raw.command, [...path22, "command"], stepLabel);
+  checkUnknownKeys(ctx, raw, path23, EXEC_KEYS, `${stepLabel} "exec"`);
+  const command = parseExecCommand(ctx, raw.command, [...path23, "command"], stepLabel);
   if (command === undefined)
     return;
   const exec = { command };
-  const cwd = parseExecCwd(ctx, raw.cwd, [...path22, "cwd"], stepLabel);
+  const cwd = parseExecCwd(ctx, raw.cwd, [...path23, "cwd"], stepLabel);
   if (cwd !== undefined)
     exec.cwd = cwd;
-  const passEnv = parseExecPassEnv(ctx, raw.pass_env, [...path22, "pass_env"], stepLabel);
+  const passEnv = parseExecPassEnv(ctx, raw.pass_env, [...path23, "pass_env"], stepLabel);
   if (passEnv !== undefined)
     exec.passEnv = passEnv;
   return exec;
 }
-function parseExecPassEnv(ctx, raw, path22, stepLabel) {
+function parseExecPassEnv(ctx, raw, path23, stepLabel) {
   if (raw === undefined)
     return;
   if (!Array.isArray(raw) || raw.length === 0) {
-    ctx.err(path22, `${stepLabel} "exec.pass_env" must be a non-empty list of environment variable NAMES to copy through from ` + `akm's own environment, e.g. pass_env: [CARGO_HOME]. Values never appear here — use "env:" bindings for those.`);
+    ctx.err(path23, `${stepLabel} "exec.pass_env" must be a non-empty list of environment variable NAMES to copy through from ` + `akm's own environment, e.g. pass_env: [CARGO_HOME]. Values never appear here — use "env:" bindings for those.`);
     return;
   }
   const names = [];
   for (const [index, entry] of raw.entries()) {
     if (typeof entry !== "string" || !WORKFLOW_ENV_VAR_NAME_PATTERN.test(entry)) {
-      ctx.err(path22, `${stepLabel} "exec.pass_env[${index}]" must be an environment variable name matching ` + `${WORKFLOW_ENV_VAR_NAME_PATTERN.source}.`);
+      ctx.err(path23, `${stepLabel} "exec.pass_env[${index}]" must be an environment variable name matching ` + `${WORKFLOW_ENV_VAR_NAME_PATTERN.source}.`);
       return;
     }
     if (names.includes(entry)) {
-      ctx.err(path22, `${stepLabel} "exec.pass_env" lists "${entry}" more than once.`);
+      ctx.err(path23, `${stepLabel} "exec.pass_env" lists "${entry}" more than once.`);
       return;
     }
     names.push(entry);
   }
   return names;
 }
-function parseExecCommand(ctx, raw, path22, stepLabel) {
+function parseExecCommand(ctx, raw, path23, stepLabel) {
   if (!Array.isArray(raw) || raw.length === 0) {
-    ctx.err(path22, `${stepLabel} "exec" requires "command": a non-empty argv list, e.g. command: ["bun", "run", "test:unit"]. ` + `A single shell string is not accepted — the command is spawned directly, never through a shell.`);
+    ctx.err(path23, `${stepLabel} "exec" requires "command": a non-empty argv list, e.g. command: ["bun", "run", "test:unit"]. ` + `A single shell string is not accepted — the command is spawned directly, never through a shell.`);
     return;
   }
   const argv = [];
   for (const [index, entry] of raw.entries()) {
     if (typeof entry !== "string" || entry === "") {
-      ctx.err(path22, `${stepLabel} "exec.command[${index}]" must be a non-empty string.`);
+      ctx.err(path23, `${stepLabel} "exec.command[${index}]" must be a non-empty string.`);
       return;
     }
     if (entry.includes("\x00")) {
-      ctx.err([...path22, index], `${stepLabel} "exec.command[${index}]" may not contain NUL bytes.`);
+      ctx.err([...path23, index], `${stepLabel} "exec.command[${index}]" may not contain NUL bytes.`);
       return;
     }
     argv.push(entry);
   }
   return argv;
 }
-function parseExecCwd(ctx, raw, path22, stepLabel) {
+function parseExecCwd(ctx, raw, path23, stepLabel) {
   if (raw === undefined)
     return;
   if (typeof raw !== "string" || raw.trim() === "") {
-    ctx.err(path22, `${stepLabel} "exec.cwd" must be a non-empty relative path inside the unit's working directory.`);
+    ctx.err(path23, `${stepLabel} "exec.cwd" must be a non-empty relative path inside the unit's working directory.`);
     return;
   }
   const value = raw.trim();
   if (!isContainedRelativePath(value)) {
-    ctx.err(path22, `${stepLabel} "exec.cwd" (${JSON.stringify(value)}) must be a RELATIVE path inside the unit's working ` + `directory — absolute paths, Windows drive letters, "~", and ".." segments are rejected.`);
+    ctx.err(path23, `${stepLabel} "exec.cwd" (${JSON.stringify(value)}) must be a RELATIVE path inside the unit's working ` + `directory — absolute paths, Windows drive letters, "~", and ".." segments are rejected.`);
     return;
   }
   if (ctx.validateExecCwd) {
@@ -12712,7 +12801,7 @@ function parseExecCwd(ctx, raw, path22, stepLabel) {
     if (!semantic.ok) {
       ctx.errors.push({
         code: semantic.code,
-        line: ctx.lineAt(path22),
+        line: ctx.lineAt(path23),
         message: semantic.message
       });
       return;
@@ -12721,29 +12810,29 @@ function parseExecCwd(ctx, raw, path22, stepLabel) {
   }
   return value;
 }
-function parseMap(ctx, raw, path22, stepLabel) {
+function parseMap(ctx, raw, path23, stepLabel) {
   if (!isRecord(raw)) {
-    ctx.err(path22, `${stepLabel} "map" must be a mapping with an "over" key.`);
+    ctx.err(path23, `${stepLabel} "map" must be a mapping with an "over" key.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, MAP_KEYS, `${stepLabel} "map"`);
+  checkUnknownKeys(ctx, raw, path23, MAP_KEYS, `${stepLabel} "map"`);
   let over = "";
   if (typeof raw.over === "string" && raw.over.trim() !== "") {
     over = raw.over.trim();
-    checkReferenceSyntax(ctx, over, [...path22, "over"], `${stepLabel} "over"`);
+    checkReferenceSyntax(ctx, over, [...path23, "over"], `${stepLabel} "over"`);
   } else {
-    ctx.err([...path22, "over"], `${stepLabel} "map" requires "over": a reference naming the item list (e.g. steps.discover.output.files).`);
+    ctx.err([...path23, "over"], `${stepLabel} "map" requires "over": a reference naming the item list (e.g. steps.discover.output.files).`);
   }
   let concurrency;
   if (raw.concurrency !== undefined) {
     if (typeof raw.concurrency === "number" && Number.isInteger(raw.concurrency) && raw.concurrency > 0) {
       concurrency = Math.min(raw.concurrency, WORKFLOW_MAX_CONCURRENCY);
     } else {
-      ctx.err([...path22, "concurrency"], `${stepLabel} "concurrency" must be a positive integer.`);
+      ctx.err([...path23, "concurrency"], `${stepLabel} "concurrency" must be a positive integer.`);
     }
   }
-  const reducer = parseEnumField(ctx, raw.reducer, [...path22, "reducer"], `${stepLabel} "reducer"`, PROGRAM_REDUCERS);
-  const unit = raw.unit !== undefined ? parseUnit(ctx, raw.unit, [...path22, "unit"], stepLabel) : undefined;
+  const reducer = parseEnumField(ctx, raw.reducer, [...path23, "reducer"], `${stepLabel} "reducer"`, PROGRAM_REDUCERS);
+  const unit = raw.unit !== undefined ? parseUnit(ctx, raw.unit, [...path23, "unit"], stepLabel) : undefined;
   const map = { over };
   if (concurrency !== undefined)
     map.concurrency = concurrency;
@@ -12753,21 +12842,21 @@ function parseMap(ctx, raw, path22, stepLabel) {
     map.unit = unit;
   return map;
 }
-function parseRoute(ctx, raw, path22, stepLabel, stepIndex, routeChecks) {
+function parseRoute(ctx, raw, path23, stepLabel, stepIndex, routeChecks) {
   if (!isRecord(raw)) {
-    ctx.err(path22, `${stepLabel} "route" must be a mapping with "input" and "when" keys.`);
+    ctx.err(path23, `${stepLabel} "route" must be a mapping with "input" and "when" keys.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, ROUTE_KEYS, `${stepLabel} "route"`);
+  checkUnknownKeys(ctx, raw, path23, ROUTE_KEYS, `${stepLabel} "route"`);
   let input = "";
   if (typeof raw.input === "string" && raw.input.trim() !== "") {
     input = raw.input.trim();
-    checkReferenceSyntax(ctx, input, [...path22, "input"], `${stepLabel} "route.input"`);
+    checkReferenceSyntax(ctx, input, [...path23, "input"], `${stepLabel} "route.input"`);
   } else {
-    ctx.err([...path22, "input"], `${stepLabel} "route" requires "input": a reference naming the value to route on.`);
+    ctx.err([...path23, "input"], `${stepLabel} "route" requires "input": a reference naming the value to route on.`);
   }
   const check = { stepIndex, stepLabel, branches: [] };
-  const whenPath = [...path22, "when"];
+  const whenPath = [...path23, "when"];
   if (!Array.isArray(raw.when) || raw.when.length === 0) {
     ctx.err(whenPath, `${stepLabel} "route" requires "when": a non-empty list of { match, step } branches (e.g. when: [{ match: pass, step: ship }]).`);
   } else {
@@ -12808,9 +12897,9 @@ function parseRoute(ctx, raw, path22, stepLabel, stepIndex, routeChecks) {
   if (raw.default !== undefined) {
     if (typeof raw.default === "string" && raw.default.trim() !== "") {
       defaultStepId = raw.default.trim();
-      check.defaultTarget = { stepId: defaultStepId, line: ctx.lineAt([...path22, "default"]) };
+      check.defaultTarget = { stepId: defaultStepId, line: ctx.lineAt([...path23, "default"]) };
     } else {
-      ctx.err([...path22, "default"], `${stepLabel} "route.default" must be a step id string.`);
+      ctx.err([...path23, "default"], `${stepLabel} "route.default" must be a step id string.`);
     }
   }
   routeChecks.push(check);
@@ -12819,70 +12908,70 @@ function parseRoute(ctx, raw, path22, stepLabel, stepIndex, routeChecks) {
     route.defaultStepId = defaultStepId;
   return route;
 }
-function parseInputs(ctx, raw, path22, stepLabel) {
+function parseInputs(ctx, raw, path23, stepLabel) {
   if (raw === undefined)
     return;
   if (!Array.isArray(raw) || raw.length === 0) {
-    ctx.err(path22, `${stepLabel} "inputs" must be a non-empty list of reference strings.`);
+    ctx.err(path23, `${stepLabel} "inputs" must be a non-empty list of reference strings.`);
     return;
   }
   const out = [];
   const seen = new Set;
   raw.forEach((entry, i) => {
     if (typeof entry !== "string" || entry.trim() === "") {
-      ctx.err([...path22, i], `${stepLabel} "inputs[${i}]" must be a non-empty reference string.`);
+      ctx.err([...path23, i], `${stepLabel} "inputs[${i}]" must be a non-empty reference string.`);
       return;
     }
     const value = entry.trim();
     if (seen.has(value)) {
-      ctx.err([...path22, i], `${stepLabel} "inputs[${i}]" duplicates an earlier entry: "${value}".`);
+      ctx.err([...path23, i], `${stepLabel} "inputs[${i}]" duplicates an earlier entry: "${value}".`);
       return;
     }
     seen.add(value);
-    checkReferenceSyntax(ctx, value, [...path22, i], `${stepLabel} "inputs[${i}]"`);
+    checkReferenceSyntax(ctx, value, [...path23, i], `${stepLabel} "inputs[${i}]"`);
     out.push(value);
   });
   return out.length > 0 ? out : undefined;
 }
-function parseGate(ctx, raw, path22, stepLabel) {
+function parseGate(ctx, raw, path23, stepLabel) {
   if (!isRecord(raw)) {
-    ctx.err(path22, `${stepLabel} "gate" must be a mapping with any of: ${GATE_KEYS.join(", ")}.`);
+    ctx.err(path23, `${stepLabel} "gate" must be a mapping with any of: ${GATE_KEYS.join(", ")}.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, GATE_KEYS, `${stepLabel} "gate"`);
+  checkUnknownKeys(ctx, raw, path23, GATE_KEYS, `${stepLabel} "gate"`);
   const gate = {};
   if (raw.max_loops !== undefined) {
     if (typeof raw.max_loops === "number" && Number.isInteger(raw.max_loops) && raw.max_loops >= 1) {
       gate.maxLoops = raw.max_loops;
     } else {
-      ctx.err([...path22, "max_loops"], `${stepLabel} "gate.max_loops" must be an integer of at least 1.`);
+      ctx.err([...path23, "max_loops"], `${stepLabel} "gate.max_loops" must be an integer of at least 1.`);
     }
   }
   return gate;
 }
-function parseEngineName(ctx, raw, path22, label) {
+function parseEngineName(ctx, raw, path23, label) {
   if (typeof raw !== "string" || raw.trim() === "") {
-    ctx.err(path22, `${label} must be a non-empty engine name.`);
+    ctx.err(path23, `${label} must be a non-empty engine name.`);
     return;
   }
   const name = raw.trim();
   if (!WORKFLOW_ENGINE_NAME_PATTERN.test(name) || name.length > WORKFLOW_MAX_ENGINE_NAME_LENGTH) {
-    ctx.err(path22, `${label} has an invalid engine name ${JSON.stringify(name)}. Engine names are lowercase words of letters ` + `and digits separated by single dashes, starting with a letter (e.g. "code-review-llm"), at most ` + `${WORKFLOW_MAX_ENGINE_NAME_LENGTH} characters.`);
+    ctx.err(path23, `${label} has an invalid engine name ${JSON.stringify(name)}. Engine names are lowercase words of letters ` + `and digits separated by single dashes, starting with a letter (e.g. "code-review-llm"), at most ` + `${WORKFLOW_MAX_ENGINE_NAME_LENGTH} characters.`);
     return;
   }
   return name;
 }
-function parseRetry(ctx, raw, path22, stepLabel) {
+function parseRetry(ctx, raw, path23, stepLabel) {
   if (raw === undefined)
     return;
   if (!isRecord(raw)) {
-    ctx.err(path22, `${stepLabel} "retry" must be a mapping: { max: <n>, on: [<failure_reason>, …] }.`);
+    ctx.err(path23, `${stepLabel} "retry" must be a mapping: { max: <n>, on: [<failure_reason>, …] }.`);
     return;
   }
-  checkUnknownKeys(ctx, raw, path22, RETRY_KEYS, `${stepLabel} "retry"`);
+  checkUnknownKeys(ctx, raw, path23, RETRY_KEYS, `${stepLabel} "retry"`);
   let ok = true;
   if (!(typeof raw.max === "number" && Number.isInteger(raw.max) && raw.max >= 0)) {
-    ctx.err([...path22, "max"], `${stepLabel} "retry.max" is required and must be a non-negative integer.`);
+    ctx.err([...path23, "max"], `${stepLabel} "retry.max" is required and must be a non-negative integer.`);
     ok = false;
   }
   const on = [];
@@ -12891,27 +12980,27 @@ function parseRetry(ctx, raw, path22, stepLabel) {
       if (typeof reason === "string" && PROGRAM_RETRY_REASONS.includes(reason)) {
         on.push(reason);
       } else {
-        ctx.err([...path22, "on", i], `${stepLabel} "retry.on" has unknown failure reason ${JSON.stringify(reason)}. Valid reasons: ${PROGRAM_RETRY_REASONS.join(", ")}.`);
+        ctx.err([...path23, "on", i], `${stepLabel} "retry.on" has unknown failure reason ${JSON.stringify(reason)}. Valid reasons: ${PROGRAM_RETRY_REASONS.join(", ")}.`);
         ok = false;
       }
     });
   } else {
-    ctx.err([...path22, "on"], `${stepLabel} "retry.on" is required and must be a non-empty list of failure reasons (${PROGRAM_RETRY_REASONS.join(", ")}).`);
+    ctx.err([...path23, "on"], `${stepLabel} "retry.on" is required and must be a non-empty list of failure reasons (${PROGRAM_RETRY_REASONS.join(", ")}).`);
     ok = false;
   }
   return ok ? { max: raw.max, on } : undefined;
 }
-function parseTimeoutField(ctx, raw, path22, label) {
+function parseTimeoutField(ctx, raw, path23, label) {
   if (raw === undefined)
     return;
   if (typeof raw === "number") {
     if (Number.isInteger(raw) && raw > 0)
-      return checkTimeoutCeiling(ctx, raw, path22, label, String(raw));
-    ctx.err(path22, `${label} has a non-positive timeout ${JSON.stringify(raw)}. ${TIMEOUT_HINT}.`);
+      return checkTimeoutCeiling(ctx, raw, path23, label, String(raw));
+    ctx.err(path23, `${label} has a non-positive timeout ${JSON.stringify(raw)}. ${TIMEOUT_HINT}.`);
     return;
   }
   if (typeof raw !== "string") {
-    ctx.err(path22, `${label} must be a duration string. ${TIMEOUT_HINT}.`);
+    ctx.err(path23, `${label} must be a duration string. ${TIMEOUT_HINT}.`);
     return;
   }
   const value = raw.trim().toLowerCase();
@@ -12919,37 +13008,37 @@ function parseTimeoutField(ctx, raw, path22, label) {
     return null;
   const match = value.match(TIMEOUT_VALUE);
   if (!match) {
-    ctx.err(path22, `${label} has an invalid timeout "${raw}". ${TIMEOUT_HINT}.`);
+    ctx.err(path23, `${label} has an invalid timeout "${raw}". ${TIMEOUT_HINT}.`);
     return;
   }
   const n = Number.parseInt(match[1], 10);
   const unit = match[2] ?? "ms";
   const timeoutMs = unit === "m" ? n * 60000 : unit === "s" ? n * 1000 : n;
   if (timeoutMs <= 0) {
-    ctx.err(path22, `${label} has a non-positive timeout "${raw}". Use a positive duration or "none".`);
+    ctx.err(path23, `${label} has a non-positive timeout "${raw}". Use a positive duration or "none".`);
     return;
   }
-  return checkTimeoutCeiling(ctx, timeoutMs, path22, label, raw);
+  return checkTimeoutCeiling(ctx, timeoutMs, path23, label, raw);
 }
-function checkTimeoutCeiling(ctx, timeoutMs, path22, label, raw) {
+function checkTimeoutCeiling(ctx, timeoutMs, path23, label, raw) {
   if (timeoutMs <= WORKFLOW_MAX_TIMEOUT_MS)
     return timeoutMs;
-  ctx.err(path22, `${label} has a timeout "${raw}" above the maximum of ${WORKFLOW_MAX_TIMEOUT_MS} ms (about 24.8 days). ` + `Use a shorter duration or "none" for no timeout.`);
+  ctx.err(path23, `${label} has a timeout "${raw}" above the maximum of ${WORKFLOW_MAX_TIMEOUT_MS} ms (about 24.8 days). ` + `Use a shorter duration or "none" for no timeout.`);
   return;
 }
-function parseEnumField(ctx, raw, path22, label, allowed) {
+function parseEnumField(ctx, raw, path23, label, allowed) {
   if (raw === undefined)
     return;
   if (typeof raw === "string" && allowed.includes(raw))
     return raw;
-  ctx.err(path22, `${label} must be one of: ${allowed.join(" | ")} (got ${JSON.stringify(raw)}).`);
+  ctx.err(path23, `${label} must be one of: ${allowed.join(" | ")} (got ${JSON.stringify(raw)}).`);
   return;
 }
-function parseLlmOverrides(ctx, raw, path22, label) {
+function parseLlmOverrides(ctx, raw, path23, label) {
   if (raw === undefined)
     return;
   if (!isRecord(raw)) {
-    ctx.err(path22, `${label} must be a mapping of LLM invocation overrides.`);
+    ctx.err(path23, `${label} must be a mapping of LLM invocation overrides.`);
     return;
   }
   const keys2 = [
@@ -12961,36 +13050,36 @@ function parseLlmOverrides(ctx, raw, path22, label) {
     "enable_thinking",
     "reasoning_effort"
   ];
-  checkUnknownKeys(ctx, raw, path22, keys2, label);
+  checkUnknownKeys(ctx, raw, path23, keys2, label);
   const result = {};
   if (raw.temperature !== undefined) {
     if (typeof raw.temperature === "number" && Number.isFinite(raw.temperature))
       result.temperature = raw.temperature;
     else
-      ctx.err([...path22, "temperature"], `${label}.temperature must be a finite number.`);
+      ctx.err([...path23, "temperature"], `${label}.temperature must be a finite number.`);
   }
   if (raw.max_tokens !== undefined) {
     if (typeof raw.max_tokens === "number" && Number.isInteger(raw.max_tokens) && raw.max_tokens > 0) {
       result.maxTokens = raw.max_tokens;
     } else
-      ctx.err([...path22, "max_tokens"], `${label}.max_tokens must be a positive integer.`);
+      ctx.err([...path23, "max_tokens"], `${label}.max_tokens must be a positive integer.`);
   }
   if (raw.supports_json_schema !== undefined) {
     if (typeof raw.supports_json_schema === "boolean")
       result.supportsJsonSchema = raw.supports_json_schema;
     else
-      ctx.err([...path22, "supports_json_schema"], `${label}.supports_json_schema must be a boolean.`);
+      ctx.err([...path23, "supports_json_schema"], `${label}.supports_json_schema must be a boolean.`);
   }
   if (raw.extra_params !== undefined) {
     if (!isRecord(raw.extra_params)) {
-      ctx.err([...path22, "extra_params"], `${label}.extra_params must be a JSON object.`);
+      ctx.err([...path23, "extra_params"], `${label}.extra_params must be a JSON object.`);
     } else {
       const issues = validateExtraParams(raw.extra_params);
       for (const issue of issues) {
-        ctx.err([...path22, "extra_params", ...issue.path], `${formatExtraParamsIssue(`${label}.extra_params`, issue)}.`);
+        ctx.err([...path23, "extra_params", ...issue.path], `${formatExtraParamsIssue(`${label}.extra_params`, issue)}.`);
       }
       if (jsonBytes(raw.extra_params) > WORKFLOW_MAX_EXTRA_PARAMS_BYTES) {
-        ctx.err([...path22, "extra_params"], `${label}.extra_params exceeds the 64 KiB resource limit.`);
+        ctx.err([...path23, "extra_params"], `${label}.extra_params exceeds the 64 KiB resource limit.`);
       }
       if (issues.length === 0 && jsonBytes(raw.extra_params) <= WORKFLOW_MAX_EXTRA_PARAMS_BYTES) {
         result.extraParams = raw.extra_params;
@@ -13001,38 +13090,38 @@ function parseLlmOverrides(ctx, raw, path22, label) {
     if (typeof raw.context_length === "number" && Number.isInteger(raw.context_length) && raw.context_length > 0) {
       result.contextLength = raw.context_length;
     } else
-      ctx.err([...path22, "context_length"], `${label}.context_length must be a positive integer.`);
+      ctx.err([...path23, "context_length"], `${label}.context_length must be a positive integer.`);
   }
   if (raw.enable_thinking !== undefined) {
     if (typeof raw.enable_thinking === "boolean")
       result.enableThinking = raw.enable_thinking;
     else
-      ctx.err([...path22, "enable_thinking"], `${label}.enable_thinking must be a boolean.`);
+      ctx.err([...path23, "enable_thinking"], `${label}.enable_thinking must be a boolean.`);
   }
   if (raw.reasoning_effort !== undefined) {
     if (typeof raw.reasoning_effort === "string" && raw.reasoning_effort.trim().length > 0) {
       result.reasoningEffort = raw.reasoning_effort;
     } else
-      ctx.err([...path22, "reasoning_effort"], `${label}.reasoning_effort must be a non-empty string.`);
+      ctx.err([...path23, "reasoning_effort"], `${label}.reasoning_effort must be a non-empty string.`);
   }
   return Object.keys(result).length > 0 ? result : undefined;
 }
-function parseSchemaObject(ctx, raw, path22, label) {
+function parseSchemaObject(ctx, raw, path23, label) {
   if (raw === undefined)
     return;
   if (!isRecord(raw)) {
-    ctx.err(path22, `${label} must be a JSON Schema object (e.g. { type: object, properties: { … } }).`);
+    ctx.err(path23, `${label} must be a JSON Schema object (e.g. { type: object, properties: { … } }).`);
     return;
   }
   if (jsonBytes(raw) > WORKFLOW_MAX_SCHEMA_BYTES) {
-    ctx.err(path22, `${label} exceeds the 256 KiB resource limit.`);
+    ctx.err(path23, `${label} exceeds the 256 KiB resource limit.`);
   }
-  checkSchemaDefinition(ctx, raw, path22, label);
+  checkSchemaDefinition(ctx, raw, path23, label);
   return raw;
 }
-function checkSchemaDefinition(ctx, schema, path22, label) {
+function checkSchemaDefinition(ctx, schema, path23, label) {
   for (const issue of checkJsonSchemaDefinition(schema)) {
-    const issuePath = [...path22, ...issue.path];
+    const issuePath = [...path23, ...issue.path];
     if (issue.kind === "unsupported") {
       ctx.err(issuePath, `${label} (at ${issue.pointer}): ${issue.message}. Supported JSON Schema keywords: ` + `${JSON_SCHEMA_SUBSET_SUPPORTED_KEYWORDS}.`);
     } else {
@@ -13040,15 +13129,15 @@ function checkSchemaDefinition(ctx, schema, path22, label) {
     }
   }
 }
-function checkReferenceSyntax(ctx, text, path22, label) {
+function checkReferenceSyntax(ctx, text, path23, label) {
   const result = parseReference(text);
   if (!result.ok)
-    ctx.err(path22, `${label}: ${result.message}`);
+    ctx.err(path23, `${label}: ${result.message}`);
 }
-function checkUnknownKeys(ctx, obj, path22, allowed, label) {
+function checkUnknownKeys(ctx, obj, path23, allowed, label) {
   for (const key of Object.keys(obj)) {
     if (!allowed.includes(key)) {
-      ctx.err([...path22, key], `Unknown ${label} key "${key}". Allowed keys: ${allowed.join(", ")}.`);
+      ctx.err([...path23, key], `Unknown ${label} key "${key}". Allowed keys: ${allowed.join(", ")}.`);
     }
   }
 }
@@ -13108,7 +13197,7 @@ var init_parser = __esm(() => {
 });
 
