archctx 0.2.2 → 0.2.3

package/bin/archctx.mjs

@@ -696,13 +696,13 @@ function productVersionManifest() {
       sqliteMigrations: "0001_runtime_state..0004_changeset_journal",
       codeGraph: {
         packageName: "@colbymchenry/codegraph",
-        requiredVersion: "1.0.1",
+        requiredVersion: "1.4.0",
         adapter: "codegraph-cli"
       }
     }
   };
 }
-var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.2.2", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10", ARCHCONTEXT_NODE_RANGE = ">=24 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-06-25.al0-ledger";
+var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.2.3", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10", ARCHCONTEXT_NODE_RANGE = ">=24 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-06-25.al0-ledger";
 // packages/contracts/src/index.ts
 var init_src = __esm(() => {
   init_control_plane_routes();
@@ -5145,8 +5145,8 @@ var init_src7 = __esm(() => {
 
 // packages/surfaces/cli/src/main.ts
 import { execFileSync as execFileSync8, spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { accessSync, chmodSync as chmodSync5, closeSync as closeSync7, constants, existsSync as existsSync15, mkdirSync as mkdirSync9, openSync as openSync7, readFileSync as readFileSync13, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname10, join as join10, resolve as resolve17 } from "path";
+import { accessSync as accessSync2, chmodSync as chmodSync5, closeSync as closeSync7, constants, existsSync as existsSync15, mkdirSync as mkdirSync9, openSync as openSync7, readFileSync as readFileSync14, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname11, join as join10, resolve as resolve18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/contracts/src/index.ts
@@ -5292,8 +5292,8 @@ var UNTRUSTED_TOOL_ESCAPE_KEYS = new Set([
 ]);
 
 // packages/cloud/hardening/src/index.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as statSync4 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
 
 // packages/core/architecture-domain/src/index.ts
 init_src();
@@ -5654,8 +5654,9 @@ init_src2();
 
 // packages/local-runtime/codegraph-adapter/src/index.ts
 import { execFileSync } from "node:child_process";
-import { closeSync, existsSync, openSync, readSync, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
-import { basename as basename2, delimiter, isAbsolute, join, posix } from "node:path";
+import { accessSync, closeSync, constants as fsConstants, existsSync, openSync, readFileSync as readFileSync3, readSync, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { basename as basename2, delimiter, dirname, isAbsolute, join, posix, resolve as resolve3 } from "node:path";
 
 // packages/core/architecture-delta/src/index.ts
 init_src();
@@ -6582,9 +6583,11 @@ function numberExtension(value) {
 // packages/local-runtime/codegraph-adapter/src/index.ts
 init_src();
 var REQUIRED_CODEGRAPH_PACKAGE = "@colbymchenry/codegraph";
-var REQUIRED_CODEGRAPH_VERSION = "1.0.1";
+var REQUIRED_CODEGRAPH_VERSION = "1.4.0";
 var CODEGRAPH_TELEMETRY_ENV = "DO_NOT_TRACK";
 var CODEGRAPH_TELEMETRY_DISABLED_VALUE = "1";
+var DEFAULT_CODEGRAPH_BINARY = "codegraph";
+var requireFromAdapter = createRequire2(import.meta.url);
 function disableCodeGraphTelemetryByDefault(env = process.env) {
   env[CODEGRAPH_TELEMETRY_ENV] ??= CODEGRAPH_TELEMETRY_DISABLED_VALUE;
   return env[CODEGRAPH_TELEMETRY_ENV] ?? CODEGRAPH_TELEMETRY_DISABLED_VALUE;
@@ -6595,7 +6598,7 @@ class CodeGraphCliProvider {
   version = REQUIRED_CODEGRAPH_VERSION;
   capabilities = ["index", "context", "impact"];
   workspaceRoot;
-  constructor(workspaceRoot = process.cwd(), binary = "codegraph") {
+  constructor(workspaceRoot = process.cwd(), binary = DEFAULT_CODEGRAPH_BINARY) {
     this.binary = binary;
     this.workspaceRoot = workspaceRoot;
   }
@@ -6679,27 +6682,56 @@ class CodeGraphCliProvider {
     }
   }
 }
-function codeGraphCliInvocation(binary, cwd) {
-  const resolved = resolveExecutable(binary, cwd);
+function codeGraphCliInvocation(binary, cwd, pathValue = process.env.PATH ?? "") {
+  const resolved = resolveExecutable(binary, cwd, pathValue);
   if (resolved && isNodeRuntimeScript(resolved)) {
     return { command: process.execPath, argsPrefix: [resolved] };
   }
+  if (!resolved && binary === DEFAULT_CODEGRAPH_BINARY) {
+    const packagedShim = resolvePackagedCodeGraphShim();
+    if (packagedShim)
+      return { command: process.execPath, argsPrefix: [packagedShim] };
+  }
   return { command: binary, argsPrefix: [] };
 }
-function resolveExecutable(binary, cwd) {
+function resolveExecutable(binary, cwd, pathValue) {
   if (binary.includes("/") || binary.includes("\\")) {
     const path = isAbsolute(binary) ? binary : join(cwd, binary);
     return existsSync(path) ? realpathSync3.native(path) : undefined;
   }
-  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+  for (const dir of pathValue.split(delimiter)) {
     if (!dir)
       continue;
     const path = join(dir, binary);
-    if (existsSync(path))
+    if (isExecutablePath(path))
       return realpathSync3.native(path);
   }
   return;
 }
+function isExecutablePath(path) {
+  try {
+    if (!statSync3(path).isFile())
+      return false;
+    if (process.platform !== "win32")
+      accessSync(path, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolvePackagedCodeGraphShim() {
+  try {
+    const manifestPath = requireFromAdapter.resolve(`${REQUIRED_CODEGRAPH_PACKAGE}/package.json`);
+    const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+    const relativeBin = manifest.bin?.codegraph;
+    if (manifest.version !== REQUIRED_CODEGRAPH_VERSION || !relativeBin)
+      return;
+    const shimPath = resolve3(dirname(manifestPath), relativeBin);
+    return existsSync(shimPath) ? realpathSync3.native(shimPath) : undefined;
+  } catch {
+    return;
+  }
+}
 function isNodeRuntimeScript(path) {
   if (/\.[cm]?js$/i.test(path))
     return true;
@@ -7094,7 +7126,7 @@ function uninstallMarker(content, host) {
 `).trim();
 }
 function dependencyAudit(root) {
-  const packageJson = JSON.parse(readFileSync3(resolve3(root, "package.json"), "utf8"));
+  const packageJson = JSON.parse(readFileSync4(resolve4(root, "package.json"), "utf8"));
   const issues = [];
   if (!packageJson.engines?.node?.includes(">=24"))
     issues.push("node engine must include >=24");
@@ -7107,7 +7139,7 @@ function secretScan(root) {
       continue;
     if (file === "packages/cloud/hardening/src/index.ts" || file.includes("/test/"))
       continue;
-    const body = readFileSync3(resolve3(root, file), "utf8");
+    const body = readFileSync4(resolve4(root, file), "utf8");
     if (/(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|BEGIN PRIVATE KEY)/.test(body))
       findings.push(file);
   }
@@ -7141,11 +7173,11 @@ function listFiles(root) {
   walk(".");
   return out;
   function walk(relativeDir) {
-    for (const entry of readdirSync3(resolve3(root, relativeDir), { withFileTypes: true })) {
+    for (const entry of readdirSync3(resolve4(root, relativeDir), { withFileTypes: true })) {
       if ([".git", "node_modules", "coverage"].includes(entry.name))
         continue;
       const child = relativeDir === "." ? entry.name : `${relativeDir}/${entry.name}`;
-      const full = resolve3(root, child);
+      const full = resolve4(root, child);
       if (entry.isDirectory())
         walk(child);
       if (entry.isFile() && statSync4(full).size < 1e6)
@@ -7157,10 +7189,10 @@ function listFiles(root) {
 // packages/local-runtime/local-store-sqlite/src/index.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash5, randomUUID } from "node:crypto";
-import { chmodSync, closeSync as closeSync2, existsSync as existsSync2, fsyncSync, lstatSync, mkdirSync, openSync as openSync2, readFileSync as readFileSync4, realpathSync as realpathSync4, renameSync, rmSync, writeFileSync } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
+import { chmodSync, closeSync as closeSync2, existsSync as existsSync2, fsyncSync, lstatSync, mkdirSync, openSync as openSync2, readFileSync as readFileSync5, realpathSync as realpathSync4, renameSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
 import { homedir } from "node:os";
-import { dirname, isAbsolute as isAbsolute2, join as join2, relative as relative3, resolve as resolve4 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative3, resolve as resolve5 } from "node:path";
 
 // packages/core/architecture-ledger/src/index.ts
 init_src();
@@ -8994,7 +9026,7 @@ function assertRecord(value, label) {
 
