avorelo 0.3.0 → 0.3.2

package/dist/avorelo.mjs

@@ -362,6 +362,16 @@ function listReceipts(dir) {
   }
   return out;
 }
+function readReceipt(dir, receiptId) {
+  const path = join(localReceiptDir(dir), `${receiptId}.json`);
+  if (!existsSync(path)) return null;
+  try {
+    const r2 = JSON.parse(readFileSync(path, "utf8"));
+    return r2 && typeof r2.receiptId === "string" ? r2 : null;
+  } catch {
+    return null;
+  }
+}
 var init_receipts = __esm({
   "src/avorelo/kernel/receipts/index.ts"() {
     init_redaction();
@@ -5659,9 +5669,9 @@ function executeMultiAgentReview(reviewPlan, executorResult, plan, ctx) {
       break;
     }
   }
-  const finalVerdict = determineFinalVerdict(rounds, stopCondition);
+  const finalVerdict2 = determineFinalVerdict(rounds, stopCondition);
   const routedToManualGate = stopCondition === "REVIEWER_DISAGREEMENT" || stopCondition === "MAX_REVIEW_ROUNDS_REACHED" || stopCondition === "VERIFIER_OVERRIDE";
-  const modelConsensusOnly = finalVerdict === "approved" && rounds.every((r2) => r2.verifierPassed === null);
+  const modelConsensusOnly = finalVerdict2 === "approved" && rounds.every((r2) => r2.verifierPassed === null);
   const reasonCodes = [
     ...reviewPlan.triggerReasonCodes,
     `REVIEW_ROUNDS:${rounds.length}`,
@@ -5673,7 +5683,7 @@ function executeMultiAgentReview(reviewPlan, executorResult, plan, ctx) {
     attempted: true,
     roundsCompleted: rounds.length,
     maxRoundsReached: stopCondition === "MAX_REVIEW_ROUNDS_REACHED",
-    finalVerdict,
+    finalVerdict: finalVerdict2,
     rounds,
     totalDurationMs: Date.now() - start,
     reasonCodes,
@@ -6523,7 +6533,7 @@ init_run();
 init_work_contract();
 init_receipts();
 init_state_ledger();
-import { writeFileSync as writeFileSync37, mkdirSync as mkdirSync39, existsSync as existsSync61, readFileSync as readFileSync46, appendFileSync as appendFileSync11, rmSync as rmSync3, unlinkSync as unlinkSync4 } from "node:fs";
+import { writeFileSync as writeFileSync37, mkdirSync as mkdirSync39, existsSync as existsSync62, readFileSync as readFileSync46, appendFileSync as appendFileSync11, rmSync as rmSync3, unlinkSync as unlinkSync4 } from "node:fs";
 import { join as join61 } from "node:path";
 
 // src/avorelo/capabilities/activation/index.ts
@@ -6604,93 +6614,170 @@ function doctor(targetDir) {
   return { ok: checks.every((c) => c.passed), checks, hookLatencyMs: fired.latencyMs };
 }
 
-// src/avorelo/capabilities/activation/activation-state.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, mkdirSync as mkdirSync12, existsSync as existsSync25 } from "node:fs";
-import { join as join23, resolve as resolve3 } from "node:path";
-init_redaction();
-var ACTIVATION_STATE_CONTRACT = "avorelo.activationState.v1";
-var ACTIVATION_STATE_DIR = ".avorelo/activation";
-var ACTIVATION_STATE_FILE = "activation-state.json";
-function writeActivationState(targetDir, state) {
-  const dir = join23(targetDir, ACTIVATION_STATE_DIR);
-  mkdirSync12(dir, { recursive: true });
-  const path = join23(dir, ACTIVATION_STATE_FILE);
-  const safe = redact(state).value;
-  writeFileSync12(path, JSON.stringify(safe, null, 2));
-  return path;
-}
-function readActivationState(targetDir) {
-  const path = join23(targetDir, ACTIVATION_STATE_DIR, ACTIVATION_STATE_FILE);
-  if (!existsSync25(path)) return null;
+// src/avorelo/capabilities/activation/activation-preflight.ts
+import { existsSync as existsSync25 } from "node:fs";
+import { execSync } from "node:child_process";
+import { platform, tmpdir as tmpdir2 } from "node:os";
+function runPreflight(targetDir) {
+  const checks = [];
+  const isWindows = platform() === "win32";
+  let nodeOk = false;
   try {
-    const raw = readFileSync12(path, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.contract !== ACTIVATION_STATE_CONTRACT && parsed.contract !== "avorelo.activationState.v2") return null;
-    return parsed;
+    const v = execSync("node --version", { encoding: "utf8", timeout: 5e3 }).trim();
+    nodeOk = v.startsWith("v");
+    checks.push({ id: "node_available", label: "Node.js available", passed: nodeOk, details: v });
   } catch {
-    return null;
+    checks.push({ id: "node_available", label: "Node.js available", passed: false, details: "node not found in PATH", recovery: "Install Node.js from https://nodejs.org (LTS recommended)" });
   }
-}
-function verifyActivationState(targetDir) {
-  const checks = [];
-  const state = readActivationState(targetDir);
-  if (!state) {
-    checks.push({ id: "state_exists", passed: false, reason: "Activation state not found" });
-    return { valid: false, checks };
+  let npmOk = false;
+  try {
+    const v = execSync("npm --version", { encoding: "utf8", timeout: 5e3 }).trim();
+    npmOk = true;
+    checks.push({ id: "npm_available", label: "npm available", passed: true, details: `npm ${v}` });
+  } catch {
+    checks.push({ id: "npm_available", label: "npm available", passed: false, details: "npm not found in PATH", recovery: "npm is included with Node.js \u2014 reinstall Node.js from https://nodejs.org" });
   }
-  checks.push({ id: "state_exists", passed: true, reason: "Activation state found" });
-  const validContracts = [ACTIVATION_STATE_CONTRACT, "avorelo.activationState.v2"];
-  const contractOk = validContracts.includes(state.contract);
-  checks.push({ id: "contract_valid", passed: contractOk, reason: contractOk ? "Contract matches" : `Expected ${ACTIVATION_STATE_CONTRACT} or v2, got ${state.contract}` });
-  checks.push({ id: "redacted", passed: state.redacted === true, reason: state.redacted ? "State is redacted" : "State is NOT redacted" });
-  const raw2 = state;
-  const billingLive = raw2.billing?.billingLive;
-  checks.push({ id: "billing_not_live", passed: billingLive === false, reason: billingLive === false ? "Billing not live" : "BILLING IS LIVE \u2014 violation" });
-  const authLive = raw2.cloud?.authLive ?? raw2.auth?.sessionAvailable === true;
-  checks.push({ id: "auth_not_live", passed: !authLive, reason: !authLive ? "Auth not live" : "AUTH IS LIVE \u2014 violation" });
-  const cloudSyncLive = raw2.cloud?.cloudSyncLive;
-  checks.push({ id: "cloud_sync_not_live", passed: cloudSyncLive === false, reason: cloudSyncLive === false ? "Cloud sync not live" : "CLOUD SYNC IS LIVE \u2014 violation" });
-  checks.push({ id: "production_not_ready", passed: state.productionReady === false, reason: state.productionReady === false ? "Production not ready (correct)" : "PRODUCTION MARKED READY \u2014 violation" });
-  const raw = JSON.stringify(state);
-  const hasSecret = carriesRawSecret(raw);
-  checks.push({ id: "no_secrets", passed: !hasSecret, reason: hasSecret ? "RAW SECRET DETECTED in state" : "No raw secrets" });
-  const legacyTokens = ["wuz", "cco", "claudecode-optimizer"];
-  const oldNaming = legacyTokens.some((t) => raw.toLowerCase().includes(t));
-  checks.push({ id: "no_old_naming", passed: !oldNaming, reason: oldNaming ? "Old naming leakage detected" : "No old naming leakage" });
-  return { valid: checks.every((c) => c.passed), checks };
+  let npxOk = false;
+  try {
+    const v = execSync("npx --version", { encoding: "utf8", timeout: 5e3 }).trim();
+    npxOk = true;
+    checks.push({ id: "npx_available", label: "npx available", passed: true, details: `npx ${v}` });
+  } catch {
+    checks.push({ id: "npx_available", label: "npx available", passed: false, details: "npx not found in PATH", recovery: "npx is included with npm 5.2+. Update Node.js to get a recent npm." });
+  }
+  let cacheOk = false;
+  try {
+    const cachePath = execSync("npm config get cache", { encoding: "utf8", timeout: 5e3 }).trim();
+    if (cachePath && existsSync25(cachePath)) {
+      cacheOk = true;
+      checks.push({ id: "npm_cache_writable", label: "npm cache directory accessible", passed: true, details: "cache directory exists" });
+    } else {
+      checks.push({
+        id: "npm_cache_writable",
+        label: "npm cache directory accessible",
+        passed: false,
+        details: "cache path does not exist",
+        recovery: isWindows ? 'Use a temporary cache. PowerShell: $env:npm_config_cache="$env:TEMP\\npm-cache-avorelo"; npx -y avorelo@latest activate. cmd.exe: cmd /c "set npm_config_cache=%TEMP%\\npm-cache-avorelo && npx -y avorelo@latest activate"' : "Use a temporary cache: npm_config_cache=$(mktemp -d) npx -y avorelo@latest activate"
+      });
+    }
+  } catch {
+    checks.push({
+      id: "npm_cache_writable",
+      label: "npm cache directory accessible",
+      passed: false,
+      details: "could not read npm cache config",
+      recovery: isWindows ? 'Use a temporary cache. PowerShell: $env:npm_config_cache="$env:TEMP\\npm-cache-avorelo"; npx -y avorelo@latest activate. cmd.exe: cmd /c "set npm_config_cache=%TEMP%\\npm-cache-avorelo && npx -y avorelo@latest activate"' : "Use a temporary cache: npm_config_cache=$(mktemp -d) npx -y avorelo@latest activate"
+    });
+  }
+  let tempOk = false;
+  try {
+    const td = tmpdir2();
+    tempOk = existsSync25(td);
+    checks.push({ id: "temp_dir_writable", label: "Temp directory writable", passed: tempOk, details: tempOk ? "temp dir accessible" : "temp dir not found" });
+  } catch {
+    checks.push({ id: "temp_dir_writable", label: "Temp directory writable", passed: false, details: "cannot access temp directory" });
+  }
+  let targetOk = false;
+  try {
+    targetOk = existsSync25(targetDir);
+    checks.push({ id: "target_dir_writable", label: "Target directory exists", passed: targetOk, details: targetOk ? "directory accessible" : "directory not found" });
+  } catch {
+    checks.push({ id: "target_dir_writable", label: "Target directory exists", passed: false, details: "cannot access target directory" });
+  }
+  let psOk = true;
+  if (isWindows) {
+    try {
+      const policy = execSync("powershell -NoProfile -Command Get-ExecutionPolicy", { encoding: "utf8", timeout: 5e3 }).trim().toLowerCase();
+      const blocked = policy === "restricted" || policy === "allsigned";
+      psOk = !blocked;
+      checks.push({
+        id: "powershell_execution_policy",
+        label: "PowerShell execution policy",
+        passed: psOk,
+        details: `Policy: ${policy}`,
+        recovery: blocked ? "PowerShell is blocking script execution. Use Command Prompt instead:\n  cmd /c npx -y avorelo@latest activate" : void 0
+      });
+    } catch {
+      checks.push({ id: "powershell_execution_policy", label: "PowerShell execution policy", passed: true, details: "could not check (non-PowerShell shell)" });
+    }
+  }
+  let registryOk = false;
+  try {
+    const result3 = execSync("npm view avorelo@latest version", { encoding: "utf8", timeout: 15e3 }).trim();
+    registryOk = /^\d+\.\d+\.\d+/.test(result3);
+    checks.push({ id: "network_npm_registry", label: "npm registry reachable", passed: registryOk, details: registryOk ? `latest: ${result3}` : "unexpected response" });
+  } catch {
+    checks.push({ id: "network_npm_registry", label: "npm registry reachable", passed: false, details: "cannot reach npm registry", recovery: "Check your network connection. If behind a proxy, configure npm: npm config set proxy <url>" });
+  }
+  const allPassed = checks.every((c) => c.passed);
+  const canStart = nodeOk && npmOk && npxOk;
+  let fallbackCommand;
+  if (!allPassed && isWindows) {
+    fallbackCommand = buildWindowsFallbackCommand();
+  }
+  const taxonomy = allPassed ? "READY" : canStart ? "LOCAL_PREFLIGHT_FAILED" : "BLOCKED_BY_RUNNER_BEFORE_AVORELO_STARTED";
+  return { ok: allPassed, canStart, checks, fallbackCommand, taxonomy };
 }
-function repairActivationState(targetDir) {
-  const state = readActivationState(targetDir);
-  if (!state) {
-    return { repaired: false, message: "No activation state found. Run: npx avorelo activate" };
+function buildWindowsFallbackCommand() {
+  return [
+    ":: Avorelo activation \u2014 safe Windows fallback",
+    ":: Run this in Command Prompt (cmd.exe), not PowerShell",
+    "set AVORELO_TEMP=%TEMP%\\avorelo-activate-%RANDOM%",
+    "mkdir %AVORELO_TEMP%",
+    "set npm_config_cache=%AVORELO_TEMP%\\npm-cache",
+    "cd /d %AVORELO_TEMP%",
+    "npx -y avorelo@latest activate",
+    "npx -y avorelo@latest status"
+  ].join("\n");
+}
+function formatPreflightReport(result3) {
+  const lines = ["", "Avorelo Activation Preflight", ""];
+  for (const c of result3.checks) {
+    const icon = c.passed ? "\u2713" : "\u2717";
+    lines.push(`  ${icon} ${c.label}: ${c.details}`);
+    if (!c.passed && c.recovery) {
+      for (const line of c.recovery.split("\n")) {
+        lines.push(`    \u2192 ${line}`);
+      }
+    }
   }
-  const validContracts2 = [ACTIVATION_STATE_CONTRACT, "avorelo.activationState.v2"];
-  if (!validContracts2.includes(state.contract)) {
-    return { repaired: false, message: `Corrupt contract: ${state.contract}. Run: npx avorelo activate (will re-create)` };
+  lines.push("");
+  if (result3.ok) {
+    lines.push("  All checks passed. Ready to activate.");
+  } else if (result3.canStart) {
+    lines.push("  Some checks failed but activation can attempt to proceed.");
+    lines.push("  Fix the issues above for the best experience.");
+  } else {
+    lines.push("  Activation cannot start in this environment.");
+    lines.push("  Avorelo requires Node.js and npm to be available.");
+    if (result3.fallbackCommand) {
+      lines.push("");
+      lines.push("  Safe fallback command:");
+      for (const line of result3.fallbackCommand.split("\n")) {
+        lines.push(`    ${line}`);
+      }
+    }
   }
-  return { repaired: true, message: "Activation state is valid." };
+  lines.push("");
+  return lines.join("\n");
 }
 