 // src/workflows/source-ir/result.ts
-function sourceFailureResult(cause, path22) {
+function sourceFailureResult(cause, path23) {
   if (cause instanceof WorkflowSourceFailure)
     return { ok: false, errors: [cause.error] };
   return {
@@ -13117,7 +13206,7 @@ function sourceFailureResult(cause, path22) {
       {
         code: "invalid-workflow-source",
         message: cause instanceof Error ? cause.message : String(cause),
-        path: path22,
+        path: path23,
         line: 1
       }
     ]
@@ -13768,7 +13857,7 @@ var init_triggers = __esm(() => {
 });
 
 // src/workflows/source-ir/compile.ts
-import path22 from "node:path";
+import path23 from "node:path";
 function compileGithubWorkflowSource(source, options) {
   try {
     return {
@@ -13852,7 +13941,7 @@ function compileMarkdownWorkflowSource(source, options) {
   }
 }
 function compileWorkflowSource(source, options) {
-  const extension = path22.extname(options.path).toLowerCase();
+  const extension = path23.extname(options.path).toLowerCase();
   if (extension === ".md")
     return compileMarkdownWorkflowSource(source, options);
   if (extension === ".yml")
@@ -13930,7 +14019,7 @@ function markdownName(source, filePath) {
   const title = body.match(/^#\s+(.+?)\s*$/m)?.[1]?.trim();
   if (title)
     return title;
-  return path22.basename(filePath, path22.extname(filePath));
+  return path23.basename(filePath, path23.extname(filePath));
 }
 function wholeSourceSpan2(source, filePath) {
   return { path: filePath, start: 1, end: Math.max(1, source.split(/\r?\n/).length) };
@@ -68660,13 +68749,13 @@ function flattenForText(value, path, lines) {
 }
 
 // src/output/html-render.ts
-import path4 from "node:path";
+import path6 from "node:path";
 // src/runtime.ts
 import { spawn as nodeSpawn, spawnSync as nodeSpawnSync } from "node:child_process";
 init_common();
 import { createWriteStream, statfsSync } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import path3 from "node:path";
+import path5 from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { fileURLToPath } from "node:url";
@@ -68752,11 +68841,11 @@ async function writeResponseToFileCapped(filePath, res, options) {
   }
 }
 function getDirname(importMetaUrl) {
-  return path3.dirname(fileURLToPath(importMetaUrl));
+  return path5.dirname(fileURLToPath(importMetaUrl));
 }
-function statfsType(path4) {
+function statfsType(path6) {
   try {
-    return statfsSync(path4).type;
+    return statfsSync(path6).type;
   } catch {
     return;
   }
@@ -68783,7 +68872,7 @@ function toBuffer(data) {
 }
 
 // src/output/html-render.ts
-var TEMPLATES_DIR = path4.join(getDirname(import.meta.url), "../assets/templates/html");
+var TEMPLATES_DIR = path6.join(getDirname(import.meta.url), "../assets/templates/html");
 
 // src/output/command-registry.ts
 function createCommandRegistry() {
@@ -69368,6 +69457,7 @@ var PASSTHROUGH_COMMANDS = [
   "task-run",
   "task-sync",
   "task-sync-dry-run",
+  "task-validate",
   "update",
   "upgrade",
   "workflow-abandon",
@@ -69953,16 +70043,16 @@ function formatConfigPlain(r) {
   const lines = [];
   const walk = (obj, prefix) => {
     for (const [k, v] of Object.entries(obj)) {
-      const path5 = prefix ? `${prefix}.${k}` : k;
+      const path7 = prefix ? `${prefix}.${k}` : k;
       if (v === null || v === undefined) {
-        lines.push(`${path5}=`);
+        lines.push(`${path7}=`);
       } else if (Array.isArray(v)) {
-        lines.push(`${path5}=${JSON.stringify(v)}`);
+        lines.push(`${path7}=${JSON.stringify(v)}`);
       } else if (typeof v === "object") {
-        walk(v, path5);
+        walk(v, path7);
       } else {
-        const rendered = typeof v === "string" && /^registries\.\d+\.url$/u.test(path5) ? formatRegistryUrl(v) : String(v);
-        lines.push(`${path5}=${rendered}`);
+        const rendered = typeof v === "string" && /^registries\.\d+\.url$/u.test(path7) ? formatRegistryUrl(v) : String(v);
+        lines.push(`${path7}=${rendered}`);
       }
     }
   };
@@ -71508,27 +71598,7 @@ var GLOBAL_OUTPUT_ARGS2 = {
 init_errors();
 
 // scripts/akm-migrate/help.txt
-var help_default = `Usage: akm-migrate <command> [options]
-
-The one migration tool for an akm installation. Every historical shape akm
-has ever written lives here; the CLI proper reads only current schemas.
-\`status\` and \`apply\` run every step, in order, and print one combined JSON
-plan (exit 1 when any step is blocked):
-
-  1. legacy config \`extraParams\` keys lifted onto first-class engine fields
-  2. pending state.db migrations, historical-destructive ones included,
-     with a verified sibling safety copy (the only path that admits them)
-  3. task-v2 files to task v3, then task-v3 files to task source v4
-  4. superseded pre-0.9.0 \`.akm\` residue and stale filesystem transactions
-
-\`akm migrate status|apply\` wraps this executable; \`akm upgrade\` runs
-\`apply\` after its install step, so an image that ships akm can put either
-in its entrypoint (a current installation is a no-op).
-
-Commands:
-  status              Inspect every pending migration without changing anything.
-  apply [--dry-run]   Back up and apply every pending migration.
-`;
+var help_default = "Usage: akm-migrate <command> [options]\n\nThe one migration tool for an akm installation. Every historical shape akm\nhas ever written lives here; the CLI proper reads only current schemas.\n`status` and `apply` run every step, in order, and print one combined JSON\nplan (exit 1 when any step is blocked):\n\n  1. legacy config `extraParams` keys lifted onto first-class engine fields\n  2. pending state.db migrations, historical-destructive ones included,\n     with a verified sibling safety copy (the only path that admits them)\n  3. task-v2 files to task v3, then task-v3 files to task source v4\n  4. superseded pre-0.9.0 `.akm` residue and stale filesystem transactions\n  5. live `.akm` writers relocated to `$STATE`/`$CACHE`, for every local\n     bundle (distill-rejected, eval-cases, measurement verdicts, and stale\n     improve-pipeline locks — a lock a live run still holds is left alone)\n\n`akm migrate status|apply` wraps this executable; `akm upgrade` runs\n`apply` after its install step, so an image that ships akm can put either\nin its entrypoint (a current installation is a no-op).\n\nCommands:\n  status              Inspect every pending migration without changing anything.\n  apply [--dry-run]   Back up and apply every pending migration.\n";
 