 // packages/local-runtime/local-store-sqlite/src/index.ts
 init_src();
-var runtimeRequire = createRequire2(import.meta.url);
+var runtimeRequire = createRequire3(import.meta.url);
 var SQLITE_SIDECAR_SUFFIXES = ["", "-wal", "-shm"];
 var LEGACY_MIGRATION_MARKER_FILE = "runtime.sqlite.migration.json";
 var LEGACY_MIGRATION_LOCK_FILE = "runtime.sqlite.migration.lock";
@@ -9567,7 +9599,7 @@ var ARCHCONTEXT_LOCAL_STORE_PATH_ENV = "ARCHCONTEXT_LOCAL_STORE_PATH";
 function defaultArchContextStateRoot(env = process.env, platform = process.platform, home = homedir()) {
   const override = env[ARCHCONTEXT_STATE_DIR_ENV];
   if (override)
-    return { path: resolve4(override), source: "environment" };
+    return { path: resolve5(override), source: "environment" };
   if (platform === "darwin")
     return { path: join2(home, "Library", "Application Support", "ArchContext"), source: "os-user-data" };
   if (platform === "win32")
@@ -9585,7 +9617,7 @@ function runtimeStatePaths(root = process.cwd(), env = process.env) {
   const stateRoot = defaultArchContextStateRoot(env);
   const repositoryStateDir = join2(stateRoot.path, "repositories", storageRepositoryId);
   const workspaceStateDir = join2(repositoryStateDir, "worktrees", storageWorkspaceId);
-  const legacyControlDir = resolve4(canonicalRepositoryRoot3, ".archcontext", ".local");
+  const legacyControlDir = resolve5(canonicalRepositoryRoot3, ".archcontext", ".local");
   return {
     schemaVersion: "archcontext.runtime-state-paths/v1",
     stateRoot: stateRoot.path,
@@ -9653,7 +9685,7 @@ function migrateLegacyLocalStoreIfNeeded(root = process.cwd(), env = process.env
       status: "explicit-local-store-override"
     });
   }
-  ensurePrivateDir(dirname(paths.localStorePath));
+  ensurePrivateDir(dirname2(paths.localStorePath));
   const legacyExists = existsSync2(paths.legacyLocalStorePath);
   const integrityCheck = {};
   const quarantinedFiles = [];
@@ -9751,7 +9783,7 @@ function readAppliedLocalSqliteMigrations(db) {
 }
 function openSqliteDatabaseSync(databasePath) {
   if (databasePath !== ":memory:")
-    ensurePrivateDir(dirname(databasePath));
+    ensurePrivateDir(dirname2(databasePath));
   try {
     const nodeSqlite = runtimeRequire("node:sqlite");
     const db2 = new nodeSqlite.DatabaseSync(databasePath);
@@ -9928,7 +9960,7 @@ function publishStagedLocalStore(stagingPath, targetPath) {
   }
   renameSync(stagingPath, targetPath);
   makePrivateFile(targetPath);
-  fsyncDirectory(dirname(targetPath));
+  fsyncDirectory(dirname2(targetPath));
 }
 function writeLegacyMigrationMarker(paths, integrityCheck, quarantinedFiles) {
   const markerPath = legacyMigrationMarkerPath(paths);
@@ -9944,7 +9976,7 @@ function writeLegacyMigrationMarker(paths, integrityCheck, quarantinedFiles) {
 }
 function acquireLegacyMigrationLock(paths) {
   const lockPath = legacyMigrationLockPath(paths);
-  ensurePrivateDir(dirname(lockPath));
+  ensurePrivateDir(dirname2(lockPath));
   try {
     const fd = openSync2(lockPath, "wx", 384);
     writeFileSync(fd, JSON.stringify({
@@ -9973,7 +10005,7 @@ function releaseLegacyMigrationLock(lock) {
 }
 function isStaleMigrationLock(lockPath) {
   try {
-    const parsed = JSON.parse(readFileSync4(lockPath, "utf8"));
+    const parsed = JSON.parse(readFileSync5(lockPath, "utf8"));
     if (typeof parsed.pid !== "number" || parsed.pid <= 0)
       return true;
     return !isProcessAlive(parsed.pid);
@@ -10008,7 +10040,7 @@ function quarantineExistingLocalStore(paths) {
     quarantinedFiles.push(target);
   }
   fsyncDirectory(quarantineDir);
-  fsyncDirectory(dirname(paths.localStorePath));
+  fsyncDirectory(dirname2(paths.localStorePath));
   return quarantinedFiles;
 }
 function legacyMigrationMarkerPath(paths) {
@@ -10018,7 +10050,7 @@ function legacyMigrationLockPath(paths) {
   return join2(paths.workspaceStateDir, LEGACY_MIGRATION_LOCK_FILE);
 }
 function writePrivateJson(path, value) {
-  ensurePrivateDir(dirname(path));
+  ensurePrivateDir(dirname2(path));
   const fd = openSync2(path, "w", 384);
   try {
     writeFileSync(fd, JSON.stringify(value, null, 2), "utf8");
@@ -10027,7 +10059,7 @@ function writePrivateJson(path, value) {
     closeSync2(fd);
   }
   makePrivateFile(path);
-  fsyncDirectory(dirname(path));
+  fsyncDirectory(dirname2(path));
 }
 function ensurePrivateDir(path) {
   mkdirSync(path, { recursive: true, mode: 448 });
@@ -10057,10 +10089,10 @@ function readGitPath(root, args) {
   }
 }
 function resolveMaybeRelative(base, path) {
-  return isAbsolute2(path) ? resolve4(path) : resolve4(base, path);
+  return isAbsolute2(path) ? resolve5(path) : resolve5(base, path);
 }
 function canonicalPath(path) {
-  const resolved = resolve4(path);
+  const resolved = resolve5(path);
   try {
     return realpathSync4.native(resolved);
   } catch {
@@ -10068,8 +10100,8 @@ function canonicalPath(path) {
   }
 }
 function isPathInsideOrSame(path, parent) {
-  const child = resolve4(path);
-  const base = resolve4(parent);
+  const child = resolve5(path);
+  const base = resolve5(parent);
   const fromBase = relative3(base, child);
   return fromBase === "" || !!fromBase && !fromBase.startsWith("..") && !isAbsolute2(fromBase);
 }
@@ -10100,21 +10132,21 @@ function isIgnorableDirectoryFsyncError(error) {
 // packages/local-runtime/git-adapter/src/index.ts
 import { execFileSync as execFileSync3, spawnSync } from "node:child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync, rmSync as rmSync2 } from "node:fs";
-import { dirname as dirname2, join as join3, resolve as resolve5 } from "node:path";
+import { dirname as dirname3, join as join3, resolve as resolve6 } from "node:path";
 init_src();
 function findRepositoryRoot(start) {
   try {
-    return resolve5(execFileSync3("git", ["rev-parse", "--show-toplevel"], {
+    return resolve6(execFileSync3("git", ["rev-parse", "--show-toplevel"], {
       cwd: start,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim());
   } catch {
-    let cursor = resolve5(start);
+    let cursor = resolve6(start);
     while (true) {
-      if (existsSync3(resolve5(cursor, ".git")))
+      if (existsSync3(resolve6(cursor, ".git")))
         return cursor;
-      const parent = dirname2(cursor);
+      const parent = dirname3(cursor);
       if (parent === cursor)
         break;
       cursor = parent;
@@ -10137,19 +10169,19 @@ function readHeadSha(root) {
 // packages/local-runtime/runtime-daemon/src/index.ts
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { chmodSync as chmodSync3, closeSync as closeSync5, existsSync as existsSync13, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync5, readdirSync as readdirSync8, readFileSync as readFileSync11, rmSync as rmSync8, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync3, closeSync as closeSync5, existsSync as existsSync13, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync5, readdirSync as readdirSync8, readFileSync as readFileSync12, rmSync as rmSync8, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { createServer } from "node:http";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname8, join as join8, resolve as resolve15 } from "node:path";
+import { dirname as dirname9, join as join8, resolve as resolve16 } from "node:path";
 
 // packages/core/changeset-engine/src/index.ts
 init_src();
-import { closeSync as closeSync3, existsSync as existsSync5, fsyncSync as fsyncSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, resolve as resolve7 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync5, fsyncSync as fsyncSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname4, resolve as resolve8 } from "node:path";
 