-// src/avorelo/capabilities/activation/activation-runner.ts
-import { join as join27 } from "node:path";
-import { existsSync as existsSync29 } from "node:fs";
-
 // src/avorelo/capabilities/activation/activation-detector.ts
-import { existsSync as existsSync26, readFileSync as readFileSync13 } from "node:fs";
-import { join as join24 } from "node:path";
-import { execSync } from "node:child_process";
-import { platform } from "node:os";
+import { existsSync as existsSync26, readFileSync as readFileSync12 } from "node:fs";
+import { join as join23 } from "node:path";
+import { execSync as execSync2 } from "node:child_process";
+import { platform as platform2 } from "node:os";
 function tryExec(cmd, cwd) {
   try {
-    return execSync(cmd, { cwd, stdio: "pipe", timeout: 5e3 }).toString().trim();
+    return execSync2(cmd, { cwd, stdio: "pipe", timeout: 5e3 }).toString().trim();
   } catch {
     return null;
   }
 }
 function commandExists(cmd) {
   try {
-    const check = platform() === "win32" ? `where ${cmd}` : `which ${cmd}`;
-    execSync(check, { stdio: "pipe", timeout: 3e3 });
+    const check = platform2() === "win32" ? `where ${cmd}` : `which ${cmd}`;
+    execSync2(check, { stdio: "pipe", timeout: 3e3 });
     return true;
   } catch {
     return false;
@@ -6707,18 +6794,18 @@ function detectRepoIdentity(dir) {
 function detectEnvironment(dir) {
   const nodeVersion = tryExec("node --version", dir);
   let packageManager = null;
-  if (existsSync26(join24(dir, "pnpm-lock.yaml"))) packageManager = "pnpm";
-  else if (existsSync26(join24(dir, "yarn.lock"))) packageManager = "yarn";
-  else if (existsSync26(join24(dir, "bun.lockb"))) packageManager = "bun";
-  else if (existsSync26(join24(dir, "package-lock.json"))) packageManager = "npm";
-  else if (existsSync26(join24(dir, "package.json"))) packageManager = "npm";
+  if (existsSync26(join23(dir, "pnpm-lock.yaml"))) packageManager = "pnpm";
+  else if (existsSync26(join23(dir, "yarn.lock"))) packageManager = "yarn";
+  else if (existsSync26(join23(dir, "bun.lockb"))) packageManager = "bun";
+  else if (existsSync26(join23(dir, "package-lock.json"))) packageManager = "npm";
+  else if (existsSync26(join23(dir, "package.json"))) packageManager = "npm";
   let framework = null;
   let testCommand = null;
   let sitePreviewCommand = null;
-  const pkgPath = join24(dir, "package.json");
+  const pkgPath = join23(dir, "package.json");
   if (existsSync26(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
       const deps = { ...pkg.dependencies, ...pkg.devDependencies };
       if (deps.next) framework = "next";
       else if (deps.react) framework = "react";
@@ -6732,29 +6819,29 @@ function detectEnvironment(dir) {
     } catch {
     }
   }
-  if (existsSync26(join24(dir, "main.wasp"))) framework = "wasp";
-  return { os: platform(), nodeVersion, packageManager, framework, testCommand, sitePreviewCommand };
+  if (existsSync26(join23(dir, "main.wasp"))) framework = "wasp";
+  return { os: platform2(), nodeVersion, packageManager, framework, testCommand, sitePreviewCommand };
 }
 function detectAiTools(dir) {
   return {
-    claudeCodeDetected: existsSync26(join24(dir, ".claude")) || existsSync26(join24(dir, ".claude", "settings.json")),
-    codexDetected: existsSync26(join24(dir, ".codex")),
-    cursorDetected: existsSync26(join24(dir, ".cursor")),
-    agentsMdDetected: existsSync26(join24(dir, "AGENTS.md")),
-    claudeMdDetected: existsSync26(join24(dir, "CLAUDE.md")),
-    cursorRulesDetected: existsSync26(join24(dir, ".cursor", "rules")),
-    codexConfigDetected: existsSync26(join24(dir, ".codex", "config.toml")) || existsSync26(join24(dir, "codex.json"))
+    claudeCodeDetected: existsSync26(join23(dir, ".claude")) || existsSync26(join23(dir, ".claude", "settings.json")),
+    codexDetected: existsSync26(join23(dir, ".codex")),
+    cursorDetected: existsSync26(join23(dir, ".cursor")),
+    agentsMdDetected: existsSync26(join23(dir, "AGENTS.md")),
+    claudeMdDetected: existsSync26(join23(dir, "CLAUDE.md")),
+    cursorRulesDetected: existsSync26(join23(dir, ".cursor", "rules")),
+    codexConfigDetected: existsSync26(join23(dir, ".codex", "config.toml")) || existsSync26(join23(dir, "codex.json"))
   };
 }
 function detectModelsAndTools(dir) {
-  const ROOT2 = join24(import.meta.dirname, "..", "..", "..", "..");
+  const ROOT2 = join23(import.meta.dirname, "..", "..", "..", "..");
   const env = process.env;
   return {
-    skillsRegistryAvailable: existsSync26(join24(ROOT2, "src/avorelo/validation/skill-operating-system/registry.ts")),
-    modelRouterAvailable: existsSync26(join24(ROOT2, "src/avorelo/validation/model-routing/index.ts")),
-    primitiveRouterAvailable: existsSync26(join24(ROOT2, "tools/route-primitive.ts")),
-    scannersAvailable: existsSync26(join24(ROOT2, "src/avorelo/validation/scanners/index.ts")),
-    browserProofAvailable: commandExists("playwright") || commandExists("npx") && existsSync26(join24(dir, "node_modules", "@playwright")),
+    skillsRegistryAvailable: existsSync26(join23(ROOT2, "src/avorelo/validation/skill-operating-system/registry.ts")),
+    modelRouterAvailable: existsSync26(join23(ROOT2, "src/avorelo/validation/model-routing/index.ts")),
+    primitiveRouterAvailable: existsSync26(join23(ROOT2, "tools/route-primitive.ts")),
+    scannersAvailable: existsSync26(join23(ROOT2, "src/avorelo/validation/scanners/index.ts")),
+    browserProofAvailable: commandExists("playwright") || commandExists("npx") && existsSync26(join23(dir, "node_modules", "@playwright")),
     githubAvailable: commandExists("gh"),
     billingEnvDetected: !!(env.LEMON_SQUEEZY_PRO_CHECKOUT_URL || env.LEMON_SQUEEZY_API_KEY),
     authEnvDetected: !!(env.AUTH_SECRET || env.JWT_SECRET || env.SESSION_SECRET),
@@ -6788,8 +6875,79 @@ function runFullDetection(dir) {
   return { repo, environment, aiTools, modelsAndTools, summary: { toolsDetected, modelsDetected, missingAdvisory } };
 }
 
+// src/avorelo/capabilities/activation/activation-state.ts
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync12, mkdirSync as mkdirSync12, existsSync as existsSync27 } from "node:fs";
+import { join as join24, resolve as resolve3 } from "node:path";
+init_redaction();
+var ACTIVATION_STATE_CONTRACT = "avorelo.activationState.v1";
+var ACTIVATION_STATE_DIR = ".avorelo/activation";
+var ACTIVATION_STATE_FILE = "activation-state.json";
+function writeActivationState(targetDir, state) {
+  const dir = join24(targetDir, ACTIVATION_STATE_DIR);
+  mkdirSync12(dir, { recursive: true });
+  const path = join24(dir, ACTIVATION_STATE_FILE);
+  const safe = redact(state).value;
+  writeFileSync12(path, JSON.stringify(safe, null, 2));
+  return path;
+}
+function readActivationState(targetDir) {
+  const path = join24(targetDir, ACTIVATION_STATE_DIR, ACTIVATION_STATE_FILE);
+  if (!existsSync27(path)) return null;
+  try {
+    const raw = readFileSync13(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.contract !== ACTIVATION_STATE_CONTRACT && parsed.contract !== "avorelo.activationState.v2") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function verifyActivationState(targetDir) {
+  const checks = [];
+  const state = readActivationState(targetDir);
+  if (!state) {
+    checks.push({ id: "state_exists", passed: false, reason: "Activation state not found" });
+    return { valid: false, checks };
+  }
+  checks.push({ id: "state_exists", passed: true, reason: "Activation state found" });
+  const validContracts = [ACTIVATION_STATE_CONTRACT, "avorelo.activationState.v2"];
+  const contractOk = validContracts.includes(state.contract);
+  checks.push({ id: "contract_valid", passed: contractOk, reason: contractOk ? "Contract matches" : `Expected ${ACTIVATION_STATE_CONTRACT} or v2, got ${state.contract}` });
+  checks.push({ id: "redacted", passed: state.redacted === true, reason: state.redacted ? "State is redacted" : "State is NOT redacted" });
+  const raw2 = state;
+  const billingLive = raw2.billing?.billingLive;
+  checks.push({ id: "billing_not_live", passed: billingLive === false, reason: billingLive === false ? "Billing not live" : "BILLING IS LIVE \u2014 violation" });
+  const authLive = raw2.cloud?.authLive ?? raw2.auth?.sessionAvailable === true;
+  checks.push({ id: "auth_not_live", passed: !authLive, reason: !authLive ? "Auth not live" : "AUTH IS LIVE \u2014 violation" });
+  const cloudSyncLive = raw2.cloud?.cloudSyncLive;
+  checks.push({ id: "cloud_sync_not_live", passed: cloudSyncLive === false, reason: cloudSyncLive === false ? "Cloud sync not live" : "CLOUD SYNC IS LIVE \u2014 violation" });
+  checks.push({ id: "production_not_ready", passed: state.productionReady === false, reason: state.productionReady === false ? "Production not ready (correct)" : "PRODUCTION MARKED READY \u2014 violation" });
+  const raw = JSON.stringify(state);
+  const hasSecret = carriesRawSecret(raw);
+  checks.push({ id: "no_secrets", passed: !hasSecret, reason: hasSecret ? "RAW SECRET DETECTED in state" : "No raw secrets" });
+  const legacyTokens = ["wuz", "cco", "claudecode-optimizer"];
+  const oldNaming = legacyTokens.some((t) => raw.toLowerCase().includes(t));
+  checks.push({ id: "no_old_naming", passed: !oldNaming, reason: oldNaming ? "Old naming leakage detected" : "No old naming leakage" });
+  return { valid: checks.every((c) => c.passed), checks };
+}
+function repairActivationState(targetDir) {
+  const state = readActivationState(targetDir);
+  if (!state) {
+    return { repaired: false, message: "No activation state found. Run: npx avorelo activate" };
+  }
+  const validContracts2 = [ACTIVATION_STATE_CONTRACT, "avorelo.activationState.v2"];
+  if (!validContracts2.includes(state.contract)) {
+    return { repaired: false, message: `Corrupt contract: ${state.contract}. Run: npx avorelo activate (will re-create)` };
+  }
+  return { repaired: true, message: "Activation state is valid." };
+}
+
+// src/avorelo/capabilities/activation/activation-runner.ts
+import { join as join27 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+
 // src/avorelo/capabilities/activation/activation-repair.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13, readFileSync as readFileSync14, appendFileSync as appendFileSync2 } from "node:fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13, readFileSync as readFileSync14, appendFileSync as appendFileSync2 } from "node:fs";
 import { join as join25 } from "node:path";
 function runSafeRepairs(targetDir) {
   const repairs = [];
@@ -6805,7 +6963,7 @@ function runSafeRepairs(targetDir) {
   ];
   for (const d of dirs) {
     const p = join25(targetDir, d);
-    if (!existsSync27(p)) {
+    if (!existsSync28(p)) {
       try {
         mkdirSync13(p, { recursive: true });
         repairs.push({ id: `create_dir_${d.replace(/[/.]/g, "_")}`, label: `Create ${d}`, status: "applied", path: p });
@@ -6818,7 +6976,7 @@ function runSafeRepairs(targetDir) {
   }
   repairGitignore(targetDir, repairs);
   const contractPath = join25(targetDir, ".avorelo", "run-entry", "activation-contract.json");
-  if (!existsSync27(contractPath)) {
+  if (!existsSync28(contractPath)) {
     try {
       writeFileSync13(contractPath, JSON.stringify({
         contract: "avorelo.activationContract.v1",
@@ -6843,7 +7001,7 @@ var GITIGNORE_BLOCK = `${GITIGNORE_MARKER_START}
 ${GITIGNORE_MARKER_END}`;
 function repairGitignore(targetDir, repairs) {
   const gitignorePath = join25(targetDir, ".gitignore");
-  if (!existsSync27(gitignorePath)) {
+  if (!existsSync28(gitignorePath)) {
     try {
       writeFileSync13(gitignorePath, GITIGNORE_BLOCK + "\n");
       repairs.push({ id: "gitignore_create", label: "Create .gitignore with Avorelo block", status: "applied", path: gitignorePath });
@@ -6870,7 +7028,7 @@ function repairGitignore(targetDir, repairs) {
 }
 
 // src/avorelo/capabilities/activation/activation-run-entry.ts
-import { existsSync as existsSync28, readFileSync as readFileSync15, writeFileSync as writeFileSync14, mkdirSync as mkdirSync14 } from "node:fs";
+import { existsSync as existsSync29, readFileSync as readFileSync15, writeFileSync as writeFileSync14, mkdirSync as mkdirSync14 } from "node:fs";
 import { join as join26, dirname as dirname3 } from "node:path";
 var MARKER_START = "<!-- >>> Avorelo Run Entry (managed \u2014 do not edit between markers) >>> -->";
 var MARKER_END = "<!-- <<< Avorelo Run Entry <<< -->";
@@ -6895,14 +7053,14 @@ Commands:
 ${MARKER_END}`;
 function installBlock(filePath, blockContent) {
   const dir = dirname3(filePath);
-  if (!existsSync28(dir)) {
+  if (!existsSync29(dir)) {
     try {
       mkdirSync14(dir, { recursive: true });
     } catch {
       return { path: filePath, action: "blocked", reason: "Cannot create directory" };
     }
   }
-  if (!existsSync28(filePath)) {
+  if (!existsSync29(filePath)) {
     try {
       writeFileSync14(filePath, blockContent + "\n");
       return { path: filePath, action: "created" };
@@ -6941,14 +7099,14 @@ function installRunEntry(targetDir) {
   const claudeMd = join26(targetDir, "CLAUDE.md");
   surfaces.push(installBlock(claudeMd, RUN_ENTRY_BLOCK));
   const agentsMd = join26(targetDir, "AGENTS.md");
-  if (existsSync28(agentsMd)) {
+  if (existsSync29(agentsMd)) {
     surfaces.push(installBlock(agentsMd, RUN_ENTRY_BLOCK));
   } else {
     surfaces.push({ path: agentsMd, action: "skipped", reason: "AGENTS.md does not exist \u2014 not creating" });
     advisory.push("AGENTS.md not present");
   }
   const cursorDir = join26(targetDir, ".cursor", "rules");
-  if (existsSync28(join26(targetDir, ".cursor"))) {
+  if (existsSync29(join26(targetDir, ".cursor"))) {
     const cursorRule = join26(cursorDir, "avorelo.mdc");
     const cursorBlock = [
       "---",
@@ -6961,7 +7119,7 @@ function installRunEntry(targetDir) {
       "Check `npx avorelo status` before starting work.",
       "Use Avorelo validators for proof. Do not claim production readiness without receipts."
     ].join("\n");
-    if (!existsSync28(cursorRule)) {
+    if (!existsSync29(cursorRule)) {
       try {
         mkdirSync14(cursorDir, { recursive: true });
         writeFileSync14(cursorRule, cursorBlock + "\n");
@@ -6975,7 +7133,7 @@ function installRunEntry(targetDir) {
   } else {
     advisory.push(".cursor not present");
   }
-  if (existsSync28(join26(targetDir, ".codex"))) {
+  if (existsSync29(join26(targetDir, ".codex"))) {
     advisory.push("Codex detected \u2014 manual run-entry recommended");
   }
   let contractPath;
@@ -7636,7 +7794,7 @@ function runFullActivation(targetDir) {
     nextAction: "Run: npx avorelo status"
   };
   const dashboardPath = join27(targetDir, ".avorelo", "dashboard", "index.html");
-  const localDashboard = { available: existsSync29(dashboardPath), path: existsSync29(dashboardPath) ? dashboardPath : void 0 };
+  const localDashboard = { available: existsSync30(dashboardPath), path: existsSync30(dashboardPath) ? dashboardPath : void 0 };
   const blockers = repairsBlocked.length;
   const activationStatus = blockers > 0 ? "blocked" : "active_with_holds";
   const existingState = readActivationState(targetDir);
@@ -8017,7 +8175,7 @@ function prepareDashboardHtmlWithEntitlements(html, model) {
 