 // scripts/akm-migrate/run-migrate.ts
 init_common();
@@ -71540,14 +71610,14 @@ init_extra_params();
 
 // src/core/config/config-io.ts
 import fs4 from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 init_common();
 init_errors();
 
 // src/core/file-lock.ts
 import { randomUUID } from "node:crypto";
 import fs3 from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 
 // src/storage/database.ts
 import { createRequire as createRequire3 } from "node:module";
@@ -71571,12 +71641,12 @@ function selectProvider() {
   }
   return provider;
 }
-function openDatabase(path7, opts) {
-  return selectProvider().open(path7, opts);
+function openDatabase(path8, opts) {
+  return selectProvider().open(path8, opts);
 }
-function openBunDatabase(path7, opts) {
+function openBunDatabase(path8, opts) {
   const { Database: BunDatabase } = loadBunSqlite();
-  const db = opts ? new BunDatabase(path7, bunOptions(opts)) : new BunDatabase(path7);
+  const db = opts ? new BunDatabase(path8, bunOptions(opts)) : new BunDatabase(path8);
   return db;
 }
 function bunOptions(opts) {
@@ -71632,7 +71702,7 @@ function loadBetterSqlite3() {
   }
   return betterSqlite3Ctor;
 }
-function openNodeDatabase(path7, opts) {
+function openNodeDatabase(path8, opts) {
   const BetterSqlite3 = loadBetterSqlite3();
   const options = {};
   if (opts?.readonly !== undefined)
@@ -71641,7 +71711,7 @@ function openNodeDatabase(path7, opts) {
     options.fileMustExist = true;
   let db;
   try {
-    db = opts ? new BetterSqlite3(path7, options) : new BetterSqlite3(path7);
+    db = opts ? new BetterSqlite3(path8, options) : new BetterSqlite3(path8);
   } catch (err) {
     const raw = err instanceof Error ? err.message : String(err);
     const remedy = abiMismatchRemedy(raw);
@@ -71689,7 +71759,7 @@ function sameIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
 function operationMutexPath(lockPath) {
-  return path7.join(path7.dirname(lockPath), `.${path7.basename(lockPath)}.operations.sensitive`);
+  return path8.join(path8.dirname(lockPath), `.${path8.basename(lockPath)}.operations.sensitive`);
 }
 function withLockOperationMutex(lockPath, run) {
   const db = openDatabase(operationMutexPath(lockPath));
@@ -71908,14 +71978,14 @@ var MAX_CONFIG_BACKUPS = 5;
 function backupExistingConfig(configPath, now = new Date) {
   if (!fs4.existsSync(configPath))
     return;
-  const backupDir = path8.join(getCacheDir(), "config-backups");
+  const backupDir = path9.join(getCacheDir(), "config-backups");
   fs4.mkdirSync(backupDir, { recursive: true, mode: 448 });
   fs4.chmodSync(backupDir, 448);
   const timestamp = now.toISOString().replace(/[.:]/g, "-");
   let sequence = 0;
   let timestamped;
   while (true) {
-    timestamped = path8.join(backupDir, `config-${timestamp}${sequence === 0 ? "" : `-${sequence}`}.json`);
+    timestamped = path9.join(backupDir, `config-${timestamp}${sequence === 0 ? "" : `-${sequence}`}.json`);
     try {
       fs4.copyFileSync(configPath, timestamped, fs4.constants.COPYFILE_EXCL);
       break;
@@ -71925,7 +71995,7 @@ function backupExistingConfig(configPath, now = new Date) {
       sequence++;
     }
   }
-  const latest = path8.join(backupDir, "config.latest.json");
+  const latest = path9.join(backupDir, "config.latest.json");
   fs4.copyFileSync(configPath, latest);
   fs4.chmodSync(timestamped, 384);
   fs4.chmodSync(latest, 384);
@@ -71946,7 +72016,7 @@ function pruneToNewest(dir, keep, select) {
     return;
   }
   const candidates = entries.filter(select).map((entry) => {
-    const full = path8.join(dir, entry.name);
+    const full = path9.join(dir, entry.name);
     let mtime = 0;
     try {
       mtime = fs4.statSync(full).mtimeMs;
@@ -71960,7 +72030,7 @@ function pruneToNewest(dir, keep, select) {
   }
 }
 function getConfigLockPath() {
-  return path8.join(getConfigDir(), "config.json.lck");
+  return path9.join(getConfigDir(), "config.json.lck");
 }
 var CONFIG_LOCK_MAX_RETRIES = 40;
 var CONFIG_LOCK_RETRY_DELAY_MS = 50;
@@ -71970,7 +72040,7 @@ function sleepSyncMs(ms) {
 function acquireConfigLock() {
   const lockPath = getConfigLockPath();
   try {
-    fs4.mkdirSync(path8.dirname(lockPath), { recursive: true });
+    fs4.mkdirSync(path9.dirname(lockPath), { recursive: true });
   } catch {}
   for (let attempt = 0;attempt < CONFIG_LOCK_MAX_RETRIES; attempt++) {
     try {
@@ -72475,8 +72545,8 @@ function getErrorMap() {
 }
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path9, errorMaps, issueData } = params;
-  const fullPath = [...path9, ...issueData.path || []];
+  const { data, path: path10, errorMaps, issueData } = params;
+  const fullPath = [...path10, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -72588,11 +72658,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 class ParseInputLazyPath {
-  constructor(parent, value, path9, key) {
+  constructor(parent, value, path10, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path9;
+    this._path = path10;
     this._key = key;
   }
   get path() {
@@ -76100,6 +76170,7 @@ var LlmEngineSchema = exports_external.object({
   endpoint: chatCompletionsEndpoint,
   model: nonEmptyString,
   apiKey: exports_external.string().regex(ENV_REFERENCE_PATTERN, `apiKey must be $VAR or \${VAR}`).optional(),
+  apiKeyFile: nonEmptyString.optional(),
   temperature: exports_external.number().finite().optional(),
   maxTokens: positiveInt.optional(),
   timeoutMs: timeoutMsField,
@@ -76113,6 +76184,13 @@ var LlmEngineSchema = exports_external.object({
     if (key in value)
       ctx.addIssue({ code: exports_external.ZodIssueCode.custom, path: [key], message: `${key} is not valid on an LLM engine` });
   }
+  if (value.apiKey !== undefined && value.apiKeyFile !== undefined) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["apiKeyFile"],
+      message: "apiKey and apiKeyFile cannot both be set"
+    });
+  }
 });
 var AgentEngineSchema = exports_external.object({
   kind: exports_external.literal("agent"),
@@ -76130,6 +76208,7 @@ var AgentEngineSchema = exports_external.object({
     "provider",
     "endpoint",
     "apiKey",
+    "apiKeyFile",
     "temperature",
     "maxTokens",
     "concurrency",
@@ -76867,7 +76946,7 @@ var AkmConfigSchema = AkmConfigBaseSchema.superRefine((config, ctx) => {
 // src/core/config/config-sources.ts
 init_errors();
 import { createHash } from "node:crypto";
-import path9 from "node:path";
+import path10 from "node:path";
 function bundleComponentConfig(bundle) {
   if (!bundle?.components)
     return;
@@ -76878,7 +76957,20 @@ function bundleComponentConfig(bundle) {
   return components[0];
 }
 function bundleContentRoot(entryPath, componentRoot) {
-  return path9.resolve(entryPath, componentRoot ?? ".");
+  return path10.resolve(entryPath, componentRoot ?? ".");
+}
+function bundleContentRoots(config) {
+  const bundles = config.bundles ?? {};
+  const out = [];
+  for (const [id, entry] of Object.entries(bundles)) {
+    if (typeof entry.path !== "string" || entry.path.length === 0)
+      continue;
+    out.push({ id, contentRoot: bundleContentRoot(entry.path, bundleComponentConfig(entry)?.root) });
+  }
+  return out;
+}
+function bundleKeyForContentRoot(config, resolvedContentRoot) {
+  return bundleContentRoots(config).find((entry) => entry.contentRoot === resolvedContentRoot)?.id;
 }
 function bundlesToSourceEntries(config) {
   const bundles = config.bundles;
@@ -77191,7 +77283,7 @@ init_paths();
 // src/core/state-db.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import fs9 from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 
 // src/storage/engines/sqlite-migrations.ts
 function assertMigrationRegistry(migrations) {
@@ -77360,7 +77452,7 @@ function withImmediateWriteLock(db, fn) {
 
 // src/storage/managed-db.ts
 import fs7 from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // src/storage/sqlite-pragmas.ts
 init_warn();
@@ -77434,7 +77526,7 @@ function warnNetworkFallbackOnce(dataDir) {
 
 // src/storage/managed-db.ts
 function openManagedDatabase(spec) {
-  const dir = path10.dirname(spec.path);
+  const dir = path11.dirname(spec.path);
   if (spec.create !== false && !fs7.existsSync(dir)) {
     fs7.mkdirSync(dir, { recursive: true });
   }
@@ -77472,13 +77564,13 @@ function withManagedDb(open, fn, opts) {
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs8 from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 init_errors();
 init_paths();
 var heldBarrierContext = new AsyncLocalStorage;
 function tryAcquireMaintenanceBarrier() {
   const lockPath = getMaintenanceBarrierPath();
-  fs8.mkdirSync(path11.dirname(lockPath), { recursive: true });
+  fs8.mkdirSync(path12.dirname(lockPath), { recursive: true });
   for (let attempt = 0;attempt < 2; attempt += 1) {
     const ownership = tryAcquireLockSync(lockPath, createLockPayload({ purpose: "maintenance-start" }));
     if (ownership) {
@@ -77529,9 +77621,9 @@ function withMaintenanceStartBarrierSyncWait(run) {
 }
 function acquireMaintenanceActivitySync(name) {
   return withMaintenanceStartBarrierSyncWait(() => {
-    const directory = path11.join(path11.dirname(getMaintenanceBarrierPath()), "maintenance-activities");
+    const directory = path12.join(path12.dirname(getMaintenanceBarrierPath()), "maintenance-activities");
     fs8.mkdirSync(directory, { recursive: true, mode: 448 });
-    const lockPath = path11.join(directory, `${name}-${process.pid}-${randomUUID2()}.lock`);
+    const lockPath = path12.join(directory, `${name}-${process.pid}-${randomUUID2()}.lock`);
     const ownership = tryAcquireLockSync(lockPath, createLockPayload({ purpose: name }));
     if (!ownership) {
       throw new ConfigError(`Could not register AKM maintenance activity at ${lockPath}.`, "INVALID_CONFIG_FILE");
@@ -78297,7 +78389,7 @@ function runMigrations2(db, options) {
 
 // src/core/state-db.ts
 function getStateDbPath() {
-  return path12.join(getDataDir(), "state.db");
+  return path13.join(getDataDir(), "state.db");
 }
 function safetyCopyTimestamp() {
   return new Date().toISOString().replaceAll(/[^0-9]/g, "");
@@ -78482,7 +78574,7 @@ function createHistoricalStateSafetyCopy(source, migrationId) {
     fs9.fchmodSync(reservation.fd, finalMode);
     fs9.fsyncSync(reservation.fd);
     assertOwnedFileReservation(reservation, "Reserved state.db safety copy");
-    fsyncDirectory(path12.dirname(reservation.path));
+    fsyncDirectory(path13.dirname(reservation.path));
     closeFileIdentity(reservation);
     return reservation.path;
   } catch (error) {
@@ -78500,11 +78592,11 @@ function openStateDatabase(dbPath, options) {
   if (resolvedPath === ":memory:") {
     return openManagedDatabase({
       path: resolvedPath,
-      pragmas: { dataDir: path12.dirname(resolvedPath) },
+      pragmas: { dataDir: path13.dirname(resolvedPath) },
       init: (db) => runMigrations2(db, { freshDatabase: true })
     });
   }
-  const isCanonical = path12.resolve(resolvedPath) === path12.resolve(canonicalPath);
+  const isCanonical = path13.resolve(resolvedPath) === path13.resolve(canonicalPath);
   const releaseActivity = isCanonical ? acquireMaintenanceActivitySync("state-db") : undefined;
   let freshReservation;
   let existingSource;
@@ -78512,7 +78604,7 @@ function openStateDatabase(dbPath, options) {
   let existingUnversionedDatabase = false;
   let stateSafetyCopyCreated = false;
   try {
-    fs9.mkdirSync(path12.dirname(resolvedPath), { recursive: true });
+    fs9.mkdirSync(path13.dirname(resolvedPath), { recursive: true });
     freshReservation = reserveFreshStateDatabase(resolvedPath);
     if (!freshReservation) {
       existingSource = openExistingStateDatabaseSource(resolvedPath);
@@ -78533,7 +78625,7 @@ function openStateDatabase(dbPath, options) {
     const boundSource = existingSource;
     openedDb = openManagedDatabase({
       path: boundSource ? sqliteBoundFilePath(boundSource) : resolvedPath,
-      pragmas: { dataDir: path12.dirname(resolvedPath) },
+      pragmas: { dataDir: path13.dirname(resolvedPath) },
       init: (db2) => {
         runMigrations2(db2, {
           freshDatabase: !!freshReservation,
@@ -78734,7 +78826,7 @@ function applyConfigExtraParamsLift(configPath) {
 
