cleargate 0.11.5 → 0.13.0

package/dist/cli.cjs

@@ -423,11 +423,11 @@ function defaultDiskCachePath(env = process.env) {
   if (typeof override === "string" && override.length > 0) return override;
   const home = os9.homedir();
   if (!home) return null;
-  return path45.join(home, ".cleargate", "access-token.json");
+  return path46.join(home, ".cleargate", "access-token.json");
 }
 function readDiskCache(filePath) {
   try {
-    const raw = fs42.readFileSync(filePath, "utf8");
+    const raw = fs43.readFileSync(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && parsed.version === 1 && typeof parsed.entries === "object" && parsed.entries !== null) {
       return parsed;
@@ -437,18 +437,18 @@ function readDiskCache(filePath) {
   return { version: 1, entries: {} };
 }
 function writeDiskCache(filePath, data) {
-  const dir = path45.dirname(filePath);
+  const dir = path46.dirname(filePath);
   try {
-    fs42.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs43.mkdirSync(dir, { recursive: true, mode: 448 });
     try {
-      fs42.chmodSync(dir, 448);
+      fs43.chmodSync(dir, 448);
     } catch {
     }
-    const tmpPath = path45.join(dir, ".access-token.json.tmp");
-    fs42.writeFileSync(tmpPath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
-    fs42.chmodSync(tmpPath, 384);
-    fs42.renameSync(tmpPath, filePath);
-    fs42.chmodSync(filePath, 384);
+    const tmpPath = path46.join(dir, ".access-token.json.tmp");
+    fs43.writeFileSync(tmpPath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+    fs43.chmodSync(tmpPath, 384);
+    fs43.renameSync(tmpPath, filePath);
+    fs43.chmodSync(filePath, 384);
   } catch {
   }
 }
@@ -544,14 +544,14 @@ async function acquireAccessToken(opts) {
   }
   return accessToken;
 }
-var fs42, os9, path45, CACHE, AcquireError;
+var fs43, os9, path46, CACHE, AcquireError;
 var init_acquire = __esm({
   "src/auth/acquire.ts"() {
     "use strict";
     init_cjs_shims();
-    fs42 = __toESM(require("fs"), 1);
+    fs43 = __toESM(require("fs"), 1);
     os9 = __toESM(require("os"), 1);
-    path45 = __toESM(require("path"), 1);
+    path46 = __toESM(require("path"), 1);
     init_factory();
     CACHE = /* @__PURE__ */ new Map();
     AcquireError = class extends Error {
@@ -783,7 +783,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "cleargate",
-  version: "0.11.5",
+  version: "0.13.0",
   private: false,
   type: "module",
   description: "Planning framework for Claude Code agents \u2014 sprint/epic/story protocol, five-role agent team (architect/developer/qa/devops/reporter), Karpathy-style awareness wiki.",
@@ -830,12 +830,11 @@ var package_default = {
     build: "tsup",
     dev: "tsup --watch",
     typecheck: "tsc --noEmit",
-    test: "tsx --test --test-reporter=spec 'test/**/*.node.test.ts'",
-    "test:file": "tsx --test --test-reporter=spec",
-    "test:vitest": "npm run build && vitest run",
-    "test:vitest:watch": "vitest",
-    "test:node": "tsx --test --test-reporter=spec 'test/**/*.node.test.ts'",
-    "test:node:file": "tsx --test --test-reporter=spec"
+    test: "tsx --test --test-concurrency=1 --experimental-test-module-mocks --test-reporter=spec 'test/**/*.node.test.ts' '!test/fixtures/**'",
+    "test:file": "tsx --test --test-concurrency=1 --experimental-test-module-mocks --test-reporter=spec",
+    "test:node": "tsx --test --test-concurrency=1 --experimental-test-module-mocks --test-reporter=spec 'test/**/*.node.test.ts' '!test/fixtures/**'",
+    "test:node:file": "tsx --test --test-concurrency=1 --experimental-test-module-mocks --test-reporter=spec",
+    "check:no-vitest": `node -e "const r=require('child_process').execSync('grep -rE \\"\\\\b(vitest|vi\\\\.fn|vi\\\\.mock|vi\\\\.spyOn|vi\\\\.stubGlobal|vi\\\\.useFakeTimers|vi\\\\.useRealTimers|vi\\\\.advanceTimersByTime|vi\\\\.hoisted)\\\\b\\" --include=\\"*.ts\\" --include=\\"*.js\\" --include=\\"*.mjs\\" --exclude-dir=test/fixtures . 2>/dev/null || true', {encoding:'utf8'}); if(r.trim()){console.error('vitest residue detected:\\\\n'+r); process.exit(1)} console.log('no vitest residue')"`
   },
   dependencies: {
     "@napi-rs/keyring": "^1.2.0",
@@ -850,10 +849,10 @@ var package_default = {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^24.0.0",
     "@types/pg": "^8.11.10",
+    "ts-morph": "28.0.0",
     tsup: "^8",
     tsx: "^4.21.0",
-    typescript: "^5.8.0",
-    vitest: "^2.1.0"
+    typescript: "^5.8.0"
   }
 };
 
@@ -2304,6 +2303,24 @@ var PREFIX_MAP = [
   { prefix: "BUG-", type: "bug", bucket: "bugs" },
   { prefix: "INITIATIVE-", type: "initiative", bucket: "initiatives" }
 ];
+var SPRINT_REPORT_FILENAMES = ["REPORT.md"];
+var SPRINT_REPORT_CANONICAL_RE = /^SPRINT-\d{2,}_REPORT\.md$/;
+function isSprintReportPath(relPath) {
+  const normalised = relPath.replace(/\\/g, "/");
+  const match = /\.cleargate\/sprint-runs\/(SPRINT-\d{2,})\/([^/]+)$/.exec(normalised);
+  if (!match) return false;
+  const filename = match[2];
+  return SPRINT_REPORT_FILENAMES.includes(filename) || SPRINT_REPORT_CANONICAL_RE.test(filename);
+}
+function deriveBucketFromReportPath(relPath) {
+  const normalised = relPath.replace(/\\/g, "/");
+  const match = /\.cleargate\/sprint-runs\/(SPRINT-\d{2,})\//.exec(normalised);
+  if (!match) {
+    throw new Error(`deriveBucketFromReportPath: cannot extract SPRINT-NN from: ${relPath}`);
+  }
+  const id = match[1];
+  return { type: "sprint", id, bucket: "sprints" };
+}
 function deriveBucket(filename) {
   const base = filename.includes("/") ? filename.split("/").pop() : filename;
   const stem = base.endsWith(".md") ? base.slice(0, -3) : base;
@@ -2427,6 +2444,12 @@ function serializePage(page, body) {
   if (page.sprint_cleargate_id !== void 0) {
     lines.push(`sprint_cleargate_id: "${page.sprint_cleargate_id}"`);
   }
+  if (page.report_raw_path !== void 0) {
+    lines.push(`report_raw_path: "${page.report_raw_path}"`);
+  }
+  if (page.last_report_ingest_commit !== void 0) {
+    lines.push(`last_report_ingest_commit: "${page.last_report_ingest_commit}"`);
+  }
   lines.push("---");
   const fm = lines.join("\n");
   return `${fm}
@@ -2449,7 +2472,9 @@ function parsePage(raw) {
   const last_contradict_sha = fm["last_contradict_sha"] !== void 0 ? String(fm["last_contradict_sha"]) : void 0;
   const parent_cleargate_id = fm["parent_cleargate_id"] !== void 0 ? String(fm["parent_cleargate_id"]) : void 0;
   const sprint_cleargate_id = fm["sprint_cleargate_id"] !== void 0 ? String(fm["sprint_cleargate_id"]) : void 0;
-  return { type, id, parent, children, status, remote_id, raw_path, last_ingest, last_ingest_commit, repo, last_contradict_sha, parent_cleargate_id, sprint_cleargate_id };
+  const report_raw_path = fm["report_raw_path"] !== void 0 ? String(fm["report_raw_path"]) : void 0;
+  const last_report_ingest_commit = fm["last_report_ingest_commit"] !== void 0 ? String(fm["last_report_ingest_commit"]) : void 0;
+  return { type, id, parent, children, status, remote_id, raw_path, last_ingest, last_ingest_commit, repo, last_contradict_sha, parent_cleargate_id, sprint_cleargate_id, report_raw_path, last_report_ingest_commit };
 }
 function parseFmRaw(raw) {
   const lines = raw.split("\n");
@@ -3981,28 +4006,33 @@ async function wikiIngestHandler(opts) {
   const rawPath = opts.rawPath;
   const absRawPath = path20.isAbsolute(rawPath) ? rawPath : path20.resolve(cwd, rawPath);
   const relRawPath = path20.relative(cwd, absRawPath).replace(/\\/g, "/");
-  const deliveryRoot = path20.join(cwd, ".cleargate", "delivery");
-  const deliveryRootNorm = deliveryRoot.replace(/\\/g, "/");
-  const absDeliveryRoot = deliveryRoot;
-  const relToDelivery = path20.relative(absDeliveryRoot, absRawPath);
-  if (relToDelivery.startsWith("..") || path20.isAbsolute(relToDelivery)) {
-    stderr(`wiki ingest: ${rawPath} not under .cleargate/delivery/
+  const isSprintReport = isSprintReportPath(relRawPath);