 // src/avorelo/adapters/lemon-squeezy/subscription-store.ts
 init_redaction();
-import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync15, readFileSync as readFileSync16, readdirSync as readdirSync8, existsSync as existsSync30, renameSync } from "node:fs";
+import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync15, readFileSync as readFileSync16, readdirSync as readdirSync8, existsSync as existsSync31, renameSync } from "node:fs";
 import { join as join28 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function subscriptionDir(baseDir) {
@@ -8043,7 +8201,7 @@ function writeSubscription(baseDir, record) {
 function readSubscription(baseDir, providerSubscriptionId) {
   const dir = subscriptionDir(baseDir);
   const path = join28(dir, `sub_${providerSubscriptionId}.json`);
-  if (!existsSync30(path)) return null;
+  if (!existsSync31(path)) return null;
   try {
     const r2 = JSON.parse(readFileSync16(path, "utf8"));
     return r2 && typeof r2.id === "string" && typeof r2.plan === "string" ? r2 : null;
@@ -8065,7 +8223,7 @@ function readSubscriptionByUser(baseDir, userId) {
 }
 function listSubscriptions(baseDir) {
   const dir = subscriptionDir(baseDir);
-  if (!existsSync30(dir)) return [];
+  if (!existsSync31(dir)) return [];
   const out = [];
   for (const f of readdirSync8(dir)) {
     if (!f.endsWith(".json") || f.includes(".tmp.")) continue;
@@ -8088,7 +8246,7 @@ function writeUnmatchedEvent(baseDir, event) {
 }
 function listUnmatchedEvents(baseDir) {
   const dir = unmatchedDir(baseDir);
-  if (!existsSync30(dir)) return [];
+  if (!existsSync31(dir)) return [];
   const out = [];
   for (const f of readdirSync8(dir)) {
     if (!f.endsWith(".json") || f.includes(".tmp.")) continue;
@@ -8351,12 +8509,12 @@ function open(dir, opts) {
 
 // src/avorelo/capabilities/control-center/index.ts
 init_redaction();
-import { mkdirSync as mkdirSync25, writeFileSync as writeFileSync24, existsSync as existsSync39, readFileSync as readFileSync24 } from "node:fs";
+import { mkdirSync as mkdirSync25, writeFileSync as writeFileSync24, existsSync as existsSync40, readFileSync as readFileSync24 } from "node:fs";
 import { join as join40 } from "node:path";
 
 // src/avorelo/capabilities/runtime-flow/index.ts
 import { createHash as createHash12 } from "node:crypto";
-import { mkdirSync as mkdirSync24, writeFileSync as writeFileSync23, appendFileSync as appendFileSync9, readFileSync as readFileSync23, existsSync as existsSync38 } from "node:fs";
+import { mkdirSync as mkdirSync24, writeFileSync as writeFileSync23, appendFileSync as appendFileSync9, readFileSync as readFileSync23, existsSync as existsSync39 } from "node:fs";
 import { join as join39 } from "node:path";
 
 // src/avorelo/kernel/work-contract/routing.ts
@@ -8621,7 +8779,7 @@ init_session();
 
 // src/avorelo/capabilities/context-compiler/index.ts
 import { createHash as createHash7 } from "node:crypto";
-import { appendFileSync as appendFileSync3, existsSync as existsSync31, mkdirSync as mkdirSync17, readFileSync as readFileSync17, writeFileSync as writeFileSync17 } from "node:fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync32, mkdirSync as mkdirSync17, readFileSync as readFileSync17, writeFileSync as writeFileSync17 } from "node:fs";
 import { join as join30 } from "node:path";
 
 // src/avorelo/capabilities/secret-boundary/index.ts
@@ -9281,7 +9439,7 @@ function writeContextPack(dir, pack) {
 }
 
 // src/avorelo/capabilities/continuity/index.ts
-import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync18, readFileSync as readFileSync18, existsSync as existsSync32, appendFileSync as appendFileSync4 } from "node:fs";
+import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync18, readFileSync as readFileSync18, existsSync as existsSync33, appendFileSync as appendFileSync4 } from "node:fs";
 import { join as join31 } from "node:path";
 init_redactor();
 var DAY_MS = 24 * 60 * 60 * 1e3;
@@ -9437,7 +9595,7 @@ function writeContinuity(dir, packet) {
 }
 function loadLatestContinuity(dir) {
   const latest = join31(continuityDir(dir), "latest.json");
-  if (!existsSync32(latest)) return null;
+  if (!existsSync33(latest)) return null;
   try {
     const p = JSON.parse(readFileSync18(latest, "utf8"));
     return p && p.contract === "avorelo.nextRunContinuity.v1" ? p : null;
@@ -9448,7 +9606,7 @@ function loadLatestContinuity(dir) {
 
 // src/avorelo/capabilities/token-cost-evidence/index.ts
 init_redactor();
-import { mkdirSync as mkdirSync19, readFileSync as readFileSync19, existsSync as existsSync33, appendFileSync as appendFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync19, readFileSync as readFileSync19, existsSync as existsSync34, appendFileSync as appendFileSync5 } from "node:fs";
 import { join as join32 } from "node:path";
 import { createHash as createHash8 } from "node:crypto";
 var FORBIDDEN_IMPORT_KEYS = [
@@ -9744,7 +9902,7 @@ function writeTokenCostEvidence(dir, e) {
 }
 function loadTokenCostEvidence(dir) {
   const path = join32(evidenceDir(dir), "token-cost.jsonl");
-  if (!existsSync33(path)) return [];
+  if (!existsSync34(path)) return [];
   const out = [];
   for (const line of readFileSync19(path, "utf8").split(/\r?\n/)) {
     if (!line.trim()) continue;
@@ -9759,7 +9917,7 @@ function loadTokenCostEvidence(dir) {
 
 // src/avorelo/capabilities/proof-report/index.ts
 init_redactor();
-import { mkdirSync as mkdirSync20, writeFileSync as writeFileSync20, appendFileSync as appendFileSync6, existsSync as existsSync34, readFileSync as readFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync20, writeFileSync as writeFileSync20, appendFileSync as appendFileSync6, existsSync as existsSync35, readFileSync as readFileSync20 } from "node:fs";
 import { join as join33 } from "node:path";
 import { createHash as createHash9 } from "node:crypto";
 var rs = (s) => redactString2(String(s ?? ""), "handoff", "report").redacted;
@@ -9916,7 +10074,7 @@ function writeProofReport(dir, r2) {
 }
 function loadLatestProofReport(dir) {
   const latest = join33(reportsDir(dir), "proof-report.latest.json");
-  if (!existsSync34(latest)) return null;
+  if (!existsSync35(latest)) return null;
   try {
     return JSON.parse(readFileSync20(latest, "utf8"));
   } catch {
@@ -9926,7 +10084,7 @@ function loadLatestProofReport(dir) {
 
 // src/avorelo/capabilities/value-ledger/index.ts
 init_redactor();
-import { mkdirSync as mkdirSync21, writeFileSync as writeFileSync21, readFileSync as readFileSync21, existsSync as existsSync35, appendFileSync as appendFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync21, writeFileSync as writeFileSync21, readFileSync as readFileSync21, existsSync as existsSync36, appendFileSync as appendFileSync7 } from "node:fs";
 import { join as join34 } from "node:path";
 import { createHash as createHash10 } from "node:crypto";
 function safeText2(s) {
@@ -10075,7 +10233,7 @@ function appendValueLedgerEntry(dir, e) {
 }
 function loadValueLedgerEntries(dir) {
   const path = join34(ledgerDir(dir), "value-ledger.jsonl");
-  if (!existsSync35(path)) return [];
+  if (!existsSync36(path)) return [];
   const out = [];
   for (const line of readFileSync21(path, "utf8").split(/\r?\n/)) {
     if (!line.trim()) continue;
@@ -10251,7 +10409,7 @@ import { mkdirSync as mkdirSync23, writeFileSync as writeFileSync22 } from "node
 import { join as join38 } from "node:path";
 
 // src/avorelo/capabilities/context-check/scanner.ts
-import { existsSync as existsSync36, readdirSync as readdirSync9, statSync as statSync3, openSync, readSync, closeSync } from "node:fs";
+import { existsSync as existsSync37, readdirSync as readdirSync9, statSync as statSync3, openSync, readSync, closeSync } from "node:fs";
 import { join as join36, relative, sep as sep3 } from "node:path";
 var BYTES_PER_TOKEN_ESTIMATE = 4;
 var MAX_SCAN_DEPTH = 5;
@@ -10306,7 +10464,7 @@ function extractReferences(content) {
 function scanClaude(repoRoot2) {
   const sources = [];
   const rootMd = join36(repoRoot2, "CLAUDE.md");
-  if (existsSync36(rootMd)) {
+  if (existsSync37(rootMd)) {
     const meta = fileMeta(rootMd);
     if (meta) {
       const content = safeRead(rootMd);
@@ -10320,7 +10478,7 @@ function scanClaude(repoRoot2) {
     }
   }
   const claudeDir = join36(repoRoot2, ".claude");
-  if (existsSync36(claudeDir)) {
+  if (existsSync37(claudeDir)) {
     try {
       for (const entry of walkDir(claudeDir, 3)) {
         if (!entry.endsWith(".md") && !entry.endsWith(".json") && !entry.endsWith(".txt")) continue;
@@ -10365,7 +10523,7 @@ function scanClaude(repoRoot2) {
 }
 function scanAgents(repoRoot2) {
   const agentsMd = join36(repoRoot2, "AGENTS.md");
-  if (!existsSync36(agentsMd)) return [];
+  if (!existsSync37(agentsMd)) return [];
   const meta = fileMeta(agentsMd);
   if (!meta) return [];
   const content = safeRead(agentsMd);
@@ -10380,9 +10538,9 @@ function scanAgents(repoRoot2) {
 function scanCursor(repoRoot2) {
   const sources = [];
   const cursorDir = join36(repoRoot2, ".cursor");
-  if (!existsSync36(cursorDir)) return sources;
+  if (!existsSync37(cursorDir)) return sources;
   const rulesDir = join36(cursorDir, "rules");
-  if (existsSync36(rulesDir)) {
+  if (existsSync37(rulesDir)) {
     try {
       for (const entry of walkDir(rulesDir, 2)) {
         if (!entry.endsWith(".mdc") && !entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
@@ -10404,7 +10562,7 @@ function scanCursor(repoRoot2) {
     }
   }
   const cursorrules = join36(repoRoot2, ".cursorrules");
-  if (existsSync36(cursorrules)) {
+  if (existsSync37(cursorrules)) {
     const meta = fileMeta(cursorrules);
     if (meta) {
       sources.push({
@@ -10430,7 +10588,7 @@ function extractCursorGlobs(content) {
 function scanCodex(repoRoot2) {
   const sources = [];
   const codexMd = join36(repoRoot2, "CODEX.md");
-  if (existsSync36(codexMd)) {
+  if (existsSync37(codexMd)) {
     const meta = fileMeta(codexMd);
     if (meta) {
       sources.push({
@@ -10443,7 +10601,7 @@ function scanCodex(repoRoot2) {
     }
   }
   const codexDir = join36(repoRoot2, ".codex");
-  if (existsSync36(codexDir)) {
+  if (existsSync37(codexDir)) {
     try {
       for (const entry of walkDir(codexDir, 2)) {
         const meta = fileMeta(entry);
@@ -10467,7 +10625,7 @@ function scanGeneric(repoRoot2) {
   const knownFiles = [".github/copilot-instructions.md", "CONTRIBUTING.md"];
   for (const rel of knownFiles) {
     const full = join36(repoRoot2, rel);
-    if (existsSync36(full)) {
+    if (existsSync37(full)) {
       const meta = fileMeta(full);
       if (meta) {
         sources.push({
@@ -10503,7 +10661,7 @@ function* walkDir(dir, maxDepth, depth = 0) {
 }
 
 // src/avorelo/capabilities/context-check/classifier.ts
-import { existsSync as existsSync37 } from "node:fs";
+import { existsSync as existsSync38 } from "node:fs";
 import { join as join37, dirname as dirname4 } from "node:path";
 var OVERSIZE_WARNING_TOKENS = 8e3;
 var OVERSIZE_ATTENTION_TOKENS = 25e3;
@@ -10529,7 +10687,7 @@ function checkBrokenReferences(src, repoRoot2) {
   for (const ref of src.references) {
     const resolvedPath = join37(repoRoot2, dirname4(src.path), ref);
     const resolvedFromRoot = join37(repoRoot2, ref);
-    if (!existsSync37(resolvedPath) && !existsSync37(resolvedFromRoot)) {
+    if (!existsSync38(resolvedPath) && !existsSync38(resolvedFromRoot)) {
       findings.push({
         code: "BROKEN_CONTEXT_REFERENCE",
         severity: "warning",
@@ -10586,7 +10744,7 @@ function checkRuleMatchesNoFiles(src, repoRoot2) {
   for (const glob of src.appliesToPaths) {
     if (glob.includes("*")) continue;
     const target = join37(repoRoot2, glob);
-    if (!existsSync37(target)) {
+    if (!existsSync38(target)) {
       return [{
         code: "RULE_MATCHES_NO_FILES",
         severity: "info",
@@ -10984,6 +11142,477 @@ function buildSummary(status, sourceCount, findingCount) {
 