 // packages/core/policy-engine/src/index.ts
 import { existsSync as existsSync4, realpathSync as realpathSync5 } from "node:fs";
-import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve6, sep as sep3 } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve7, sep as sep3 } from "node:path";
 init_src();
 var INVALID_COMPAT_REASONS = new Set(["just in case", "safer to keep", "many internal callers", "large diff", "old code already exists"]);
 var PLACEHOLDER_DIGEST = `sha256:${"0".repeat(64)}`;
@@ -10190,8 +10222,8 @@ function assertAllowedArchContextPath(root, relativePath) {
   if (!ALLOWLIST.some((prefix) => normalized.startsWith(prefix))) {
     throw new Error(`Path is outside ArchContext write allowlist: ${relativePath}`);
   }
-  const absoluteRoot = resolve6(root);
-  const absoluteTarget = resolve6(root, relativePath);
+  const absoluteRoot = resolve7(root);
+  const absoluteTarget = resolve7(root, relativePath);
   const targetFromRoot = relative4(absoluteRoot, absoluteTarget);
   if (targetFromRoot === "" || targetFromRoot === ".." || targetFromRoot.startsWith(`..${sep3}`) || isAbsolute3(targetFromRoot)) {
     throw new Error(`Path escapes repository: ${relativePath}`);
@@ -10201,7 +10233,7 @@ function assertAllowedArchContextPath(root, relativePath) {
   const canonicalRoot = realpathSync5.native(absoluteRoot);
   let existingAncestor = absoluteTarget;
   while (!existsSync4(existingAncestor)) {
-    const parent = resolve6(existingAncestor, "..");
+    const parent = resolve7(existingAncestor, "..");
     if (parent === existingAncestor)
       throw new Error(`Path has no existing repository ancestor: ${relativePath}`);
     existingAncestor = parent;
@@ -10344,7 +10376,7 @@ class ChangeSetEngine {
   async applyFileOperation(root, path, expectedHash, body, operation, backups, journalId, sequence) {
     assertSafeTarget(root, path);
     const deps = this.requireDeps();
-    const absolute = resolve7(root, path);
+    const absolute = resolve8(root, path);
     const existed = existsSync5(absolute);
     const backupPath = `${absolute}.archctx-backup`;
     const tempPath = operation === "delete_entity" ? undefined : `${absolute}.archctx-tmp-${process.pid}-${sequence}`;
@@ -10367,7 +10399,7 @@ class ChangeSetEngine {
     backups.push(backup);
     if (existed) {
       renameSync2(absolute, backupPath);
-      fsyncDirectory2(dirname3(absolute));
+      fsyncDirectory2(dirname4(absolute));
     }
     if (operation === "delete_entity") {
       rmSync3(absolute, { force: true });
@@ -10378,22 +10410,22 @@ class ChangeSetEngine {
 }
 function assertSafeTarget(root, path) {
   assertAllowedArchContextPath(root, path);
-  const absolute = resolve7(root, path);
+  const absolute = resolve8(root, path);
   if (existsSync5(absolute) && lstatSync2(absolute).isSymbolicLink()) {
     throw new Error(`Refusing to write symlink target: ${path}`);
   }
 }
 function assertExpectedHash(path, expectedHash) {
-  const actual = digestJson({ body: readFileSync5(path, "utf8") });
+  const actual = digestJson({ body: readFileSync6(path, "utf8") });
   if (expectedHash !== actual)
     throw new Error(`Expected hash mismatch: ${path}`);
 }
 function atomicWriteFile(path, tempPath, body) {
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync3(dirname4(path), { recursive: true });
   writeFileSync2(tempPath, body, "utf8");
   fsyncFile(tempPath);
   renameSync2(tempPath, path);
-  fsyncDirectory2(dirname3(path));
+  fsyncDirectory2(dirname4(path));
 }
 function fsyncFile(path) {
   const fd = openSync3(path, process.platform === "win32" ? "r+" : "r");
@@ -10462,7 +10494,7 @@ function rollback(backups) {
     } else {
       rmSync3(backup.path, { recursive: true, force: true });
     }
-    fsyncDirectory2(dirname3(backup.path));
+    fsyncDirectory2(dirname4(backup.path));
   }
 }
 function cleanupBackups(backups) {
@@ -10668,18 +10700,18 @@ function digestSuffix2(digest) {
 
 // packages/core/application/src/index.ts
 import { existsSync as existsSync8, statSync as statSync5 } from "node:fs";
-import { extname, resolve as resolve10 } from "node:path";
+import { extname, resolve as resolve11 } from "node:path";
 
 // packages/core/context-compiler/src/index.ts
 init_src();
 
 // packages/core/practice-catalog/src/index.ts
 init_src();
-import { existsSync as existsSync6, lstatSync as lstatSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync6 } from "node:fs";
-import { dirname as dirname4, relative as relative5, resolve as resolve8, sep as sep4 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readdirSync as readdirSync4, readFileSync as readFileSync7, realpathSync as realpathSync6 } from "node:fs";
+import { dirname as dirname5, relative as relative5, resolve as resolve9, sep as sep4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PRACTICE_CATALOG_VERSION = "2026.06.0";
-var BUILTIN_PRACTICE_ASSETS_DIR = resolve8(dirname4(fileURLToPath(import.meta.url)), "../assets");
+var BUILTIN_PRACTICE_ASSETS_DIR = resolve9(dirname5(fileURLToPath(import.meta.url)), "../assets");
 var ALLOWED_CHECK_IDS = new Set([
   "compatibility-contract-required",
   "no-new-cycle",
@@ -10731,13 +10763,13 @@ var PRACTICE_ROOT_KEYS = new Set([
   "overlay"
 ]);
 function loadPracticeCatalog(options = {}) {
-  const root = options.root ? resolve8(options.root) : process.cwd();
+  const root = options.root ? resolve9(options.root) : process.cwd();
   const builtInAssetsDir = options.builtInAssetsDir ?? BUILTIN_PRACTICE_ASSETS_DIR;
   const errors = [];
   const warnings = [];
-  const builtIn = loadAssetFiles(resolve8(builtInAssetsDir, "practices"), "curated-static", errors);
-  const profiles = loadProfileFiles(resolve8(builtInAssetsDir, "profiles"), errors);
-  const sources = loadSourceFiles(resolve8(builtInAssetsDir, "sources"), errors);
+  const builtIn = loadAssetFiles(resolve9(builtInAssetsDir, "practices"), "curated-static", errors);
+  const profiles = loadProfileFiles(resolve9(builtInAssetsDir, "profiles"), errors);
+  const sources = loadSourceFiles(resolve9(builtInAssetsDir, "sources"), errors);
   const overlays = options.includeRepoOverlay === false ? [] : loadRepoOverlayAssets(root, errors);
   const merged = mergeCatalogAssets(builtIn, overlays, errors, options.now ?? new Date().toISOString());
   const sourceIds = new Set(sources.map((source) => source.id));
@@ -10923,7 +10955,7 @@ function loadProfileFiles(dir, errors) {
   return profiles.sort((a, b) => a.id.localeCompare(b.id));
 }
 function loadRepoOverlayAssets(root, errors) {
-  const overlayRoot = resolve8(root, ".archcontext/practices");
+  const overlayRoot = resolve9(root, ".archcontext/practices");
   if (!existsSync6(overlayRoot))
     return [];
   const out = [];
@@ -11287,7 +11319,7 @@ function listDataFiles(dir, allowedRoot, errors) {
     }
     if (stat.isDirectory()) {
       for (const entry of readdirSync4(current, { withFileTypes: true }))
-        walk(resolve8(current, entry.name));
+        walk(resolve9(current, entry.name));
       return;
     }
     if (!/\.(ya?ml|json)$/.test(current))
@@ -11302,7 +11334,7 @@ function listDataFiles(dir, allowedRoot, errors) {
 }
 function parseDataFile(path, errors) {
   try {
-    const body = readFileSync6(path, "utf8").replace(/^\uFEFF/, "").trim();
+    const body = readFileSync7(path, "utf8").replace(/^\uFEFF/, "").trim();
     const withoutDocumentMarker = body.startsWith("---") ? body.replace(/^---\s*/, "").trim() : body;
     return JSON.parse(withoutDocumentMarker);
   } catch (error) {
@@ -11331,12 +11363,12 @@ function safeRealpath(path) {
   try {
     return realpathSync6.native(path);
   } catch {
-    return resolve8(path);
+    return resolve9(path);
   }
 }
 function isRealChild(rootReal, pathReal) {
   const rel = relative5(rootReal, pathReal);
-  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep4}`) && !resolve8(rel).startsWith("..");
+  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep4}`) && !resolve9(rel).startsWith("..");
 }
 function displayPath(path) {
   return path.split(sep4).join("/");
@@ -11900,8 +11932,8 @@ function checkResult(input, result) {
 }
 // packages/core/practice-engine/src/enforcement.ts
 init_src();
-import { existsSync as existsSync7, lstatSync as lstatSync4, readdirSync as readdirSync5, readFileSync as readFileSync7 } from "node:fs";
-import { basename as basename3, join as join4, relative as relative6, resolve as resolve9, sep as sep5 } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync4, readdirSync as readdirSync5, readFileSync as readFileSync8 } from "node:fs";
+import { basename as basename3, join as join4, relative as relative6, resolve as resolve10, sep as sep5 } from "node:path";
 var ENFORCEMENT_RANK = { advisory: 0, checkpoint: 1, complete: 2 };
 var POLICY_MODES = new Set(["advisory", "active", "fail-open", "fail-closed"]);
 var DEFAULT_POLICY = {
@@ -11924,7 +11956,7 @@ function shouldEvaluatePracticeEnforcement(policy) {
   return practiceEnforcementPolicyMode(policy) !== "advisory";
 }
 function loadPracticeEnforcementPolicy(root) {
-  const path = resolve9(root, ".archcontext/policies/practices.yaml");
+  const path = resolve10(root, ".archcontext/policies/practices.yaml");
   if (!existsSync7(path))
     return defaultPracticeEnforcementPolicy();
   assertRepoPolicyFile(root, path, ".archcontext/policies/practices.yaml");
@@ -11932,7 +11964,7 @@ function loadPracticeEnforcementPolicy(root) {
   return validatePracticeEnforcementPolicy(parsed, ".archcontext/policies/practices.yaml");
 }
 function loadPracticeWaivers(root) {
-  const dir = resolve9(root, ".archcontext/waivers");
+  const dir = resolve10(root, ".archcontext/waivers");
   if (!existsSync7(dir))
     return [];
   const stat = lstatSync4(dir);
@@ -11953,17 +11985,17 @@ function loadPracticeWaivers(root) {
   return waivers.sort((left, right) => waiverDigest(left).localeCompare(waiverDigest(right)));
 }
 function loadPracticeWaiverOwnerRegistry(root) {
-  const modelDir = resolve9(root, ".archcontext/model/nodes");
+  const modelDir = resolve10(root, ".archcontext/model/nodes");
   const sources = [];
   const subjects = [];
   if (existsSync7(modelDir)) {
     if (lstatSync4(modelDir).isSymbolicLink())
       throw new Error("practice-owner-registry-symlink-denied");
     for (const path of collectFiles(root, ".archcontext/model/nodes")) {
-      const absolute = resolve9(root, path);
+      const absolute = resolve10(root, path);
       if (lstatSync4(absolute).isSymbolicLink())
         throw new Error(`practice-owner-registry-symlink-denied: ${path}`);
-      const body = readFileSync7(absolute, "utf8");
+      const body = readFileSync8(absolute, "utf8");
       const lifecycleOwners = extractOwnershipOwners(body, "lifecycle");
       const dataOwners = extractOwnershipOwners(body, "data");
       for (const kind of ["lifecycle", "data"]) {
@@ -12238,12 +12270,12 @@ function isVagueReason(reason) {
   return /^(temporary|cleanup later|todo|tbd|later|just in case)$/i.test(trimmed);
 }
 function parseJsonYamlFile(path) {
-  const body = readFileSync7(path, "utf8").replace(/^\uFEFF/, "").trim();
+  const body = readFileSync8(path, "utf8").replace(/^\uFEFF/, "").trim();
   const withoutDocumentMarker = body.startsWith("---") ? body.replace(/^---\s*/, "").trim() : body;
   return JSON.parse(withoutDocumentMarker);
 }
 function collectFiles(root, relativeDir) {
-  const dir = resolve9(root, relativeDir);
+  const dir = resolve10(root, relativeDir);
   const out = [];
   for (const entry of readdirSync5(dir, { withFileTypes: true })) {
     const child = `${relativeDir}/${entry.name}`;
@@ -12331,8 +12363,8 @@ function assertRepoPolicyFile(root, path, relativePath) {
   assertRepoRelativePath(relativePath);
   if (lstatSync4(path).isSymbolicLink())
     throw new Error(`practice-policy-symlink-denied: ${relativePath}`);
-  const rootResolved = resolve9(root);
-  const pathResolved = resolve9(path);
+  const rootResolved = resolve10(root);
+  const pathResolved = resolve10(path);
   const rel = relative6(rootResolved, pathResolved);
   if (rel === "" || rel.startsWith("..") || rel.includes(`..${sep5}`))
     throw new Error(`practice-policy-path-escape: ${relativePath}`);
@@ -13768,7 +13800,7 @@ function classifyCheckpointPath(root, path) {
     return "ignored";
   if (isGeneratedCheckpointPath(path))
     return "generated";
-  const absolute = resolve10(root, path);
+  const absolute = resolve11(root, path);
   if (!existsSync8(absolute))
     return "deleted";
   try {
@@ -14975,8 +15007,8 @@ function uniqueSorted4(values) {
 