+  if (!isSprintReport) {
+    const deliveryRoot = path20.join(cwd, ".cleargate", "delivery");
+    const absDeliveryRoot = deliveryRoot;
+    const relToDelivery = path20.relative(absDeliveryRoot, absRawPath);
+    if (relToDelivery.startsWith("..") || path20.isAbsolute(relToDelivery)) {
+      stderr(`wiki ingest: ${rawPath} not under .cleargate/delivery/
 `);
-    exit(2);
-    return;
-  }
-  void deliveryRootNorm;
-  const isExcluded = EXCLUDED_SUFFIXES2.some((excl) => relRawPath.startsWith(excl));
-  if (isExcluded) {
-    stdout(`wiki ingest: ${rawPath} excluded (skip)
+      exit(2);
+      return;
+    }
+    const isExcluded = EXCLUDED_SUFFIXES2.some((excl) => relRawPath.startsWith(excl));
+    if (isExcluded) {
+      stdout(`wiki ingest: ${rawPath} excluded (skip)
 `);
-    exit(0);
-    return;
+      exit(0);
+      return;
+    }
   }
   const filename = path20.basename(absRawPath);
   let bucketInfo;
   try {
-    bucketInfo = deriveBucket(filename);
+    if (isSprintReport) {
+      bucketInfo = deriveBucketFromReportPath(relRawPath);
+    } else {
+      bucketInfo = deriveBucket(filename);
+    }
   } catch (e) {
     stderr(`wiki ingest: cannot determine bucket for ${rawPath}: ${e.message}
 `);
@@ -4045,16 +4075,26 @@ async function wikiIngestHandler(opts) {
   }
   const currentSha = getGitSha(absRawPath, gitRunner) ?? "";
   const pageExists = fs19.existsSync(pagePath);
-  if (pageExists && currentSha !== "") {
-    let isNoOp = false;
+  let existingPage;
+  if (pageExists) {
     try {
       const existingPageContent = fs19.readFileSync(pagePath, "utf8");
-      const existingPage = parsePage(existingPageContent);
-      if (existingPage.last_ingest_commit === currentSha) {
-        const contentUnchanged = checkContentUnchanged(absRawPath, currentSha, relRawPath, gitRunner);
-        if (contentUnchanged) {
+      existingPage = parsePage(existingPageContent);
+    } catch {
+    }
+  }
+  if (existingPage !== void 0 && currentSha !== "") {
+    let isNoOp = false;
+    try {
+      if (isSprintReport) {
+        if (existingPage.last_report_ingest_commit === currentSha) {
           isNoOp = true;
         }
+      } else {
+        if (existingPage.last_ingest_commit === currentSha) {
+          const contentUnchanged = checkContentUnchanged(absRawPath, currentSha, relRawPath, gitRunner);
+          if (contentUnchanged) isNoOp = true;
+        }
       }
     } catch {
     }
@@ -4066,36 +4106,53 @@ async function wikiIngestHandler(opts) {
     }
   }
   const action = pageExists ? "update" : "create";
-  let existingLastContradictSha;
-  if (pageExists) {
-    try {
-      const existingPageContent = fs19.readFileSync(pagePath, "utf8");
-      const existingPage = parsePage(existingPageContent);
-      existingLastContradictSha = existingPage.last_contradict_sha;
-    } catch {
-    }
-  }
+  const timestamp = now();
+  const existingLastContradictSha = existingPage?.last_contradict_sha;
+  const existingReportRawPath = existingPage?.report_raw_path;
+  const existingLastReportIngestCommit = existingPage?.last_report_ingest_commit;
   const parent = buildParentRef2(fm);
   const children = buildChildrenRefs2(fm);
-  const timestamp = now();
   const wikiPage = {
     type,
     id,
-    parent,
-    children,
-    status: String(fm["status"] ?? ""),
-    remote_id: String(fm["remote_id"] ?? ""),
-    raw_path: relRawPath,
+    parent: isSprintReport ? existingPage?.parent ?? "" : parent,
+    children: isSprintReport ? existingPage?.children ?? [] : children,
+    status: isSprintReport ? existingPage?.status ?? String(fm["status"] ?? "") : String(fm["status"] ?? ""),
+    remote_id: isSprintReport ? existingPage?.remote_id ?? String(fm["remote_id"] ?? "") : String(fm["remote_id"] ?? ""),
+    // raw_path tracks the plan file path; for report-only ingest preserve existing or use relRawPath as fallback
+    raw_path: isSprintReport ? existingPage?.raw_path ?? relRawPath : relRawPath,
     last_ingest: timestamp,
-    last_ingest_commit: currentSha,
+    // last_ingest_commit tracks the plan source; preserve when re-ingesting report
+    last_ingest_commit: isSprintReport ? existingPage?.last_ingest_commit ?? "" : currentSha,
     repo,
     // Carry forward last_contradict_sha so Phase 4 idempotency survives re-ingest
     ...existingLastContradictSha !== void 0 ? { last_contradict_sha: existingLastContradictSha } : {},
-    // Hierarchy keys (§11.7): read from raw fm — stamped at raw-side, not wiki-side
-    ...typeof fm["parent_cleargate_id"] === "string" ? { parent_cleargate_id: fm["parent_cleargate_id"] } : {},
-    ...typeof fm["sprint_cleargate_id"] === "string" ? { sprint_cleargate_id: fm["sprint_cleargate_id"] } : {}
+    // Hierarchy keys (§11.7): read from raw fm for plan ingest; preserve for report ingest
+    ...isSprintReport ? existingPage?.parent_cleargate_id !== void 0 ? { parent_cleargate_id: existingPage.parent_cleargate_id } : {} : typeof fm["parent_cleargate_id"] === "string" ? { parent_cleargate_id: fm["parent_cleargate_id"] } : {},
+    ...isSprintReport ? existingPage?.sprint_cleargate_id !== void 0 ? { sprint_cleargate_id: existingPage.sprint_cleargate_id } : {} : typeof fm["sprint_cleargate_id"] === "string" ? { sprint_cleargate_id: fm["sprint_cleargate_id"] } : {},
+    // CR-063 sprint-report fields
+    report_raw_path: isSprintReport ? relRawPath : existingReportRawPath ?? void 0,
+    last_report_ingest_commit: isSprintReport ? currentSha : existingLastReportIngestCommit ?? void 0
   };
-  const pageBody = buildPageBody2({ id, fm, body });
+  let existingPageBody = "";
+  if (existingPage !== void 0 && pageExists) {
+    try {
+      const existingPageContent = fs19.readFileSync(pagePath, "utf8");
+      const lines = existingPageContent.split("\n");
+      let closingDash = -1;
+      for (let i = 1; i < lines.length; i++) {
+        if (lines[i] === "---") {
+          closingDash = i;
+          break;
+        }
+      }
+      if (closingDash !== -1) {
+        existingPageBody = lines.slice(closingDash + 1).join("\n").replace(/^\n/, "");
+      }
+    } catch {
+    }
+  }
+  const pageBody = buildPageBody2({ id, fm, body, isSprintReport, existingPageBody });
   const pageContent = serializePage(wikiPage, pageBody);
   fs19.mkdirSync(pageDir, { recursive: true });
   fs19.writeFileSync(pagePath, pageContent, "utf8");
@@ -4173,7 +4230,37 @@ function buildChildrenRefs2(fm) {
     return `[[${s}]]`;
   });
 }
+function extractReportBlock(pageBody) {
+  const beginMarker = "<!-- BEGIN sprint-report -->";
+  const endMarker = "<!-- END sprint-report -->";
+  const beginIdx = pageBody.indexOf(beginMarker);
+  const endIdx = pageBody.indexOf(endMarker);
+  if (beginIdx === -1 || endIdx === -1 || endIdx <= beginIdx) return void 0;
+  return pageBody.slice(beginIdx, endIdx + endMarker.length);
+}
+function extractPlanStub(pageBody) {
+  const beginMarker = "<!-- BEGIN sprint-report -->";
+  const beginIdx = pageBody.indexOf(beginMarker);
+  if (beginIdx === -1) return pageBody;
+  return pageBody.slice(0, beginIdx);
+}
 function buildPageBody2(item) {
+  const { isSprintReport, existingPageBody } = item;
+  if (isSprintReport) {
+    const planStub = existingPageBody ? extractPlanStub(existingPageBody) : buildPlanStub(item);
+    const reportBlock = buildReportBlock(item.body);
+    return planStub + reportBlock;
+  } else {
+    const planStub = buildPlanStub(item);
+    const existingReportBlock = existingPageBody ? extractReportBlock(existingPageBody) : void 0;
+    if (existingReportBlock !== void 0) {
+      const stub = planStub.trimEnd() + "\n\n";
+      return stub + existingReportBlock + "\n";
+    }
+    return planStub;
+  }
+}
+function buildPlanStub(item) {
   const title = String(item.fm["title"] ?? item.id);
   const summary = String(
     item.fm["description"] ?? item.body.split("\n")[0] ?? "No summary available."