 // src/avorelo/capabilities/runtime-flow/index.ts
 init_redaction();
+
+// src/avorelo/kernel/work-controls/index.ts
+var BUILTIN_CONTROLS = [
+  {
+    controlId: "secrets_guard",
+    title: "Secrets Guard",
+    purpose: "Block tasks, commands, syncs, and receipts that would leak secrets or env values.",
+    enforcementPoints: ["before_task_start", "before_shell_command", "before_secret_or_env_access", "before_cloud_sync", "before_receipt_finalize"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Detects secret and env exposure locally, returns coded findings only, never persists raw values.",
+    cloudBehavior: "Never allows raw secret or env material into sync payloads.",
+    dataPersisted: ["reason codes", "redaction classes", "safe next actions"],
+    testsRequired: ["no raw env persistence", "no secret printing", "DENY short-circuit"],
+    uiCopy: "Block secret or env leakage."
+  },
+  {
+    controlId: "scope_drift_guard",
+    title: "Scope Drift Guard",
+    purpose: "Stop broad or out-of-scope work before it silently expands.",
+    enforcementPoints: ["before_task_start", "before_file_write"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Uses route and write-scope metadata only.",
+    cloudBehavior: "Only safe scope codes may be synced.",
+    dataPersisted: ["reason codes", "triggered control id"],
+    testsRequired: ["ASK for broad scope", "DENY for out-of-scope writes"],
+    uiCopy: "Stop scope drift before it spreads."
+  },
+  {
+    controlId: "risky_action_approval",
+    title: "Risky Action Approval",
+    purpose: "Ask before risky work starts when the routed task already requires confirmation or manual review.",
+    enforcementPoints: ["before_task_start"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Maps current route/risk/proof metadata to a clear ASK verdict.",
+    cloudBehavior: "Only approval-required state may be synced, never task content.",
+    dataPersisted: ["verdict", "reason codes", "approval-required flag"],
+    testsRequired: ["ASK requires explicit approval", "approval clears ASK but not DENY"],
+    uiCopy: "Ask before risky actions."
+  },
+  {
+    controlId: "shell_command_approval",
+    title: "Shell Command Approval",
+    purpose: "Ask before risky shell commands and deny obviously destructive ones.",
+    enforcementPoints: ["before_shell_command"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Evaluates the command string locally and never stores terminal output.",
+    cloudBehavior: "Only coded gate outcomes may sync.",
+    dataPersisted: ["reason codes", "verdict"],
+    testsRequired: ["ASK for risky commands", "DENY for destructive commands"],
+    uiCopy: "Ask before risky shell commands."
+  },
+  {
+    controlId: "file_write_approval",
+    title: "File Write Approval",
+    purpose: "Require confirmation before sensitive file writes.",
+    enforcementPoints: ["before_file_write"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Uses path classification only, not file contents.",
+    cloudBehavior: "Only write gate metadata may sync.",
+    dataPersisted: ["reason codes", "verdict"],
+    testsRequired: ["ASK for sensitive writes"],
+    uiCopy: "Ask before sensitive file writes."
+  },
+  {
+    controlId: "dependency_install_approval",
+    title: "Dependency Install Approval",
+    purpose: "Pause before package installs or dependency changes.",
+    enforcementPoints: ["before_dependency_install", "before_shell_command"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Uses command metadata only.",
+    cloudBehavior: "Only approval-required metadata may sync.",
+    dataPersisted: ["reason codes", "verdict"],
+    testsRequired: ["ASK for dependency install"],
+    uiCopy: "Ask before dependency installs."
+  },
+  {
+    controlId: "release_guard",
+    title: "Release Guard",
+    purpose: "Require explicit approval before package publish or release tagging.",
+    enforcementPoints: ["before_package_publish", "before_release_tag", "before_task_start"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Evaluates release intent locally and records approval state.",
+    cloudBehavior: "Only release gate receipts may sync.",
+    dataPersisted: ["verdict", "reason codes", "approval-required flag"],
+    testsRequired: ["ASK for publish", "ASK for release tag"],
+    uiCopy: "Prevent publish or release without approval."
+  },
+  {
+    controlId: "production_deploy_guard",
+    title: "Production Deploy Guard",
+    purpose: "Escalate production-impacting work beyond a normal ASK.",
+    enforcementPoints: ["before_production_deploy", "before_task_start"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Records the stronger approval requirement locally.",
+    cloudBehavior: "Only coded escalation metadata may sync.",
+    dataPersisted: ["verdict", "reason codes", "approval-required flag"],
+    testsRequired: ["ESCALATE for production deploy without stronger approval"],
+    uiCopy: "Require stronger approval for production deploys."
+  },
+  {
+    controlId: "proof_required_before_done",
+    title: "Proof Required Before Done",
+    purpose: "Block done claims until outcome and post-action proof exist.",
+    enforcementPoints: ["after_agent_claims_done", "before_receipt_finalize", "before_test_claim"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Checks proof metadata only; never stores raw test logs or diffs.",
+    cloudBehavior: "Only proof status may sync.",
+    dataPersisted: ["proof-required flag", "reason codes", "safe next actions"],
+    testsRequired: ["REQUIRE_PROOF without evidence", "proof gate deterministic"],
+    uiCopy: "Require proof before done."
+  },
+  {
+    controlId: "raw_payload_upload_guard",
+    title: "Raw Prompt/Source/Diff Upload Guard",
+    purpose: "Deny cloud sync when raw prompt, source, diff, env, terminal, or secret payloads are present.",
+    enforcementPoints: ["before_cloud_sync"],
+    defaultState: "enabled",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Evaluates payload safety flags locally before any sync attempt.",
+    cloudBehavior: "Hard-denies unsafe sync.",
+    dataPersisted: ["reason codes", "verdict"],
+    testsRequired: ["no raw prompt upload", "no raw source upload", "no raw diff upload"],
+    uiCopy: "Receipts, not raw source."
+  },
+  {
+    controlId: "model_worthiness_guard",
+    title: "Model Worthiness Guard",
+    purpose: "Warn when a trivial task is not worth an expensive or deep review path.",
+    enforcementPoints: ["before_task_start"],
+    defaultState: "warn_only",
+    packaging: { free: true, pro: true, teams: true },
+    localOnlyBehavior: "Uses routing/task metadata only.",
+    cloudBehavior: "Only safe warning metadata may sync.",
+    dataPersisted: ["warning reason codes"],
+    testsRequired: ["WARN for trivial task with expensive model request"],
+    uiCopy: "Warn when deep review is not worth it."
+  }
+];
+var CONTROL_BY_ID = new Map(BUILTIN_CONTROLS.map((control) => [control.controlId, control]));
+var VERDICT_PRECEDENCE = [
+  "DENY",
+  "ESCALATE",
+  "ASK",
+  "REQUIRE_PROOF",
+  "WARN",
+  "ALLOW",
+  "NOOP"
+];
+var DESTRUCTIVE_SHELL_RE = /\b(rm\s+-rf|del\s+\/s|drop\s+table|git\s+push\s+--force|mkfs|dd\s+if=)\b/i;
+var RISKY_SHELL_RE = /\b(npm\s+publish|git\s+tag|railway|netlify|vercel|docker\s+push|kubectl|terraform\s+apply)\b/i;
+var DEPENDENCY_INSTALL_RE = /\b(npm|pnpm|yarn|bun)\s+(install|add)\b/i;
+function hasRawPayload(ctx) {
+  return !!(ctx.containsRawPrompt || ctx.containsRawSource || ctx.containsRawSecret || ctx.containsEnvValue || ctx.containsGitDiff || ctx.containsTerminalLog);
+}
+function hasProof(ctx) {
+  const levels = ctx.evidenceLevels ?? [];
+  return levels.includes("OUTCOME") && levels.includes("POST_ACTION");
+}
+function buildTrigger(controlId, enforcementPoint, verdict, reason, reasonCodes, nextAction) {
+  const def = CONTROL_BY_ID.get(controlId);
+  return {
+    controlId,
+    title: def.title,
+    verdict,
+    enforcementPoint,
+    reason,
+    reasonCodes,
+    nextAction
+  };
+}
+function evaluateSecretsGuard(point, ctx) {
+  if (point === "before_cloud_sync" && hasRawPayload(ctx)) {
+    return buildTrigger(
+      "raw_payload_upload_guard",
+      point,
+      "DENY",
+      "Cloud sync is blocked because the payload still contains raw prompt, source, diff, secret, env, or terminal data.",
+      ["RAW_PAYLOAD_BLOCKED"],
+      "Redact the payload and sync metadata only."
+    );
+  }
+  if (ctx.safeRunDecision === "block" || ctx.containsRawSecret || ctx.containsEnvValue) {
+    return buildTrigger(
+      "secrets_guard",
+      point,
+      "DENY",
+      "This action would expose secret or env material beyond Avorelo's trust boundary.",
+      ["SECRET_OR_ENV_EXPOSURE"],
+      "Remove the secret/env access, rotate if needed, and retry with safe references only."
+    );
+  }
+  return null;
+}
+function evaluateScopeGuard(point, ctx) {
+  if (point === "before_file_write" && ctx.outOfScopeWrite) {
+    return buildTrigger(
+      "scope_drift_guard",
+      point,
+      "DENY",
+      "The requested write is outside the approved work scope.",
+      ["OUT_OF_SCOPE_WRITE"],
+      "Narrow the task or explicitly approve the additional scope before writing."
+    );
+  }
+  if (point === "before_task_start" && ctx.route === "needs_decision") {
+    return buildTrigger(
+      "scope_drift_guard",
+      point,
+      "ASK",
+      "The task scope is too broad or ambiguous to start safely without a confirmation step.",
+      ["SCOPE_CONFIRMATION_REQUIRED"],
+      "Clarify the scope, target files, or success criteria before continuing."
+    );
+  }
+  return null;
+}
+function evaluateRiskyActionApproval(point, ctx) {
+  if (point !== "before_task_start") return null;
+  if (ctx.approvalPolicy === "require_confirmation" || ctx.approvalPolicy === "require_manual_review") {
+    if (ctx.userApproved) {
+      return buildTrigger(
+        "risky_action_approval",
+        point,
+        "ALLOW",
+        "The risky action had an explicit approval, so Avorelo can proceed without weakening safety.",
+        ["RISKY_ACTION_APPROVED"],
+        null
+      );
+    }
+    return buildTrigger(
+      "risky_action_approval",
+      point,
+      "ASK",
+      "This task has enough risk that it needs an explicit approval before work starts.",
+      ["RISKY_ACTION_APPROVAL_REQUIRED"],
+      "Confirm the risky action before continuing."
+    );
+  }
+  return null;
+}
+function evaluateShellCommand(point, ctx) {
+  if (point !== "before_shell_command" || !ctx.command) return null;
+  if (DESTRUCTIVE_SHELL_RE.test(ctx.command)) {
+    return buildTrigger(
+      "shell_command_approval",
+      point,
+      "DENY",
+      "The shell command is destructive enough that Avorelo blocks it by default.",
+      ["DESTRUCTIVE_SHELL_COMMAND"],
+      "Use a safer command or get the destructive step handled outside the automated flow."
+    );
+  }
+  if (ctx.dependencyInstallRequested || DEPENDENCY_INSTALL_RE.test(ctx.command)) {
+    if (ctx.userApproved) {
+      return buildTrigger(
+        "dependency_install_approval",
+        point,
+        "ALLOW",
+        "The dependency install had explicit approval.",
+        ["DEPENDENCY_INSTALL_APPROVED"],
+        null
+      );
+    }
+    return buildTrigger(
+      "dependency_install_approval",
+      point,
+      "ASK",
+      "Dependency installation is paused until the user explicitly approves it.",
+      ["DEPENDENCY_INSTALL_APPROVAL_REQUIRED"],
+      "Approve the dependency install, or use the existing lockfile and local dependencies only."
+    );
+  }
+  if (RISKY_SHELL_RE.test(ctx.command)) {
+    if (ctx.userApproved) {
+      return buildTrigger(
+        "shell_command_approval",
+        point,
+        "ALLOW",
+        "The risky shell command had explicit approval.",
+        ["SHELL_COMMAND_APPROVED"],
+        null
+      );
+    }
+    return buildTrigger(
+      "shell_command_approval",
+      point,
+      "ASK",
+      "This shell command can change external or release state and needs explicit approval.",
+      ["SHELL_COMMAND_APPROVAL_REQUIRED"],
+      "Approve the shell command before continuing."
+    );
+  }
+  return null;
+}
+function evaluateFileWrite(point, ctx) {
+  if (point !== "before_file_write" || !ctx.sensitiveFilePath) return null;
+  if (ctx.userApproved) {
+    return buildTrigger(
+      "file_write_approval",
+      point,
+      "ALLOW",
+      "The sensitive file write had explicit approval.",
+      ["FILE_WRITE_APPROVED"],
+      null
+    );
+  }
+  return buildTrigger(
+    "file_write_approval",
+    point,
+    "ASK",
+    "This write touches a sensitive surface and needs confirmation first.",
+    ["SENSITIVE_FILE_WRITE_APPROVAL_REQUIRED"],
+    "Approve the write or narrow the task to a non-sensitive path."
+  );
+}
+function evaluateRelease(point, ctx) {
+  if (point === "before_task_start" && ctx.productionImpact) {
+    if (ctx.adminApproved || ctx.teamApproved) {
+      return buildTrigger(
+        "production_deploy_guard",
+        point,
+        "ALLOW",
+        "The production-impacting task has stronger approval coverage.",
+        ["PRODUCTION_APPROVED"],
+        null
+      );
+    }
+    return buildTrigger(
+      "production_deploy_guard",
+      point,
+      "ESCALATE",
+      "Production-impacting work needs stronger approval than a normal ASK.",
+      ["PRODUCTION_ESCALATION_REQUIRED"],
+      "Get stronger approval before changing production-facing state."
+    );
+  }
+  if (point === "before_package_publish" || point === "before_release_tag") {
+    if (ctx.userApproved) {
+      return buildTrigger(
+        "release_guard",
+        point,
+        "ALLOW",
+        "The release step has explicit approval.",
+        ["RELEASE_APPROVED"],
+        null
+      );
+    }
+    return buildTrigger(
+      "release_guard",
+      point,
+      "ASK",
+      "Package publish and release tagging stay paused until explicitly approved.",
+      ["RELEASE_APPROVAL_REQUIRED"],
+      "Approve the release step before continuing."
+    );
+  }
+  if (point === "before_production_deploy") {
+    if (ctx.adminApproved || ctx.teamApproved) {
+      return buildTrigger(
+        "production_deploy_guard",
+        point,
+        "ALLOW",
+        "The production deploy has stronger approval coverage.",
+        ["PRODUCTION_APPROVED"],
+        null
+      );
+    }
+    return buildTrigger(
+      "production_deploy_guard",
+      point,
+      "ESCALATE",
+      "Production deploys need stronger approval than a normal ASK.",
+      ["PRODUCTION_ESCALATION_REQUIRED"],
+      "Get the stronger production approval before deploying."
+    );
+  }
+  return null;
+}
+function evaluateProof(point, ctx) {
+  if (point !== "after_agent_claims_done" && point !== "before_receipt_finalize" && point !== "before_test_claim") return null;
+  if (!ctx.agentClaimsDone) return null;
+  if (hasProof(ctx)) {
+    return buildTrigger(
+      "proof_required_before_done",
+      point,
+      "ALLOW",
+      "Outcome and post-action evidence are present, so the done claim can stand.",
+      ["PROOF_PRESENT"],
+      null
+    );
+  }
+  return buildTrigger(
+    "proof_required_before_done",
+    point,
+    "REQUIRE_PROOF",
+    "The agent claimed done before outcome and post-action proof existed.",
+    ["PROOF_REQUIRED_BEFORE_DONE"],
+    "Run the missing verification and attach outcome plus post-action evidence before marking done."
+  );
+}
+function evaluateModelWorthiness(point, ctx) {
+  if (point !== "before_task_start") return null;
+  if (!ctx.expensiveModelRequested || !ctx.taskSeemsTrivial) return null;
+  return buildTrigger(
+    "model_worthiness_guard",
+    point,
+    "WARN",
+    "This task looks trivial relative to the requested review depth.",
+    ["MODEL_WORTHINESS_WARN"],
+    "Use a lighter-weight path unless deeper review is actually needed."
+  );
+}
+function finalVerdict(triggers) {
+  if (triggers.length === 0) return "NOOP";
+  for (const verdict of VERDICT_PRECEDENCE) {
+    if (triggers.some((trigger) => trigger.verdict === verdict)) return verdict;
+  }
+  return "NOOP";
+}
+function listWorkControls() {
+  return BUILTIN_CONTROLS.map((control) => ({ ...control, enforcementPoints: [...control.enforcementPoints], packaging: { ...control.packaging }, dataPersisted: [...control.dataPersisted], testsRequired: [...control.testsRequired] }));
+}
+function getWorkControl(controlId) {
+  const found = CONTROL_BY_ID.get(controlId);
+  if (!found) return null;
+  return {
+    ...found,
+    enforcementPoints: [...found.enforcementPoints],
+    packaging: { ...found.packaging },
+    dataPersisted: [...found.dataPersisted],
+    testsRequired: [...found.testsRequired]
+  };
+}
+function evaluateWorkControls(enforcementPoint, ctx) {
+  const triggers = [
+    evaluateSecretsGuard(enforcementPoint, ctx),
+    evaluateScopeGuard(enforcementPoint, ctx),
+    evaluateRiskyActionApproval(enforcementPoint, ctx),
+    evaluateShellCommand(enforcementPoint, ctx),
+    evaluateFileWrite(enforcementPoint, ctx),
+    evaluateRelease(enforcementPoint, ctx),
+    evaluateProof(enforcementPoint, ctx),
+    evaluateModelWorthiness(enforcementPoint, ctx)
+  ].filter((trigger) => trigger !== null);
+  const verdict = finalVerdict(triggers);
+  const reasonCodes = Array.from(new Set(triggers.flatMap((trigger) => trigger.reasonCodes)));
+  const safeNextActions = Array.from(new Set(triggers.map((trigger) => trigger.nextAction).filter((value) => typeof value === "string" && value.length > 0)));
+  const blockingTrigger = triggers.find((trigger) => trigger.verdict === verdict) ?? null;
+  return {
+    enforcementPoint,
+    finalVerdict: verdict,
+    finalReason: blockingTrigger?.reason ?? "No relevant work control fired.",
+    reasonCodes,
+    approvalRequired: triggers.some((trigger) => trigger.verdict === "ASK" || trigger.verdict === "ESCALATE"),
+    proofRequired: triggers.some((trigger) => trigger.verdict === "REQUIRE_PROOF"),
+    triggers,
+    safeNextActions,
+    deterministic: true
+  };
+}
+
+// src/avorelo/capabilities/runtime-flow/index.ts
 function runtimeDir(dir) {
   return join39(dir, ".avorelo", "runtime");
 }
@@ -11018,6 +11647,22 @@ function safeFallbackProjection(reasonCodes, extraVerifierPlan = []) {
     containsRawSecret: false
   };
 }
+function toRuntimeWorkControls(evaluation) {
+  return {
+    enforcementPoint: evaluation.enforcementPoint,
+    finalVerdict: evaluation.finalVerdict,
+    finalReason: evaluation.finalReason,
+    reasonCodes: evaluation.reasonCodes,
+    approvalRequired: evaluation.approvalRequired,
+    proofRequired: evaluation.proofRequired,
+    triggeredControls: evaluation.triggers.map((trigger) => ({
+      controlId: trigger.controlId,
+      verdict: trigger.verdict,
+      reasonCodes: trigger.reasonCodes
+    })),
+    safeNextActions: evaluation.safeNextActions
+  };
+}
 function freshRuntimeId(seed) {
   return "rts_" + createHash12("sha256").update(seed).digest("hex").slice(0, 12);
 }
@@ -11082,6 +11727,20 @@ function runRuntimeSession(input) {
   const routing = decideRouting({ task, dir, planTier });
   const c = routing.contract;
   const displayTask = routing.displayTask;
+  const taskStartControls = evaluateWorkControls("before_task_start", {
+    task: displayTask,
+    planTier,
+    route: c.route,
+    riskClass: c.riskClass,
+    proofTier: c.proofTier,
+    approvalPolicy: c.approvalPolicy,
+    safeRunDecision: c.safetyBoundary.safeRunDecision,
+    secretRiskCodes: c.safetyBoundary.secretRiskCodes,
+    userApproved: routing.gate === "allow",
+    productionImpact: /deploy|release|publish|production|prod/i.test(displayTask),
+    taskSeemsTrivial: c.route === "deterministic_only" && c.riskClass === "low",
+    expensiveModelRequested: c.route === "deep_reasoning_required"
+  });
   const layers = [{
     order: 1,
     layer: "safety_and_routing",
@@ -11109,6 +11768,7 @@ function runRuntimeSession(input) {
       safeRunDecision: c.safetyBoundary.safeRunDecision,
       secretRiskCodes: c.safetyBoundary.secretRiskCodes ?? []
     },
+    workControls: toRuntimeWorkControls(taskStartControls),
     layers,
     redacted: true,
     containsRawSecret: false,
@@ -11653,7 +12313,7 @@ function writeRuntimeSession(dir, record) {
 }
 function loadLatestRuntimeSession(dir) {
   const path = join39(runtimeDir(dir), "session.latest.json");
-  if (!existsSync38(path)) return null;
+  if (!existsSync39(path)) return null;
   try {
     return JSON.parse(readFileSync23(path, "utf8"));
   } catch {
@@ -11673,6 +12333,8 @@ function buildRuntimeSessionSyncMetadata(record) {
     riskClass: record.riskClass,
     proofTier: record.proofTier,
     approvalPolicy: record.approvalPolicy,
+    workControlVerdict: record.workControls.finalVerdict,
+    workControlTriggerCount: record.workControls.triggeredControls.length,
     layerStatuses,
     secretRiskCodes: record.safetyBoundary.secretRiskCodes,
     canShowSavings: record.proof?.canShowSavings ?? false,
@@ -11688,6 +12350,8 @@ function validateRuntimeSession(record) {
   if (record.containsRawSecret !== false) reasons.push("contains_raw_secret");
   if (record.containsRawPrompt !== false) reasons.push("contains_raw_prompt");
   if (record.containsRawSourceDump !== false) reasons.push("contains_raw_source_dump");
+  if (!record.workControls) reasons.push("work_controls_missing");
+  else if (record.workControls.finalVerdict === "REQUIRE_PROOF" && record.gate === "allow") reasons.push("proof_required_task_started");
   if (record.gate === "blocked" && (record.session || record.context || record.continuity || record.tokenCost || record.proof || record.value || record.efficiencySync)) {
     reasons.push("blocked_gate_ran_downstream");
   }
@@ -11778,6 +12442,18 @@ function buildControlCenter(dir, opts) {
   } : { status: "unavailable" };
   if (runtime) sources.push(avoreloPath(dir, "runtime", "session.latest.json"));
   else notes.push('No runtime session yet \u2014 run `avorelo run "<task>"` to create one.');
+  const workControlsSection = runtime?.workControls ? {
+    status: "available",
+    enforcementPoint: runtime.workControls.enforcementPoint,
+    finalVerdict: runtime.workControls.finalVerdict,
+    approvalRequired: runtime.workControls.approvalRequired,
+    proofRequired: runtime.workControls.proofRequired,
+    triggeredCount: runtime.workControls.triggeredControls.length,
+    controls: runtime.workControls.triggeredControls.map((control) => ({
+      controlId: control.controlId,
+      verdict: control.verdict
+    }))
+  } : { status: "unavailable" };
   const contextPackSection = runtime?.contextPack ? {
     status: "available",
     contextPackId: runtime.contextPack.contextPackId,
@@ -11836,7 +12512,7 @@ function buildControlCenter(dir, opts) {
   let contextCheckSection = { status: "unavailable" };
   try {
     const ccPath = avoreloPath(dir, "context-check", "latest.json");
-    if (existsSync39(ccPath)) {
+    if (existsSync40(ccPath)) {
       const raw = JSON.parse(readFileSync24(ccPath, "utf8"));
       contextCheckSection = {
         status: "available",
@@ -11945,6 +12621,7 @@ function buildControlCenter(dir, opts) {
     workspace: dir,
     sections: {
       runtimeSession: runtimeSection,
+      workControls: workControlsSection,
       contextPack: contextPackSection,
       proof: proofSection,
       value: valueSection,
@@ -11979,6 +12656,7 @@ function renderText2(m) {
   } else {
     lines.push("  Runtime:   none yet");
   }
+  lines.push(`  Controls:  ${s.workControls.status === "available" ? `${s.workControls.finalVerdict} at ${s.workControls.enforcementPoint} \xB7 approval=${s.workControls.approvalRequired} \xB7 proof=${s.workControls.proofRequired} \xB7 triggers=${s.workControls.triggeredCount}` : "none"}`);
   lines.push(`  Ctx pack:  ${s.contextPack.status === "available" ? `${s.contextPack.contextPackId} \xB7 consumer=${s.contextPack.consumer} adapter=${s.contextPack.selectedAdapter} \xB7 refs=${s.contextPack.allowedCount}/${s.contextPack.forbiddenCount} blocked \xB7 budget=${s.contextPack.budget} used=${s.contextPack.contextBudgetUsed} \xB7 tags=${s.contextPack.provenanceTagCount}` : "none"}`);
   lines.push(`  Proof:     ${s.proof.status === "available" ? `${s.proof.reportId} \xB7 savings ${s.proof.canShowSavings ? "shown" : `not claimed (${s.proof.savingsRefusalReason ?? "no_comparative_evidence"})`}` : "none"}`);
   lines.push(`  Token/cost:${s.costEvidence.status === "available" ? ` ${s.costEvidence.confidence} \xB7 costSummary=${s.costEvidence.canShowCostSummary} \xB7 ${s.costEvidence.evidenceCount} item(s)` : " none"}`);
@@ -12046,6 +12724,7 @@ function renderHtml2(m) {
 <h1>Avorelo \u2014 Local Control Center</h1>
 <table>
 ${row("Runtime", s.runtimeSession.status === "available" ? `${esc2(s.runtimeSession.sessionStatus)} \xB7 gate=${esc2(s.runtimeSession.gate)} route=${esc2(s.runtimeSession.route)} risk=${esc2(s.runtimeSession.riskClass)} proof=${esc2(s.runtimeSession.proofTier)}<div>${layers}</div>` : '<span class="muted">none yet</span>')}
+${row("Controls", s.workControls.status === "available" ? `${esc2(s.workControls.finalVerdict)} \xB7 point=${esc2(s.workControls.enforcementPoint)} \xB7 approval=${esc2(s.workControls.approvalRequired)} \xB7 proof=${esc2(s.workControls.proofRequired)} \xB7 triggers=${esc2(s.workControls.triggeredCount)}${(s.workControls.controls ?? []).length ? `<div class="muted">${(s.workControls.controls ?? []).map((c) => `${esc2(c.controlId)}=${esc2(c.verdict)}`).join(" \xB7 ")}</div>` : ""}` : '<span class="muted">none</span>')}
 ${row("Ctx pack", s.contextPack.status === "available" ? `${esc2(s.contextPack.contextPackId)} \xB7 consumer=${esc2(s.contextPack.consumer)} adapter=${esc2(s.contextPack.selectedAdapter)} \xB7 refs=${esc2(s.contextPack.allowedCount)}/${esc2(s.contextPack.forbiddenCount)} blocked \xB7 budget=${esc2(s.contextPack.budget)} used=${esc2(s.contextPack.contextBudgetUsed)} \xB7 tags=${esc2(s.contextPack.provenanceTagCount)}` : '<span class="muted">none</span>')}
 ${row("Proof", s.proof.status === "available" ? `${esc2(s.proof.reportId)} \xB7 savings ${s.proof.canShowSavings ? "shown" : `<b>not claimed</b> (${esc2(s.proof.savingsRefusalReason ?? "no_comparative_evidence")})`}` : '<span class="muted">none</span>')}
 ${row("Token/cost", s.costEvidence.status === "available" ? `${esc2(s.costEvidence.confidence)} \xB7 costSummary=${esc2(s.costEvidence.canShowCostSummary)} \xB7 ${esc2(s.costEvidence.evidenceCount)} item(s)` : '<span class="muted">none</span>')}
@@ -12071,7 +12750,7 @@ function openControlCenter(dir, opts) {
 