 // packages/core/projection-engine/src/index.ts
 init_src();
-import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "node:fs";
-import { basename as basename4, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { basename as basename4, resolve as resolve12 } from "node:path";
 function nativeNodeSource(node) {
   const value = node.source;
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -15097,12 +15129,12 @@ function architectureDocumentationSourceDigest(input) {
   });
 }
 function loadArchitectureDecisionRecords(root) {
-  const dir = resolve11(root, "docs/adr");
+  const dir = resolve12(root, "docs/adr");
   if (!existsSync9(dir))
     return [];
   return readdirSync6(dir).filter((file) => /^ADR-\d{4}-.+\.md$/.test(file)).sort().map((file) => {
     const path = `docs/adr/${file}`;
-    const body = readFileSync8(resolve11(root, path), "utf8");
+    const body = readFileSync9(resolve12(root, path), "utf8");
     const title = body.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? basename4(file, ".md");
     const status = body.match(/^Status:\s*(.+)$/mi)?.[1]?.trim();
     return {
@@ -15124,17 +15156,17 @@ function loadArchitectureDocumentationFiles(root) {
     "docs/architecture/diagrams/architecture.structurizr.json",
     "docs/architecture/.projection-manifest.json"
   ]) {
-    const absolute = resolve11(root, entry);
+    const absolute = resolve12(root, entry);
     if (existsSync9(absolute))
-      files.push({ path: entry, body: readFileSync8(absolute, "utf8") });
+      files.push({ path: entry, body: readFileSync9(absolute, "utf8") });
   }
   for (const dir of ["docs/architecture/modules", "docs/architecture/relations"]) {
-    const absoluteDir = resolve11(root, dir);
+    const absoluteDir = resolve12(root, dir);
     if (!existsSync9(absoluteDir))
       continue;
     for (const file of readdirSync6(absoluteDir).filter((name) => name.endsWith(".md")).sort()) {
       const path = `${dir}/${file}`;
-      files.push({ path, body: readFileSync8(resolve11(root, path), "utf8") });
+      files.push({ path, body: readFileSync9(resolve12(root, path), "utf8") });
     }
   }
   return files.sort((left, right) => left.path.localeCompare(right.path));
@@ -15228,8 +15260,8 @@ function exportDocumentationStructurizrWorkspace(model) {
 }
 function loadNativeModelFromArchContext(root) {
   return {
-    nodes: readYamlObjects(resolve11(root, ".archcontext/model/nodes")),
-    relations: readYamlObjects(resolve11(root, ".archcontext/model/relations"))
+    nodes: readYamlObjects(resolve12(root, ".archcontext/model/nodes")),
+    relations: readYamlObjects(resolve12(root, ".archcontext/model/relations"))
   };
 }
 function mermaidId(id) {
@@ -15239,8 +15271,8 @@ function readYamlObjects(dir) {
   if (!existsSync9(dir))
     return [];
   return readdirSync6(dir).filter((file) => /\.ya?ml$/.test(file)).sort().map((file) => {
-    const path = resolve11(dir, file);
-    return parseJsonOrStableYaml(readFileSync8(path, "utf8"), path);
+    const path = resolve12(dir, file);
+    return parseJsonOrStableYaml(readFileSync9(path, "utf8"), path);
   });
 }
 function escapeMermaid(value) {
@@ -16798,22 +16830,22 @@ init_src();
 // packages/local-runtime/git-adapter/src/index.ts
 import { execFileSync as execFileSync4, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
-import { dirname as dirname5, join as join5, resolve as resolve12 } from "node:path";
+import { dirname as dirname6, join as join5, resolve as resolve13 } from "node:path";
 import { tmpdir } from "node:os";
 init_src();
 function findRepositoryRoot2(start) {
   try {
-    return resolve12(execFileSync4("git", ["rev-parse", "--show-toplevel"], {
+    return resolve13(execFileSync4("git", ["rev-parse", "--show-toplevel"], {
       cwd: start,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim());
   } catch {
-    let cursor = resolve12(start);
+    let cursor = resolve13(start);
     while (true) {
-      if (existsSync10(resolve12(cursor, ".git")))
+      if (existsSync10(resolve13(cursor, ".git")))
         return cursor;
-      const parent = dirname5(cursor);
+      const parent = dirname6(cursor);
       if (parent === cursor)
         break;
       cursor = parent;
@@ -16913,7 +16945,7 @@ function prepareDetachedReviewWorktree(input) {
       observed: {}
     };
   }
-  const parent = input.tempRoot ? resolve12(input.tempRoot) : tmpdir();
+  const parent = input.tempRoot ? resolve13(input.tempRoot) : tmpdir();
   mkdirSync4(parent, { recursive: true });
   const temporaryRoot = mkdtempSync2(join5(parent, "archctx-review-worktree-"));
   const worktreeRoot = join5(temporaryRoot, "worktree");
@@ -16965,7 +16997,7 @@ function removeDetachedReviewWorktree(worktree) {
   } catch {
     removePathWithRetry(worktree.worktreeRoot);
   } finally {
-    removePathWithRetry(worktree.temporaryRoot || dirname5(worktree.worktreeRoot));
+    removePathWithRetry(worktree.temporaryRoot || dirname6(worktree.worktreeRoot));
   }
 }
 function removePathWithRetry(path) {
@@ -17082,13 +17114,13 @@ function isGitWorktreeError(error) {
 // packages/local-runtime/local-store-sqlite/src/index.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, closeSync as closeSync4, existsSync as existsSync11, fsyncSync as fsyncSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync9, realpathSync as realpathSync7, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { chmodSync as chmodSync2, closeSync as closeSync4, existsSync as existsSync11, fsyncSync as fsyncSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync10, realpathSync as realpathSync7, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
-import { createRequire as createRequire3 } from "node:module";
+import { createRequire as createRequire4 } from "node:module";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join6, relative as relative7, resolve as resolve13 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute4, join as join6, relative as relative7, resolve as resolve14 } from "node:path";
 init_src();
-var runtimeRequire2 = createRequire3(import.meta.url);
+var runtimeRequire2 = createRequire4(import.meta.url);
 var SQLITE_SIDECAR_SUFFIXES2 = ["", "-wal", "-shm"];
 var LEGACY_MIGRATION_MARKER_FILE2 = "runtime.sqlite.migration.json";
 var LEGACY_MIGRATION_LOCK_FILE2 = "runtime.sqlite.migration.lock";
@@ -17662,7 +17694,7 @@ var ARCHCONTEXT_LOCAL_STORE_PATH_ENV2 = "ARCHCONTEXT_LOCAL_STORE_PATH";
 function defaultArchContextStateRoot2(env = process.env, platform = process.platform, home = homedir2()) {
   const override = env[ARCHCONTEXT_STATE_DIR_ENV2];
   if (override)
-    return { path: resolve13(override), source: "environment" };
+    return { path: resolve14(override), source: "environment" };
   if (platform === "darwin")
     return { path: join6(home, "Library", "Application Support", "ArchContext"), source: "os-user-data" };
   if (platform === "win32")
@@ -17680,7 +17712,7 @@ function runtimeStatePaths2(root = process.cwd(), env = process.env) {
   const stateRoot = defaultArchContextStateRoot2(env);
   const repositoryStateDir = join6(stateRoot.path, "repositories", storageRepositoryId);
   const workspaceStateDir = join6(repositoryStateDir, "worktrees", storageWorkspaceId);
-  const legacyControlDir = resolve13(canonicalRepositoryRoot3, ".archcontext", ".local");
+  const legacyControlDir = resolve14(canonicalRepositoryRoot3, ".archcontext", ".local");
   return {
     schemaVersion: "archcontext.runtime-state-paths/v1",
     stateRoot: stateRoot.path,
@@ -17714,7 +17746,7 @@ function migrateLegacyLocalStoreIfNeeded2(root = process.cwd(), env = process.en
       status: "explicit-local-store-override"
     });
   }
-  ensurePrivateDir2(dirname6(paths.localStorePath));
+  ensurePrivateDir2(dirname7(paths.localStorePath));
   const legacyExists = existsSync11(paths.legacyLocalStorePath);
   const integrityCheck = {};
   const quarantinedFiles = [];
@@ -18568,7 +18600,7 @@ class SqliteLocalStore {
   }
   async backupArchitectureLedger(input) {
     const db = await this.database();
-    ensurePrivateDir2(dirname6(input.backupPath));
+    ensurePrivateDir2(dirname7(input.backupPath));
     if (existsSync11(input.backupPath))
       rmSync5(input.backupPath, { force: true });
     db.exec(`VACUUM INTO ${sqliteStringLiteral2(input.backupPath)}`);
@@ -19157,7 +19189,7 @@ function readAppliedLocalSqliteMigrations2(db) {
 async function rebuildDerivedLandscapeState(store, input) {
   const landscapePath = input.landscapePath ?? LANDSCAPE_FILE;
   const relationsDir = input.relationsDir ?? ".archcontext/relations";
-  const landscape = parseLandscapeFile(await readFile(resolve13(input.root, landscapePath), "utf8"), landscapePath);
+  const landscape = parseLandscapeFile(await readFile(resolve14(input.root, landscapePath), "utf8"), landscapePath);
   const relations = await readRelationFiles(input.root, relationsDir);
   const scopedRelations = relations.filter((relation) => landscape.relations.includes(relation.id));
   const relationIds = new Set(relations.map((relation) => relation.id));
@@ -19184,7 +19216,7 @@ async function rebuildDerivedLandscapeState(store, input) {
 }
 async function openSqliteDatabase(databasePath) {
   if (databasePath !== ":memory:")
-    ensurePrivateDir2(dirname6(databasePath));
+    ensurePrivateDir2(dirname7(databasePath));
   try {
     const nodeSqlite = await import("node:sqlite");
     const db = new nodeSqlite.DatabaseSync(databasePath);
@@ -19205,7 +19237,7 @@ async function openSqliteDatabase(databasePath) {
 }
 function openSqliteDatabaseSync2(databasePath) {
   if (databasePath !== ":memory:")
-    ensurePrivateDir2(dirname6(databasePath));
+    ensurePrivateDir2(dirname7(databasePath));
   try {
     const nodeSqlite = runtimeRequire2("node:sqlite");
     const db2 = new nodeSqlite.DatabaseSync(databasePath);
@@ -19360,7 +19392,7 @@ function publishStagedLocalStore2(stagingPath, targetPath) {
   }
   renameSync3(stagingPath, targetPath);
   makePrivateFile2(targetPath);
-  fsyncDirectory3(dirname6(targetPath));
+  fsyncDirectory3(dirname7(targetPath));
 }
 function writeLegacyMigrationMarker2(paths, integrityCheck, quarantinedFiles) {
   const markerPath = legacyMigrationMarkerPath2(paths);
@@ -19376,7 +19408,7 @@ function writeLegacyMigrationMarker2(paths, integrityCheck, quarantinedFiles) {
 }
 function acquireLegacyMigrationLock2(paths) {
   const lockPath = legacyMigrationLockPath2(paths);
-  ensurePrivateDir2(dirname6(lockPath));
+  ensurePrivateDir2(dirname7(lockPath));
   try {
     const fd = openSync4(lockPath, "wx", 384);
     writeFileSync3(fd, JSON.stringify({
@@ -19405,7 +19437,7 @@ function releaseLegacyMigrationLock2(lock) {
 }
 function isStaleMigrationLock2(lockPath) {
   try {
-    const parsed = JSON.parse(readFileSync9(lockPath, "utf8"));
+    const parsed = JSON.parse(readFileSync10(lockPath, "utf8"));
     if (typeof parsed.pid !== "number" || parsed.pid <= 0)
       return true;
     return !isProcessAlive2(parsed.pid);
@@ -19440,7 +19472,7 @@ function quarantineExistingLocalStore2(paths) {
     quarantinedFiles.push(target);
   }
   fsyncDirectory3(quarantineDir);
-  fsyncDirectory3(dirname6(paths.localStorePath));
+  fsyncDirectory3(dirname7(paths.localStorePath));
   return quarantinedFiles;
 }
 function legacyMigrationMarkerPath2(paths) {
@@ -19450,7 +19482,7 @@ function legacyMigrationLockPath2(paths) {
   return join6(paths.workspaceStateDir, LEGACY_MIGRATION_LOCK_FILE2);
 }
 function writePrivateJson2(path, value) {
-  ensurePrivateDir2(dirname6(path));
+  ensurePrivateDir2(dirname7(path));
   const fd = openSync4(path, "w", 384);
   try {
     writeFileSync3(fd, JSON.stringify(value, null, 2), "utf8");
@@ -19459,7 +19491,7 @@ function writePrivateJson2(path, value) {
     closeSync4(fd);
   }
   makePrivateFile2(path);
-  fsyncDirectory3(dirname6(path));
+  fsyncDirectory3(dirname7(path));
 }
 function ensurePrivateDir2(path) {
   mkdirSync5(path, { recursive: true, mode: 448 });
@@ -19489,10 +19521,10 @@ function readGitPath2(root, args) {
   }
 }
 function resolveMaybeRelative2(base, path) {
-  return isAbsolute4(path) ? resolve13(path) : resolve13(base, path);
+  return isAbsolute4(path) ? resolve14(path) : resolve14(base, path);
 }
 function canonicalPath2(path) {
-  const resolved = resolve13(path);
+  const resolved = resolve14(path);
   try {
     return realpathSync7.native(resolved);
   } catch {
@@ -19500,8 +19532,8 @@ function canonicalPath2(path) {
   }
 }
 function isPathInsideOrSame2(path, parent) {
-  const child = resolve13(path);
-  const base = resolve13(parent);
+  const child = resolve14(path);
+  const base = resolve14(parent);
   const fromBase = relative7(base, child);
   return fromBase === "" || !!fromBase && !fromBase.startsWith("..") && !isAbsolute4(fromBase);
 }
@@ -19706,7 +19738,7 @@ function isJsonRecord(value) {
 }
 function recoverJournalFiles(root, files) {
   for (const file of [...files].reverse()) {
-    const absolute = resolve13(root, file.path);
+    const absolute = resolve14(root, file.path);
     if (file.tempPath)
       rmSync5(file.tempPath, { recursive: true, force: true });
     if (file.existed) {
@@ -19717,7 +19749,7 @@ function recoverJournalFiles(root, files) {
     } else {
       rmSync5(absolute, { recursive: true, force: true });
     }
-    fsyncDirectory3(dirname6(absolute));
+    fsyncDirectory3(dirname7(absolute));
   }
 }
 function cleanupCommittedJournalFiles(files) {
@@ -19754,7 +19786,7 @@ function reviewTaskSessionId(result) {
 async function readRelationFiles(root, relationsDir) {
   let entries;
   try {
-    entries = await readdir(resolve13(root, relationsDir), { withFileTypes: true });
+    entries = await readdir(resolve14(root, relationsDir), { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT")
       return [];
@@ -19765,15 +19797,15 @@ async function readRelationFiles(root, relationsDir) {
     if (!entry.isFile() || !/\.(json|ya?ml)$/.test(entry.name))
       continue;
     const relativePath = join6(relationsDir, entry.name).split("\\").join("/");
-    relations.push(parseCrossRepoRelationFile(await readFile(resolve13(root, relativePath), "utf8"), relativePath));
+    relations.push(parseCrossRepoRelationFile(await readFile(resolve14(root, relativePath), "utf8"), relativePath));
   }
   return relations.sort((a, b) => a.id.localeCompare(b.id));
 }
 