@@ -4197,6 +4284,16 @@ function buildPageBody2(item) {
     ""
   ].join("\n");
 }
+function buildReportBlock(reportBody) {
+  return [
+    "<!-- BEGIN sprint-report -->",
+    "## Sprint Report",
+    "",
+    reportBody.trim(),
+    "<!-- END sprint-report -->",
+    ""
+  ].join("\n");
+}
 function appendLogEntry(wikiRoot, entry) {
   const logPath = path20.join(wikiRoot, "log.md");
   const logEntry = [
@@ -4428,9 +4525,9 @@ function detectWorkItemTypeFromFm(fm) {
 }
 function detectWorkItemType(idOrPath) {
   const upper = idOrPath.toUpperCase();
-  const basename13 = upper.split("/").pop() ?? upper;
+  const basename14 = upper.split("/").pop() ?? upper;
   for (const { prefix, type } of PREFIX_MAP2) {
-    if (basename13.includes(prefix)) {
+    if (basename14.includes(prefix)) {
       return type;
     }
   }
@@ -6677,7 +6774,7 @@ async function writeCachedGate(absPath, result, opts) {
     throw new Error(`writeCachedGate: failed to parse frontmatter in ${absPath}`);
   }
   const existing = coerceCachedGate(fm["cached_gate_result"]);
-  if (existing && JSON.stringify(existing) === JSON.stringify(newResult)) {
+  if (existing && existing.pass === newResult.pass && JSON.stringify(existing.failing_criteria) === JSON.stringify(newResult.failing_criteria)) {
     return;
   }
   const newFm = {};
@@ -7017,24 +7114,312 @@ function gateRunHandler(name, opts, cli) {
 
 // src/commands/sprint.ts
 init_cjs_shims();
-var fs34 = __toESM(require("fs"), 1);
-var path36 = __toESM(require("path"), 1);
+var fs35 = __toESM(require("fs"), 1);
+var path37 = __toESM(require("path"), 1);
 var import_node_child_process11 = require("child_process");
 var import_js_yaml7 = __toESM(require("js-yaml"), 1);
 
 // src/lib/lifecycle-reconcile.ts
 init_cjs_shims();
+var fs34 = __toESM(require("fs"), 1);
+var path36 = __toESM(require("path"), 1);
+var import_node_child_process10 = require("child_process");
+
+// src/lib/parent-rollup.ts
+init_cjs_shims();
 var fs33 = __toESM(require("fs"), 1);
 var path35 = __toESM(require("path"), 1);
-var import_node_child_process10 = require("child_process");
+function readFm(filePath) {
+  try {
+    const raw = fs33.readFileSync(filePath, "utf8");
+    const { fm } = parseFrontmatter(raw);
+    return fm;
+  } catch {
+    return null;
+  }
+}
+function extractId(fm, filePath) {
+  for (const key of [
+    "story_id",
+    "epic_id",
+    "sprint_id",
+    "bug_id",
+    "cr_id",
+    "initiative_id",
+    "hotfix_id"
+  ]) {
+    const val = fm[key];
+    if (typeof val === "string" && val.trim() !== "") return val.trim();
+  }
+  const stem = path35.basename(filePath, ".md");
+  return stem.split("_")[0] ?? stem;
+}
+function enumerateChildren(parentId, deliveryRoot, archiveRoot, fmCache) {
+  const pendingSyncDir = path35.join(deliveryRoot, "pending-sync");
+  const results = [];
+  const pools = [];
+  if (fs33.existsSync(archiveRoot)) pools.push(archiveRoot);
+  if (fs33.existsSync(pendingSyncDir)) pools.push(pendingSyncDir);
+  for (const dir of pools) {
+    let entries;
+    try {
+      entries = fs33.readdirSync(dir);
+    } catch {
+      entries = [];
+    }
+    for (const entry of entries) {
+      if (!entry.endsWith(".md")) continue;
+      const absPath = path35.join(dir, entry);
+      let fm = fmCache.get(absPath);
+      if (fm === void 0) {
+        const parsed = readFm(absPath);
+        if (parsed === null) continue;
+        fm = parsed;
+        fmCache.set(absPath, fm);
+      }
+      const parentCleargateId = fm["parent_cleargate_id"];
+      const parentEpicRef = fm["parent_epic_ref"];
+      const isChild = typeof parentCleargateId === "string" && parentCleargateId.trim() === parentId || typeof parentEpicRef === "string" && parentEpicRef.trim() === parentId;
+      if (!isChild) continue;
+      const childId = extractId(fm, absPath);
+      const status = typeof fm["status"] === "string" ? fm["status"].trim() : "";
+      results.push({ id: childId, status });
+    }
+  }
+  return results;
+}
+async function rollUpParentStatusInternal(parentFilePath, opts, visited, fmCache) {
+  const { deliveryRoot, archiveRoot } = opts;
+  let fm = fmCache.get(parentFilePath);
+  if (fm === void 0) {
+    const raw = readFm(parentFilePath);
+    if (raw === null) {
+      throw new Error(`parent-rollup: cannot read frontmatter from ${parentFilePath}`);
+    }
+    fm = raw;
+    fmCache.set(parentFilePath, fm);
+  }
+  const parentId = extractId(fm, parentFilePath);
+  const currentStatus = typeof fm["status"] === "string" ? fm["status"].trim() : "";
+  if (ARTIFACT_TERMINAL_STATUSES.has(currentStatus)) {
+    return {
+      parent_id: parentId,
+      parent_path: parentFilePath,
+      current_status: currentStatus,
+      proposed_status: null,
+      coverage: "full",
+      terminal_children: [],
+      pending_children: [],
+      verdict: "no-op"
+    };
+  }
+  if (visited.has(parentId)) {
+    throw new Error(`parent-rollup: sub_epics cycle detected at ${parentId}`);
+  }
+  visited.add(parentId);
+  const subEpicsField = fm["sub_epics"];
+  const subEpics = Array.isArray(subEpicsField) && subEpicsField.length > 0 ? subEpicsField.filter((s) => typeof s === "string") : [];
+  if (subEpics.length > 0) {
+    const pendingSyncDir = path35.join(deliveryRoot, "pending-sync");
+    const terminalSubEpics = [];
+    const pendingSubEpics = [];
+    for (const subEpicId of subEpics) {
+      let subEpicPath = null;
+      const candidateDirs = [pendingSyncDir, archiveRoot];
+      for (const dir of candidateDirs) {
+        if (!fs33.existsSync(dir)) continue;
+        let entries;
+        try {
+          entries = fs33.readdirSync(dir);
+        } catch {
+          entries = [];
+        }
+        for (const entry of entries) {
+          if (!entry.endsWith(".md")) continue;
+          const absPath = path35.join(dir, entry);
+          let subFm2 = fmCache.get(absPath);
+          if (subFm2 === void 0) {
+            const parsed = readFm(absPath);
+            if (parsed === null) continue;
+            subFm2 = parsed;
+            fmCache.set(absPath, subFm2);
+          }
+          const entryId = extractId(subFm2, absPath);
+          if (entryId === subEpicId) {
+            subEpicPath = absPath;
+            break;
+          }
+        }
+        if (subEpicPath !== null) break;
+      }
+      if (subEpicPath === null) {
+        pendingSubEpics.push(subEpicId);
+        continue;
+      }
+      let subFm = fmCache.get(subEpicPath);
+      if (subFm === void 0) {
+        const parsed = readFm(subEpicPath);
+        if (parsed === null) {
+          pendingSubEpics.push(subEpicId);
+          continue;
+        }
+        subFm = parsed;
+        fmCache.set(subEpicPath, subFm);
+      }
+      const subStatus = typeof subFm["status"] === "string" ? subFm["status"].trim() : "";
+      if (subStatus === "DEFERRED") {
+        continue;
+      }
+      if (ARTIFACT_TERMINAL_STATUSES.has(subStatus)) {
+        terminalSubEpics.push(subEpicId);
+        continue;
+      }
+      const visitedSnapshot = new Set(visited);
+      const subResult = await rollUpParentStatusInternal(
+        subEpicPath,
+        opts,
+        visitedSnapshot,
+        fmCache
+      );
+      if (subResult.verdict === "auto-flip" || subResult.verdict === "no-op") {
+        terminalSubEpics.push(subEpicId);
+      } else {
+        pendingSubEpics.push(subEpicId);
+      }
+    }
+    visited.delete(parentId);
+    const total2 = terminalSubEpics.length + pendingSubEpics.length;
+    if (total2 === 0) {
+      return {
+        parent_id: parentId,
+        parent_path: parentFilePath,
+        current_status: currentStatus,
+        proposed_status: null,
+        coverage: "zero",
+        terminal_children: [],