 // src/avorelo/capabilities/activation/init.ts
 import { createHash as createHash13, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync40, mkdirSync as mkdirSync26, writeFileSync as writeFileSync25, readFileSync as readFileSync25, statSync as statSync4, accessSync, constants } from "node:fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync26, writeFileSync as writeFileSync25, readFileSync as readFileSync25, statSync as statSync4, accessSync, constants } from "node:fs";
 import { join as join41 } from "node:path";
 var ACTIVATION_V1_CONTRACT = "avorelo.activation.v1";
 var WORKSPACE_V1_CONTRACT = "avorelo.workspace.v1";
@@ -12089,7 +12768,7 @@ function freshActivationId(seed) {
 }
 function loadWorkspace(dir) {
   const p = workspacePath(dir);
-  if (!existsSync40(p)) return null;
+  if (!existsSync41(p)) return null;
   try {
     const w = JSON.parse(readFileSync25(p, "utf8"));
     return w.contract === WORKSPACE_V1_CONTRACT && typeof w.workspaceId === "string" ? w : null;
@@ -12114,9 +12793,9 @@ function buildActivationContract(dir, opts) {
   } catch {
     packageManager = null;
   }
-  const packageDetected = existsSync40(join41(dir, "package.json"));
+  const packageDetected = existsSync41(join41(dir, "package.json"));
   const repoDetected = packageDetected || gitDetected;
-  const avoreloDirReady = existsSync40(avoreloDir(dir));
+  const avoreloDirReady = existsSync41(avoreloDir(dir));
   const initialized = !!existing;
   const firstRunRecommended = !initialized ? { command: `avorelo init --target ${dir}`, reason: "Initialize the local Avorelo workspace first." } : { command: `avorelo run "run tests" --target ${dir}`, reason: "Run your first focused task; Avorelo saves proof locally." };
   const limitations = [
@@ -12151,7 +12830,7 @@ function buildActivationContract(dir, opts) {
 function initWorkspace(dir, opts) {
   const now = opts?.now ?? Date.now();
   try {
-    if (!existsSync40(dir)) return { ok: false, created: false, reason: "target_does_not_exist" };
+    if (!existsSync41(dir)) return { ok: false, created: false, reason: "target_does_not_exist" };
     if (!statSync4(dir).isDirectory()) return { ok: false, created: false, reason: "target_not_a_directory" };
   } catch {
     return { ok: false, created: false, reason: "target_not_accessible" };
@@ -12291,11 +12970,11 @@ function renderDogfoodCheck(r2) {
 
 // src/avorelo/capabilities/core-readiness/index.ts
 import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync42, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync43, readFileSync as readFileSync27 } from "node:fs";
 import { join as join43 } from "node:path";
 
 // src/avorelo/capabilities/canonical-readiness/index.ts
-import { existsSync as existsSync41, readFileSync as readFileSync26, readdirSync as readdirSync11, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync42, readFileSync as readFileSync26, readdirSync as readdirSync11, statSync as statSync5 } from "node:fs";
 import { join as join42 } from "node:path";
 import { createHash as createHash14 } from "node:crypto";
 var FORBIDDEN_CLAIM_PATTERNS = [
@@ -12380,7 +13059,7 @@ var OLD_CAP_SPECS = [
   { capability: "Seamless Model & Primitive Routing", evidence: ["src/avorelo/kernel/model-routing/index.ts", "src/avorelo/kernel/model-routing/resolver.ts", "src/avorelo/kernel/model-routing/verifier.ts"], status: "adapted", notes: ["Phase 10; deterministic-first cascade, upgrade-only session memory, safety-verified projections"] }
 ];
 function has(root, rel) {
-  return existsSync41(join42(root, rel));
+  return existsSync42(join42(root, rel));
 }
 function read(root, rel) {
   try {
@@ -12392,7 +13071,7 @@ function read(root, rel) {
 function walkFiles(root, rel, exts) {
   const out = [];
   const base = join42(root, rel);
-  if (!existsSync41(base)) return out;
+  if (!existsSync42(base)) return out;
   const rec = (dir) => {
     for (const name of readdirSync11(dir)) {
       const p = join42(dir, name);
@@ -12536,7 +13215,7 @@ function repoRoot() {
   return join43(import.meta.dirname, "..", "..", "..", "..");
 }
 function has2(root, rel) {
-  return existsSync42(join43(root, rel));
+  return existsSync43(join43(root, rel));
 }
 function buildCoreReadiness(opts) {
   const now = opts?.now ?? Date.now();
@@ -12843,18 +13522,18 @@ init_stop_continue_gate();
 init_state_ledger();
 init_receipts();
 init_redaction();
-import { readFileSync as readFileSync28, existsSync as existsSync43, statSync as statSync6 } from "node:fs";
+import { readFileSync as readFileSync28, existsSync as existsSync44, statSync as statSync6 } from "node:fs";
 import { execFileSync as execFileSync2 } from "node:child_process";
 function readBack(dir, check) {
   const id = check.artifactId ?? `sot_${check.kind}`;
   const resolve5 = (p) => p.startsWith("/") || /^[A-Za-z]:/.test(p) ? p : `${dir}/${p}`;
   try {
     if (check.kind === "file_absent") {
-      const passed2 = !existsSync43(resolve5(check.path));
+      const passed2 = !existsSync44(resolve5(check.path));
       return { artifact: passed2 ? { artifactId: id, kind: "source_of_truth_readback", ref: `sot:absent:${check.path}` } : null, passed: passed2, reasonCode: passed2 ? "READBACK_ABSENT_OK" : "READBACK_UNEXPECTEDLY_PRESENT", check };
     }
     const p = resolve5(check.path);
-    if (!existsSync43(p)) return { artifact: null, passed: false, reasonCode: "READBACK_FILE_MISSING", check };
+    if (!existsSync44(p)) return { artifact: null, passed: false, reasonCode: "READBACK_FILE_MISSING", check };
     const actual = readFileSync28(p, "utf8");
     const passed = check.kind === "file_equals" ? actual.trim() === check.expected.trim() : actual.includes(check.expected);
     return { artifact: passed ? { artifactId: id, kind: "source_of_truth_readback", ref: `sot:${check.kind}:${check.path}` } : null, passed, reasonCode: passed ? "READBACK_MATCH" : "READBACK_MISMATCH", check };
@@ -12877,7 +13556,7 @@ function checkEnvironmentIntegrity(dir, signals) {
   if (signals?.staleProcess) reasonCodes.push("STALE_PROCESS");
   return { compromised: reasonCodes.length > 0, reasonCodes };
 }
-function evaluateProof(input) {
+function evaluateProof2(input) {
   const declared = input.artifacts ?? [];
   const readbacks = (input.readbacks ?? []).map((c) => readBack(input.dir, c));
   const readbackArtifacts = readbacks.map((r2) => r2.artifact).filter((a) => a !== null);
@@ -12918,7 +13597,7 @@ function evaluateProof(input) {
 }
 function loadProofInput(dir) {
   const p = `${dir}/.avorelo/proof-input.json`;
-  if (!existsSync43(p)) return null;
+  if (!existsSync44(p)) return null;
   try {
     return JSON.parse(readFileSync28(p, "utf8"));
   } catch {
@@ -12927,17 +13606,18 @@ function loadProofInput(dir) {
 }
 
 // src/avorelo/surfaces/public-web/index.ts
-import { mkdirSync as mkdirSync27, copyFileSync as copyFileSync2, readdirSync as readdirSync12, existsSync as existsSync44 } from "node:fs";
+import { mkdirSync as mkdirSync27, copyFileSync as copyFileSync2, readdirSync as readdirSync12, existsSync as existsSync45 } from "node:fs";
 import { join as join44, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var __dirname = dirname5(fileURLToPath2(import.meta.url));
 var STATIC_DIR = join44(__dirname, "static");
 function buildSite(outDir) {
   mkdirSync27(outDir, { recursive: true });
-  if (!existsSync44(STATIC_DIR)) {
+  if (!existsSync45(STATIC_DIR)) {
     return { ok: false, outDir, pages: [], indexPath: "" };
   }
-  const files = readdirSync12(STATIC_DIR).filter((f) => /\.(html|js|css|png|svg|ico|json|txt|xml|webmanifest)$/.test(f));
+  const NETLIFY_FILES = ["_redirects", "_headers"];
+  const files = readdirSync12(STATIC_DIR).filter((f) => /\.(html|js|css|png|svg|ico|json|txt|xml|webmanifest)$/.test(f) || NETLIFY_FILES.includes(f));
   for (const f of files) {
     copyFileSync2(join44(STATIC_DIR, f), join44(outDir, f));
   }
@@ -12951,7 +13631,7 @@ function buildSite(outDir) {
 