 // packages/local-runtime/model-store-yaml/src/index.ts
 init_src();
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync10, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync11, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname8, resolve as resolve15 } from "node:path";
 var GENERATED_ARCHITECTURE_PATH = ".archcontext/generated/ARCHITECTURE.md";
 var GENERATED_ARCHITECTURE_BODY = [
   "<!-- Generated by ArchContext. Do not edit by hand. -->",
@@ -19935,7 +19967,7 @@ function initializeArchContextModel(root, productName = "ArchContext Project") {
 function rebuildGeneratedProjection(root) {
   for (const operation of planGeneratedProjection(root)) {
     if (operation.operation === "delete_entity") {
-      rmSync6(resolve14(root, operation.path), { force: true });
+      rmSync6(resolve15(root, operation.path), { force: true });
     } else {
       writeFile(root, operation.path, operation.body);
     }
@@ -19943,12 +19975,12 @@ function rebuildGeneratedProjection(root) {
 }
 function planGeneratedProjection(root) {
   const desiredBody = GENERATED_ARCHITECTURE_BODY;
-  const desiredAbsolute = resolve14(root, GENERATED_ARCHITECTURE_PATH);
+  const desiredAbsolute = resolve15(root, GENERATED_ARCHITECTURE_PATH);
   const operations = [];
-  if (!existsSync12(desiredAbsolute) || readFileSync10(desiredAbsolute, "utf8") !== desiredBody) {
+  if (!existsSync12(desiredAbsolute) || readFileSync11(desiredAbsolute, "utf8") !== desiredBody) {
     operations.push({
       path: GENERATED_ARCHITECTURE_PATH,
-      expectedHash: existsSync12(desiredAbsolute) ? digestJson({ body: readFileSync10(desiredAbsolute, "utf8") }) : "missing",
+      expectedHash: existsSync12(desiredAbsolute) ? digestJson({ body: readFileSync11(desiredAbsolute, "utf8") }) : "missing",
       body: desiredBody,
       operation: "render_projection"
     });
@@ -19956,7 +19988,7 @@ function planGeneratedProjection(root) {
   for (const path of collectGeneratedProjectionFiles(root)) {
     if (path === GENERATED_ARCHITECTURE_PATH)
       continue;
-    const body = readFileSync10(resolve14(root, path), "utf8");
+    const body = readFileSync11(resolve15(root, path), "utf8");
     operations.push({
       path,
       expectedHash: digestJson({ body }),
@@ -19968,9 +20000,9 @@ function planGeneratedProjection(root) {
 }
 function collectGeneratedProjectionFiles(root) {
   const generatedRoot = ".archcontext/generated";
-  if (!existsSync12(resolve14(root, generatedRoot)))
+  if (!existsSync12(resolve15(root, generatedRoot)))
     return [];
-  const walk = (relativeDir) => readdirSync7(resolve14(root, relativeDir), { withFileTypes: true }).flatMap((entry) => {
+  const walk = (relativeDir) => readdirSync7(resolve15(root, relativeDir), { withFileTypes: true }).flatMap((entry) => {
     const child = `${relativeDir}/${entry.name}`;
     if (entry.isDirectory())
       return walk(child);
@@ -19981,7 +20013,7 @@ function collectGeneratedProjectionFiles(root) {
 