+        pending_children: [],
+        verdict: "halt-zero-children",
+        halt_reason: `${parentId}: 0 children drafted; not reconcilable \u2014 decompose or abandon`
+      };
+    }
+    if (pendingSubEpics.length === 0) {
+      return {
+        parent_id: parentId,
+        parent_path: parentFilePath,
+        current_status: currentStatus,
+        proposed_status: "Completed",
+        coverage: "full",
+        terminal_children: terminalSubEpics,
+        pending_children: [],
+        verdict: "auto-flip"
+      };
+    }
+    return {
+      parent_id: parentId,
+      parent_path: parentFilePath,
+      current_status: currentStatus,
+      proposed_status: null,
+      coverage: "sub-epic-partial",
+      terminal_children: terminalSubEpics,
+      pending_children: pendingSubEpics,
+      verdict: "halt-partial",
+      halt_reason: `${parentId}: ${terminalSubEpics.length}/${total2} sub-epics terminal \u2014 pending: ${pendingSubEpics.join(", ")}`
+    };
+  }
+  const children = enumerateChildren(parentId, deliveryRoot, archiveRoot, fmCache);
+  visited.delete(parentId);
+  if (children.length === 0) {
+    return {
+      parent_id: parentId,
+      parent_path: parentFilePath,
+      current_status: currentStatus,
+      proposed_status: null,
+      coverage: "zero",
+      terminal_children: [],
+      pending_children: [],
+      verdict: "halt-zero-children",
+      halt_reason: `${parentId}: 0 children drafted; not reconcilable \u2014 decompose or abandon`
+    };
+  }
+  const terminalChildren = [];
+  const pendingChildren = [];
+  for (const child of children) {
+    if (ARTIFACT_TERMINAL_STATUSES.has(child.status)) {
+      terminalChildren.push(child.id);
+    } else {
+      pendingChildren.push(child.id);
+    }
+  }
+  const total = terminalChildren.length + pendingChildren.length;
+  if (pendingChildren.length === 0) {
+    return {
+      parent_id: parentId,
+      parent_path: parentFilePath,
+      current_status: currentStatus,
+      proposed_status: "Completed",
+      coverage: "full",
+      terminal_children: terminalChildren,
+      pending_children: [],
+      verdict: "auto-flip"
+    };
+  }
+  return {
+    parent_id: parentId,
+    parent_path: parentFilePath,
+    current_status: currentStatus,
+    proposed_status: null,
+    coverage: "partial",
+    terminal_children: terminalChildren,
+    pending_children: pendingChildren,
+    verdict: "halt-partial",
+    halt_reason: `${parentId}: ${terminalChildren.length}/${total} children terminal \u2014 pending: ${pendingChildren.join(", ")}`
+  };
+}
+async function walkActiveParents(opts) {
+  const { deliveryRoot } = opts;
+  const pendingSyncDir = path35.join(deliveryRoot, "pending-sync");
+  let entries;
+  try {
+    entries = fs33.readdirSync(pendingSyncDir);
+  } catch {
+    return [];
+  }
+  const parentFiles = entries.filter(
+    (e) => e.endsWith(".md") && (e.startsWith("EPIC-") || e.startsWith("SPRINT-"))
+  );
+  const results = [];
+  const fmCache = /* @__PURE__ */ new Map();
+  for (const entry of parentFiles) {
+    const absPath = path35.join(pendingSyncDir, entry);
+    try {
+      const visited = /* @__PURE__ */ new Set();
+      const result = await rollUpParentStatusInternal(absPath, opts, visited, fmCache);
+      results.push(result);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("sub_epics cycle detected")) {
+        throw err;
+      }
+    }
+  }
+  return results;
+}
+
+// src/lib/lifecycle-reconcile.ts
+var ARTIFACT_TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+  "Completed",
+  "Abandoned",
+  "Closed",
+  "Resolved"
+]);
+var ARTIFACT_GATE_EXPECTED = ["Completed"];
 var VERB_STATUS_MAP = {
   feat: {
     types: ["STORY", "EPIC", "CR"],
-    expected: ["Done", "Completed"]
+    expected: [...ARTIFACT_GATE_EXPECTED]
   },
   fix: {
     types: ["BUG", "HOTFIX"],
-    expected: ["Verified", "Done", "Completed"]
+    expected: [...ARTIFACT_GATE_EXPECTED]
   }
 };
 var ID_PATTERN = /\b(STORY-\d{3}-\d{2}|(CR|BUG|EPIC|HOTFIX)-\d{3}|(PROPOSAL|PROP)-\d{3})\b/g;
@@ -7085,10 +7470,10 @@ function findArtifactFile(deliveryRoot, id) {
     { rel: "archive", inArchive: true }
   ];
   for (const { rel, inArchive } of dirs) {
-    const dir = path35.join(deliveryRoot, rel);
+    const dir = path36.join(deliveryRoot, rel);
     let entries;
     try {
-      entries = fs33.readdirSync(dir);
+      entries = fs34.readdirSync(dir);
     } catch {
       continue;
     }
@@ -7096,7 +7481,7 @@ function findArtifactFile(deliveryRoot, id) {
       (e) => (e.startsWith(prefix) || e === `${id}.md`) && e.endsWith(".md")
     );
     if (match) {
-      const absPath = path35.join(dir, match);
+      const absPath = path36.join(dir, match);
       return { absPath, inArchive, relPath: `${rel}/${match}` };
     }
   }
@@ -7105,7 +7490,7 @@ function findArtifactFile(deliveryRoot, id) {
 function readArtifactStatus(absPath) {
   let raw;
   try {
-    raw = fs33.readFileSync(absPath, "utf8");
+    raw = fs34.readFileSync(absPath, "utf8");
   } catch {
     return { status: null, carryOver: false };
   }
@@ -7160,7 +7545,7 @@ function reconcileLifecycle(opts) {
         if (carryOver) continue;
         let expectedStatuses;
         if (verb === "feat" && type === "BUG") {
-          expectedStatuses = ["Verified", "Done", "Completed"];
+          expectedStatuses = [...ARTIFACT_GATE_EXPECTED];
         } else if (!verbConfig.types.includes(type)) {
           continue;
         } else {
@@ -7172,7 +7557,7 @@ function reconcileLifecycle(opts) {
           cleanIds.add(id);
           idToItem.delete(id);
         } else if (!idToItem.has(id)) {
-          const expectedStr = expectedStatuses[0] ?? "Done";
+          const expectedStr = expectedStatuses[0] ?? "Completed";
           idToItem.set(id, {
             id,
             type,
@@ -7202,7 +7587,7 @@ function reconcileDecomposition(opts) {
   const { sprintPlanPath, deliveryRoot } = opts;
   let raw;
   try {
-    raw = fs33.readFileSync(sprintPlanPath, "utf8");
+    raw = fs34.readFileSync(sprintPlanPath, "utf8");
   } catch {
     return { missing: [], clean: 0 };
   }
@@ -7214,11 +7599,11 @@ function reconcileDecomposition(opts) {
   }
   const epics = Array.isArray(fm["epics"]) ? fm["epics"].map(String) : [];
   const proposals = Array.isArray(fm["proposals"]) ? fm["proposals"].map(String) : [];
-  const pendingDir = path35.join(deliveryRoot, "pending-sync");
-  const archiveDir = path35.join(deliveryRoot, "archive");
+  const pendingDir = path36.join(deliveryRoot, "pending-sync");
+  const archiveDir = path36.join(deliveryRoot, "archive");
   function listMdFiles(dir) {
     try {
-      return fs33.readdirSync(dir).filter((f) => f.endsWith(".md"));
+      return fs34.readdirSync(dir).filter((f) => f.endsWith(".md"));
     } catch {
       return [];
     }
@@ -7290,9 +7675,9 @@ function findChildStories(epicId, pendingDir, pendingFiles, archiveDir, archiveF
     for (const f of files) {
       if (!f.startsWith(storyPrefix) && !f.startsWith("STORY-")) continue;
       if (!f.includes(storyPrefix)) continue;
-      const absPath = path35.join(dir, f);
+      const absPath = path36.join(dir, f);
       try {
-        const raw = fs33.readFileSync(absPath, "utf8");
+        const raw = fs34.readFileSync(absPath, "utf8");
         const { fm } = parseFrontmatter(raw);
         const parentRef = fm["parent_epic_ref"];
         if (parentRef === epicId) {
@@ -7307,9 +7692,9 @@ function findChildStories(epicId, pendingDir, pendingFiles, archiveDir, archiveF
 function findDecomposedEpic(proposalId, pendingDir, pendingFiles) {
   for (const f of pendingFiles) {
     if (!f.startsWith("EPIC-")) continue;
-    const absPath = path35.join(pendingDir, f);