 // src/avorelo/surfaces/preview-server/index.ts
 import { createServer } from "node:http";
-import { readFileSync as readFileSync29, existsSync as existsSync45, statSync as statSync7 } from "node:fs";
+import { readFileSync as readFileSync29, existsSync as existsSync46, statSync as statSync7 } from "node:fs";
 import { join as join45, normalize, extname, sep as sep4 } from "node:path";
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -12971,7 +13651,7 @@ function resolveRequestPath(root, urlPath) {
     const abs = normalize(join45(rootNorm, candidate));
     if (abs !== rootNorm && !abs.startsWith(rootNorm.endsWith(sep4) ? rootNorm : rootNorm + sep4)) return null;
     try {
-      if (!existsSync45(abs) || !statSync7(abs).isFile()) return null;
+      if (!existsSync46(abs) || !statSync7(abs).isFile()) return null;
     } catch {
       return null;
     }
@@ -13486,12 +14166,12 @@ init_resume_packet();
 init_registry();
 
 // src/avorelo/capabilities/update-notice/index.ts
-import { existsSync as existsSync46, readFileSync as readFileSync30, writeFileSync as writeFileSync26, mkdirSync as mkdirSync28 } from "node:fs";
+import { existsSync as existsSync47, readFileSync as readFileSync30, writeFileSync as writeFileSync26, mkdirSync as mkdirSync28 } from "node:fs";
 import { join as join46, dirname as dirname6 } from "node:path";
 var STATE_PATH = ".avorelo/notice-state.json";
 function readNoticeState(dir) {
   const filePath = join46(dir, STATE_PATH);
-  if (!existsSync46(filePath)) {
+  if (!existsSync47(filePath)) {
     return { lastSeenVersion: "", dismissedVersions: [], quietMode: false, lastCheckedAt: "" };
   }
   try {
@@ -13503,7 +14183,7 @@ function readNoticeState(dir) {
 function writeNoticeState(dir, state) {
   const filePath = join46(dir, STATE_PATH);
   const d = dirname6(filePath);
-  if (!existsSync46(d)) mkdirSync28(d, { recursive: true });
+  if (!existsSync47(d)) mkdirSync28(d, { recursive: true });
   writeFileSync26(filePath, JSON.stringify(state, null, 2));
 }
 function getCurrentVersion() {
@@ -13559,7 +14239,7 @@ function getNoticeState(dir) {
 }
 
 // src/avorelo/capabilities/registry-freshness/index.ts
-import { existsSync as existsSync47, readFileSync as readFileSync31, writeFileSync as writeFileSync27, mkdirSync as mkdirSync29 } from "node:fs";
+import { existsSync as existsSync48, readFileSync as readFileSync31, writeFileSync as writeFileSync27, mkdirSync as mkdirSync29 } from "node:fs";
 import { join as join47, dirname as dirname7 } from "node:path";
 var REGISTRY_FRESHNESS_CONTRACT = "avorelo.registryFreshness.v1";
 var CACHE_FILE = ".avorelo/registry-freshness-cache.json";
@@ -13591,7 +14271,7 @@ function isSuppressed() {
 }
 function readCache(dir) {
   const p = join47(dir, CACHE_FILE);
-  if (!existsSync47(p)) return null;
+  if (!existsSync48(p)) return null;
   try {
     return JSON.parse(readFileSync31(p, "utf8"));
   } catch {
@@ -13695,10 +14375,10 @@ init_drift_detector();
 init_intervention();
 import { readdirSync as readdirSync13, statSync as statSync9 } from "node:fs";
 import { join as join48, relative as relative2 } from "node:path";
-import { execSync as execSync2 } from "node:child_process";
+import { execSync as execSync3 } from "node:child_process";
 function getGitChangedFiles(dir) {
   try {
-    const out = execSync2("git diff --name-only", { cwd: dir, stdio: "pipe", timeout: 5e3 }).toString().trim();
+    const out = execSync3("git diff --name-only", { cwd: dir, stdio: "pipe", timeout: 5e3 }).toString().trim();
     if (!out) return [];
     return out.split("\n").map((f) => f.trim()).filter(Boolean);
   } catch {
@@ -13707,7 +14387,7 @@ function getGitChangedFiles(dir) {
 }
 function getGitUntrackedFiles(dir) {
   try {
-    const out = execSync2("git ls-files --others --exclude-standard", { cwd: dir, stdio: "pipe", timeout: 5e3 }).toString().trim();
+    const out = execSync3("git ls-files --others --exclude-standard", { cwd: dir, stdio: "pipe", timeout: 5e3 }).toString().trim();
     if (!out) return [];
     return out.split("\n").map((f) => f.trim()).filter(Boolean);
   } catch {
@@ -13833,7 +14513,7 @@ function watchWithFixture(dir, fixture) {
 }
 
 // src/avorelo/capabilities/workspace/monorepo.ts
-import { existsSync as existsSync49, readFileSync as readFileSync33, readdirSync as readdirSync14, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync50, readFileSync as readFileSync33, readdirSync as readdirSync14, statSync as statSync10 } from "node:fs";
 import { join as join49 } from "node:path";
 function expandGlobDirs(dir, patterns) {
   const results = [];
@@ -13841,16 +14521,16 @@ function expandGlobDirs(dir, patterns) {
     const clean = pattern.replace(/\/\*$/, "").replace(/\*$/, "");
     if (!clean) continue;
     const base = join49(dir, clean);
-    if (!existsSync49(base)) continue;
+    if (!existsSync50(base)) continue;
     if (clean.includes("*")) continue;
     try {
       const stat = statSync10(base);
       if (stat.isDirectory()) {
-        if (existsSync49(join49(base, "package.json"))) {
+        if (existsSync50(join49(base, "package.json"))) {
           results.push(base);
         } else {
           for (const entry of readdirSync14(base, { withFileTypes: true })) {
-            if (entry.isDirectory() && existsSync49(join49(base, entry.name, "package.json"))) {
+            if (entry.isDirectory() && existsSync50(join49(base, entry.name, "package.json"))) {
               results.push(join49(base, entry.name));
             }
           }
@@ -13873,9 +14553,9 @@ function buildWorkspace(dir, wsPath) {
     name,
     path: wsPath,
     relativePath: rel,
-    hasPackageJson: existsSync49(join49(wsPath, "package.json")),
-    hasAgentsMd: existsSync49(join49(wsPath, "AGENTS.md")),
-    hasCursorRules: existsSync49(join49(wsPath, ".cursor"))
+    hasPackageJson: existsSync50(join49(wsPath, "package.json")),
+    hasAgentsMd: existsSync50(join49(wsPath, "AGENTS.md")),
+    hasCursorRules: existsSync50(join49(wsPath, ".cursor"))
   };
 }
 function detectMonorepo(dir) {
@@ -13906,7 +14586,7 @@ function detectMonorepo(dir) {
   } catch {
   }
   const pnpmPath = join49(dir, "pnpm-workspace.yaml");
-  if (existsSync49(pnpmPath)) {
+  if (existsSync50(pnpmPath)) {
     try {
       const content = readFileSync33(pnpmPath, "utf8");
       const match = content.match(/packages:\s*\n((?:\s*-\s*.+\n?)+)/);
@@ -13927,10 +14607,10 @@ function detectMonorepo(dir) {
   }
   for (const conventionDir of ["apps", "packages"]) {
     const convPath = join49(dir, conventionDir);
-    if (existsSync49(convPath)) {
+    if (existsSync50(convPath)) {
       try {
         const entries = readdirSync14(convPath, { withFileTypes: true });
-        const workspacePaths = entries.filter((e) => e.isDirectory() && existsSync49(join49(convPath, e.name, "package.json"))).map((e) => join49(convPath, e.name));
+        const workspacePaths = entries.filter((e) => e.isDirectory() && existsSync50(join49(convPath, e.name, "package.json"))).map((e) => join49(convPath, e.name));
         if (workspacePaths.length > 0) {
           return {
             isMonorepo: true,
@@ -13947,7 +14627,7 @@ function detectMonorepo(dir) {
 }
 
 // src/avorelo/capabilities/feedback/config.ts
-import { existsSync as existsSync50, readFileSync as readFileSync34, writeFileSync as writeFileSync28, mkdirSync as mkdirSync30 } from "node:fs";
+import { existsSync as existsSync51, readFileSync as readFileSync34, writeFileSync as writeFileSync28, mkdirSync as mkdirSync30 } from "node:fs";
 import { join as join50, dirname as dirname8 } from "node:path";
 var CONFIG_PATH = ".avorelo/config.json";
 var DEFAULTS = {
@@ -13959,7 +14639,7 @@ var DEFAULTS = {
 };
 function readConfig(dir) {
   const p = join50(dir, CONFIG_PATH);
-  if (!existsSync50(p)) return {};
+  if (!existsSync51(p)) return {};
   try {
     return JSON.parse(readFileSync34(p, "utf8"));
   } catch {
@@ -13990,9 +14670,9 @@ function optOut(dir) {
 
 // src/avorelo/capabilities/feedback/bundle.ts
 init_redaction();
-import { existsSync as existsSync51, readFileSync as readFileSync35, writeFileSync as writeFileSync29, mkdirSync as mkdirSync31, readdirSync as readdirSync15 } from "node:fs";
+import { existsSync as existsSync52, readFileSync as readFileSync35, writeFileSync as writeFileSync29, mkdirSync as mkdirSync31, readdirSync as readdirSync15 } from "node:fs";
 import { join as join51 } from "node:path";
-import { platform as platform2, release, arch } from "node:os";
+import { platform as platform3, release, arch } from "node:os";
 init_registry();
 init_session_store();
 function getVersion() {
@@ -14004,11 +14684,11 @@ function getVersion() {
   }
 }
 function detectPackageManager(dir) {
-  if (existsSync51(join51(dir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync51(join51(dir, "yarn.lock"))) return "yarn";
-  if (existsSync51(join51(dir, "bun.lockb"))) return "bun";
-  if (existsSync51(join51(dir, "package-lock.json"))) return "npm";
-  if (existsSync51(join51(dir, "package.json"))) return "npm";
+  if (existsSync52(join51(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync52(join51(dir, "yarn.lock"))) return "yarn";
+  if (existsSync52(join51(dir, "bun.lockb"))) return "bun";
+  if (existsSync52(join51(dir, "package-lock.json"))) return "npm";
+  if (existsSync52(join51(dir, "package.json"))) return "npm";
   return null;
 }
 function detectFramework(dir) {
@@ -14029,7 +14709,7 @@ function detectFramework(dir) {
 }
 function countReceipts(dir) {
   const receiptsDir = join51(dir, ".avorelo", "receipts");
-  if (!existsSync51(receiptsDir)) return { total: 0, done: 0, blocked: 0, inProgress: 0 };
+  if (!existsSync52(receiptsDir)) return { total: 0, done: 0, blocked: 0, inProgress: 0 };
   let done = 0, blocked = 0, inProgress = 0;
   try {
     for (const f of readdirSync15(receiptsDir).filter((f2) => f2.endsWith(".json"))) {
@@ -14056,7 +14736,7 @@ function prepareFeedbackBundle(dir) {
     bundleId: `fb_${Date.now().toString(36)}`,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     avorelo: { version: getVersion() },
-    platform: { os: platform2(), release: release(), arch: arch(), nodeVersion: process.version },
+    platform: { os: platform3(), release: release(), arch: arch(), nodeVersion: process.version },
     workspace: {
       packageManager: detectPackageManager(dir),
       framework: detectFramework(dir),
@@ -14294,11 +14974,11 @@ function result(classification, risk, reasonCodes, humanGateConditions) {
 import { randomUUID as randomUUID6 } from "node:crypto";
 
 // src/avorelo/capabilities/loop-control/check-detection.ts
-import { readFileSync as readFileSync36, existsSync as existsSync52 } from "node:fs";
+import { readFileSync as readFileSync36, existsSync as existsSync53 } from "node:fs";
 import { join as join52 } from "node:path";
 function detectFromPackageJson(cwd) {
   const pkgPath = join52(cwd, "package.json");
-  if (!existsSync52(pkgPath)) return [];
+  if (!existsSync53(pkgPath)) return [];
   try {
     const pkg = JSON.parse(readFileSync36(pkgPath, "utf8"));
     const scripts = pkg.scripts ?? {};
@@ -14321,19 +15001,19 @@ function detectFromPackageJson(cwd) {
   }
 }
 function detectFromPython(cwd) {
-  if (existsSync52(join52(cwd, "pytest.ini")) || existsSync52(join52(cwd, "pyproject.toml")) || existsSync52(join52(cwd, "setup.py"))) {
+  if (existsSync53(join52(cwd, "pytest.ini")) || existsSync53(join52(cwd, "pyproject.toml")) || existsSync53(join52(cwd, "setup.py"))) {
     return [{ checkId: "chk_pytest", label: "pytest", command: "python -m pytest", source: "python" }];
   }
   return [];
 }
 function detectFromGo(cwd) {
-  if (existsSync52(join52(cwd, "go.mod"))) {
+  if (existsSync53(join52(cwd, "go.mod"))) {
     return [{ checkId: "chk_go_test", label: "go test", command: "go test ./...", source: "go.mod" }];
   }
   return [];
 }
 function detectFromRust(cwd) {
-  if (existsSync52(join52(cwd, "Cargo.toml"))) {
+  if (existsSync53(join52(cwd, "Cargo.toml"))) {
     return [{ checkId: "chk_cargo_test", label: "cargo test", command: "cargo test", source: "Cargo.toml" }];
   }
   return [];
@@ -14573,7 +15253,7 @@ function detectIterationDrift(input) {
 }
 
 // src/avorelo/capabilities/loop-control/checks-runner.ts
-import { execSync as execSync3 } from "node:child_process";
+import { execSync as execSync4 } from "node:child_process";
 var CHECK_TIMEOUT_MS = 12e4;
 var MAX_OUTPUT_LENGTH = 200;
 function truncateOutput(s) {
@@ -14589,7 +15269,7 @@ function runCheck(check, cwd) {
     return { ...check, lastResult: "skipped", lastOutput: "no command configured" };
   }
   try {
-    execSync3(check.command, {
+    execSync4(check.command, {
       cwd,
       timeout: CHECK_TIMEOUT_MS,
       stdio: ["pipe", "pipe", "pipe"],
@@ -14606,10 +15286,10 @@ function runAllChecks(checks, cwd) {
 }
 
 // src/avorelo/capabilities/loop-control/git-observer.ts
-import { execSync as execSync4 } from "node:child_process";
+import { execSync as execSync5 } from "node:child_process";
 function getChangedFiles(cwd, since) {
   try {
-    const output = execSync4(`git diff --name-only ${since}`, {
+    const output = execSync5(`git diff --name-only ${since}`, {
       cwd,
       encoding: "utf-8",
       timeout: 1e4,
@@ -14622,7 +15302,7 @@ function getChangedFiles(cwd, since) {
 }
 function getCurrentHead(cwd) {
   try {
-    return execSync4("git rev-parse HEAD", { cwd, encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
+    return execSync5("git rev-parse HEAD", { cwd, encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return null;
   }
@@ -14630,7 +15310,7 @@ function getCurrentHead(cwd) {
 