 class YamlModelStore {
   async loadManifest(workspace) {
-    return readFileSync10(resolve14(workspace.root, ".archcontext/manifest.yaml"), "utf8");
+    return readFileSync11(resolve15(workspace.root, ".archcontext/manifest.yaml"), "utf8");
   }
   async loadModel(workspace) {
     return listModelFiles(workspace.root);
@@ -19990,7 +20022,7 @@ class YamlModelStore {
     const errors = [];
     for (const required of [".archcontext/manifest.yaml", ".archcontext/product.yaml"]) {
       try {
-        readFileSync10(resolve14(workspace.root, required), "utf8");
+        readFileSync11(resolve15(workspace.root, required), "utf8");
       } catch {
         errors.push(`missing ${required}`);
       }
@@ -20020,7 +20052,7 @@ function listModelFiles(root) {
     "docs/adr"
   ]);
   return paths.map((path) => {
-    const body = readFileSync10(resolve14(root, path), "utf8");
+    const body = readFileSync11(resolve15(root, path), "utf8");
     return {
       path,
       body,
@@ -20032,7 +20064,7 @@ function listModelFiles(root) {
 function collectArchContextFiles(root, entries) {
   const files = [];
   for (const entry of entries) {
-    const absolute = resolve14(root, entry);
+    const absolute = resolve15(root, entry);
     if (!existsSync12(absolute))
       continue;
     const stat = readdirOrFile(absolute);
@@ -20046,7 +20078,7 @@ function collectArchContextFiles(root, entries) {
   return [...new Set(files)].sort();
   function walk(relativeDir) {
     const out = [];
-    const dir = resolve14(root, relativeDir);
+    const dir = resolve15(root, relativeDir);
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
       const child = `${relativeDir}/${entry.name}`;
       if (entry.isDirectory())
@@ -20087,8 +20119,8 @@ function writeYaml(root, path, value) {
   writeFile(root, path, stableYaml(value));
 }
 function writeFile(root, path, body) {
-  const absolute = resolve14(root, path);
-  mkdirSync6(dirname7(absolute), { recursive: true });
+  const absolute = resolve15(root, path);
+  mkdirSync6(dirname8(absolute), { recursive: true });
   writeFileSync4(absolute, body.endsWith(`
 `) ? body : `${body}
 `, "utf8");
@@ -21482,10 +21514,10 @@ class ArchctxDaemon {
       return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
     }
     const path = `.archcontext/waivers/${waiverId}.json`;
-    const absolute = resolve15(session.workspace.root, path);
+    const absolute = resolve16(session.workspace.root, path);
     const body = `${JSON.stringify(waiver, null, 2)}
 `;
-    const expectedHash = existsSync13(absolute) ? digestJson({ body: readFileSync11(absolute, "utf8") }) : "missing";
+    const expectedHash = existsSync13(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
     const draft = this.changeSetEngine.plan({
       id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
       base: {
@@ -22892,7 +22924,7 @@ class ArchctxDaemon {
   recoverDeveloperReviewRuns(input) {
     this.assertRunning();
     const sourceRoot = findRepositoryRoot2(input.repositoryRoot);
-    const stateDir = input.stateDir ? resolve15(input.stateDir) : defaultDeveloperReviewRunStateDir(sourceRoot);
+    const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir(sourceRoot);
     const recovery = {
       schemaVersion: "archcontext.developer-review-run-recovery/v1",
       sourceRoot,
@@ -23696,8 +23728,8 @@ class ArchctxRuntimeRpcServer {
     const root = this.options.root ?? process.cwd();
     const connectionPath = this.options.connectionPath ?? defaultDaemonConnectionPath(root);
     const lockPath = this.options.lockPath ?? defaultDaemonLockPath(root);
-    mkdirSync7(dirname8(connectionPath), { recursive: true });
-    mkdirSync7(dirname8(lockPath), { recursive: true });
+    mkdirSync7(dirname9(connectionPath), { recursive: true });
+    mkdirSync7(dirname9(lockPath), { recursive: true });
     this.lockFd = acquireDaemonLock(lockPath, root);
     const token = this.options.token ?? randomBytes(18).toString("base64url");
     const server = createServer((request, response) => {
@@ -24002,7 +24034,7 @@ function readRuntimeRpcConnectionFile(root = process.cwd()) {
   try {
     if (!isPrivateControlFile(path))
       return;
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     if (!parsed || typeof parsed !== "object")
       return;
     return {
@@ -24043,7 +24075,7 @@ function readRuntimeRpcConnection(root = process.cwd()) {
   try {
     if (!isPrivateControlFile(path))
       return;
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     return isValidRuntimeRpcConnection(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -24321,8 +24353,8 @@ function schemaVersionKind(schemaVersion) {
 function createDeveloperReviewRunPaths(input) {
   const safeChallengeId = safeControlFileSegment(input.challengeId);
   const runId = `${safeChallengeId}-${randomBytes(6).toString("hex")}`;
-  const stateDir = input.stateDir ? resolve15(input.stateDir) : defaultDeveloperReviewRunStateDir(input.sourceRoot);
-  const tempParent = input.tempRoot ? resolve15(input.tempRoot) : tmpdir3();
+  const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir(input.sourceRoot);
+  const tempParent = input.tempRoot ? resolve16(input.tempRoot) : tmpdir3();
   mkdirSync7(tempParent, { recursive: true });
   const runRoot = mkdtempSync4(join8(tempParent, `archctx-developer-review-${safeChallengeId.slice(0, 32)}-`));
   return {
@@ -24468,7 +24500,7 @@ function readExactPackageVersion(root, packageName) {
   return;
 }
 function readPackageLockExactVersion(root, packageName) {
-  const lock = readJsonFile(resolve15(root, "package-lock.json"));
+  const lock = readJsonFile(resolve16(root, "package-lock.json"));
   if (!lock || typeof lock !== "object" || Array.isArray(lock))
     return;
   const packages = lock.packages;
@@ -24486,7 +24518,7 @@ function readPackageLockExactVersion(root, packageName) {
   return;
 }
 function packageManifestPaths(root) {
-  const paths = [resolve15(root, "package.json")];
+  const paths = [resolve16(root, "package.json")];
   const rootManifest = readJsonFile(paths[0]);
   for (const pattern of workspacePatternsFromManifest(rootManifest)) {
     for (const path of expandWorkspacePackageJson(root, pattern))
@@ -24509,15 +24541,15 @@ function expandWorkspacePackageJson(root, pattern) {
   if (pattern.includes("**") || pattern.startsWith("/") || pattern.includes("\\"))
     return [];
   if (!pattern.includes("*")) {
-    const path = resolve15(root, pattern, "package.json");
+    const path = resolve16(root, pattern, "package.json");
     return existsSync13(path) ? [path] : [];
   }
   if (!pattern.endsWith("/*"))
     return [];
-  const base = resolve15(root, pattern.slice(0, -2));
+  const base = resolve16(root, pattern.slice(0, -2));
   if (!existsSync13(base) || !statSync6(base).isDirectory())
     return [];
-  return readdirSync8(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve15(base, entry.name, "package.json")).filter((path) => existsSync13(path));
+  return readdirSync8(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve16(base, entry.name, "package.json")).filter((path) => existsSync13(path));
 }
 function exactVersionFromManifest(manifest, packageName) {
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
@@ -24536,7 +24568,7 @@ function readJsonFile(path) {
   if (!existsSync13(path))
     return;
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
     return;
   }
@@ -24545,7 +24577,7 @@ function isExactPackageVersion(value) {
   return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(value);
 }
 function readContext7Lockfile(root) {
-  const path = resolve15(root, CONTEXT7_LOCKFILE);
+  const path = resolve16(root, CONTEXT7_LOCKFILE);
   if (!existsSync13(path)) {
     return {
       schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
@@ -24553,7 +24585,7 @@ function readContext7Lockfile(root) {
       libraries: []
     };
   }
-  const parsed = JSON.parse(readFileSync11(path, "utf8"));
+  const parsed = JSON.parse(readFileSync12(path, "utf8"));
   if (parsed.schemaVersion !== CONTEXT7_LOCKFILE_SCHEMA_VERSION || parsed.provider !== "context7" || !Array.isArray(parsed.libraries)) {
     throw new Error("Invalid Context7 lockfile");
   }
@@ -24574,13 +24606,13 @@ function upsertContext7Pin(lock, pin) {
   };
 }
 function writeContext7Lockfile(root, lock) {
-  writePrivateJson3(resolve15(root, CONTEXT7_LOCKFILE), lock);
+  writePrivateJson3(resolve16(root, CONTEXT7_LOCKFILE), lock);
 }
 function writeDeveloperReviewRunManifest(manifest) {