+    const absPath = path36.join(pendingDir, f);
     try {
-      const raw = fs33.readFileSync(absPath, "utf8");
+      const raw = fs34.readFileSync(absPath, "utf8");
       const { fm } = parseFrontmatter(raw);
       const contextSource = fm["context_source"];
       if (typeof contextSource === "string" && contextSource.includes(proposalId)) {
@@ -7335,7 +7720,7 @@ var TERMINAL_STATUSES2 = /* @__PURE__ */ new Set(["Completed", "Done", "Abandone
 function resolveRunScript(opts) {
   if (opts.runScriptPath) return opts.runScriptPath;
   const cwd = opts.cwd ?? process.cwd();
-  return path36.join(cwd, ".cleargate", "scripts", "run_script.sh");
+  return path37.join(cwd, ".cleargate", "scripts", "run_script.sh");
 }
 function defaultExit(code) {
   return process.exit(code);
@@ -7354,18 +7739,18 @@ function sprintInitHandler(opts, cli) {
   if (mode === "v1") {
     return printInertAndExit(stdoutFn, exitFn);
   }
-  const deliveryRoot = path36.join(cwd, ".cleargate", "delivery");
+  const deliveryRoot = path37.join(cwd, ".cleargate", "delivery");
   let lifecycleInitMode = "warn";
   let sprintPlanPath = null;
-  const pendingDir = path36.join(deliveryRoot, "pending-sync");
+  const pendingDir = path37.join(deliveryRoot, "pending-sync");
   try {
-    const entries = fs34.readdirSync(pendingDir);
+    const entries = fs35.readdirSync(pendingDir);
     const sprintFile = entries.find(
       (e) => (e.startsWith(`${opts.sprintId}_`) || e === `${opts.sprintId}.md`) && e.endsWith(".md")
     );
     if (sprintFile) {
-      sprintPlanPath = path36.join(pendingDir, sprintFile);
-      const raw = fs34.readFileSync(sprintPlanPath, "utf8");
+      sprintPlanPath = path37.join(pendingDir, sprintFile);
+      const raw = fs35.readFileSync(sprintPlanPath, "utf8");
       const { fm } = parseFileFrontmatter(raw);
       if (fm["lifecycle_init_mode"] === "block") {
         lifecycleInitMode = "block";
@@ -7399,7 +7784,7 @@ function sprintInitHandler(opts, cli) {
         stderrFn("[cleargate sprint init] lifecycle drift waived via --allow-drift flag");
         if (sprintPlanPath) {
           try {
-            const rawSprint = fs34.readFileSync(sprintPlanPath, "utf8");
+            const rawSprint = fs35.readFileSync(sprintPlanPath, "utf8");
             const { fm, body } = parseFileFrontmatter(rawSprint);
             const waiverLine = `lifecycle waiver: ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]} for ${lifecycleResult.drift.map((d) => d.id).join(", ")}`;
             const currentContextSource = typeof fm["context_source"] === "string" ? fm["context_source"] : "";
@@ -7496,20 +7881,20 @@ function reconcileLifecycleCliHandler(opts, cli) {
   const stderrFn = cli?.stderr ?? ((s) => process.stderr.write(s + "\n"));
   const exitFn = cli?.exit ?? defaultExit;
   const cwd = cli?.cwd ?? process.cwd();
-  const deliveryRoot = path36.join(cwd, ".cleargate", "delivery");
+  const deliveryRoot = path37.join(cwd, ".cleargate", "delivery");
   let since;
   let until;
   if (opts.since) {
     since = new Date(opts.since);
   } else {
     try {
-      const pendingDir = path36.join(deliveryRoot, "pending-sync");
-      const entries = fs34.readdirSync(pendingDir);
+      const pendingDir = path37.join(deliveryRoot, "pending-sync");
+      const entries = fs35.readdirSync(pendingDir);
       const sprintFile = entries.find(
         (e) => (e.startsWith(`${opts.sprintId}_`) || e === `${opts.sprintId}.md`) && e.endsWith(".md")
       );
       if (sprintFile) {
-        const raw = fs34.readFileSync(path36.join(pendingDir, sprintFile), "utf8");
+        const raw = fs35.readFileSync(path37.join(pendingDir, sprintFile), "utf8");
         const { fm } = parseFileFrontmatter(raw);
         const startDate = fm["start_date"];
         since = typeof startDate === "string" ? new Date(startDate) : new Date(Date.now() - 90 * 24 * 60 * 60 * 1e3);
@@ -7531,22 +7916,50 @@ function reconcileLifecycleCliHandler(opts, cli) {
     });
     if (result.drift.length === 0) {
       stdoutFn(`lifecycle: clean (${result.clean} artifacts reconciled)`);
-      return exitFn(0);
-    }
-    stderrFn(`lifecycle: DRIFT detected (${result.drift.length} unreconciled artifacts):`);
-    for (const item of result.drift) {
-      stderrFn(
-        `  DRIFT: ${item.id} status=${item.actual_status ?? "missing"} in ${item.in_archive ? "archive" : "pending-sync"}, expected ${item.expected_status} (commit ${item.commit_shas[0] ?? "unknown"})`
-      );
-      stderrFn(
-        `    Remediation: git mv .cleargate/delivery/pending-sync/${item.file_path?.replace("pending-sync/", "") ?? item.id + "_*.md"} .cleargate/delivery/archive/ && update status: ${item.expected_status}`
-      );
+    } else {
+      stderrFn(`lifecycle: DRIFT detected (${result.drift.length} unreconciled artifacts):`);
+      for (const item of result.drift) {
+        stderrFn(
+          `  DRIFT: ${item.id} status=${item.actual_status ?? "missing"} in ${item.in_archive ? "archive" : "pending-sync"}, expected ${item.expected_status} (commit ${item.commit_shas[0] ?? "unknown"})`
+        );
+        stderrFn(
+          `    Remediation: git mv .cleargate/delivery/pending-sync/${item.file_path?.replace("pending-sync/", "") ?? item.id + "_*.md"} .cleargate/delivery/archive/ && update status: ${item.expected_status}`
+        );
+      }
+      if (!opts.parents) {
+        return exitFn(1);
+      }
     }
-    return exitFn(1);
   } catch (err) {
     stderrFn(`lifecycle reconciliation error: ${err instanceof Error ? err.message : String(err)}`);
-    return exitFn(1);
+    if (!opts.parents) {
+      return exitFn(1);
+    }
+  }
+  if (opts.parents) {
+    const archiveRoot = path37.join(deliveryRoot, "archive");
+    walkActiveParents({ deliveryRoot, archiveRoot }).then((results) => {
+      stdoutFn("Parent rollup audit (--parents):");
+      for (const r of results) {
+        if (r.verdict === "auto-flip") {
+          stdoutFn(
+            `  ${r.parent_id}  \u2713 proposed: Completed (${r.terminal_children.length}/${r.terminal_children.length} children Completed)`
+          );
+        } else if (r.verdict === "halt-partial" || r.verdict === "halt-zero-children") {
+          stdoutFn(`  ${r.parent_id}  \u2717 ${r.verdict}: ${r.halt_reason ?? "no details"}`);
+        } else if (r.verdict === "no-op") {
+        } else {
+          stdoutFn(`  ${r.parent_id}  ~ ${r.verdict}`);
+        }
+      }
+      exitFn(0);
+    }).catch((err) => {
+      stderrFn(`--parents audit error: ${err instanceof Error ? err.message : String(err)}`);
+      exitFn(0);
+    });
+    return;
   }
+  return exitFn(0);
 }
 function parseFileFrontmatter(raw) {
   const lines = raw.split("\n");
@@ -7590,8 +8003,8 @@ ${body}`;
 }
 function atomicWriteStr(filePath, content) {
   const tmp = `${filePath}.tmp.${process.pid}`;
-  fs34.writeFileSync(tmp, content, "utf8");
-  fs34.renameSync(tmp, filePath);
+  fs35.writeFileSync(tmp, content, "utf8");
+  fs35.renameSync(tmp, filePath);
 }
 function deriveSprintBranchForArchive(sprintId) {
   const match = /^SPRINT-(\d+)/.exec(sprintId);
@@ -7605,7 +8018,7 @@ function stampFile(raw, status, completedAt) {
   return serializeFileContent(fm, body);
 }
 function stampSprintClose(sprintPath, now) {
-  const previousContent = fs34.readFileSync(sprintPath, "utf8");
+  const previousContent = fs35.readFileSync(sprintPath, "utf8");
   const { fm, body } = parseFileFrontmatter(previousContent);
   const currentStatus = typeof fm["status"] === "string" ? fm["status"] : "";
   const alreadyTerminal = TERMINAL_STATUSES2.has(currentStatus);
@@ -7665,14 +8078,14 @@ async function sprintArchiveHandler(opts, cli) {
     if (mode === "v1") {
       return printInertAndExit(stdoutFn, exitFn);
     }