 // scripts/akm-migrate/migrate/dead-residue.ts
 import fs10 from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 var DEAD_RESIDUE_PATHS = [
   { name: "proposals", reason: "superseded by the `proposals` table in $DATA/state.db (0.9.0)" },
   { prefix: "runs.archived-", reason: "orphaned archive of a directory that no longer exists" },
@@ -78756,7 +78848,7 @@ function dirSizeBytes(target) {
     return 0;
   }
   for (const entry of entries) {
-    const entryPath = path13.join(target, entry.name);
+    const entryPath = path14.join(target, entry.name);
     if (entry.isDirectory()) {
       total += dirSizeBytes(entryPath);
     } else if (entry.isFile()) {
@@ -78772,7 +78864,7 @@ function sizeOf(target) {
   return st.isDirectory() ? dirSizeBytes(target) : st.size;
 }
 function findDeadResidueEntries(stashDir) {
-  const akmDir = path13.join(stashDir, ".akm");
+  const akmDir = path14.join(stashDir, ".akm");
   let names;
   try {
     names = fs10.readdirSync(akmDir);
@@ -78785,14 +78877,14 @@ function findDeadResidueEntries(stashDir) {
     for (const name of matches) {
       if (!names.includes(name))
         continue;
-      const absolutePath = path13.join(akmDir, name);
+      const absolutePath = path14.join(akmDir, name);
       let sizeBytes;
       try {
         sizeBytes = sizeOf(absolutePath);
       } catch {
         continue;
       }
-      found.push({ relativePath: path13.join(".akm", name), absolutePath, sizeBytes, reason: spec.reason });
+      found.push({ relativePath: path14.join(".akm", name), absolutePath, sizeBytes, reason: spec.reason });
     }
   }
   return found;
@@ -78819,7 +78911,7 @@ init_paths();
 init_warn();
 import { createHash as createHash2, randomUUID as randomUUID4 } from "node:crypto";
 import fs11 from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 var kinds = new Map;
 function registerTxnKind(kind, handler3) {
   kinds.set(kind, handler3);
@@ -78863,18 +78955,18 @@ function writeTxnFileDurably(filePath, content, mode = 384) {
   fs11.writeFileSync(tempPath, content, { mode });
   fsyncTxnFile(tempPath);
   fs11.renameSync(tempPath, filePath);
-  fsyncTxnDir(path14.dirname(filePath));
+  fsyncTxnDir(path15.dirname(filePath));
 }
 function canonicalTxnRoot(root) {
   try {
-    return fs11.realpathSync(path14.resolve(root));
+    return fs11.realpathSync(path15.resolve(root));
   } catch {
-    return path14.resolve(root);
+    return path15.resolve(root);
   }
 }
 function txnNamespaceDir(root) {
   const ns = txnHash(canonicalTxnRoot(root)).slice(0, 24);
-  return path14.join(getDataDir(), "txn", ns);
+  return path15.join(getDataDir(), "txn", ns);
 }
 function advanceTxn(txn, phase) {
   const handler3 = requireKind(txn.journal.kind);
@@ -78890,7 +78982,7 @@ function cleanupTxn(dir) {
   try {
     fs11.rmSync(dir, { recursive: true, force: true });
     try {
-      fs11.rmdirSync(path14.dirname(dir));
+      fs11.rmdirSync(path15.dirname(dir));
     } catch {}
     return null;
   } catch (error) {
@@ -78912,8 +79004,8 @@ function sweepJournallessTxnDir(dir, graceMs = TXN_SWEEP_GRACE_MS) {
   }
 }
 function isWithinTxnRoot(candidate, root) {
-  const rel = path14.relative(path14.resolve(root), path14.resolve(candidate));
-  return rel !== "" && !rel.startsWith("..") && !path14.isAbsolute(rel);
+  const rel = path15.relative(path15.resolve(root), path15.resolve(candidate));
+  return rel !== "" && !rel.startsWith("..") && !path15.isAbsolute(rel);
 }
 function readJournal(journalPath) {
   let journal;
@@ -78954,8 +79046,8 @@ async function recoverTxnsForRoot(root, filter) {
   for (const entry of fs11.readdirSync(nsDir, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const dir = path14.join(nsDir, entry.name);
-    const journalPath = path14.join(dir, "journal.json");
+    const dir = path15.join(nsDir, entry.name);
+    const journalPath = path15.join(dir, "journal.json");
     if (!fs11.existsSync(journalPath)) {
       sweepJournallessTxnDir(dir);
       continue;
@@ -78984,7 +79076,7 @@ async function recoverTxnsForRoot(root, filter) {
   return recovered;
 }
 function listTxnJournalsTolerant(predicate) {
-  const home = path14.join(getDataDir(), "txn");
+  const home = path15.join(getDataDir(), "txn");
   const matches = [];
   const unreadableMtimes = [];
   if (!fs11.existsSync(home))
@@ -78992,11 +79084,11 @@ function listTxnJournalsTolerant(predicate) {
   for (const ns of fs11.readdirSync(home, { withFileTypes: true })) {
     if (!ns.isDirectory())
       continue;
-    const nsDir = path14.join(home, ns.name);
+    const nsDir = path15.join(home, ns.name);
     for (const entry of fs11.readdirSync(nsDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const journalPath = path14.join(nsDir, entry.name, "journal.json");
+      const journalPath = path15.join(nsDir, entry.name, "journal.json");
       let mtimeMs;
       try {
         mtimeMs = fs11.statSync(journalPath).mtimeMs;
@@ -79025,7 +79117,7 @@ import path60 from "node:path";
 init_frontmatter();
 init_common();
 import fs12 from "node:fs";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // src/core/adapter/adapters/shared.ts
 init_frontmatter();
@@ -79334,10 +79426,10 @@ var agentSkillsAdapter = {
   recognize,
   validate,
   readCandidates(c, conceptId) {
-    return [{ path: path16.join(c.root, conceptId, SKILL_MANIFEST), conceptId }];
+    return [{ path: path17.join(c.root, conceptId, SKILL_MANIFEST), conceptId }];
   },
   placeNew(c, conceptId) {
-    return path16.join(c.root, conceptId, SKILL_MANIFEST);
+    return path17.join(c.root, conceptId, SKILL_MANIFEST);
   },
   looksLikeRoot(root) {
     let entries;
@@ -79350,7 +79442,7 @@ var agentSkillsAdapter = {
       if (!entry.isDirectory())
         return false;
       try {
-        return fs12.existsSync(path16.join(root, entry.name, SKILL_MANIFEST));
+        return fs12.existsSync(path17.join(root, entry.name, SKILL_MANIFEST));
       } catch {
         return false;
       }
@@ -79363,66 +79455,66 @@ init_metadata();
 init_asset_placement();
 init_frontmatter();
 import fs16 from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/core/adapter/execution-source.ts
 init_dist();
 import { createHash as createHash4 } from "node:crypto";
 
 // src/execution/json.ts
-function fail(path18, detail) {
-  throw new TypeError(`${path18} ${detail}`);
+function fail(path19, detail) {
+  throw new TypeError(`${path19} ${detail}`);
 }
-function cloneExecutionJson(value, path18 = "execution value", ancestors = new Set) {
+function cloneExecutionJson(value, path19 = "execution value", ancestors = new Set) {
   if (value === null || typeof value === "string" || typeof value === "boolean")
     return value;
   if (typeof value === "number") {
     if (!Number.isFinite(value))
-      fail(path18, "must contain only finite numbers");
+      fail(path19, "must contain only finite numbers");
     return value;
   }
   if (value === undefined)
-    fail(path18, "must be omitted rather than set to undefined");
+    fail(path19, "must be omitted rather than set to undefined");
   if (typeof value !== "object")
-    fail(path18, "must be JSON-safe");
+    fail(path19, "must be JSON-safe");
   if (ancestors.has(value))
-    fail(path18, "must not contain a cycle");
+    fail(path19, "must not contain a cycle");
   const nextAncestors = new Set(ancestors);
   nextAncestors.add(value);
   if (Array.isArray(value)) {
     if (Object.getPrototypeOf(value) !== Array.prototype)
-      fail(path18, "array must use the standard Array prototype");
+      fail(path19, "array must use the standard Array prototype");
     const ownKeys = Reflect.ownKeys(value);
     const lengthDescriptor = Reflect.getOwnPropertyDescriptor(value, "length");
     if (!lengthDescriptor || !("value" in lengthDescriptor) || typeof lengthDescriptor.value !== "number" || !Number.isInteger(lengthDescriptor.value) || lengthDescriptor.value < 0) {
-      fail(path18, "array length must be a stable nonnegative integer data property");
+      fail(path19, "array length must be a stable nonnegative integer data property");
     }
     const length = lengthDescriptor.value;
     if (ownKeys.length !== length + 1) {
-      fail(path18, "array must be dense and contain no non-index properties");
+      fail(path19, "array must be dense and contain no non-index properties");
     }
     for (const key of ownKeys) {
       if (key === "length")
         continue;
       if (typeof key !== "string" || !/^(?:0|[1-9]\d*)$/.test(key) || Number(key) >= length) {
-        fail(path18, "array must contain only canonical index properties");
+        fail(path19, "array must contain only canonical index properties");
       }
     }
     const cloned2 = [];
     for (let index = 0;index < length; index++) {
       const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
       if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
-        fail(path18, "array must be dense enumerable data properties");
+        fail(path19, "array must be dense enumerable data properties");
       }
-      cloned2.push(cloneExecutionJson(descriptor.value, `${path18}[${index}]`, nextAncestors));
+      cloned2.push(cloneExecutionJson(descriptor.value, `${path19}[${index}]`, nextAncestors));
     }
     return Object.freeze(cloned2);
   }
-  const snapshot = snapshotStrictRecord(value, path18);
+  const snapshot = snapshotStrictRecord(value, path19);
   const cloned = Object.create(null);
   for (const [key, child] of Object.entries(snapshot)) {
     Object.defineProperty(cloned, key, {
-      value: cloneExecutionJson(child, `${path18}.${key}`, nextAncestors),
+      value: cloneExecutionJson(child, `${path19}.${key}`, nextAncestors),
       enumerable: true,
       configurable: false,
       writable: false
@@ -79430,10 +79522,10 @@ function cloneExecutionJson(value, path18 = "execution value", ancestors = new S
   }
   return Object.freeze(cloned);
 }
-function cloneExecutionJsonObject(value, path18) {
-  const cloned = cloneExecutionJson(value, path18);
+function cloneExecutionJsonObject(value, path19) {
+  const cloned = cloneExecutionJson(value, path19);
   if (cloned === null || Array.isArray(cloned) || typeof cloned !== "object") {
-    fail(path18, "must be a JSON object");
+    fail(path19, "must be a JSON object");
   }
   return cloned;
 }
@@ -79447,11 +79539,11 @@ var WINDOWS_DRIVE_PREFIX_PATTERN = /^[A-Za-z]:/;
 var RESERVED_EXTENSION_OWNERS = new Set(["__proto__", "constructor", "prototype", "tostring"]);
 var renderedSourceBrand = Symbol("akm.adapter-rendered-execution-source");
 var renderedSourceInstances = new WeakSet;
-function requireRecord(value, path18) {
-  return snapshotStrictRecord(value, path18);
+function requireRecord(value, path19) {
+  return snapshotStrictRecord(value, path19);
 }
-function assertOnlyKeys(value, allowed, path18) {
-  assertSnapshotKeys(value, allowed, path18);
+function assertOnlyKeys(value, allowed, path19) {
+  assertSnapshotKeys(value, allowed, path19);
 }
 function validateExtensionOwner(owner) {
   const normalized = owner.toLowerCase();
@@ -79467,16 +79559,16 @@ function frozenNullPrototypeMap(entries) {
   return Object.freeze(out);
 }
 function cloneExtensionEntry(value, index) {
-  const path18 = `extension entry ${index}`;
-  const cloned = cloneExecutionJson(value, path18);
+  const path19 = `extension entry ${index}`;
+  const cloned = cloneExecutionJson(value, path19);
   if (!Array.isArray(cloned) || cloned.length !== 2) {
-    throw new TypeError(`${path18} must be a two-element [owner, values] array`);
+    throw new TypeError(`${path19} must be a two-element [owner, values] array`);
   }
   const [owner, values] = cloned;
   if (typeof owner !== "string")
-    throw new TypeError(`${path18} owner must be a string`);
+    throw new TypeError(`${path19} owner must be a string`);
   if (values === null || Array.isArray(values) || typeof values !== "object") {
-    throw new TypeError(`${path18} values must be a JSON object`);
+    throw new TypeError(`${path19} values must be a JSON object`);
   }
   return [owner, values];
 }
@@ -79494,18 +79586,18 @@ function createAdapterExtensions(first, second, ...rest) {
   }
   return frozenNullPrototypeMap(cloned);
 }
-function cloneAdapterExtensions(value, path18) {
-  const record = requireRecord(value, path18);
-  const entries = Object.entries(record).map(([owner, fields]) => [owner, cloneExecutionJsonObject(fields, `${path18}.${owner}`)]);
+function cloneAdapterExtensions(value, path19) {
+  const record = requireRecord(value, path19);
+  const entries = Object.entries(record).map(([owner, fields]) => [owner, cloneExecutionJsonObject(fields, `${path19}.${owner}`)]);
   const [first, ...rest] = entries;
   return first ? createAdapterExtensions(first, ...rest) : frozenNullPrototypeMap([]);
 }
-function requireCanonicalString(value, path18) {
+function requireCanonicalString(value, path19) {
   if (typeof value !== "string" || value.length === 0 || !isWellFormedUnicode(value) || value.normalize("NFC") !== value) {
-    throw new TypeError(`${path18} must be a non-empty NFC string`);
+    throw new TypeError(`${path19} must be a non-empty NFC string`);
   }
   if (hasUnsafeIdentityCharacter(value)) {
-    throw new TypeError(`${path18} must not contain Unicode control or dangerous format characters`);
+    throw new TypeError(`${path19} must not contain Unicode control or dangerous format characters`);
   }
   return value;
 }
@@ -79532,38 +79624,38 @@ function isWellFormedUnicode(value) {
   }
   return true;
 }
-function validateCanonicalIdentity(input, path18) {
-  assertOnlyKeys(input, ["ref", "bundle", "adapter", "file", "hash"], path18);
-  const ref = requireCanonicalString(input.ref, `${path18}.ref`);
-  const bundle = requireCanonicalString(input.bundle, `${path18}.bundle`);
-  const adapter = requireCanonicalString(input.adapter, `${path18}.adapter`);
-  const file = requireCanonicalString(input.file, `${path18}.file`);
-  const hash = requireCanonicalString(input.hash, `${path18}.hash`);
+function validateCanonicalIdentity(input, path19) {
+  assertOnlyKeys(input, ["ref", "bundle", "adapter", "file", "hash"], path19);
+  const ref = requireCanonicalString(input.ref, `${path19}.ref`);
+  const bundle = requireCanonicalString(input.bundle, `${path19}.bundle`);
+  const adapter = requireCanonicalString(input.adapter, `${path19}.adapter`);
+  const file = requireCanonicalString(input.file, `${path19}.file`);
+  const hash = requireCanonicalString(input.hash, `${path19}.hash`);
   let parsed;
   try {
     parsed = parseBundleRef(ref);
   } catch (cause) {
-    throw new TypeError(`${path18}.ref is not a canonical bundle ref`, { cause });
+    throw new TypeError(`${path19}.ref is not a canonical bundle ref`, { cause });
   }
   if (parsed.bundle === undefined || parsed.bundle !== bundle || parsed.fragment !== undefined || !isBundleSlug(bundle) || bundleRefToString(parsed) !== ref) {
-    throw new TypeError(`${path18}.ref must round-trip as the same fully-qualified bundle ref without a fragment`);
+    throw new TypeError(`${path19}.ref must round-trip as the same fully-qualified bundle ref without a fragment`);
   }
   if (!EXECUTION_ADAPTER_ID_PATTERN.test(adapter)) {
-    throw new TypeError(`${path18}.adapter must use the current lowercase kebab-case adapter identifier grammar`);
+    throw new TypeError(`${path19}.adapter must use the current lowercase kebab-case adapter identifier grammar`);
   }
   const segments = file.split("/");
   if (file.startsWith("/") || WINDOWS_DRIVE_PREFIX_PATTERN.test(file) || file.includes("\\") || segments.some((segment) => !segment || segment === "." || segment === "..")) {
-    throw new TypeError(`${path18}.file must be a normalized relative POSIX path`);
+    throw new TypeError(`${path19}.file must be a normalized relative POSIX path`);
   }
   if (!/^[a-f0-9]{64}$/.test(hash))
-    throw new TypeError(`${path18}.hash must be a SHA-256 hex digest`);
+    throw new TypeError(`${path19}.hash must be a SHA-256 hex digest`);
   return { ref, bundle, adapter, file, hash };
 }
 function createExecutionSourceIdentity(input) {
   return Object.freeze(validateCanonicalIdentity(requireRecord(input, "execution source identity"), "execution source identity"));
 }
-function cloneUnresolvedExecutionDefaults(input, path18 = "execution source defaults") {
-  const record = requireRecord(input, path18);
+function cloneUnresolvedExecutionDefaults(input, path19 = "execution source defaults") {
+  const record = requireRecord(input, path19);
   assertOnlyKeys(record, [
     "agent",
     "engine",
@@ -79575,47 +79667,47 @@ function cloneUnresolvedExecutionDefaults(input, path18 = "execution source defa
     "workspace",
     "environment",
     "runtime"
-  ], path18);
-  const json = { ...cloneExecutionJsonObject(record, path18) };
+  ], path19);
+  const json = { ...cloneExecutionJsonObject(record, path19) };
   for (const key of ["agent", "engine", "model", "workspace"]) {
     const value = json[key];
     if (value !== undefined && value !== null && typeof value !== "string") {
-      throw new TypeError(`${path18}.${key} must be a string or null`);
+      throw new TypeError(`${path19}.${key} must be a string or null`);
     }
   }
   const timeout = json.timeout;
   if (timeout !== undefined && timeout !== null && typeof timeout !== "string" && typeof timeout !== "number") {
-    throw new TypeError(`${path18}.timeout must be a string, number, or null`);
+    throw new TypeError(`${path19}.timeout must be a string, number, or null`);
   }
   for (const key of ["inference", "outputSchema", "runtime"]) {
     const value = json[key];
     if (value !== undefined && value !== null && (Array.isArray(value) || typeof value !== "object")) {
-      throw new TypeError(`${path18}.${key} must be an object or null`);
+      throw new TypeError(`${path19}.${key} must be an object or null`);
     }
   }
   const environment = json.environment;
   if (environment !== undefined && environment !== null) {
     if (Array.isArray(environment) || typeof environment !== "object") {
-      throw new TypeError(`${path18}.environment must be an object or null`);
+      throw new TypeError(`${path19}.environment must be an object or null`);
     }
     if (Object.values(environment).some((value) => typeof value !== "string")) {
-      throw new TypeError(`${path18}.environment values must be strings`);
+      throw new TypeError(`${path19}.environment values must be strings`);
     }
   }
   if (Object.hasOwn(json, "tools"))
-    json.tools = cloneToolSelection(json.tools, `${path18}.tools`);
+    json.tools = cloneToolSelection(json.tools, `${path19}.tools`);
   return Object.freeze(json);
 }
-function cloneToolSelection(value, path18 = "tools") {
+function cloneToolSelection(value, path19 = "tools") {
   if (value === null || typeof value === "string")
     return value;
-  const cloned = cloneExecutionJson(value, path18);
+  const cloned = cloneExecutionJson(value, path19);
   if (Array.isArray(cloned)) {
     if (cloned.some((tool) => typeof tool !== "string"))
-      throw new TypeError(`${path18} array values must be strings`);
+      throw new TypeError(`${path19} array values must be strings`);
     return cloned;
   }
-  return cloneExecutionJsonObject(cloned, path18);
+  return cloneExecutionJsonObject(cloned, path19);
 }
 function createAdapterRenderedExecutionSource(input) {
   const record = requireRecord(input, "adapter-rendered execution source");
@@ -79724,34 +79816,34 @@ function parseExecutionMarkdown(raw) {
 function own(data, key) {
   return Object.hasOwn(data, key);
 }
-function requireMetadataMapping(value, path18) {
+function requireMetadataMapping(value, path19) {
   try {
-    return snapshotStrictRecord(value, path18);
+    return snapshotStrictRecord(value, path19);
   } catch (cause) {
-    throw new TypeError(`${path18} must be a mapping with enumerable data fields`, { cause });
+    throw new TypeError(`${path19} must be a mapping with enumerable data fields`, { cause });
   }
 }
-function nullableString(value, path18) {
+function nullableString(value, path19) {
   if (value !== null && typeof value !== "string")
-    throw new TypeError(`${path18} must be a string or null`);
+    throw new TypeError(`${path19} must be a string or null`);
   return value;
 }
-function nullableObject(value, path18) {
-  return value === null ? null : cloneExecutionJsonObject(value, path18);
+function nullableObject(value, path19) {
+  return value === null ? null : cloneExecutionJsonObject(value, path19);
 }
-function nullableEnvironment(value, path18) {
+function nullableEnvironment(value, path19) {
   if (value === null)
     return null;
-  const environment = cloneExecutionJsonObject(value, path18);
+  const environment = cloneExecutionJsonObject(value, path19);
   if (Object.values(environment).some((entry) => typeof entry !== "string")) {
-    throw new TypeError(`${path18} values must be strings`);
+    throw new TypeError(`${path19} values must be strings`);
   }
   return environment;
 }
-function nullableTimeout(value, path18) {
-  const timeout = cloneExecutionJson(value, path18);
+function nullableTimeout(value, path19) {
+  const timeout = cloneExecutionJson(value, path19);
   if (timeout !== null && typeof timeout !== "string" && typeof timeout !== "number") {
-    throw new TypeError(`${path18} must be a string, number, or null`);
+    throw new TypeError(`${path19} must be a string, number, or null`);
   }
   return timeout;
 }
@@ -80195,7 +80287,7 @@ function recognizeMatch(file) {
 }
 