   writePrivateJson3(manifest.manifestPath, manifest);
 }
 function writePrivateJson3(path, value, flag = "w") {
-  mkdirSync7(dirname8(path), { recursive: true });
+  mkdirSync7(dirname9(path), { recursive: true });
   writeFileSync6(path, JSON.stringify(value, null, 2), { mode: 384, flag });
   chmodSync3(path, 384);
 }
@@ -24604,7 +24636,7 @@ function readDeveloperReviewRunManifest(path) {
 }
 function readJsonObject(path) {
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -24796,8 +24828,8 @@ function auditApproveResultPayload(runId, status, totalCount, issuedIssues) {
   };
 }
 function expectedFileHash(root, path) {
-  const absolute = resolve15(root, path);
-  return existsSync13(absolute) ? digestJson({ body: readFileSync11(absolute, "utf8") }) : "missing";
+  const absolute = resolve16(root, path);
+  return existsSync13(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
 }
 function architectureProjectionRollbackBackup(files, options = {}) {
   const manifest = {
@@ -24824,7 +24856,7 @@ function architectureProjectionRollbackBackup(files, options = {}) {
 function uniqueBackupPath(root, backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync13(resolve15(root, candidate))) {
+  while (existsSync13(resolve16(root, candidate))) {
     candidate = `${backupBase}-${suffix}`;
     suffix += 1;
   }
@@ -24883,7 +24915,7 @@ function staleConnectionFileReason(path, removeUnhealthyConnection) {
   try {
     if (!isPrivateControlFile(path))
       return "insecure-connection-file";
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     if (!isValidRuntimeRpcConnection(parsed))
       return "invalid-connection-file";
     if (!isProcessAlive3(parsed.pid))
@@ -24901,7 +24933,7 @@ function isPrivateControlFile(path) {
 }
 function isStaleLock(lockPath) {
   try {
-    const lock = JSON.parse(readFileSync11(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync12(lockPath, "utf8"));
     if (typeof lock.pid !== "number" || lock.pid <= 0)
       return true;
     return !isProcessAlive3(lock.pid);
@@ -24940,7 +24972,7 @@ function parsePracticeCheckpointBaselineState(state, repositoryId, taskSessionId
   return record;
 }
 function completeTaskProjectionDrift(root) {
-  if (!existsSync13(resolve15(root, "docs/architecture/.projection-manifest.json")))
+  if (!existsSync13(resolve16(root, "docs/architecture/.projection-manifest.json")))
     return;
   const loaded = loadArchitectureDocumentationInputs(root);
   const sourceDigest = architectureDocumentationSourceDigest({
@@ -25216,10 +25248,10 @@ init_src();
 // packages/local-runtime/runtime-daemon/src/index.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { chmodSync as chmodSync4, closeSync as closeSync6, existsSync as existsSync14, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync12, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync4, closeSync as closeSync6, existsSync as existsSync14, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync13, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync7 } from "node:fs";
 import { createServer as createServer2 } from "node:http";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname9, join as join9, resolve as resolve16 } from "node:path";
+import { dirname as dirname10, join as join9, resolve as resolve17 } from "node:path";
 init_src();
 var RUNTIME_AGENT_HOOK_DEFAULT_MAX_QUEUED_JOBS2 = 32;
 var RUNTIME_AGENT_HOOK_DEFAULT_PRIORITY2 = 0;
@@ -26363,10 +26395,10 @@ class ArchctxDaemon2 {
       return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
     }
     const path = `.archcontext/waivers/${waiverId}.json`;
-    const absolute = resolve16(session.workspace.root, path);
+    const absolute = resolve17(session.workspace.root, path);
     const body = `${JSON.stringify(waiver, null, 2)}
 `;
-    const expectedHash = existsSync14(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
+    const expectedHash = existsSync14(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
     const draft = this.changeSetEngine.plan({
       id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
       base: {
@@ -27773,7 +27805,7 @@ class ArchctxDaemon2 {
   recoverDeveloperReviewRuns(input) {
     this.assertRunning();
     const sourceRoot = findRepositoryRoot2(input.repositoryRoot);
-    const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir2(sourceRoot);
+    const stateDir = input.stateDir ? resolve17(input.stateDir) : defaultDeveloperReviewRunStateDir2(sourceRoot);
     const recovery = {
       schemaVersion: "archcontext.developer-review-run-recovery/v1",
       sourceRoot,
@@ -28604,7 +28636,7 @@ function readRuntimeRpcConnection2(root = process.cwd()) {
   try {
     if (!isPrivateControlFile2(path))
       return;
-    const parsed = JSON.parse(readFileSync12(path, "utf8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf8"));
     return isValidRuntimeRpcConnection2(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -28867,8 +28899,8 @@ function schemaVersionKind2(schemaVersion) {
 function createDeveloperReviewRunPaths2(input) {
   const safeChallengeId = safeControlFileSegment2(input.challengeId);
   const runId = `${safeChallengeId}-${randomBytes2(6).toString("hex")}`;
-  const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir2(input.sourceRoot);
-  const tempParent = input.tempRoot ? resolve16(input.tempRoot) : tmpdir4();
+  const stateDir = input.stateDir ? resolve17(input.stateDir) : defaultDeveloperReviewRunStateDir2(input.sourceRoot);
+  const tempParent = input.tempRoot ? resolve17(input.tempRoot) : tmpdir4();
   mkdirSync8(tempParent, { recursive: true });
   const runRoot = mkdtempSync5(join9(tempParent, `archctx-developer-review-${safeChallengeId.slice(0, 32)}-`));
   return {
@@ -29014,7 +29046,7 @@ function readExactPackageVersion2(root, packageName) {
   return;
 }
 function readPackageLockExactVersion2(root, packageName) {
-  const lock = readJsonFile2(resolve16(root, "package-lock.json"));
+  const lock = readJsonFile2(resolve17(root, "package-lock.json"));
   if (!lock || typeof lock !== "object" || Array.isArray(lock))
     return;
   const packages = lock.packages;
@@ -29032,7 +29064,7 @@ function readPackageLockExactVersion2(root, packageName) {
   return;
 }
 function packageManifestPaths2(root) {
-  const paths = [resolve16(root, "package.json")];
+  const paths = [resolve17(root, "package.json")];
   const rootManifest = readJsonFile2(paths[0]);
   for (const pattern of workspacePatternsFromManifest2(rootManifest)) {
     for (const path of expandWorkspacePackageJson2(root, pattern))
@@ -29055,15 +29087,15 @@ function expandWorkspacePackageJson2(root, pattern) {
   if (pattern.includes("**") || pattern.startsWith("/") || pattern.includes("\\"))
     return [];
   if (!pattern.includes("*")) {
-    const path = resolve16(root, pattern, "package.json");
+    const path = resolve17(root, pattern, "package.json");
     return existsSync14(path) ? [path] : [];
   }
   if (!pattern.endsWith("/*"))
     return [];
-  const base = resolve16(root, pattern.slice(0, -2));
+  const base = resolve17(root, pattern.slice(0, -2));
   if (!existsSync14(base) || !statSync7(base).isDirectory())
     return [];
-  return readdirSync9(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve16(base, entry.name, "package.json")).filter((path) => existsSync14(path));
+  return readdirSync9(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve17(base, entry.name, "package.json")).filter((path) => existsSync14(path));
 }
 function exactVersionFromManifest2(manifest, packageName) {
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
@@ -29082,7 +29114,7 @@ function readJsonFile2(path) {
   if (!existsSync14(path))
     return;
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync13(path, "utf8"));
   } catch {
     return;
   }
@@ -29091,7 +29123,7 @@ function isExactPackageVersion2(value) {
   return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(value);
 }
 function readContext7Lockfile2(root) {
-  const path = resolve16(root, CONTEXT7_LOCKFILE2);
+  const path = resolve17(root, CONTEXT7_LOCKFILE2);
   if (!existsSync14(path)) {
     return {
       schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
@@ -29099,7 +29131,7 @@ function readContext7Lockfile2(root) {
       libraries: []
     };
   }
-  const parsed = JSON.parse(readFileSync12(path, "utf8"));
+  const parsed = JSON.parse(readFileSync13(path, "utf8"));
   if (parsed.schemaVersion !== CONTEXT7_LOCKFILE_SCHEMA_VERSION || parsed.provider !== "context7" || !Array.isArray(parsed.libraries)) {