-    const stateFile = path36.join(cwd, ".cleargate", "sprint-runs", opts.sprintId, "state.json");
-    if (!fs34.existsSync(stateFile)) {
+    const stateFile = path37.join(cwd, ".cleargate", "sprint-runs", opts.sprintId, "state.json");
+    if (!fs35.existsSync(stateFile)) {
       stderrFn(`[cleargate sprint archive] state.json not found at ${stateFile}`);
       return exitFn(1);
     }
     let state2;
     try {
-      state2 = JSON.parse(fs34.readFileSync(stateFile, "utf8"));
+      state2 = JSON.parse(fs35.readFileSync(stateFile, "utf8"));
     } catch (err) {
       stderrFn(`[cleargate sprint archive] failed to parse state.json: ${err.message}`);
       return exitFn(1);
@@ -7684,18 +8097,18 @@ async function sprintArchiveHandler(opts, cli) {
       return exitFn(1);
     }
     const stateStories = state2.stories ?? {};
-    const pendingDir = path36.join(cwd, ".cleargate", "delivery", "pending-sync");
-    const archiveDir = path36.join(cwd, ".cleargate", "delivery", "archive");
+    const pendingDir = path37.join(cwd, ".cleargate", "delivery", "pending-sync");
+    const archiveDir = path37.join(cwd, ".cleargate", "delivery", "archive");
     let sprintFile = null;
-    for (const entry of fs34.readdirSync(pendingDir)) {
+    for (const entry of fs35.readdirSync(pendingDir)) {
       if ((entry.startsWith(`${opts.sprintId}_`) || entry === `${opts.sprintId}.md`) && entry.endsWith(".md")) {
-        sprintFile = path36.join(pendingDir, entry);
+        sprintFile = path37.join(pendingDir, entry);
         break;
       }
     }
     let epicIds = [];
-    if (sprintFile && fs34.existsSync(sprintFile)) {
-      const { fm } = parseFileFrontmatter(fs34.readFileSync(sprintFile, "utf8"));
+    if (sprintFile && fs35.existsSync(sprintFile)) {
+      const { fm } = parseFileFrontmatter(fs35.readFileSync(sprintFile, "utf8"));
       const epics = fm["epics"];
       if (Array.isArray(epics)) {
         epicIds = epics.map(String);
@@ -7705,15 +8118,15 @@ async function sprintArchiveHandler(opts, cli) {
     if (sprintFile) {
       plan.push({
         src: sprintFile,
-        destName: path36.basename(sprintFile),
+        destName: path37.basename(sprintFile),
         status: "Completed"
       });
     }
     for (const epicId of epicIds) {
-      for (const entry of fs34.readdirSync(pendingDir)) {
+      for (const entry of fs35.readdirSync(pendingDir)) {
         if ((entry.startsWith(`${epicId}_`) || entry === `${epicId}.md`) && entry.endsWith(".md")) {
           plan.push({
-            src: path36.join(pendingDir, entry),
+            src: path37.join(pendingDir, entry),
             destName: entry,
             status: "Approved"
           });
@@ -7722,10 +8135,10 @@ async function sprintArchiveHandler(opts, cli) {
       }
       const storyKeys = storyKeysForEpic(stateStories, epicId);
       for (const storyId of storyKeys) {
-        for (const entry of fs34.readdirSync(pendingDir)) {
+        for (const entry of fs35.readdirSync(pendingDir)) {
           if ((entry.startsWith(`${storyId}_`) || entry === `${storyId}.md`) && entry.endsWith(".md")) {
             plan.push({
-              src: path36.join(pendingDir, entry),
+              src: path37.join(pendingDir, entry),
               destName: entry,
               status: "Done"
             });
@@ -7737,13 +8150,13 @@ async function sprintArchiveHandler(opts, cli) {
     const storyIdsInState = new Set(Object.keys(stateStories));
     const planSrcs = new Set(plan.map((p) => p.src));
     const orphans = [];
-    for (const entry of fs34.readdirSync(pendingDir)) {
+    for (const entry of fs35.readdirSync(pendingDir)) {
       if (!entry.startsWith("STORY-") || !entry.endsWith(".md")) continue;
-      const candidate = path36.join(pendingDir, entry);
+      const candidate = path37.join(pendingDir, entry);
       if (planSrcs.has(candidate)) continue;
       let raw;
       try {
-        raw = fs34.readFileSync(candidate, "utf8");
+        raw = fs35.readFileSync(candidate, "utf8");
       } catch {
         continue;
       }
@@ -7760,18 +8173,18 @@ async function sprintArchiveHandler(opts, cli) {
     }
     const completedAt = (/* @__PURE__ */ new Date()).toISOString();
     const sprintBranch = deriveSprintBranchForArchive(opts.sprintId);
-    const activePath = path36.join(cwd, ".cleargate", "sprint-runs", ".active");
+    const activePath = path37.join(cwd, ".cleargate", "sprint-runs", ".active");
     if (opts.dryRun) {
       stdoutFn(`[dry-run] Sprint archive plan for ${opts.sprintId}:`);
       stdoutFn(`  Sprint branch: ${sprintBranch}`);
       stdoutFn(`  Files to archive (${plan.length}):`);
       for (const entry of plan) {
         stdoutFn(
-          `    ${path36.basename(entry.src)} \u2192 archive/${entry.destName}  [stamp: status=${entry.status}, completed_at=<now>]`
+          `    ${path37.basename(entry.src)} \u2192 archive/${entry.destName}  [stamp: status=${entry.status}, completed_at=<now>]`
         );
       }
       if (orphans.length > 0) {
-        stdoutFn(`  Orphan files (${orphans.length}): ${orphans.map((o) => path36.basename(o)).join(", ")}`);
+        stdoutFn(`  Orphan files (${orphans.length}): ${orphans.map((o) => path37.basename(o)).join(", ")}`);
       }
       stdoutFn(`  .active \u2192 "" (truncate)`);
       stdoutFn(`  git checkout main`);
@@ -7780,9 +8193,9 @@ async function sprintArchiveHandler(opts, cli) {
       return exitFn(0);
     }
     let sprintFileSnapshot = null;
-    const wikiRoot = path36.join(cwd, ".cleargate", "wiki");
-    const wikiInitialised = fs34.existsSync(wikiRoot);
-    if (sprintFile && fs34.existsSync(sprintFile)) {
+    const wikiRoot = path37.join(cwd, ".cleargate", "wiki");
+    const wikiInitialised = fs35.existsSync(wikiRoot);
+    if (sprintFile && fs35.existsSync(sprintFile)) {
       const { previousContent } = stampSprintClose(sprintFile, () => completedAt);
       sprintFileSnapshot = previousContent;
       if (wikiInitialised) {
@@ -7809,15 +8222,15 @@ async function sprintArchiveHandler(opts, cli) {
       }
     }
     for (const entry of plan) {
-      if (!fs34.existsSync(entry.src)) {
+      if (!fs35.existsSync(entry.src)) {
         stderrFn(`[cleargate sprint archive] source not found: ${entry.src} \u2014 skipping`);
         continue;
       }
-      const raw = fs34.readFileSync(entry.src, "utf8");
+      const raw = fs35.readFileSync(entry.src, "utf8");
       const stamped = stampFile(raw, entry.status, completedAt);
-      const dest = path36.join(archiveDir, entry.destName);
+      const dest = path37.join(archiveDir, entry.destName);
       atomicWriteStr(entry.src, stamped);
-      fs34.renameSync(entry.src, dest);
+      fs35.renameSync(entry.src, dest);
       stdoutFn(`archived: ${entry.destName}`);
     }
     try {
@@ -7876,14 +8289,14 @@ function checkPrevSprintCompleted(sprintId, cwd) {
   const prevNum = sprintNum - 1;
   const prevId = `SPRINT-${String(prevNum).padStart(2, "0")}`;
   const prevIdAlt = `SPRINT-${prevNum}`;
-  const sprintRunsBase = path36.join(cwd, ".cleargate", "sprint-runs");
+  const sprintRunsBase = path37.join(cwd, ".cleargate", "sprint-runs");
   let stateJson = null;
   let resolvedPrevId = prevId;
   for (const pid of [prevId, prevIdAlt]) {
-    const stateFile = path36.join(sprintRunsBase, pid, "state.json");
-    if (fs34.existsSync(stateFile)) {
+    const stateFile = path37.join(sprintRunsBase, pid, "state.json");
+    if (fs35.existsSync(stateFile)) {
       try {
-        const raw = fs34.readFileSync(stateFile, "utf8");
+        const raw = fs35.readFileSync(stateFile, "utf8");
         stateJson = JSON.parse(raw);
         resolvedPrevId = pid;
         break;
@@ -7986,21 +8399,21 @@ function checkMainClean(cwd, execFn) {
 }