 // src/core/adapter/adapters/akm-lint.ts
-import path23 from "node:path";
+import path24 from "node:path";
 
 // src/commands/lint/env-key-rules.ts
 init_env();
@@ -80318,28 +80410,28 @@ var MOVE_TO_ENV = "Workflow params are copied verbatim into every native unit ex
 function detectSecretShapedParams(params) {
   const warnings = [];
   const seen = new Set;
-  const push = (path19, why) => {
-    if (seen.has(path19))
+  const push = (path20, why) => {
+    if (seen.has(path20))
       return;
-    seen.add(path19);
-    warnings.push(`Run param "${path19}" ${why}. ${MOVE_TO_ENV} (Heuristic warning; params are declared non-secret.)`);
+    seen.add(path20);
+    warnings.push(`Run param "${path20}" ${why}. ${MOVE_TO_ENV} (Heuristic warning; params are declared non-secret.)`);
   };
-  const walk = (value, path19, key) => {
+  const walk = (value, path20, key) => {
     if (key !== null && keyLooksSecret(key))
-      push(path19, "has a secret-suggesting name");
+      push(path20, "has a secret-suggesting name");
     if (typeof value === "string") {
       if (valueLooksSecret(value))
-        push(path19, "has a secret-shaped value (long, high-entropy string)");
+        push(path20, "has a secret-shaped value (long, high-entropy string)");
       return;
     }
     if (Array.isArray(value)) {
       for (let i = 0;i < value.length; i++)
-        walk(value[i], `${path19}[${i}]`, null);
+        walk(value[i], `${path20}[${i}]`, null);
       return;
     }
     if (value && typeof value === "object") {
       for (const [k, v] of Object.entries(value)) {
-        walk(v, path19 ? `${path19}.${k}` : k, k);
+        walk(v, path20 ? `${path20}.${k}` : k, k);
       }
     }
   };
@@ -80787,8 +80879,8 @@ init_dist();
 init_asset_ref();
 init_extra_params();
 init_resource_limits();
-import crypto3 from "node:crypto";
-import path19 from "node:path";
+import crypto4 from "node:crypto";
+import path20 from "node:path";
 
 // src/tasks/task-id.ts
 init_errors();
@@ -81230,7 +81322,7 @@ var KNOWN_PROMPT_REF_FAMILIES = new Set([
   "workflows"
 ]);
 function hash(bytes) {
-  return crypto3.createHash("sha256").update(bytes).digest("hex");
+  return crypto4.createHash("sha256").update(bytes).digest("hex");
 }
 function base(input) {
   return {
@@ -81389,7 +81481,7 @@ function addSharedNonPromptOverrides(data, akm) {
 }
 function promptSourceKind(raw) {
   const trimmed = raw.trim();
-  if (trimmed.startsWith("./") || trimmed.startsWith("../") || path19.isAbsolute(trimmed) || /^[A-Za-z]:[\\/]/.test(trimmed)) {
+  if (trimmed.startsWith("./") || trimmed.startsWith("../") || path20.isAbsolute(trimmed) || /^[A-Za-z]:[\\/]/.test(trimmed)) {
     return "file";
   }
   try {
@@ -81496,7 +81588,7 @@ function planLegacyTaskDataToV3(input, data) {
     return blocked(input, "read-only-source", !input.writable ? "the owning source is not writable" : "the source file or publication directory is read-only");
   }
   try {
-    validateTaskId(path19.basename(input.filePath, ".yml"));
+    validateTaskId(path20.basename(input.filePath, ".yml"));
   } catch (cause) {
     return blocked(input, "invalid-v2-task", cause instanceof Error ? cause.message : String(cause));
   }
@@ -81566,7 +81658,7 @@ function planTaskToV3File(input) {
   return planLegacyTaskDataToV3(input, data);
 }
 function generationFor(files) {
-  const digest = crypto3.createHash("sha256");
+  const digest = crypto4.createHash("sha256");
   digest.update("akm-task-to-v3-plan-v1\x00");
   for (const file of files) {
     digest.update(file.filePath);
@@ -81600,7 +81692,7 @@ function taskToV3PlanFromOutcomes(outcomes) {
   for (let index = 1;index < files.length; index += 1) {
     const previous = files[index - 1];
     const current = files[index];
-    if (previous && current && path19.resolve(previous.filePath) === path19.resolve(current.filePath)) {
+    if (previous && current && path20.resolve(previous.filePath) === path20.resolve(current.filePath)) {
       throw new Error(`duplicate task migration file path: ${current.filePath}`);
     }
   }
@@ -81610,7 +81702,7 @@ function planTaskToV3Migration(inputs) {
   const sorted = [...inputs].sort((left, right) => left.filePath < right.filePath ? -1 : left.filePath > right.filePath ? 1 : 0);
   let previous;
   for (const current of sorted) {
-    if (previous && path19.resolve(previous.filePath) === path19.resolve(current.filePath)) {
+    if (previous && path20.resolve(previous.filePath) === path20.resolve(current.filePath)) {
       throw new Error(`duplicate task migration file path: ${current.filePath}`);
     }
     previous = current;
@@ -81621,8 +81713,8 @@ function planTaskToV3Migration(inputs) {
 // src/tasks/source/task-to-v4.ts
 init_dist();
 init_bounded_document();
-import crypto4 from "node:crypto";
-import path20 from "node:path";
+import crypto5 from "node:crypto";
+import path21 from "node:path";
 var V3_TOP_LEVEL_KEYS = new Set([
   "version",
   "name",
@@ -81668,7 +81760,7 @@ var AKM_HOIST_KEYS = [
   "maxRetries"
 ];
 function hash2(bytes) {
-  return crypto4.createHash("sha256").update(bytes).digest("hex");
+  return crypto5.createHash("sha256").update(bytes).digest("hex");
 }
 function causeMessage(cause) {
   return cause instanceof Error ? cause.message : String(cause);
@@ -81937,7 +82029,7 @@ function planTaskToV4File(input) {
   return planV3DataToV4(input, data);
 }
 function generationFor2(files) {
-  const digest = crypto4.createHash("sha256");
+  const digest = crypto5.createHash("sha256");
   digest.update("akm-task-to-v4-plan-v1\x00");
   for (const file of files) {
     digest.update(file.filePath);
@@ -81974,7 +82066,7 @@ function taskToV4PlanFromOutcomes(outcomes) {
   for (let index = 1;index < files.length; index += 1) {
     const previous = files[index - 1];
     const current = files[index];
-    if (previous && current && path20.resolve(previous.filePath) === path20.resolve(current.filePath)) {
+    if (previous && current && path21.resolve(previous.filePath) === path21.resolve(current.filePath)) {
       throw new Error(`duplicate task migration file path: ${current.filePath}`);
     }
   }
@@ -81984,7 +82076,7 @@ function planTaskToV4Migration(inputs) {
   const sorted = [...inputs].sort((left, right) => left.filePath < right.filePath ? -1 : left.filePath > right.filePath ? 1 : 0);
   let previous;
   for (const current of sorted) {
-    if (previous && path20.resolve(previous.filePath) === path20.resolve(current.filePath)) {
+    if (previous && path21.resolve(previous.filePath) === path21.resolve(current.filePath)) {
       throw new Error(`duplicate task migration file path: ${current.filePath}`);
     }
     previous = current;
@@ -82299,7 +82391,7 @@ function checkInvalidTypeValue(data, allowedTypes) {
   return `type field has invalid value '${value}'; expected one of: ${allowedTypes.join(", ")}`;
 }
 function suggestSlug(filePath) {
-  return path23.basename(filePath, ".md").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return path24.basename(filePath, ".md").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function nameOrTypeDiagnostics(relPath, data, frontmatter, allowedTypes) {
   const missingFieldDetail = checkMissingNameOrType(data, frontmatter);
@@ -82339,7 +82431,7 @@ function collectSuppressedKeys(raw) {
 function dangerousEnvKeyDiagnostics(type, relPath, raw) {
   if (type !== "env" && type !== "secret")
     return [];
-  const baseNameWithExt = path23.basename(relPath);
+  const baseNameWithExt = path24.basename(relPath);
   if (!baseNameWithExt.endsWith(".env"))
     return [];
   const ref = conceptIdForStashFile(type, ".", relPath);
@@ -82485,7 +82577,7 @@ function workflowFrontendDiagnostics(relPath, raw, parsePath2) {
       }
       return { errors: errors3, warnings };
     }
-    const compiled = compileWorkflowPlan(result.ir, path23.basename(parsePath2, path23.extname(parsePath2)));
+    const compiled = compileWorkflowPlan(result.ir, path24.basename(parsePath2, path24.extname(parsePath2)));
     if (!compiled.ok) {
       for (const err of compiled.errors) {
         errors3.push({
@@ -82803,13 +82895,13 @@ function isReservedFileName(name) {
 }
 var WIKI_INFRA_FILES = new Set(["schema.md", "index.md", "log.md"]);
 function akmStashAbstains(root, absPath) {
-  const relPath = path24.relative(root, absPath);
-  if (!relPath || relPath.startsWith("..") || path24.isAbsolute(relPath))
+  const relPath = path25.relative(root, absPath);
+  if (!relPath || relPath.startsWith("..") || path25.isAbsolute(relPath))
     return false;
   const segments = relPath.split(/[\\/]+/).filter(Boolean);
   if (segments.length === 0)
     return false;
-  if (segments[0] === "env" && (absPath.endsWith(".env") || path24.basename(absPath) === ".env")) {
+  if (segments[0] === "env" && (absPath.endsWith(".env") || path25.basename(absPath) === ".env")) {
     if (fs16.existsSync(absPath.replace(/\.env$/, ".sensitive")))
       return true;
   }
@@ -82916,7 +83008,7 @@ function recognize2(c, file) {
     return null;
   const stashDir = stashDirFor(match.type);
   const canonicalName = stashDir !== undefined ? conceptId.slice(stashDir.length + 1) : conceptId;
-  const dirPath = path24.dirname(file.absPath);
+  const dirPath = path25.dirname(file.absPath);
   const entry = {
     name: canonicalName,
     type: match.type,
@@ -82962,13 +83054,13 @@ function renderExecutionSource(c, file) {
   });
 }
 function buildOverlayContext(root, relPathInput, raw) {
-  const absPath = path24.join(root, relPathInput);
-  const relPath = path24.relative(root, absPath).replace(/\\/g, "/");
-  const ext = path24.extname(absPath).toLowerCase();
-  const fileName = path24.basename(absPath);
-  const parentDirAbs = path24.dirname(absPath);
-  const parentDir = path24.basename(parentDirAbs);
-  const relDir = path24.dirname(relPath).replace(/\\/g, "/");
+  const absPath = path25.join(root, relPathInput);
+  const relPath = path25.relative(root, absPath).replace(/\\/g, "/");
+  const ext = path25.extname(absPath).toLowerCase();
+  const fileName = path25.basename(absPath);
+  const parentDirAbs = path25.dirname(absPath);
+  const parentDir = path25.basename(parentDirAbs);
+  const relDir = path25.dirname(relPath).replace(/\\/g, "/");
   const ancestorDirs = relDir === "." ? [] : relDir.split("/").filter((seg) => seg.length > 0);
   let cachedFrontmatter;
   let frontmatterComputed = false;
@@ -83066,13 +83158,13 @@ var akmAdapter = {
     const posix = conceptId.replace(/\\/g, "/");
     const slash = posix.indexOf("/");
     if (slash <= 0)
-      return [{ path: path24.join(c.root, `${posix}.md`), conceptId: posix }];
+      return [{ path: path25.join(c.root, `${posix}.md`), conceptId: posix }];
     const head = posix.slice(0, slash);
     const rest = posix.slice(slash + 1);
     const type = stashDirToType(head);
     if (type === undefined || rest.length === 0)
       return [];
-    const canonical = assetPathCandidatesForName(type, path24.join(c.root, head), rest);
+    const canonical = assetPathCandidatesForName(type, path25.join(c.root, head), rest);
     const loose = assetPathCandidatesForName(type, c.root, rest);
     return [...new Set([...canonical, ...loose])].map((candidatePath) => ({
       path: candidatePath,
@@ -83087,18 +83179,18 @@ var akmAdapter = {
       const rest = posix.slice(slash + 1);
       const type = stashDirToType(head);
       if (type !== undefined && rest.length > 0) {
-        const typeDir = path24.join(c.root, head);
+        const typeDir = path25.join(c.root, head);
         return assetPathForName(type, typeDir, rest);
       }
     }
-    return path24.join(c.root, `${posix}.md`);
+    return path25.join(c.root, `${posix}.md`);
   },
   directoryList(_c) {
     return [...new Set(stashDirNames())];
   },
   looksLikeRoot(root) {
     try {
-      if (fs16.statSync(path24.join(root, ".stash")).isDirectory())
+      if (fs16.statSync(path25.join(root, ".stash")).isDirectory())
         return true;
     } catch {}
     const ownedDirNames = new Set(stashDirNames());
@@ -83116,10 +83208,10 @@ var akmAdapter = {
       return false;
     const expectedType = stashDirToType(only.name);
     try {
-      const markdown = fs16.readdirSync(path24.join(root, only.name), { withFileTypes: true }).find((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".md"));
+      const markdown = fs16.readdirSync(path25.join(root, only.name), { withFileTypes: true }).find((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".md"));
       if (!markdown)
         return true;
-      const data = parseFrontmatter(fs16.readFileSync(path24.join(root, only.name, markdown.name), "utf8")).data;
+      const data = parseFrontmatter(fs16.readFileSync(path25.join(root, only.name, markdown.name), "utf8")).data;
       const declaredType = typeof data.type === "string" ? data.type.trim() : "";
       return !declaredType || declaredType === expectedType;
     } catch {
@@ -83130,7 +83222,7 @@ var akmAdapter = {
 