 // src/avorelo/capabilities/loop-control/loop-metadata.ts
 init_redaction();
-import { mkdirSync as mkdirSync32, writeFileSync as writeFileSync30, readFileSync as readFileSync37, existsSync as existsSync53, readdirSync as readdirSync16 } from "node:fs";
+import { mkdirSync as mkdirSync32, writeFileSync as writeFileSync30, readFileSync as readFileSync37, existsSync as existsSync54, readdirSync as readdirSync16 } from "node:fs";
 import { join as join53 } from "node:path";
 function classifyFile(file, allowed, disallowed) {
   for (const d of disallowed) {
@@ -14718,7 +15398,7 @@ function persistLoopMetadata(dir, metadata) {
 }
 function readLoopMetadata(dir, loopId) {
   const path = join53(loopDir(dir), `${loopId}.json`);
-  if (!existsSync53(path)) return null;
+  if (!existsSync54(path)) return null;
   try {
     const data = JSON.parse(readFileSync37(path, "utf8"));
     return data && data.contract === "avorelo.loopMetadata.v1" ? data : null;
@@ -14728,7 +15408,7 @@ function readLoopMetadata(dir, loopId) {
 }
 function readLatestLoopMetadata(dir) {
   const d = loopDir(dir);
-  if (!existsSync53(d)) return null;
+  if (!existsSync54(d)) return null;
   try {
     const files = readdirSync16(d).filter((f) => f.startsWith("loop_") && f.endsWith(".json"));
     if (files.length === 0) return null;
@@ -14751,7 +15431,7 @@ function readLatestLoopMetadata(dir) {
 }
 function readActiveLoop(dir) {
   const path = join53(loopDir(dir), "active.json");
-  if (!existsSync53(path)) return null;
+  if (!existsSync54(path)) return null;
   try {
     return JSON.parse(readFileSync37(path, "utf8"));
   } catch {
@@ -14765,7 +15445,7 @@ function writeActiveLoop(dir, loopId, status) {
 }
 function clearActiveLoop(dir) {
   const path = join53(loopDir(dir), "active.json");
-  if (existsSync53(path)) {
+  if (existsSync54(path)) {
     writeFileSync30(path, JSON.stringify({ loopId: null, status: "none" }));
   }
 }
@@ -15006,7 +15686,7 @@ async function runLoop(input) {
 }
 
 // src/avorelo/adapters/claude-code/loop-adapter.ts
-import { execSync as execSync5 } from "node:child_process";
+import { execSync as execSync6 } from "node:child_process";
 var MAX_LOG_LENGTH = 200;
 var ITERATION_TIMEOUT_MS = 3e5;
 function truncate(s) {
@@ -15036,7 +15716,7 @@ function buildPrompt2(input) {
 }
 function detectPermissionFlag() {
   try {
-    const help2 = execSync5("claude --help", { timeout: 5e3, stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8" });
+    const help2 = execSync6("claude --help", { timeout: 5e3, stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8" });
     if (help2.includes("--permission-mode")) return "--permission-mode bypassPermissions";
   } catch {
   }
@@ -15065,7 +15745,7 @@ var claudeCodeLoopAdapter = {
     const prompt = buildPrompt2(input);
     if (!_cachedPermFlag) _cachedPermFlag = detectPermissionFlag();
     try {
-      execSync5(
+      execSync6(
         `claude --print ${_cachedPermFlag} "${prompt.replace(/"/g, '\\"')}"`,
         {
           cwd: input.cwd,
@@ -15100,7 +15780,7 @@ var claudeCodeLoopAdapter = {
   },
   isAvailable() {
     try {
-      execSync5("claude --version", { timeout: 5e3, stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8" });
+      execSync6("claude --version", { timeout: 5e3, stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8" });
       return true;
     } catch {
       return false;
@@ -15109,7 +15789,7 @@ var claudeCodeLoopAdapter = {
 };
 
 // src/avorelo/capabilities/settings/index.ts
-import { existsSync as existsSync54, readFileSync as readFileSync38, writeFileSync as writeFileSync31, mkdirSync as mkdirSync33 } from "node:fs";
+import { existsSync as existsSync55, readFileSync as readFileSync38, writeFileSync as writeFileSync31, mkdirSync as mkdirSync33 } from "node:fs";
 import { join as join54, dirname as dirname9 } from "node:path";
 var SETTINGS_CONTRACT = "avorelo.settings.v1";
 var SETTINGS_PATH = ".avorelo/settings.json";
@@ -15176,7 +15856,7 @@ function buildDefaultSettings(opts) {
 }
 function loadSettings(dir) {
   const p = join54(dir, SETTINGS_PATH);
-  if (!existsSync54(p)) return null;
+  if (!existsSync55(p)) return null;
   try {
     const s = JSON.parse(readFileSync38(p, "utf8"));
     return s.contract === SETTINGS_CONTRACT ? s : null;
@@ -15283,7 +15963,7 @@ var ALPHA_NOTICE = [
 ].join("\n");
 
 // src/avorelo/capabilities/update-channel/index.ts
-import { existsSync as existsSync55, readFileSync as readFileSync39, writeFileSync as writeFileSync32, mkdirSync as mkdirSync34 } from "node:fs";
+import { existsSync as existsSync56, readFileSync as readFileSync39, writeFileSync as writeFileSync32, mkdirSync as mkdirSync34 } from "node:fs";
 import { join as join55, dirname as dirname10 } from "node:path";
 var UPDATE_CHANNEL_CONTRACT = "avorelo.updateChannel.v1";
 var UPDATE_MANIFEST_CONTRACT = "avorelo.updateManifest.v1";
@@ -15298,10 +15978,10 @@ function getCurrentVersion4() {
 }
 function detectInstallMethod(root) {
   const r2 = root ?? join55(dirname10(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "../../../..");
-  if (existsSync55(join55(r2, ".git"))) return "source-checkout";
+  if (existsSync56(join55(r2, ".git"))) return "source-checkout";
   try {
     const p = join55(r2, "package.json");
-    if (existsSync55(p)) {
+    if (existsSync56(p)) {
       const pkg = JSON.parse(readFileSync39(p, "utf8"));
       if (pkg._resolved) return "npm-global";
       if (pkg._where) return "npm-local";
@@ -15312,7 +15992,7 @@ function detectInstallMethod(root) {
 }
 function loadManifest(dir) {
   const p = join55(dir, ".avorelo", "update-manifest.json");
-  if (!existsSync55(p)) return null;
+  if (!existsSync56(p)) return null;
   try {
     const m = JSON.parse(readFileSync39(p, "utf8"));
     return m.contract === UPDATE_MANIFEST_CONTRACT ? m : null;
@@ -15454,7 +16134,7 @@ function renderUpdateApply(r2) {
 }
 
 // src/avorelo/capabilities/dogfood-learning/index.ts
-import { existsSync as existsSync56, readFileSync as readFileSync40, writeFileSync as writeFileSync33, mkdirSync as mkdirSync35, readdirSync as readdirSync17, unlinkSync as unlinkSync3 } from "node:fs";
+import { existsSync as existsSync57, readFileSync as readFileSync40, writeFileSync as writeFileSync33, mkdirSync as mkdirSync35, readdirSync as readdirSync17, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join56, dirname as dirname11 } from "node:path";
 import { randomUUID as randomUUID8 } from "node:crypto";
 var DOGFOOD_LEARNING_CONTRACT = "avorelo.dogfoodLearning.v1";
@@ -15651,7 +16331,7 @@ function ensureQueueDir(dir) {
 }
 function countQueuedEvents(dir) {
   const qd = queueDir(dir);
-  if (!existsSync56(qd)) return 0;
+  if (!existsSync57(qd)) return 0;
   try {
     return readdirSync17(qd).filter((f) => f.endsWith(".json")).length;
   } catch {
@@ -15669,7 +16349,7 @@ function queueEvent(dir, payload) {
 }
 function loadQueuedEvents(dir) {
   const qd = queueDir(dir);
-  if (!existsSync56(qd)) return [];
+  if (!existsSync57(qd)) return [];
   const files = readdirSync17(qd).filter((f) => f.endsWith(".json")).sort();
   const events = [];
   for (const f of files) {
@@ -15683,7 +16363,7 @@ function loadQueuedEvents(dir) {
 }
 function purgeQueue(dir) {
   const qd = queueDir(dir);
-  if (!existsSync56(qd)) return { purged: 0 };
+  if (!existsSync57(qd)) return { purged: 0 };
   const files = readdirSync17(qd).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
@@ -15878,7 +16558,7 @@ function generateLocalFingerprint(target) {
 var CLAIM_EXPIRY_MS = 24 * 60 * 60 * 1e3;
 
 // src/avorelo/capabilities/cloud-sync/cli-auth-state.ts
-import { existsSync as existsSync57, readFileSync as readFileSync41, writeFileSync as writeFileSync34, mkdirSync as mkdirSync36 } from "node:fs";
+import { existsSync as existsSync58, readFileSync as readFileSync41, writeFileSync as writeFileSync34, mkdirSync as mkdirSync36 } from "node:fs";
 import { join as join57 } from "node:path";
 function authDir(baseDir) {
   return join57(baseDir, ".avorelo", "auth");
@@ -15895,7 +16575,7 @@ function writeCliAuthState(baseDir, state) {
 }
 function readCliAuthState(baseDir) {
   const path = authPath(baseDir);
-  if (!existsSync57(path)) return null;
+  if (!existsSync58(path)) return null;
   try {
     const raw = JSON.parse(readFileSync41(path, "utf8"));
     if (!raw || typeof raw.token !== "string" || typeof raw.workspaceId !== "string") return null;
@@ -15911,7 +16591,7 @@ function buildAuthHeaders(authState) {
 }
 
 // src/avorelo/capabilities/cloud-sync/claim-state.ts
-import { existsSync as existsSync58, readFileSync as readFileSync42, writeFileSync as writeFileSync35, mkdirSync as mkdirSync37 } from "node:fs";
+import { existsSync as existsSync59, readFileSync as readFileSync42, writeFileSync as writeFileSync35, mkdirSync as mkdirSync37 } from "node:fs";
 import { join as join58 } from "node:path";
 function claimDir(baseDir) {
   return join58(baseDir, ".avorelo", "claim");
@@ -15928,7 +16608,7 @@ function writeClaimState(baseDir, state) {
 }
 function readClaimState(baseDir) {
   const path = claimPath(baseDir);
-  if (!existsSync58(path)) return null;
+  if (!existsSync59(path)) return null;
   try {
     const raw = JSON.parse(readFileSync42(path, "utf8"));
     if (!raw || typeof raw.workspaceId !== "string" || typeof raw.claimedAt !== "string") return null;
@@ -15951,6 +16631,9 @@ var RUNTIME_ACTIONS = [
   { action: "cli.status", capabilityKey: "session_value_visible", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Show activation status", freeFallbackExists: true },
   { action: "cli.open", capabilityKey: "session_value_visible", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Local receipts dashboard", freeFallbackExists: true },
   { action: "cli.control_center", capabilityKey: "session_value_visible", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Local Control Center", freeFallbackExists: true },
+  { action: "cli.controls", capabilityKey: "session_value_visible", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Inspect built-in Work Controls", freeFallbackExists: true },
+  { action: "cli.receipt", capabilityKey: "session_proof_summary", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Inspect latest local receipt", freeFallbackExists: true },
+  { action: "cli.proof", capabilityKey: "session_proof_summary", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Validate latest proof status", freeFallbackExists: true },
   { action: "cli.doctor", capabilityKey: "scope_safety_check_basic", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Health check", freeFallbackExists: true },
   { action: "cli.verify", capabilityKey: "session_proof_summary", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Validate activation state", freeFallbackExists: true },
   { action: "cli.billing", capabilityKey: "session_value_visible", minimumTier: "free", surface: "cli", fallback: "allow", reason: "Billing readiness (read-only)", freeFallbackExists: true },
@@ -15989,6 +16672,9 @@ var FREE_COMMANDS = /* @__PURE__ */ new Set([
   "status",
   "open",
   "control-center",
+  "controls",
+  "receipt",
+  "proof",
   "doctor",
   "verify",
   "billing",
@@ -16070,7 +16756,7 @@ function formatCliGateMessage(gateResult) {
 }
 
 // src/avorelo/telemetry/local-store.ts
-import { appendFileSync as appendFileSync10, existsSync as existsSync59, mkdirSync as mkdirSync38, readFileSync as readFileSync44, writeFileSync as writeFileSync36 } from "node:fs";
+import { appendFileSync as appendFileSync10, existsSync as existsSync60, mkdirSync as mkdirSync38, readFileSync as readFileSync44, writeFileSync as writeFileSync36 } from "node:fs";
 import { dirname as dirname13 } from "node:path";
 
 // src/avorelo/telemetry/config.ts
@@ -16084,7 +16770,7 @@ var TELEMETRY_STATE_FILE = "telemetry-state.json";
 var TELEMETRY_BATCH_SIZE = 100;
 var TELEMETRY_PERIOD_MS = 6 * 60 * 60 * 1e3;
 var TELEMETRY_OPPORTUNISTIC_MS = 24 * 60 * 60 * 1e3;
-var TELEMETRY_TIMEOUT_MS = 750;
+var TELEMETRY_TIMEOUT_MS = 2e3;
 function getPackageVersion() {
   for (const rel of ["../../../package.json", "../../../../package.json", "../../../../../package.json"]) {
     try {
@@ -16392,7 +17078,7 @@ function safeParseJson(text) {
   }
 }
 function readJsonl(path) {
-  if (!existsSync59(path)) return [];
+  if (!existsSync60(path)) return [];
   const lines = readFileSync44(path, "utf8").split(/\r?\n/);
   const values = [];
   for (const line of lines) {
@@ -16415,7 +17101,7 @@ function writeJsonl(path, values) {
 }
 function ensureTelemetryState(dir, now = Date.now()) {
   const paths = getTelemetryConfig(dir, buildTelemetryState(now));
-  if (existsSync59(paths.statePath)) {
+  if (existsSync60(paths.statePath)) {
     const parsed = safeParseJson(readFileSync44(paths.statePath, "utf8"));
     if (parsed?.contract === "avorelo.telemetry.state.v1") return parsed;
   }
@@ -16903,11 +17589,11 @@ function renderTelemetryPreview(preview) {
 }
 