 function findSprintFile(sprintId, cwd) {
   const searchDirs = [
-    path36.join(cwd, ".cleargate", "delivery", "pending-sync"),
-    path36.join(cwd, ".cleargate", "delivery", "archive")
+    path37.join(cwd, ".cleargate", "delivery", "pending-sync"),
+    path37.join(cwd, ".cleargate", "delivery", "archive")
   ];
   for (const dir of searchDirs) {
-    if (!fs34.existsSync(dir)) continue;
+    if (!fs35.existsSync(dir)) continue;
     let entries;
     try {
-      entries = fs34.readdirSync(dir);
+      entries = fs35.readdirSync(dir);
     } catch {
       continue;
     }
     const prefix = `${sprintId}_`;
     for (const entry of entries) {
       if ((entry.startsWith(prefix) || entry === `${sprintId}.md`) && entry.endsWith(".md")) {
-        return path36.join(dir, entry);
+        return path37.join(dir, entry);
       }
     }
   }
@@ -8008,26 +8421,26 @@ function findSprintFile(sprintId, cwd) {
 }
 function findWorkItemFileLocal(cwd, workItemId) {
   const searchDirs = [
-    path36.join(cwd, ".cleargate", "delivery", "pending-sync"),
-    path36.join(cwd, ".cleargate", "delivery", "archive")
+    path37.join(cwd, ".cleargate", "delivery", "pending-sync"),
+    path37.join(cwd, ".cleargate", "delivery", "archive")
   ];
   const prefix = `${workItemId}_`;
   for (const dir of searchDirs) {
     let entries;
     try {
-      entries = fs34.readdirSync(dir);
+      entries = fs35.readdirSync(dir);
     } catch {
       continue;
     }
     const match = entries.find((e) => (e.startsWith(prefix) || e === `${workItemId}.md`) && e.endsWith(".md"));
-    if (match) return path36.join(dir, match);
+    if (match) return path37.join(dir, match);
   }
   return null;
 }
 function readCachedGateSync(absPath) {
   let raw;
   try {
-    raw = fs34.readFileSync(absPath, "utf8");
+    raw = fs35.readFileSync(absPath, "utf8");
   } catch {
     return null;
   }
@@ -8051,7 +8464,7 @@ function readCachedGateSync(absPath) {
   return null;
 }
 function extractInScopeWorkItemIds(sprintFilePath, cwd, execFn) {
-  const scriptPath = path36.join(cwd, ".cleargate", "scripts", "assert_story_files.mjs");
+  const scriptPath = path37.join(cwd, ".cleargate", "scripts", "assert_story_files.mjs");
   const cmd = `node "${scriptPath}" "${sprintFilePath}" --emit-json`;
   let stdout;
   try {
@@ -8103,7 +8516,7 @@ function checkPerItemReadinessGates(sprintId, cwd, execFn, mode) {
     let fm;
     let raw;
     try {
-      raw = fs34.readFileSync(absPath, "utf8");
+      raw = fs35.readFileSync(absPath, "utf8");
       ({ fm } = parseFrontmatter(raw));
     } catch {
       totalChecked++;
@@ -8147,7 +8560,7 @@ function checkPerItemReadinessGates(sprintId, cwd, execFn, mode) {
   let sprintRaw;
   let sprintFm = {};
   try {
-    sprintRaw = fs34.readFileSync(sprintFilePath, "utf8");
+    sprintRaw = fs35.readFileSync(sprintFilePath, "utf8");
     ({ fm: sprintFm } = parseFrontmatter(sprintRaw));
   } catch {
   }
@@ -8203,9 +8616,13 @@ function refreshScopedGateCaches(sprintId, cwd, execFn) {
     if (!absPath) {
       continue;
     }
+    if (absPath.includes(`${path37.sep}archive${path37.sep}`)) {
+      result.skipped.push(id);
+      continue;
+    }
     let status = "";
     try {
-      const raw = fs34.readFileSync(absPath, "utf8");
+      const raw = fs35.readFileSync(absPath, "utf8");
       const { fm } = parseFrontmatter(raw);
       status = String(fm["status"] ?? "");
     } catch {
@@ -8278,8 +8695,8 @@ function sprintPreflightHandler(opts, cli) {
 
 // src/commands/story.ts
 init_cjs_shims();
-var fs35 = __toESM(require("fs"), 1);
-var path37 = __toESM(require("path"), 1);
+var fs36 = __toESM(require("fs"), 1);
+var path38 = __toESM(require("path"), 1);
 var import_node_child_process12 = require("child_process");
 function defaultExit2(code) {
   return process.exit(code);
@@ -8287,7 +8704,7 @@ function defaultExit2(code) {
 function resolveRunScript2(opts) {
   if (opts.runScriptPath) return opts.runScriptPath;
   const cwd = opts.cwd ?? process.cwd();
-  return path37.join(cwd, ".cleargate", "scripts", "run_script.sh");
+  return path38.join(cwd, ".cleargate", "scripts", "run_script.sh");
 }
 function deriveSprintBranch(sprintId) {
   const match = /^SPRINT-(\d+)/.exec(sprintId);
@@ -8296,11 +8713,11 @@ function deriveSprintBranch(sprintId) {
 }
 function atomicWriteString(filePath, text) {
   const tmpFile = `${filePath}.tmp.${process.pid}`;
-  fs35.writeFileSync(tmpFile, text, "utf8");
-  fs35.renameSync(tmpFile, filePath);
+  fs36.writeFileSync(tmpFile, text, "utf8");
+  fs36.renameSync(tmpFile, filePath);
 }
 function stateJsonPath(cwd, sprintId) {
-  return path37.join(cwd, ".cleargate", "sprint-runs", sprintId, "state.json");
+  return path38.join(cwd, ".cleargate", "sprint-runs", sprintId, "state.json");
 }
 function storyStartHandler(opts, cli) {
   const stdoutFn = cli?.stdout ?? ((s) => process.stdout.write(s + "\n"));
@@ -8317,7 +8734,7 @@ function storyStartHandler(opts, cli) {
     return printInertAndExit(stdoutFn, exitFn);
   }
   const sprintBranch = deriveSprintBranch(sprintId);
-  const worktreePath = path37.join(cwd, ".worktrees", opts.storyId);
+  const worktreePath = path38.join(cwd, ".worktrees", opts.storyId);
   const storyBranch = `story/${opts.storyId}`;
   const step1 = spawnFn(
     "git",
@@ -8350,13 +8767,13 @@ function storyStartHandler(opts, cli) {
     return exitFn(step2.status ?? 1);
   }
   const stateFile = stateJsonPath(cwd, sprintId);
-  if (!fs35.existsSync(stateFile)) {
+  if (!fs36.existsSync(stateFile)) {
     stderrFn(`[cleargate story start] step 3: state.json not found at ${stateFile}`);
     return exitFn(1);
   }
   let state2;
   try {
-    state2 = JSON.parse(fs35.readFileSync(stateFile, "utf8"));
+    state2 = JSON.parse(fs36.readFileSync(stateFile, "utf8"));
   } catch (err) {
     stderrFn(`[cleargate story start] step 3: failed to parse state.json: ${err.message}`);
     return exitFn(1);
@@ -8397,7 +8814,7 @@ function storyCompleteHandler(opts, cli) {
   }
   const sprintBranch = deriveSprintBranch(sprintId);
   const storyBranch = `story/${opts.storyId}`;
-  const worktreeRel = path37.join(".worktrees", opts.storyId);
+  const worktreeRel = path38.join(".worktrees", opts.storyId);
   const step1 = spawnFn(
     "git",
     ["rev-list", "--count", `${sprintBranch}..${storyBranch}`],
@@ -8496,7 +8913,7 @@ function storyCompleteHandler(opts, cli) {
 
 // src/commands/state.ts
 init_cjs_shims();
-var path38 = __toESM(require("path"), 1);
+var path39 = __toESM(require("path"), 1);
 var import_node_child_process13 = require("child_process");
 function defaultExit3(code) {
   return process.exit(code);
@@ -8504,7 +8921,7 @@ function defaultExit3(code) {
 function resolveRunScript3(opts) {
   if (opts.runScriptPath) return opts.runScriptPath;
   const cwd = opts.cwd ?? process.cwd();
-  return path38.join(cwd, ".cleargate", "scripts", "run_script.sh");
+  return path39.join(cwd, ".cleargate", "scripts", "run_script.sh");
 }
 function stateUpdateHandler(opts, cli) {
   const stdoutFn = cli?.stdout ?? ((s) => process.stdout.write(s + "\n"));
@@ -8565,21 +8982,21 @@ function stateValidateHandler(opts, cli) {
 
 // src/commands/stamp-tokens.ts
 init_cjs_shims();
-var fs37 = __toESM(require("fs"), 1);
-var path40 = __toESM(require("path"), 1);
+var fs38 = __toESM(require("fs"), 1);
+var path41 = __toESM(require("path"), 1);
 
 // src/lib/ledger-reader.ts
 init_cjs_shims();
-var fs36 = __toESM(require("fs"), 1);
-var path39 = __toESM(require("path"), 1);
+var fs37 = __toESM(require("fs"), 1);
+var path40 = __toESM(require("path"), 1);
 function findSprintRunsRoot(startDir) {
   let dir = startDir;
   while (true) {
-    const candidate = path39.join(dir, ".cleargate", "sprint-runs");
-    if (fs36.existsSync(candidate)) {