 // src/core/adapter/adapters/akm-task-adapter.ts
 import fs17 from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 init_common();
 var COMPONENT_ID2 = "main";
 var TASK_EXT = TASK_EXTENSION;
@@ -83161,7 +83253,7 @@ async function validate3(c, changes, ctx) {
     const raw = change.after ?? await ctx.readFile(change.path);
     if (typeof raw !== "string")
       continue;
-    const ext = path25.extname(change.path).toLowerCase();
+    const ext = path26.extname(change.path).toLowerCase();
     if (ext !== TASK_EXT && ext !== TASK_NEAR_MISS_EXTENSION)
       continue;
     const relPath = toPosix(change.path);
@@ -83196,13 +83288,13 @@ var akmTaskAdapter = {
   readCandidates(c, conceptId) {
     const posix = toPosix(conceptId).replace(/\.ya?ml$/i, "");
     return [
-      { path: path25.join(c.root, `${posix}.yml`), conceptId: posix },
-      { path: path25.join(c.root, `${posix}.yaml`), conceptId: posix }
+      { path: path26.join(c.root, `${posix}.yml`), conceptId: posix },
+      { path: path26.join(c.root, `${posix}.yaml`), conceptId: posix }
     ];
   },
   placeNew(c, conceptId) {
     const posix = toPosix(conceptId);
-    return path25.join(c.root, /\.yml$/i.test(posix) ? posix : `${posix}.yml`);
+    return path26.join(c.root, /\.yml$/i.test(posix) ? posix : `${posix}.yml`);
   },
   directoryList() {
     return ["."];
@@ -83215,11 +83307,11 @@ var akmTaskAdapter = {
       return false;
     }
     for (const entry of entries) {
-      if (!entry.isFile() || path25.extname(entry.name).toLowerCase() !== TASK_EXT)
+      if (!entry.isFile() || path26.extname(entry.name).toLowerCase() !== TASK_EXT)
         continue;
       let raw;
       try {
-        raw = fs17.readFileSync(path25.join(root, entry.name), "utf8");
+        raw = fs17.readFileSync(path26.join(root, entry.name), "utf8");
       } catch {
         continue;
       }
@@ -83237,7 +83329,7 @@ init_compile();
 init_frontmatter();
 init_common();
 import fs18 from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 var COMPONENT_ID3 = "main";
 var WORKFLOW_EXTS = new Set([".md", ".yml"]);
 function conceptIdOf(relPath) {
@@ -83291,8 +83383,8 @@ async function validate4(c, changes, ctx) {
     const raw = change.after ?? await ctx.readFile(change.path);
     if (typeof raw !== "string")
       continue;
-    const ext = path26.extname(change.path).toLowerCase();
-    if (!WORKFLOW_EXTS.has(ext) || isReservedDocFile(path26.basename(change.path)))
+    const ext = path27.extname(change.path).toLowerCase();
+    if (!WORKFLOW_EXTS.has(ext) || isReservedDocFile(path27.basename(change.path)))
       continue;
     const relPath = toPosix(change.path);
     if (ext === ".yml") {
@@ -83321,12 +83413,12 @@ function hasTopLevelWorkflowFile(root, entries) {
   for (const entry of entries) {
     if (!entry.isFile())
       continue;
-    const ext = path26.extname(entry.name).toLowerCase();
+    const ext = path27.extname(entry.name).toLowerCase();
     if (!WORKFLOW_EXTS.has(ext) || isReservedDocFile(entry.name))
       continue;
     let raw;
     try {
-      raw = fs18.readFileSync(path26.join(root, entry.name), "utf8");
+      raw = fs18.readFileSync(path27.join(root, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -83346,16 +83438,16 @@ var akmWorkflowAdapter = {
   readCandidates(c, conceptId) {
     const posix = toPosix(conceptId);
     const canonical = posix.replace(/\.(?:md|yml)$/i, "");
-    return /\.(?:md|yml)$/i.test(posix) ? [{ path: path26.join(c.root, posix), conceptId: canonical }] : [
-      { path: path26.join(c.root, `${posix}.md`), conceptId: canonical },
-      { path: path26.join(c.root, `${posix}.yml`), conceptId: canonical }
+    return /\.(?:md|yml)$/i.test(posix) ? [{ path: path27.join(c.root, posix), conceptId: canonical }] : [
+      { path: path27.join(c.root, `${posix}.md`), conceptId: canonical },
+      { path: path27.join(c.root, `${posix}.yml`), conceptId: canonical }
     ];
   },
   placeNew(c, conceptId) {
     const posix = toPosix(conceptId);
     if (/\.(?:md|yml)$/i.test(posix))
-      return path26.join(c.root, posix);
-    return path26.join(c.root, `${posix}.md`);
+      return path27.join(c.root, posix);
+    return path27.join(c.root, `${posix}.md`);
   },
   directoryList() {
     return ["."];
@@ -83373,10 +83465,10 @@ var akmWorkflowAdapter = {
 
 // src/core/adapter/adapters/claude-adapter.ts
 import fs19 from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 
 // src/core/adapter/adapters/tool-dir-shared.ts
-import path27 from "node:path";
+import path28 from "node:path";
 init_frontmatter();
 init_common();
 var CANONICAL_COMMAND_DIR = "commands";
@@ -83398,7 +83490,7 @@ function classify(relPath, layout) {
     return { type: "instruction", conceptId: layout.instructionConceptId, name: layout.instructionConceptId };
   }
   const head = segs[0];
-  const ext = path27.extname(base3).toLowerCase();
+  const ext = path28.extname(base3).toLowerCase();
   if (layout.skillDirs.has(head)) {
     if (segs.length === 3 && base3 === SKILL_MANIFEST2) {
       return { type: "skill", conceptId: `${segs[0]}/${segs[1]}`, name: segs[1] };
@@ -83447,24 +83539,24 @@ function recognizeToolDir(layout, c, file) {
 function placeNewToolDir(layout, c, conceptId) {
   const posix = toPosix(conceptId);
   if (posix === layout.instructionConceptId)
-    return path27.join(c.root, layout.instructionFile);
+    return path28.join(c.root, layout.instructionFile);
   const segs = posix.split("/").filter((s) => s.length > 0);
   const head = segs[0];
   const rest = segs.slice(1).join("/");
   if (rest.length > 0) {
     if (layout.skillDirs.has(head))
-      return path27.join(c.root, CANONICAL_SKILL_DIR, rest, SKILL_MANIFEST2);
+      return path28.join(c.root, CANONICAL_SKILL_DIR, rest, SKILL_MANIFEST2);
     if (layout.commandDirs.has(head))
-      return path27.join(c.root, CANONICAL_COMMAND_DIR, `${rest}.md`);
+      return path28.join(c.root, CANONICAL_COMMAND_DIR, `${rest}.md`);
     if (layout.agentDirs.has(head))
-      return path27.join(c.root, CANONICAL_AGENT_DIR, `${rest}.md`);
+      return path28.join(c.root, CANONICAL_AGENT_DIR, `${rest}.md`);
   }
-  return path27.join(c.root, `${posix}.md`);
+  return path28.join(c.root, `${posix}.md`);
 }
 function readCandidatesToolDir(layout, c, conceptId) {
   const posix = toPosix(conceptId);
   if (posix === layout.instructionConceptId) {
-    return [{ path: path27.join(c.root, layout.instructionFile), conceptId: posix }];
+    return [{ path: path28.join(c.root, layout.instructionFile), conceptId: posix }];
   }
   const segs = posix.split("/").filter((segment) => segment.length > 0);
   const head = segs[0];
@@ -83472,10 +83564,10 @@ function readCandidatesToolDir(layout, c, conceptId) {
   if (!head || !rest)
     return [];
   if (layout.skillDirs.has(head)) {
-    return segs.length === 2 ? [{ path: path27.join(c.root, head, rest, SKILL_MANIFEST2), conceptId: posix }] : [];
+    return segs.length === 2 ? [{ path: path28.join(c.root, head, rest, SKILL_MANIFEST2), conceptId: posix }] : [];
   }
   if (layout.commandDirs.has(head) || layout.agentDirs.has(head)) {
-    return [{ path: path27.join(c.root, head, `${rest}.md`), conceptId: posix }];
+    return [{ path: path28.join(c.root, head, `${rest}.md`), conceptId: posix }];
   }
   return [];
 }
@@ -83587,12 +83679,12 @@ function dirExists(p) {
 }
 function claudeLooksLikeRoot(root) {
   try {
-    if (!fs19.existsSync(path28.join(root, "CLAUDE.md")))
+    if (!fs19.existsSync(path29.join(root, "CLAUDE.md")))
       return false;
   } catch {
     return false;
   }
-  return ["commands", "agents", "skills"].some((d) => dirExists(path28.join(root, d)));
+  return ["commands", "agents", "skills"].some((d) => dirExists(path29.join(root, d)));
 }
 var claudeAdapter = makeToolDirAdapter(LAYOUT, claudeLooksLikeRoot);
 
@@ -83600,7 +83692,7 @@ var claudeAdapter = makeToolDirAdapter(LAYOUT, claudeLooksLikeRoot);
 init_asset_placement();
 init_common();
 import fs20 from "node:fs";
-import path29 from "node:path";
+import path30 from "node:path";
 var COMPONENT_ID4 = "main";
 var ENV_DIR = "env";
 var SECRETS_DIR = "secrets";
@@ -83702,7 +83794,7 @@ var dotenvAdapter = {
     const type = typeForStashDir(head);
     if (type !== "env" && type !== "secret" || rest.length === 0)
       return [];
-    const primaries = assetPathCandidatesForName(type, path29.join(c.root, head), rest);
+    const primaries = assetPathCandidatesForName(type, path30.join(c.root, head), rest);
     const expanded = primaries.flatMap((primary) => type === "env" ? [primary, primary.replace(/\.env$/i, ".sensitive")] : [primary, `${primary}.sensitive`, `${primary}.lock`]);
     return expanded.map((candidatePath) => ({ path: candidatePath, conceptId: posix }));
   },
@@ -83714,10 +83806,10 @@ var dotenvAdapter = {
       const rest = posix.slice(slash + 1);
       const type = typeForStashDir(head);
       if ((type === "env" || type === "secret") && rest.length > 0) {
-        return assetPathForName(type, path29.join(c.root, head), rest);
+        return assetPathForName(type, path30.join(c.root, head), rest);
       }
     }
-    return path29.join(c.root, posix);
+    return path30.join(c.root, posix);
   },
   directoryList() {
     return [ENV_DIR, SECRETS_DIR];
@@ -83742,7 +83834,7 @@ var dotenvAdapter = {
 init_frontmatter();
 init_common();
 init_recognition_util();
-import path30 from "node:path";
+import path31 from "node:path";
 var COMPONENT_ID5 = "main";
 var DOCUMENT_EXTENSIONS = new Set([".md", ".markdown", ".txt", ".text"]);
 function isReserved2(base3) {
@@ -83808,17 +83900,17 @@ var genericFilesAdapter = {
   validate: validate6,
   readCandidates(c, conceptId) {
     const posix = toPosix(conceptId);
-    const extension = path30.extname(posix).toLowerCase();
+    const extension = path31.extname(posix).toLowerCase();
     const documentCandidates = [...DOCUMENT_EXTENSIONS].map((candidateExtension) => ({
-      path: path30.join(c.root, `${posix}${candidateExtension}`),
+      path: path31.join(c.root, `${posix}${candidateExtension}`),
       conceptId: posix
     }));
-    return DOCUMENT_EXTENSIONS.has(extension) ? documentCandidates : [{ path: path30.join(c.root, posix), conceptId: posix }, ...documentCandidates];
+    return DOCUMENT_EXTENSIONS.has(extension) ? documentCandidates : [{ path: path31.join(c.root, posix), conceptId: posix }, ...documentCandidates];
   },
   placeNew(c, conceptId) {
     const posix = toPosix(conceptId);
-    const hasExt = path30.extname(posix) !== "";
-    return path30.join(c.root, hasExt ? posix : `${posix}.md`);
+    const hasExt = path31.extname(posix) !== "";
+    return path31.join(c.root, hasExt ? posix : `${posix}.md`);
   },
   looksLikeRoot() {
     return false;
@@ -83830,7 +83922,7 @@ init_dist();
 init_frontmatter();
 init_common();
 import fs21 from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 var WIKI_COMPONENT_ID = "main";
 var WIKI_SOURCE_TYPE = "wiki-source";
 var DEFAULT_PAGE_KIND = "note";
@@ -83888,7 +83980,7 @@ function resolveXref(xref, bundleId) {
   return target.length > 0 ? target : null;
 }
 function resolveBodyLinks(body, fileRelPath) {
-  const dir = path31.posix.dirname(toPosix(fileRelPath));
+  const dir = path32.posix.dirname(toPosix(fileRelPath));
   const linkRe = /\[[^\]]*\]\(([^)]+)\)/g;
   const out = [];
   const seen = new Set;
@@ -83914,10 +84006,10 @@ function resolveBodyLinks(body, fileRelPath) {
       continue;
     let resolved;
     if (target.startsWith("/")) {
-      resolved = path31.posix.normalize(target.slice(1));
+      resolved = path32.posix.normalize(target.slice(1));
     } else {
       const base3 = dir === "." ? "" : dir;
-      resolved = path31.posix.normalize(path31.posix.join(base3, target));
+      resolved = path32.posix.normalize(path32.posix.join(base3, target));
     }
     if (resolved.startsWith("../") || resolved === ".." || resolved.startsWith("/"))
       continue;
@@ -84099,19 +84191,19 @@ var llmWikiAdapter = {
   validate: validate7,
   readCandidates(c, conceptId) {
     const canonical = toPosix(conceptId).replace(/\.md$/i, "");
-    return [{ path: path31.join(c.root, `${canonical}.md`), conceptId: canonical }];
+    return [{ path: path32.join(c.root, `${canonical}.md`), conceptId: canonical }];
   },
   placeNew(c, conceptId) {
-    return path31.join(c.root, `${conceptId}.md`);
+    return path32.join(c.root, `${conceptId}.md`);
   },
   directoryList(_c) {
     return ["."];
   },
   looksLikeRoot(root) {
     try {
-      if (!fs21.existsSync(path31.join(root, "schema.md")))
+      if (!fs21.existsSync(path32.join(root, "schema.md")))
         return false;
-      return fs21.statSync(path31.join(root, PAGES_SUBDIR)).isDirectory();
+      return fs21.statSync(path32.join(root, PAGES_SUBDIR)).isDirectory();
     } catch {
       return false;
     }
@@ -84122,7 +84214,7 @@ var llmWikiAdapter = {
 init_frontmatter();
 init_common();
 import fs22 from "node:fs";
-import path32 from "node:path";
+import path33 from "node:path";
 var CONSUMED_FRONTMATTER_KEYS = [
   "type",
   "title",
@@ -84194,7 +84286,7 @@ function isReservedFileName2(name) {
   return RESERVED_FILES.has(name.toLowerCase());
 }
 function resolveOkfLinks(body, fileRelPath) {
-  const dir = path32.posix.dirname(toPosix(fileRelPath));
+  const dir = path33.posix.dirname(toPosix(fileRelPath));
   const definitions = new Map;
   for (const match of body.matchAll(/^\s*\[([^\]]+)\]:\s*(\S+)/gm)) {
     definitions.set(match[1].trim().toLowerCase(), match[2]);
@@ -84232,10 +84324,10 @@ function resolveOkfLinks(body, fileRelPath) {
       continue;
     let resolved;
     if (target.startsWith("/")) {
-      resolved = path32.posix.normalize(target.slice(1));
+      resolved = path33.posix.normalize(target.slice(1));
     } else {
       const base3 = dir === "." ? "" : dir;
-      resolved = path32.posix.normalize(path32.posix.join(base3, target));
+      resolved = path33.posix.normalize(path33.posix.join(base3, target));
     }
     if (resolved.startsWith("../") || resolved === ".." || resolved.startsWith("/"))
       continue;
@@ -84363,13 +84455,13 @@ var okfAdapter = {
   validate: validate8,
   readCandidates(c, conceptId) {
     const canonical = conceptId.replace(/\\/g, "/").replace(/\.md$/i, "");
-    return [{ path: path32.join(c.root, `${canonical}.md`), conceptId: canonical }];
+    return [{ path: path33.join(c.root, `${canonical}.md`), conceptId: canonical }];
   },
   directoryList(_c) {
     return ["."];
   },
   looksLikeRoot(root) {
-    if (fs22.existsSync(path32.join(root, "index.md")))
+    if (fs22.existsSync(path33.join(root, "index.md")))
       return true;
     const stack = [root];
     while (stack.length > 0) {
@@ -84385,7 +84477,7 @@ var okfAdapter = {
       for (const entry of entries) {
         if (entry.isSymbolicLink() || entry.name === ".git")
           continue;
-        const absolute = path32.join(current, entry.name);
+        const absolute = path33.join(current, entry.name);
         if (entry.isDirectory()) {
           stack.push(absolute);
           continue;
@@ -84403,7 +84495,7 @@ var okfAdapter = {
 