 // src/avorelo/telemetry/integration-detection.ts
-import { existsSync as existsSync60, readFileSync as readFileSync45 } from "node:fs";
+import { existsSync as existsSync61, readFileSync as readFileSync45 } from "node:fs";
 import { join as join60 } from "node:path";
 function detectGitProviderFromConfig(dir) {
   const configPath = join60(dir, ".git", "config");
-  if (!existsSync60(configPath)) return "unknown";
+  if (!existsSync61(configPath)) return "unknown";
   try {
     const content = readFileSync45(configPath, "utf8").toLowerCase();
     if (content.includes("github.com")) return "github";
@@ -16919,15 +17605,15 @@ function detectGitProviderFromConfig(dir) {
   }
 }
 function detectCiProvider(dir) {
-  if (existsSync60(join60(dir, ".github", "workflows"))) return "github_actions";
-  if (existsSync60(join60(dir, ".gitlab-ci.yml"))) return "gitlab_ci";
-  if (existsSync60(join60(dir, ".circleci", "config.yml"))) return "circle";
-  if (existsSync60(join60(dir, "Jenkinsfile"))) return "jenkins";
+  if (existsSync61(join60(dir, ".github", "workflows"))) return "github_actions";
+  if (existsSync61(join60(dir, ".gitlab-ci.yml"))) return "gitlab_ci";
+  if (existsSync61(join60(dir, ".circleci", "config.yml"))) return "circle";
+  if (existsSync61(join60(dir, "Jenkinsfile"))) return "jenkins";
   return "unknown";
 }
 function detectRepoVisibility(dir) {
   const configPath = join60(dir, ".git", "config");
-  if (!existsSync60(configPath)) return "unknown";
+  if (!existsSync61(configPath)) return "unknown";
   try {
     const content = readFileSync45(configPath, "utf8").toLowerCase();
     if (content.includes("github.com")) {
@@ -17104,6 +17790,10 @@ function help() {
     "  status [--target <dir>]                                           Show activation and session status",
     "  open [--target <dir>] [--format html|json|text]                   Local receipts dashboard",
     "  control-center [--target <dir>] [--format html|json|text]         Local Control Center (read-only, all local state)",
+    "  controls list [--json]                                            List built-in Work Controls",
+    "  controls explain <control> [--json]                               Explain one built-in Work Control",
+    "  receipt latest [--target <dir>] [--json]                          Show the latest local receipt",
+    "  proof check [--target <dir>] [--json]                             Validate the latest proof status",
     "  doctor [--target <dir>]                                           Health check (adapters, hooks, session)",
     "  verify [--target <dir>]                                           Validate activation state invariants",
     "  uninstall [--target <dir>]                                        Remove all Avorelo-managed content",
@@ -17175,10 +17865,12 @@ function cmdRun(args) {
   process.stdout.write(JSON.stringify({ fixture: name, decision: gate.decision, confidence: gate.confidence, reasonCodes: gate.reasonCodes, receipt }, null, 2) + "\n");
   return gate.decision === "STOP_DONE" ? 0 : 1;
 }
-function cmdActivate(args) {
+async function cmdActivate(args) {
   const target = arg(args, "--target", process.cwd());
   const installHooksFlag = args.includes("--install-hooks");
   const approve = args.includes("--approve");
+  const claimToken = arg(args, "--claim");
+  const scope = arg(args, "--scope") ?? "project-wide";
   if (installHooksFlag) {
     if (!approve) {
       process.stderr.write("Hook installation requires explicit approval. Add --approve to confirm.\n");
@@ -17199,6 +17891,18 @@ function cmdActivate(args) {
       return 2;
     }
   }
+  const preflight = runPreflight(target);
+  if (!preflight.canStart) {
+    process.stderr.write(formatPreflightReport(preflight));
+    process.stderr.write(`
+Activation taxonomy: ${preflight.taxonomy}
+`);
+    return 2;
+  }
+  if (!preflight.ok) {
+    process.stderr.write(formatPreflightReport(preflight));
+    process.stderr.write("Continuing with activation despite warnings...\n\n");
+  }
   const state = runFullActivation(target);
   const contract = createWorkContract({ contractId: "canonical-activate", objective: "full local-first activation", allowedPaths: [join61(target, ".avorelo")], planTier: "Free" });
   const ledger = new StateLedger();
@@ -17218,12 +17922,15 @@ function cmdActivate(args) {
   state.receipts.push({ id: receipt.receiptId, path: join61(target, ".avorelo", "receipts", `${receipt.receiptId}.json`), type: "canonical_activation" });
   persistActivationV2(target, state);
   persistReceipt(target, receipt);
+  const detection = runFullDetection(target);
+  const fingerprint = generateLocalFingerprint(target);
   const fv = state.firstValue;
   const lines = [
     "",
     "Avorelo activated.",
     "",
     `  Mode:       ${state.activationMode}`,
+    `  Scope:      ${scope}`,
     `  Status:     ${state.activationStatus}`,
     `  State:      ${join61(target, ACTIVATION_STATE_DIR, ACTIVATION_STATE_FILE)}`
   ];
@@ -17232,6 +17939,10 @@ function cmdActivate(args) {
     for (const f of fv.found.slice(0, 8)) lines.push(`    ${f}`);
     if (fv.found.length > 8) lines.push(`    ... and ${fv.found.length - 8} more`);
   }
+  if (detection.summary.toolsDetected.length > 0) {
+    lines.push("", "  Coding tools detected:");
+    for (const t of detection.summary.toolsDetected) lines.push(`    ${t}`);
+  }
   if (fv.fixed.length > 0) {
     lines.push("", "  Fixed:");
     for (const f of fv.fixed) lines.push(`    ${f}`);
@@ -17245,7 +17956,38 @@ function cmdActivate(args) {
     `  Run entry:  ${state.runEntry.installed ? "installed" : "not installed"}`,
     `  Billing:    ${state.billing.status}`,
     `  Auth:       ${state.auth.status}`,
-    `  Production: not ready`,
+    `  Production: not ready`
+  );
+  let linkResult = "no claim provided";
+  if (claimToken) {
+    const baseUrl = process.env.APP_BASE_URL ?? "https://app.avorelo.com";
+    try {
+      const resp = await fetch(`${baseUrl}/api/activation/link`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          token: claimToken,
+          fingerprint,
+          version: avoreloVersion(),
+          toolsDetected: detection.summary.toolsDetected,
+          osFamily: detection.environment.os,
+          nodeVersion: detection.environment.nodeVersion ?? null,
+          taxonomy: "ACTIVATION_SUCCEEDED_LOCALLY"
+        })
+      });
+      if (resp.ok) {
+        const data = await resp.json();
+        linkResult = data.linked ? "linked" : data.error ?? "unknown";
+      } else {
+        const err = await resp.json().catch(() => ({ error: resp.statusText }));
+        linkResult = `failed: ${err.error ?? resp.statusText}`;
+      }
+    } catch (e) {
+      linkResult = `error: ${e.message}`;
+    }
+    lines.push(`  Dashboard:  ${linkResult === "linked" ? "linked to account" : linkResult}`);
+  }
+  lines.push(
     "",
     `  Next: ${fv.nextAction}`,
     ""
@@ -17253,6 +17995,14 @@ function cmdActivate(args) {
   process.stdout.write(lines.join("\n"));
   return 0;
 }
+function cmdPreflight(args) {
+  const target = arg(args, "--target", process.cwd());
+  const result3 = runPreflight(target);
+  process.stdout.write(formatPreflightReport(result3));
+  process.stdout.write(`Taxonomy: ${result3.taxonomy}
+`);
+  return result3.canStart ? 0 : 2;
+}
 async function cmdDoctor(args) {
   const target = arg(args, "--target", process.cwd());
   const r2 = doctor(target);
@@ -17524,6 +18274,140 @@ function cmdControlCenter(args) {
   process.stdout.write(JSON.stringify({ ok: true, htmlPath, runtime: model.sections.runtimeSession.status, sources: model.sources.length }, null, 2) + "\n");
   return 0;
 }
+function cmdControls(args) {
+  const sub = args[0] && !args[0].startsWith("--") ? args[0] : "list";
+  const asJson = args.includes("--json");
+  if (sub === "list") {
+    const controls = listWorkControls();
+    if (asJson) {
+      process.stdout.write(JSON.stringify(controls, null, 2) + "\n");
+      return 0;
+    }
+    process.stdout.write([
+      "",
+      "Avorelo Work Controls",
+      ...controls.map((control) => `  ${control.controlId}: ${control.uiCopy} [${control.defaultState}]`),
+      ""
+    ].join("\n"));
+    return 0;
+  }
+  if (sub === "explain") {
+    const controlId = args.find((value, index) => index > 0 && !value.startsWith("--"));
+    if (!controlId) {
+      process.stderr.write("Usage: avorelo controls explain <control> [--json]\n");
+      return 2;
+    }
+    const control = getWorkControl(controlId);
+    if (!control) {
+      process.stderr.write(`Unknown Work Control: ${controlId}
+`);
+      return 1;
+    }
+    if (asJson) {
+      process.stdout.write(JSON.stringify(control, null, 2) + "\n");
+      return 0;
+    }
+    process.stdout.write([
+      "",
+      `${control.title} (${control.controlId})`,
+      `  Purpose:    ${control.purpose}`,
+      `  Points:     ${control.enforcementPoints.join(", ")}`,
+      `  Default:    ${control.defaultState}`,
+      `  Packaging:  Free=${control.packaging.free} Pro=${control.packaging.pro} Teams=${control.packaging.teams}`,
+      `  Local:      ${control.localOnlyBehavior}`,
+      `  Cloud:      ${control.cloudBehavior}`,
+      `  Persisted:  ${control.dataPersisted.join(", ")}`,
+      `  Tests:      ${control.testsRequired.join(", ")}`,
+      `  UI copy:    ${control.uiCopy}`,
+      ""
+    ].join("\n"));
+    return 0;
+  }
+  process.stderr.write("Usage: avorelo controls <list|explain> [<control>] [--json]\n");
+  return 2;
+}
+function latestReceiptFor(dir) {
+  return listReceipts(dir).sort((a, b) => {
+    const aw = typeof a.writtenAt === "number" ? a.writtenAt : -1;
+    const bw = typeof b.writtenAt === "number" ? b.writtenAt : -1;
+    if (aw !== bw) return bw - aw;
+    return b.receiptId.localeCompare(a.receiptId);
+  })[0] ?? null;
+}
+function cmdReceipt(args) {
+  const sub = args[0] && !args[0].startsWith("--") ? args[0] : "latest";
+  const target = arg(args, "--target", process.cwd());
+  const asJson = args.includes("--json");
+  if (sub !== "latest") {
+    process.stderr.write("Usage: avorelo receipt latest [--target <dir>] [--json]\n");
+    return 2;
+  }
+  const latest = latestReceiptFor(target);
+  if (!latest) {
+    if (asJson) {
+      process.stdout.write(JSON.stringify({ status: "none", message: "no receipts found" }, null, 2) + "\n");
+      return 0;
+    }
+    process.stdout.write("\nNo receipts found yet. Run a controlled session first.\n\n");
+    return 0;
+  }
+  const full = readReceipt(target, latest.receiptId) ?? latest;
+  if (asJson) {
+    process.stdout.write(JSON.stringify(full, null, 2) + "\n");
+    return 0;
+  }
+  process.stdout.write([
+    "",
+    `Latest receipt: ${full.receiptId}`,
+    `  Contract:    ${full.contractId}`,
+    `  Decision:    ${full.decision}`,
+    `  Evidence:    ${full.evidenceLevels.join(", ") || "none"}`,
+    `  Reasons:     ${full.decisionBasis.reasonCodes.join(", ") || "none"}`,
+    `  Next:        ${full.safeNextActions.join("; ") || "none"}`,
+    ""
+  ].join("\n"));
+  return 0;
+}
+function cmdProof(args) {
+  const sub = args[0] && !args[0].startsWith("--") ? args[0] : "check";
+  const target = arg(args, "--target", process.cwd());
+  const asJson = args.includes("--json");
+  if (sub !== "check") {
+    process.stderr.write("Usage: avorelo proof check [--target <dir>] [--json]\n");
+    return 2;
+  }
+  const report = loadLatestProofReport(target) ?? buildProofReportFromLocalEvidence(target);
+  const summary = summarizeProofReport(report);
+  const validation = validateProofReport(report);
+  const payload = {
+    reportId: report.reportId,
+    valid: validation.valid,
+    reasons: validation.reasons,
+    canShowCostSummary: summary.canShowCostSummary,
+    canShowSavings: summary.canShowSavings,
+    savingsRefusalReason: summary.savingsRefusalReason,
+    sections: summary.sections
+  };
+  if (asJson) {
+    process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+    return validation.valid ? 0 : 1;
+  }
+  process.stdout.write([
+    "",
+    `Proof check: ${report.reportId}`,
+    `  Valid:      ${validation.valid}`,
+    `  Found:      ${summary.sections.found}`,
+    `  Protected:  ${summary.sections.protected}`,
+    `  Verified:   ${summary.sections.verified}`,
+    `  Attention:  ${summary.sections.needsAttention}`,
+    `  Next:       ${summary.sections.next}`,
+    `  Cost:       ${summary.canShowCostSummary ? "available" : "unavailable"}`,
+    `  Savings:    ${summary.canShowSavings ? "shown" : "not claimed"}${summary.savingsRefusalReason ? ` (${summary.savingsRefusalReason})` : ""}`,
+    validation.reasons.length ? `  Issues:      ${validation.reasons.join(", ")}` : "  Issues:      none",
+    ""
+  ].join("\n"));
+  return validation.valid ? 0 : 1;
+}
 function cmdVerify(args) {
   const target = arg(args, "--target", process.cwd());
   const stateVerify = verifyActivationState(target);
@@ -17537,7 +18421,7 @@ function cmdVerify(args) {
   const input = loadProofInput(target);
   if (input) {
     const contract = createWorkContract({ contractId: "verify", objective: input.objective ?? "verify real-workflow proof", allowedPaths: [join61(target, "src")], planTier: "Free" });
-    const r2 = evaluateProof({ contract, artifacts: input.artifacts, readbacks: input.readbacks, dir: target, sampleSize: input.sampleSize, receiptId: "rcpt_verify" });
+    const r2 = evaluateProof2({ contract, artifacts: input.artifacts, readbacks: input.readbacks, dir: target, sampleSize: input.sampleSize, receiptId: "rcpt_verify" });
     process.stdout.write(JSON.stringify({ scope: "full", activationState: { valid: true }, proof: { decision: r2.decision, confidence: r2.confidence } }, null, 2) + "\n");
     return r2.decision === "STOP_DONE" ? 0 : 1;
   }
@@ -18039,7 +18923,7 @@ function cmdTokenCost(args) {
   }
   if (sub === "import" || sub === "validate") {
     const file = arg(args, "--file");
-    if (!file || !existsSync61(file)) {
+    if (!file || !existsSync62(file)) {
       process.stderr.write("Usage: avorelo token-cost " + sub + " --file <path> [--json]\n");
       return 2;
     }
@@ -18186,7 +19070,7 @@ function cmdContextCheck(args) {
   const ci = args.includes("--ci");
   const wcPath = arg(args, "--work-contract");
   let workContract;
-  if (wcPath && existsSync61(wcPath)) {
+  if (wcPath && existsSync62(wcPath)) {
     try {
       workContract = JSON.parse(readFileSync46(wcPath, "utf8"));
     } catch {
@@ -18251,7 +19135,7 @@ function cmdSecretBoundary(args) {
   const asJson = args.includes("--json");
   let content = arg(args, "--content");
   const file = arg(args, "--file");
-  if (file && existsSync61(file)) content = readFileSync46(file, "utf8");
+  if (file && existsSync62(file)) content = readFileSync46(file, "utf8");
   if (content === void 0) content = "";
   if (sub === "scan" || sub === void 0) {
     const r2 = scanContent({ content, sourceKind: file ? "file" : "tool_output" });
@@ -18318,7 +19202,7 @@ function cmdExplain(args) {
   const changedFiles = [];
   for (const { adapter } of detected) {
     const surface = adapter.getInstructionSurface(target);
-    if (surface && existsSync61(surface)) changedFiles.push(surface);
+    if (surface && existsSync62(surface)) changedFiles.push(surface);
   }
   if (changedFiles.length > 0) {
     lines.push("  Changed:");
@@ -18492,7 +19376,7 @@ function cmdFeedback(args) {
   }
   if (sub === "share") {
     const file = arg(args, "--file");
-    if (!file || !existsSync61(file)) {
+    if (!file || !existsSync62(file)) {
       process.stderr.write("Usage: avorelo feedback share --file <bundle-path>\n");
       return 2;
     }
@@ -18796,7 +19680,7 @@ No loop metadata found for ${loopId}.
   if (sub === "doctor") {
     const issues = [];
     const ok = [];
-    if (existsSync61(join61(target, ".git"))) {
+    if (existsSync62(join61(target, ".git"))) {
       ok.push("Git repository detected");
     } else {
       issues.push("Not a git repository \u2014 loop needs git for drift detection");
@@ -18856,7 +19740,7 @@ function cmdUninstallAll(args) {
   const preserved = adapterResult.preserved;
   const avoreloDir2 = join61(target, ".avorelo");
   try {
-    if (existsSync61(avoreloDir2)) {
+    if (existsSync62(avoreloDir2)) {
       rmSync3(avoreloDir2, { recursive: true, force: true });
       removed.push(avoreloDir2);
     }
@@ -19505,6 +20389,8 @@ function main(argv) {
       return cmdSupport(rest);
     case "activate":
       return cmdActivate(rest);
+    case "preflight":
+      return cmdPreflight(rest);
     case "doctor":
       return cmdDoctor(rest);
     case "uninstall":
@@ -19523,6 +20409,12 @@ function main(argv) {
       return cmdOpen(rest);
     case "control-center":
       return cmdControlCenter(rest);
+    case "controls":
+      return cmdControls(rest);
+    case "receipt":
+      return cmdReceipt(rest);
+    case "proof":
+      return cmdProof(rest);
     case "verify":
       return cmdVerify(rest);
     case "site":
@@ -19722,14 +20614,21 @@ async function finalize(exitCode) {
     recordCliTelemetry(exitCode);
   } catch {
   }
-  sendDueTelemetry(CLI_TELEMETRY_SNAPSHOT.target).catch(() => {
-  });
   if (_cmd && LEARNING_COMMANDS.has(_cmd)) {
     try {
       emitLearningEvent(process.cwd(), { commandName: _cmd, commandStatus: exitCode === 0 ? "ok" : "error", eventType: "command" });
     } catch {
     }
   }
+  try {
+    const telemetryDone = sendDueTelemetry(CLI_TELEMETRY_SNAPSHOT.target).catch(() => {
+    });
+    await Promise.race([telemetryDone, new Promise((r2) => {
+      const t = setTimeout(r2, 2e3);
+      if (typeof t.unref === "function") t.unref();
+    })]);
+  } catch {
+  }
   if (_cmd !== "serve" && _cmd !== "webhook" && _cmd !== "sync") {
     setTimeout(() => process.exit(exitCode), 50).unref();
   }