     throw new Error("Invalid Context7 lockfile");
   }
@@ -29120,13 +29152,13 @@ function upsertContext7Pin2(lock, pin) {
   };
 }
 function writeContext7Lockfile2(root, lock) {
-  writePrivateJson4(resolve16(root, CONTEXT7_LOCKFILE2), lock);
+  writePrivateJson4(resolve17(root, CONTEXT7_LOCKFILE2), lock);
 }
 function writeDeveloperReviewRunManifest2(manifest) {
   writePrivateJson4(manifest.manifestPath, manifest);
 }
 function writePrivateJson4(path, value, flag = "w") {
-  mkdirSync8(dirname9(path), { recursive: true });
+  mkdirSync8(dirname10(path), { recursive: true });
   writeFileSync7(path, JSON.stringify(value, null, 2), { mode: 384, flag });
   chmodSync4(path, 384);
 }
@@ -29150,7 +29182,7 @@ function readDeveloperReviewRunManifest2(path) {
 }
 function readJsonObject2(path) {
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -29322,8 +29354,8 @@ function auditApproveResultPayload2(runId, status, totalCount, issuedIssues) {
   };
 }
 function expectedFileHash2(root, path) {
-  const absolute = resolve16(root, path);
-  return existsSync14(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
+  const absolute = resolve17(root, path);
+  return existsSync14(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
 }
 function architectureProjectionRollbackBackup2(files, options = {}) {
   const manifest = {
@@ -29350,7 +29382,7 @@ function architectureProjectionRollbackBackup2(files, options = {}) {
 function uniqueBackupPath2(root, backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync14(resolve16(root, candidate))) {
+  while (existsSync14(resolve17(root, candidate))) {
     candidate = `${backupBase}-${suffix}`;
     suffix += 1;
   }
@@ -29421,7 +29453,7 @@ function parsePracticeCheckpointBaselineState2(state, repositoryId, taskSessionI
   return record;
 }
 function completeTaskProjectionDrift2(root) {
-  if (!existsSync14(resolve16(root, "docs/architecture/.projection-manifest.json")))
+  if (!existsSync14(resolve17(root, "docs/architecture/.projection-manifest.json")))
     return;
   const loaded = loadArchitectureDocumentationInputs(root);
   const sourceDigest = architectureDocumentationSourceDigest({
@@ -30007,7 +30039,7 @@ async function runCliUnchecked(command2 = "help", args2 = [], cwd, deps = {}) {
         const subcommand = args2[0] ?? "list";
         if (subcommand === "add") {
           const root = readFlag(args2, "--root") ?? cwd;
-          if (resolve17(root) !== resolve17(cwd)) {
+          if (resolve18(root) !== resolve18(cwd)) {
             return errorEnvelope("repo.add", "AC_CAPABILITY_UNSUPPORTED", "Multi-repo architecture context is outside the Local Core MVP; run archctx inside one Git repository.");
           }
           const daemon2 = await runtime();
@@ -30698,8 +30730,8 @@ function architectureDocsRenderProjectionOperation(root, files) {
   };
 }
 function currentBodyHash(root, path) {
-  const absolute = resolve17(root, path);
-  return existsSync15(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
+  const absolute = resolve18(root, path);
+  return existsSync15(absolute) ? digestJson({ body: readFileSync14(absolute, "utf8") }) : "missing";
 }
 async function runPracticesCommand(args2, cwd, daemon) {
   const subcommand = args2[0] ?? "list";
@@ -31046,12 +31078,12 @@ function auditManifestGateRoot(cwd) {
   }
 }
 function auditGithubIssuesEnabled(cwd) {
-  const manifestPath = resolve17(auditManifestGateRoot(cwd), ".archcontext/manifest.yaml");
+  const manifestPath = resolve18(auditManifestGateRoot(cwd), ".archcontext/manifest.yaml");
   if (!existsSync15(manifestPath))
     return false;
   let raw;
   try {
-    raw = readFileSync13(manifestPath, "utf8");
+    raw = readFileSync14(manifestPath, "utf8");
   } catch {
     return false;
   }
@@ -31646,11 +31678,11 @@ async function digestReviewChallenge(challenge) {
 }
 function defaultGithubDeveloperReviewStatePath(cwd, pullRequestNumber) {
   const suffix = pullRequestNumber ? `github-developer-review-pr-${pullRequestNumber}.json` : "github-developer-review.json";
-  return join10(dirname10(defaultDaemonConnectionPath(cwd)), suffix);
+  return join10(dirname11(defaultDaemonConnectionPath(cwd)), suffix);
 }
 async function writeGithubDeveloperReviewState(cwd, state) {
   const path = defaultGithubDeveloperReviewStatePath(cwd, state.challenge.pullRequestNumber);
-  mkdirSync9(dirname10(path), { recursive: true });
+  mkdirSync9(dirname11(path), { recursive: true });
   const serialized = `${JSON.stringify(state, null, 2)}
 `;
   assertNoCliSecretMaterial(serialized);
@@ -31663,7 +31695,7 @@ function readGithubDeveloperReviewState(path) {
   if (!existsSync15(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync13(path, "utf8"));
+    const parsed = JSON.parse(readFileSync14(path, "utf8"));
     if (parsed.schemaVersion !== "archcontext.github-developer-review-state/v1")
       return;
     if (!parsed.challenge || typeof parsed.challenge.pullRequestNumber !== "number")
@@ -31709,13 +31741,13 @@ function sanitizeGithubDeveloperReviewState(state, statePath) {
   return data;
 }
 function defaultGithubConnectionPath(cwd) {
-  return join10(dirname10(defaultDaemonConnectionPath(cwd)), "github-connection.json");
+  return join10(dirname11(defaultDaemonConnectionPath(cwd)), "github-connection.json");
 }
 function readGithubConnection(path) {
   if (!existsSync15(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync13(path, "utf8"));
+    const parsed = JSON.parse(readFileSync14(path, "utf8"));
     if (parsed.schemaVersion !== "archcontext.github-connection/v1" || parsed.status !== "connected")
       return;
     return parsed;
@@ -31724,7 +31756,7 @@ function readGithubConnection(path) {
   }
 }
 function writeGithubConnection(path, record) {
-  mkdirSync9(dirname10(path), { recursive: true });
+  mkdirSync9(dirname11(path), { recursive: true });
   const serialized = `${JSON.stringify(record, null, 2)}
 `;
   assertNoCliSecretMaterial(serialized);
@@ -31759,7 +31791,7 @@ async function readReviewChallengeV2Arg(args2, cwd, commandName = "github verify
   if (!inline && !challengePath)
     return { ok: false, message: `${commandName} requires --challenge-json or --challenge-path` };
   try {
-    const raw = inline ?? readFileSync13(resolve17(cwd, challengePath), "utf8");
+    const raw = inline ?? readFileSync14(resolve18(cwd, challengePath), "utf8");
     const parsed = JSON.parse(raw);
     const attestation = await Promise.resolve().then(() => (init_src7(), exports_src3));
     const assertReviewChallengeV23 = attestation.assertReviewChallengeV2;
@@ -32235,7 +32267,7 @@ function doctorSqlite(cwd) {
 }
 function doctorPermissions(cwd) {
   const paths = runtimeStatePaths(cwd);
-  const controlDir = dirname10(defaultDaemonConnectionPath(cwd));
+  const controlDir = dirname11(defaultDaemonConnectionPath(cwd));
   return {
     workspace: pathAccess(cwd),
     stateRoot: pathAccess(paths.stateRoot),
@@ -32271,7 +32303,7 @@ function pathAccess(path) {
 }
 function canAccess(path, mode) {
   try {
-    accessSync(path, mode);
+    accessSync2(path, mode);
     return true;
   } catch {
     return false;
@@ -32480,7 +32512,7 @@ async function startBackgroundDaemon(args2, cwd) {
   }
   const recovery = discovered.recovery;
   const connectionPath = defaultDaemonConnectionPath(cwd);
-  const controlDir = dirname10(connectionPath);
+  const controlDir = dirname11(connectionPath);
   const logPath = join10(controlDir, "archctxd.log");
   mkdirSync9(controlDir, { recursive: true });
   const logFd = openSync7(logPath, "a", 384);
@@ -32679,11 +32711,11 @@ async function waitForDaemonReady(cwd, timeoutMs, shouldStop) {
   return;
 }
 function sleep(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function readFileTail(path, maxBytes = 4096) {
   try {
-    const content = readFileSync13(path, "utf8");
+    const content = readFileSync14(path, "utf8");
     return content.slice(Math.max(0, content.length - maxBytes)).replace(/\s+/g, " ").trim();
   } catch {
     return "<unavailable>";
@@ -32692,8 +32724,8 @@ function readFileTail(path, maxBytes = 4096) {
 async function runForegroundDaemon(cwd, args2) {
   const daemon = await createStartedProductionDaemon({ root: cwd });
   let resolveStopped;
-  const stopped = new Promise((resolve18) => {
-    resolveStopped = resolve18;
+  const stopped = new Promise((resolve19) => {
+    resolveStopped = resolve19;
   });
   const idleTimeoutFlag = readFlag(args2, "--idle-timeout-ms");
   const server = new ArchctxRuntimeRpcServer(daemon, {