 // src/core/adapter/adapters/opencode-adapter.ts
 import fs23 from "node:fs";
-import path33 from "node:path";
+import path34 from "node:path";
 var LAYOUT2 = {
   adapterId: "opencode",
   componentId: ".opencode",
@@ -84430,11 +84522,11 @@ function dirExists2(p) {
   }
 }
 function opencodeLooksLikeRoot(root) {
-  if (CONFIG_FILES.some((f) => fileExists(path33.join(root, f))))
+  if (CONFIG_FILES.some((f) => fileExists(path34.join(root, f))))
     return true;
-  if (!fileExists(path33.join(root, "AGENTS.md")))
+  if (!fileExists(path34.join(root, "AGENTS.md")))
     return false;
-  return TOOL_DIRS.some((d) => dirExists2(path33.join(root, d)));
+  return TOOL_DIRS.some((d) => dirExists2(path34.join(root, d)));
 }
 var opencodeAdapter = makeToolDirAdapter(LAYOUT2, opencodeLooksLikeRoot);
 
@@ -84443,7 +84535,7 @@ init_dist();
 init_frontmatter();
 init_common();
 import fs24 from "node:fs";
-import path34 from "node:path";
+import path35 from "node:path";
 var COMPONENT_ID6 = "main";
 var PAGES_PREFIX = "stash/knowledge/";
 var MANIFEST_FILE = "manifest.json";
@@ -84531,12 +84623,12 @@ var websiteSnapshotAdapter = {
   validate: validate9,
   readCandidates(c, conceptId) {
     const canonical = toPosix(conceptId).replace(/\.md$/i, "");
-    return [{ path: path34.join(c.root, PAGES_PREFIX, `${canonical}.md`), conceptId: canonical }];
+    return [{ path: path35.join(c.root, PAGES_PREFIX, `${canonical}.md`), conceptId: canonical }];
   },
   looksLikeRoot(root) {
     let raw;
     try {
-      raw = fs24.readFileSync(path34.join(root, MANIFEST_FILE), "utf8");
+      raw = fs24.readFileSync(path35.join(root, MANIFEST_FILE), "utf8");
     } catch {
       return false;
     }
@@ -84649,7 +84741,7 @@ function isSourceWriteActivated(source) {
 
 // src/core/adapter/detect-adapter.ts
 import fs25 from "node:fs";
-import path35 from "node:path";
+import path36 from "node:path";
 var SHADOWABLE_ADAPTER_IDS = new Set(["agent-skills", "claude", "opencode"]);
 function hasExtraAkmContent(root, winnerId) {
   const akm = adapterForId("akm");
@@ -84671,13 +84763,13 @@ function hasExtraAkmContent(root, winnerId) {
       continue;
     if (winnerId === "agent-skills") {
       try {
-        if (fs25.statSync(path35.join(root, entry.name, "SKILL.md")).isFile())
+        if (fs25.statSync(path36.join(root, entry.name, "SKILL.md")).isFile())
           continue;
       } catch {}
     }
     let children;
     try {
-      children = fs25.readdirSync(path35.join(root, entry.name), { withFileTypes: true });
+      children = fs25.readdirSync(path36.join(root, entry.name), { withFileTypes: true });
     } catch {
       continue;
     }
@@ -84702,48 +84794,7 @@ function detectAdapterId(root, fallback = "akm") {
 
 // src/indexer/installations.ts
 init_asset_placement();
-
-// src/core/bundle-id.ts
-init_asset_ref();
-import crypto5 from "node:crypto";
-import path36 from "node:path";
-function slugForPath(sourcePath) {
-  const resolved = path36.resolve(sourcePath);
-  const base3 = path36.basename(resolved).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  if (base3.length > 0)
-    return base3;
-  return `bundle-${shortHash(resolved)}`;
-}
-function deriveBundleId(registryId, sourcePath, usedIds) {
-  const preferred = registryId && registryId.length > 0 && isBundleSlug(registryId) ? registryId : slugForPath(sourcePath);
-  const id = ensureUniqueId(preferred, sourcePath, usedIds);
-  usedIds.add(id);
-  return id;
-}
-function deriveBundleIds(sources) {
-  const usedIds = new Set;
-  const reservedIds = new Set(sources.flatMap((source) => source.registryId && isBundleSlug(source.registryId) ? [source.registryId] : []));
-  return sources.map((source) => {
-    const id = source.registryId && isBundleSlug(source.registryId) ? deriveBundleId(source.registryId, source.path, usedIds) : deriveBundleId(undefined, source.path, new Set([...usedIds, ...reservedIds]));
-    usedIds.add(id);
-    return id;
-  });
-}
-function ensureUniqueId(preferred, sourcePath, used) {
-  if (!used.has(preferred))
-    return preferred;
-  const suffixed = `${preferred}-${shortHash(path36.resolve(sourcePath))}`;
-  if (!used.has(suffixed))
-    return suffixed;
-  let n = 2;
-  while (used.has(`${suffixed}-${n}`))
-    n++;
-  return `${suffixed}-${n}`;
-}
-function shortHash(input) {
-  return crypto5.createHash("sha256").update(input).digest("hex").slice(0, 8);
-}
-// src/indexer/installations.ts
+init_bundle_id();
 var FALLBACK_ADAPTER_ID = "akm";
 function deriveInstallations(sources) {
   const ids = deriveBundleIds(sources);
@@ -84782,6 +84833,7 @@ function deriveEntryProvenance(bundle, type, name, adapterConceptId) {
 // src/indexer/search/search-source.ts
 init_common();
 import path49 from "node:path";
+init_paths();
 
 // src/core/write-source.ts
 import fs36 from "node:fs";
@@ -87752,6 +87804,7 @@ function buildGithubTargetAliases(canonicalUrl) {
 // src/core/write-source.ts
 init_asset_placement();
 init_resolve_ref();
+init_bundle_id();
 init_common();
 init_errors();
 init_warn();
@@ -92295,14 +92348,14 @@ function resolveSourceEntries(overrideStashDir, existingConfig) {
     const component = bundleComponentConfig(config.bundles?.[entry.name ?? ""]);
     const contentRoot = resolveEntryContentDir(entry);
     if (contentRoot == null) {
-      const unresolvedPath = path49.join(implicitStashDir ?? process.cwd(), ".akm", "unresolved-sources", entry.name ?? entry.type);
+      const unresolvedPath = path49.join(getUnresolvedSourcesDir(implicitStashDir ?? process.cwd()), entry.name ?? entry.type);
       addSource(unresolvedPath, entry.name, component?.writable ?? resolveWritable(entry), entry.type, component?.adapter, true);
       continue;
     }
     const dir = path49.resolve(contentRoot, component?.root ?? ".");
     if (!isWithin(dir, contentRoot)) {
       warn(`Warning: component root "${component?.root}" escapes bundle "${entry.name}"; skipping source.`);
-      const unresolvedPath = path49.join(contentRoot, ".akm", "unresolved-sources", entry.name ?? entry.type);
+      const unresolvedPath = path49.join(getUnresolvedSourcesDir(contentRoot), entry.name ?? entry.type);
       addSource(unresolvedPath, entry.name, component?.writable ?? resolveWritable(entry), entry.type, component?.adapter, true);
       continue;
     }
@@ -95472,31 +95525,178 @@ async function recoverStaleTxns(stashDir) {
   return recovered.map(journalToEntry);
 }
 
+// scripts/akm-migrate/migrate/writer-relocation.ts
+import fs48 from "node:fs";
+import path61 from "node:path";
+init_paths();
+function relocationSpecs(stashDir) {
+  return [
+    { key: "distillRejected", oldRelative: "distill-rejected", newDir: getDistillRejectedDir(stashDir) },
+    { key: "evalCases", oldRelative: "eval-cases", newDir: getEvalCasesDir(stashDir) },
+    {
+      key: "measurementVerdicts",
+      oldRelative: ["measurement", "verdicts"],
+      newDir: getMeasurementVerdictsDir(stashDir)
+    }
+  ];
+}
+var LOCK_NAMES = ["improve.lock", "consolidate.lock", "reflect-distill.lock", "triage.lock"];
+function mutexSiblingName(lockName) {
+  return `.${lockName}.operations.sensitive`;
+}
+function fileCountIfExists(dir) {
+  let entries;
+  try {
+    entries = fs48.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  return entries.filter((entry) => entry.isFile()).length;
+}
+function statFileIfExists(filePath) {
+  try {
+    const stat = fs48.statSync(filePath);
+    return stat.isFile() ? stat : undefined;
+  } catch {
+    return;
+  }
+}
+function classifyLockArtifacts(akmDir) {
+  const removable = [];
+  const skipped = [];
+  for (const lockName of LOCK_NAMES) {
+    const lockPath = path61.join(akmDir, lockName);
+    const mutexPath = path61.join(akmDir, mutexSiblingName(lockName));
+    const lockStat = statFileIfExists(lockPath);
+    const mutexStat = statFileIfExists(mutexPath);
+    if (!lockStat) {
+      if (mutexStat)
+        removable.push({ path: mutexPath, sizeBytes: mutexStat.size });
+      continue;
+    }
+    const probe = probeLock(lockPath);
+    if (probe.state === "held") {
+      skipped.push({ path: lockPath, reason: "held", holderPid: probe.holderPid });
+      continue;
+    }
+    if (probe.state === "inaccessible") {
+      skipped.push({ path: lockPath, reason: "inaccessible" });
+      continue;
+    }
+    if (probe.state === "absent")
+      continue;
+    removable.push({ path: lockPath, sizeBytes: lockStat.size });
+    if (mutexStat)
+      removable.push({ path: mutexPath, sizeBytes: mutexStat.size });
+  }
+  return { removable, skipped };
+}
+function findWriterRelocationEntries(stashDir) {
+  const akmDir = path61.join(stashDir, ".akm");
+  const directories = [];
+  for (const spec of relocationSpecs(stashDir)) {
+    const relativeParts = Array.isArray(spec.oldRelative) ? spec.oldRelative : [spec.oldRelative];
+    const oldPath = path61.join(akmDir, ...relativeParts);
+    const fileCount = fileCountIfExists(oldPath);
+    if (fileCount === undefined || fileCount === 0)
+      continue;
+    directories.push({ key: spec.key, oldPath, newPath: spec.newDir, fileCount });
+  }
+  const { removable, skipped } = classifyLockArtifacts(akmDir);
+  return { directories, lockArtifacts: removable, skippedLocks: skipped };
+}
+function moveFile(oldFilePath, newFilePath) {
+  try {
+    fs48.renameSync(oldFilePath, newFilePath);
+  } catch (error2) {
+    if (error2.code !== "EXDEV")
+      throw error2;
+    fs48.copyFileSync(oldFilePath, newFilePath);
+    fs48.rmSync(oldFilePath, { force: true });
+  }
+}
+function moveDirectoryContents(entry) {
+  const errors3 = [];
+  let moved = 0;
+  fs48.mkdirSync(entry.newPath, { recursive: true });
+  let names;
+  try {
+    names = fs48.readdirSync(entry.oldPath).sort();
+  } catch {
+    return { key: entry.key, oldPath: entry.oldPath, newPath: entry.newPath, moved: 0, errors: [] };
+  }
+  for (const name of names) {
+    const oldFilePath = path61.join(entry.oldPath, name);
+    const newFilePath = path61.join(entry.newPath, name);
+    let oldStat;
+    try {
+      oldStat = fs48.lstatSync(oldFilePath);
+    } catch {
+      continue;
+    }
+    if (!oldStat.isFile())
+      continue;
+    if (fs48.existsSync(newFilePath))
+      continue;
+    try {
+      moveFile(oldFilePath, newFilePath);
+      moved += 1;
+    } catch (error2) {
+      errors3.push(`${name}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+    }
+  }
+  return { key: entry.key, oldPath: entry.oldPath, newPath: entry.newPath, moved, errors: errors3 };
+}
+function removeIfEmptyDir(dir) {
+  try {
+    if (fs48.readdirSync(dir).length === 0)
+      fs48.rmdirSync(dir);
+  } catch {}
+}
+function removeLockArtifact(entry) {
+  try {
+    fs48.rmSync(entry.path, { force: true });
+    return { path: entry.path, removed: true };
+  } catch (error2) {
+    return { path: entry.path, removed: false, error: error2 instanceof Error ? error2.message : String(error2) };
+  }
+}
+function applyWriterRelocation(stashDir) {
+  const { directories, lockArtifacts, skippedLocks } = findWriterRelocationEntries(stashDir);
+  const directoryResults = directories.map(moveDirectoryContents);
+  const lockResults = lockArtifacts.map(removeLockArtifact);
+  for (const spec of relocationSpecs(stashDir)) {
+    const relativeParts = Array.isArray(spec.oldRelative) ? spec.oldRelative : [spec.oldRelative];
+    removeIfEmptyDir(path61.join(stashDir, ".akm", ...relativeParts));
+  }
+  return { directories: directoryResults, lockArtifacts: lockResults, skippedLocks };
+}
+
 // scripts/akm-migrate/task-migrate.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import fs51 from "node:fs";
+import fs53 from "node:fs";
 import os5 from "node:os";
-import path63 from "node:path";
+import path64 from "node:path";
 init_errors();
 init_paths();
 
 // scripts/akm-migrate/migrate/task-files-to-v3.ts
 init_errors();
 import crypto6 from "node:crypto";
-import fs49 from "node:fs";
-import path61 from "node:path";
+import fs50 from "node:fs";
+import path62 from "node:path";
 
 // scripts/akm-migrate/migrate/durable-fs.ts
-import fs48 from "node:fs";
+import fs49 from "node:fs";
 function fsyncDirectoryPortable(directory) {
   if (process.platform === "win32")
     return;
   try {
-    const fd = fs48.openSync(directory, "r");
+    const fd = fs49.openSync(directory, "r");
     try {
-      fs48.fsyncSync(fd);
+      fs49.fsyncSync(fd);
     } finally {
-      fs48.closeSync(fd);
+      fs49.closeSync(fd);
     }
   } catch (cause) {
     const code = cause.code;
@@ -95510,25 +95710,25 @@ function migrationError(detail) {
   return new ConfigError(`Task migration to v3 failed: ${detail}`, "INVALID_CONFIG_FILE");
 }
 function contained2(root, candidate) {
-  const relative = path61.relative(root, candidate);
-  return relative === "" || !relative.startsWith("..") && !path61.isAbsolute(relative);
+  const relative = path62.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
 }
 function realDirectory(filePath) {
-  const stat = fs49.lstatSync(filePath);
+  const stat = fs50.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw migrationError(`${filePath} must be a real directory.`);
-  return fs49.realpathSync(filePath);
+  return fs50.realpathSync(filePath);
 }
 function snapshot(filePath) {
-  const stat = fs49.lstatSync(filePath);
+  const stat = fs50.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isFile())
     throw migrationError(`${filePath} must be a real file.`);
-  const bytes = fs49.readFileSync(filePath);
+  const bytes = fs50.readFileSync(filePath);
   return Object.freeze({ bytes, mode: stat.mode & 511 });
 }
 function writable(filePath) {
   try {
-    fs49.accessSync(filePath, fs49.constants.W_OK);
+    fs50.accessSync(filePath, fs50.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -95541,12 +95741,12 @@ function walkTasks(root, tasksDir, out) {
     throw migrationError(`${root.root} resolves outside bundle ${root.bundleId}.`);
   }
   const visit2 = (directory) => {
-    const physicalDirectory = fs49.realpathSync(directory);
+    const physicalDirectory = fs50.realpathSync(directory);
     if (!contained2(physicalRoot, physicalDirectory)) {
       throw migrationError(`${directory} resolves outside bundle ${root.bundleId}.`);
     }
-    for (const entry of fs49.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const candidate = path61.join(directory, entry.name);
+    for (const entry of fs50.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const candidate = path62.join(directory, entry.name);
       if (entry.isSymbolicLink())
         throw migrationError(`task migration does not follow symbolic link ${candidate}.`);
       if (entry.isDirectory()) {
@@ -95556,7 +95756,7 @@ function walkTasks(root, tasksDir, out) {
       if (!entry.isFile() || !entry.name.endsWith(".yml"))
         continue;
       const current = snapshot(candidate);
-      const parent = path61.dirname(candidate);
+      const parent = path62.dirname(candidate);
       out.push({
         filePath: candidate,
         bytes: current.bytes,
@@ -95572,9 +95772,9 @@ function walkTasks(root, tasksDir, out) {
 function inspectTaskToV3Files(roots) {
   const files = [];
   for (const root of [...roots].sort((a, b) => a.bundleId.localeCompare(b.bundleId))) {
-    const tasksDir = root.layout === "akm-task" ? root.root : path61.join(root.root, "tasks");
+    const tasksDir = root.layout === "akm-task" ? root.root : path62.join(root.root, "tasks");
     try {
-      const stat = fs49.lstatSync(tasksDir);
+      const stat = fs50.lstatSync(tasksDir);
       if (stat.isSymbolicLink())
         throw migrationError(`task migration does not follow symbolic link ${tasksDir}.`);
       if (!stat.isDirectory())
@@ -95589,33 +95789,33 @@ function inspectTaskToV3Files(roots) {
   return files.sort((a, b) => a.filePath.localeCompare(b.filePath));
 }
 function hashPath(filePath) {
-  return crypto6.createHash("sha256").update(path61.resolve(filePath)).digest("hex").slice(0, 16);
+  return crypto6.createHash("sha256").update(path62.resolve(filePath)).digest("hex").slice(0, 16);
 }
 function taskMigrationBackupPath(backupRoot, filePath) {
-  return path61.join(backupRoot, "files", `${hashPath(filePath)}-${path61.basename(filePath)}`);
+  return path62.join(backupRoot, "files", `${hashPath(filePath)}-${path62.basename(filePath)}`);
 }
 function writeDurable(filePath, bytes, mode, exclusive = false) {
-  fs49.mkdirSync(path61.dirname(filePath), { recursive: true });
+  fs50.mkdirSync(path62.dirname(filePath), { recursive: true });
   const flags = exclusive ? "wx" : "w";
-  const fd = fs49.openSync(filePath, flags, mode);
+  const fd = fs50.openSync(filePath, flags, mode);
   try {
-    fs49.writeFileSync(fd, bytes);
-    fs49.fsyncSync(fd);
+    fs50.writeFileSync(fd, bytes);
+    fs50.fsyncSync(fd);
   } finally {
-    fs49.closeSync(fd);
+    fs50.closeSync(fd);
   }
-  fs49.chmodSync(filePath, mode);
-  fsyncDirectoryPortable(path61.dirname(filePath));
+  fs50.chmodSync(filePath, mode);
+  fsyncDirectoryPortable(path62.dirname(filePath));
 }
 function replaceAtomically(filePath, bytes, mode) {
-  const temporary = path61.join(path61.dirname(filePath), `.${path61.basename(filePath)}.migrate-${crypto6.randomUUID()}`);
+  const temporary = path62.join(path62.dirname(filePath), `.${path62.basename(filePath)}.migrate-${crypto6.randomUUID()}`);
   try {
     writeDurable(temporary, bytes, mode, true);
-    fs49.renameSync(temporary, filePath);
-    fsyncDirectoryPortable(path61.dirname(filePath));
+    fs50.renameSync(temporary, filePath);
+    fsyncDirectoryPortable(path62.dirname(filePath));
   } finally {
     try {
-      fs49.unlinkSync(temporary);
+      fs50.unlinkSync(temporary);
     } catch (cause) {
       if (cause.code !== "ENOENT")
         throw cause;
@@ -95654,7 +95854,7 @@ function applyTaskToV3MigrationPlan(plan, options) {
       const current = snapshot(change.filePath);
       if (!current.bytes.equals(change.after))
         continue;
-      replaceAtomically(change.filePath, fs49.readFileSync(taskMigrationBackupPath(options.backupRoot, change.filePath)), change.mode);
+      replaceAtomically(change.filePath, fs50.readFileSync(taskMigrationBackupPath(options.backupRoot, change.filePath)), change.mode);
     }
     throw cause;
   }
@@ -95664,31 +95864,31 @@ function applyTaskToV3MigrationPlan(plan, options) {
 // scripts/akm-migrate/migrate/task-files-to-v4.ts
 init_errors();
 import crypto7 from "node:crypto";
-import fs50 from "node:fs";
-import path62 from "node:path";
+import fs51 from "node:fs";
+import path63 from "node:path";
 function migrationError2(detail) {
   return new ConfigError(`Task migration to v4 failed: ${detail}`, "INVALID_CONFIG_FILE");
 }
 function contained3(root, candidate) {
-  const relative = path62.relative(root, candidate);
-  return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
+  const relative = path63.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path63.isAbsolute(relative);
 }
 function realDirectory2(filePath) {
-  const stat = fs50.lstatSync(filePath);
+  const stat = fs51.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw migrationError2(`${filePath} must be a real directory.`);
-  return fs50.realpathSync(filePath);
+  return fs51.realpathSync(filePath);
 }
 function snapshot2(filePath) {
-  const stat = fs50.lstatSync(filePath);
+  const stat = fs51.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isFile())
     throw migrationError2(`${filePath} must be a real file.`);
-  const bytes = fs50.readFileSync(filePath);
+  const bytes = fs51.readFileSync(filePath);
   return Object.freeze({ bytes, mode: stat.mode & 511 });
 }
 function writable2(filePath) {
   try {
-    fs50.accessSync(filePath, fs50.constants.W_OK);
+    fs51.accessSync(filePath, fs51.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -95701,12 +95901,12 @@ function walkTasks2(root, tasksDir, out) {
     throw migrationError2(`${root.root} resolves outside bundle ${root.bundleId}.`);
   }
   const visit2 = (directory) => {
-    const physicalDirectory = fs50.realpathSync(directory);
+    const physicalDirectory = fs51.realpathSync(directory);
     if (!contained3(physicalRoot, physicalDirectory)) {
       throw migrationError2(`${directory} resolves outside bundle ${root.bundleId}.`);
     }
-    for (const entry of fs50.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const candidate = path62.join(directory, entry.name);
+    for (const entry of fs51.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const candidate = path63.join(directory, entry.name);
       if (entry.isSymbolicLink())
         throw migrationError2(`task migration does not follow symbolic link ${candidate}.`);
       if (entry.isDirectory()) {
@@ -95716,7 +95916,7 @@ function walkTasks2(root, tasksDir, out) {
       if (!entry.isFile() || !entry.name.endsWith(".yml"))
         continue;
       const current = snapshot2(candidate);
-      const parent = path62.dirname(candidate);
+      const parent = path63.dirname(candidate);
       out.push({
         filePath: candidate,
         bytes: current.bytes,
@@ -95732,9 +95932,9 @@ function walkTasks2(root, tasksDir, out) {
 function inspectTaskToV4Files(roots) {
   const files = [];
   for (const root of [...roots].sort((a, b) => a.bundleId.localeCompare(b.bundleId))) {
-    const tasksDir = root.layout === "akm-task" ? root.root : path62.join(root.root, "tasks");
+    const tasksDir = root.layout === "akm-task" ? root.root : path63.join(root.root, "tasks");
     try {
-      const stat = fs50.lstatSync(tasksDir);
+      const stat = fs51.lstatSync(tasksDir);
       if (stat.isSymbolicLink())
         throw migrationError2(`task migration does not follow symbolic link ${tasksDir}.`);
       if (!stat.isDirectory())
@@ -95749,33 +95949,33 @@ function inspectTaskToV4Files(roots) {
   return files.sort((a, b) => a.filePath.localeCompare(b.filePath));
 }
 function hashPath2(filePath) {
-  return crypto7.createHash("sha256").update(path62.resolve(filePath)).digest("hex").slice(0, 16);
+  return crypto7.createHash("sha256").update(path63.resolve(filePath)).digest("hex").slice(0, 16);
 }
 function taskMigrationBackupPathV4(backupRoot, filePath) {
-  return path62.join(backupRoot, "files", `${hashPath2(filePath)}-${path62.basename(filePath)}`);
+  return path63.join(backupRoot, "files", `${hashPath2(filePath)}-${path63.basename(filePath)}`);
 }
 function writeDurable2(filePath, bytes, mode, exclusive = false) {
-  fs50.mkdirSync(path62.dirname(filePath), { recursive: true });
+  fs51.mkdirSync(path63.dirname(filePath), { recursive: true });
   const flags = exclusive ? "wx" : "w";
-  const fd = fs50.openSync(filePath, flags, mode);
+  const fd = fs51.openSync(filePath, flags, mode);
   try {
-    fs50.writeFileSync(fd, bytes);
-    fs50.fsyncSync(fd);
+    fs51.writeFileSync(fd, bytes);
+    fs51.fsyncSync(fd);
   } finally {
-    fs50.closeSync(fd);
+    fs51.closeSync(fd);
   }
-  fs50.chmodSync(filePath, mode);
-  fsyncDirectoryPortable(path62.dirname(filePath));
+  fs51.chmodSync(filePath, mode);
+  fsyncDirectoryPortable(path63.dirname(filePath));
 }
 function replaceAtomically2(filePath, bytes, mode) {
-  const temporary = path62.join(path62.dirname(filePath), `.${path62.basename(filePath)}.migrate-${crypto7.randomUUID()}`);
+  const temporary = path63.join(path63.dirname(filePath), `.${path63.basename(filePath)}.migrate-${crypto7.randomUUID()}`);
   try {
     writeDurable2(temporary, bytes, mode, true);
-    fs50.renameSync(temporary, filePath);
-    fsyncDirectoryPortable(path62.dirname(filePath));
+    fs51.renameSync(temporary, filePath);
+    fsyncDirectoryPortable(path63.dirname(filePath));
   } finally {
     try {
-      fs50.unlinkSync(temporary);
+      fs51.unlinkSync(temporary);
     } catch (cause) {
       if (cause.code !== "ENOENT")
         throw cause;
@@ -95814,7 +96014,7 @@ function applyTaskToV4MigrationPlan(plan, options) {
       const current = snapshot2(change.filePath);
       if (!current.bytes.equals(change.after))
         continue;
-      replaceAtomically2(change.filePath, fs50.readFileSync(taskMigrationBackupPathV4(options.backupRoot, change.filePath)), change.mode);
+      replaceAtomically2(change.filePath, fs51.readFileSync(taskMigrationBackupPathV4(options.backupRoot, change.filePath)), change.mode);
     }
     throw cause;
   }
@@ -95826,12 +96026,12 @@ function expandTilde(value) {
   if (value === "~")
     return os5.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\"))
-    return path63.join(os5.homedir(), value.slice(2));
+    return path64.join(os5.homedir(), value.slice(2));
   return value;
 }
 function existingDirectory(target) {
   try {
-    return fs51.statSync(target).isDirectory();
+    return fs53.statSync(target).isDirectory();
   } catch (cause) {
     if (cause.code === "ENOENT")
       return false;
@@ -95852,21 +96052,21 @@ function taskRoots(config, resolutionBase = process.cwd()) {
     const source = sources.get(bundleId);
     if (!source)
       continue;
-    const configuredRoot = source.type === "filesystem" && source.path ? path63.resolve(resolutionBase, expandTilde(source.path)) : lockContentRootFor(bundleId, source.type);
+    const configuredRoot = source.type === "filesystem" && source.path ? path64.resolve(resolutionBase, expandTilde(source.path)) : lockContentRootFor(bundleId, source.type);
     if (!configuredRoot || !existingDirectory(configuredRoot))
       continue;
-    const bundleRoot = path63.resolve(configuredRoot);
+    const bundleRoot = path64.resolve(configuredRoot);
     const component = bundleComponentConfig(bundle);
-    const componentRoot = path63.resolve(bundleRoot, component?.root ?? ".");
-    const relative = path63.relative(bundleRoot, componentRoot);
-    if (relative === ".." || relative.startsWith(`..${path63.sep}`) || path63.isAbsolute(relative)) {
+    const componentRoot = path64.resolve(bundleRoot, component?.root ?? ".");
+    const relative = path64.relative(bundleRoot, componentRoot);
+    if (relative === ".." || relative.startsWith(`..${path64.sep}`) || path64.isAbsolute(relative)) {
       throw new ConfigError(`Task migration component root ${componentRoot} escapes bundle ${bundleId} at ${bundleRoot}.`, "INVALID_CONFIG_FILE");
     }
     if (!existingDirectory(componentRoot))
       continue;
     const adapter = component?.adapter ?? detectAdapterId(componentRoot, "");
     if (!component?.adapter && adapter === "") {
-      const flatTasks = fs51.readdirSync(componentRoot, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".yml")).map((entry) => entry.name).sort();
+      const flatTasks = fs53.readdirSync(componentRoot, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".yml")).map((entry) => entry.name).sort();
       if (flatTasks.length > 0) {
         throw new ConfigError(`Task migration cannot classify top-level task file(s) ${flatTasks.join(", ")} in bundle ${bundleId}; configure adapter "akm-task" or move them under tasks/.`, "INVALID_CONFIG_FILE");
       }
@@ -95938,8 +96138,8 @@ function applyTaskV3Migration() {
     const before = inspectCurrentTaskPlan();
     if (before.result.taskV3Migration.changed === 0)
       return before.result;
-    const backupRoot = path63.join(getDataDir(), "backups", "task-v3");
-    const backupPath = path63.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
+    const backupRoot = path64.join(getDataDir(), "backups", "task-v3");
+    const backupPath = path64.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
     const applied = applyTaskToV3MigrationPlan(before.plan, { backupRoot: backupPath });
     const after = inspectCurrentTaskPlan().result;
     if (after.taskV3Migration.changed > 0) {
@@ -95995,8 +96195,8 @@ function applyTaskV4Migration() {
     const before = inspectCurrentTaskV4Plan();
     if (before.result.taskV4Migration.changed === 0)
       return before.result;
-    const backupRoot = path63.join(getDataDir(), "backups", "task-v4");
-    const backupPath = path63.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
+    const backupRoot = path64.join(getDataDir(), "backups", "task-v4");
+    const backupPath = path64.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
     const applied = applyTaskToV4MigrationPlan(before.plan, { backupRoot: backupPath });
     const after = inspectCurrentTaskV4Plan().result;
     if (after.taskV4Migration.changed > 0) {
@@ -96024,6 +96224,22 @@ function stashDirIfConfigured() {
     throw error2;
   }
 }
+function writerRelocationTargets(defaultStashDir) {
+  const config = loadConfig();
+  const seen = new Set;
+  const targets = [];
+  if (defaultStashDir !== undefined) {
+    targets.push({ id: bundleKeyForContentRoot(config, defaultStashDir) ?? "default", dir: defaultStashDir });
+    seen.add(defaultStashDir);
+  }
+  for (const { id, contentRoot } of bundleContentRoots(config)) {
+    if (seen.has(contentRoot))
+      continue;
+    seen.add(contentRoot);
+    targets.push({ id, dir: contentRoot });
+  }
+  return targets;
+}
 async function runMigration(options) {
   const { apply } = options;
   const configPath = getConfigPath();
@@ -96044,10 +96260,15 @@ async function runMigration(options) {
   const stashDir = stashDirIfConfigured();
   const taskV3 = apply ? applyTaskV3Migration() : inspectMigrationPlan();
   const taskV4 = apply ? applyTaskV4Migration() : inspectTaskV4MigrationStatus();
-  const stashSections = stashDir === undefined ? {} : {
-    deadResidue: apply ? { removed: removeDeadResidue(stashDir) } : { pending: findDeadResidueEntries(stashDir) },
-    staleTxns: apply ? { recovered: await recoverStaleTxns(stashDir) } : { pending: findStaleTxnEntries(stashDir) }
-  };
+  const stashSections = {};
+  if (stashDir !== undefined) {
+    stashSections.deadResidue = apply ? { removed: removeDeadResidue(stashDir) } : { pending: findDeadResidueEntries(stashDir) };
+    stashSections.staleTxns = apply ? { recovered: await recoverStaleTxns(stashDir) } : { pending: findStaleTxnEntries(stashDir) };
+  }
+  const relocationTargets = writerRelocationTargets(stashDir);
+  if (relocationTargets.length > 0) {
+    stashSections.writerRelocation = apply ? { relocated: Object.fromEntries(relocationTargets.map(({ id, dir }) => [id, applyWriterRelocation(dir)])) } : { pending: Object.fromEntries(relocationTargets.map(({ id, dir }) => [id, findWriterRelocationEntries(dir)])) };
+  }
   const stateStatus = "pending" in stateMigrations && stateMigrations.pending.length > 0 ? "ready" : "current";
   return {
     schemaVersion: 1,