+    const candidate = path40.join(dir, ".cleargate", "sprint-runs");
+    if (fs37.existsSync(candidate)) {
       return candidate;
     }
-    const parent = path39.dirname(dir);
+    const parent = path40.dirname(dir);
     if (parent === dir) {
       return null;
     }
@@ -8632,13 +9049,13 @@ function readLedgerForWorkItem(workItemId, opts = {}) {
     }
     sprintRunsRoot = found;
   }
-  if (!fs36.existsSync(sprintRunsRoot)) {
+  if (!fs37.existsSync(sprintRunsRoot)) {
     return [];
   }
   let ledgerFiles;
   try {
-    const entries = fs36.readdirSync(sprintRunsRoot, { withFileTypes: true });
-    ledgerFiles = entries.filter((e) => e.isDirectory()).map((e) => path39.join(sprintRunsRoot, e.name, "token-ledger.jsonl")).filter((f) => fs36.existsSync(f));
+    const entries = fs37.readdirSync(sprintRunsRoot, { withFileTypes: true });
+    ledgerFiles = entries.filter((e) => e.isDirectory()).map((e) => path40.join(sprintRunsRoot, e.name, "token-ledger.jsonl")).filter((f) => fs37.existsSync(f));
   } catch {
     return [];
   }
@@ -8646,7 +9063,7 @@ function readLedgerForWorkItem(workItemId, opts = {}) {
   for (const ledgerFile of ledgerFiles) {
     let content;
     try {
-      content = fs36.readFileSync(ledgerFile, "utf-8");
+      content = fs37.readFileSync(ledgerFile, "utf-8");
     } catch {
       continue;
     }
@@ -8697,7 +9114,7 @@ async function stampTokensHandler(file, opts, cli) {
   });
   const nowFn = cli?.now ?? (() => /* @__PURE__ */ new Date());
   const cwd = cli?.cwd ?? process.cwd();
-  const absPath = path40.isAbsolute(file) ? file : path40.resolve(cwd, file);
+  const absPath = path41.isAbsolute(file) ? file : path41.resolve(cwd, file);
   if (/\/\.cleargate\/delivery\/archive\//.test(absPath)) {
     stdoutFn(`[frozen] ${absPath}`);
     exitFn(0);
@@ -8705,7 +9122,7 @@ async function stampTokensHandler(file, opts, cli) {
   }
   let rawContent;
   try {
-    rawContent = fs37.readFileSync(absPath, "utf-8");
+    rawContent = fs38.readFileSync(absPath, "utf-8");
   } catch {
     stdoutFn(`[stamp-tokens] error: cannot read file: ${absPath}`);
     exitFn(1);
@@ -8777,7 +9194,7 @@ async function stampTokensHandler(file, opts, cli) {
     return;
   }
   try {
-    fs37.writeFileSync(absPath, serialized, "utf-8");
+    fs38.writeFileSync(absPath, serialized, "utf-8");
   } catch {
     stdoutFn(`[stamp-tokens] error: cannot write file: ${absPath}`);
     exitFn(1);
@@ -8794,14 +9211,14 @@ function extractWorkItemId(fm, absPath) {
       return val.trim();
     }
   }
-  const basename13 = path40.basename(absPath);
-  const match = basename13.match(/^(STORY|EPIC|PROPOSAL|CR|BUG|INITIATIVE|SPRINT)-\d+(-\d+)?/i);
+  const basename14 = path41.basename(absPath);
+  const match = basename14.match(/^(STORY|EPIC|PROPOSAL|CR|BUG|INITIATIVE|SPRINT)-\d+(-\d+)?/i);
   if (match) {
     return match[0].toUpperCase();
   }
   const typeFromPath = detectWorkItemType(absPath);
   if (typeFromPath) {
-    const idMatch = basename13.match(/((?:STORY|EPIC|PROPOSAL|CR|BUG|INITIATIVE|SPRINT)-\d+(?:-\d+)?)/i);
+    const idMatch = basename14.match(/((?:STORY|EPIC|PROPOSAL|CR|BUG|INITIATIVE|SPRINT)-\d+(?:-\d+)?)/i);
     if (idMatch) {
       return idMatch[1].toUpperCase();
     }
@@ -8899,9 +9316,9 @@ ${body}`;
 
 // src/commands/upgrade.ts
 init_cjs_shims();
-var fs38 = __toESM(require("fs"), 1);
+var fs39 = __toESM(require("fs"), 1);
 var fsp = __toESM(require("fs/promises"), 1);
-var path41 = __toESM(require("path"), 1);
+var path42 = __toESM(require("path"), 1);
 
 // src/lib/changelog.ts
 init_cjs_shims();
@@ -9105,7 +9522,7 @@ async function writeAtomic2(filePath, content) {
   }
 }
 async function updateSnapshotEntry(projectRoot, filePath, newSha) {
-  const snapshotPath = path41.join(projectRoot, ".cleargate", ".install-manifest.json");
+  const snapshotPath = path42.join(projectRoot, ".cleargate", ".install-manifest.json");
   let snapshot;
   try {
     const raw = await fsp.readFile(snapshotPath, "utf-8");
@@ -9122,17 +9539,17 @@ async function updateSnapshotEntry(projectRoot, filePath, newSha) {
   await writeAtomic2(snapshotPath, JSON.stringify(updated, null, 2) + "\n");
 }
 function isClaudeMd(filePath) {
-  return path41.basename(filePath) === "CLAUDE.md";
+  return path42.basename(filePath) === "CLAUDE.md";
 }
 function isSettingsJson(filePath) {
-  return path41.basename(filePath) === "settings.json" && filePath.includes(".claude");
+  return path42.basename(filePath) === "settings.json" && filePath.includes(".claude");
 }
 async function applyAlwaysOverwrite(entry, projectRoot, packageRoot, stdout) {
-  const targetPath = path41.join(projectRoot, entry.path);
-  const sourcePath = path41.join(packageRoot, entry.path);
+  const targetPath = path42.join(projectRoot, entry.path);
+  const sourcePath = path42.join(packageRoot, entry.path);
   try {
     const pkgContent = await fsp.readFile(sourcePath, "utf-8");
-    await fsp.mkdir(path41.dirname(targetPath), { recursive: true });
+    await fsp.mkdir(path42.dirname(targetPath), { recursive: true });
     await writeAtomic2(targetPath, pkgContent);
     await updateSnapshotEntry(projectRoot, entry.path, entry.sha256);
     stdout(`[always] overwritten: ${entry.path}`);
@@ -9142,8 +9559,8 @@ async function applyAlwaysOverwrite(entry, projectRoot, packageRoot, stdout) {
 }
 async function applyMerge3Way(entry, projectRoot, packageRoot, installSha, currentSha, flags, opts) {
   const { stdout, stderr, promptMergeChoiceFn, openInEditorFn, stdin } = opts;
-  const targetPath = path41.join(projectRoot, entry.path);
-  const sourcePath = path41.join(packageRoot, entry.path);
+  const targetPath = path42.join(projectRoot, entry.path);
+  const sourcePath = path42.join(packageRoot, entry.path);
   let ours = "";
   let theirs = "";
   try {
@@ -9206,7 +9623,7 @@ async function applyMerge3Way(entry, projectRoot, packageRoot, installSha, curre
         mergedContent = theirs;
       }
     }
-    await fsp.mkdir(path41.dirname(targetPath), { recursive: true });
+    await fsp.mkdir(path42.dirname(targetPath), { recursive: true });
     await writeAtomic2(targetPath, mergedContent);
     const newSha2 = hashNormalized(mergedContent);
     await updateSnapshotEntry(projectRoot, entry.path, newSha2);
@@ -9218,7 +9635,7 @@ async function applyMerge3Way(entry, projectRoot, packageRoot, installSha, curre
 ${ours}=======
 ${theirs}>>>>>>> theirs (upstream)
 `;
-  await fsp.mkdir(path41.dirname(mergeFilePath), { recursive: true });
+  await fsp.mkdir(path42.dirname(mergeFilePath), { recursive: true });
   await writeAtomic2(mergeFilePath, conflictContent);
   try {
     const result = await openInEditorFn(mergeFilePath);
@@ -9278,10 +9695,10 @@ async function upgradeHandler(flags, cli) {
     const installedVersion = installSnapshot?.cleargate_version ?? pkgManifest.cleargate_version;
     const targetVersion = pkgManifest.cleargate_version;
     if (installedVersion !== targetVersion) {
-      const pkgRoot = cli?.packageRoot ?? path41.join(path41.dirname(new URL(importMetaUrl).pathname), "..", "..");
-      const changelogPath = path41.join(pkgRoot, "CHANGELOG.md");
+      const pkgRoot = cli?.packageRoot ?? path42.join(path42.dirname(new URL(importMetaUrl).pathname), "..", "..");
+      const changelogPath = path42.join(pkgRoot, "CHANGELOG.md");
       try {
-        const changelogContent = fs38.readFileSync(changelogPath, "utf-8");
+        const changelogContent = fs39.readFileSync(changelogPath, "utf-8");
         const sections = sliceChangelog(changelogContent, installedVersion, targetVersion);
         if (sections.length > 0) {
           const deltaText = sections.map((s) => s.body).join("\n\n");
@@ -9347,7 +9764,7 @@ async function upgradeHandler(flags, cli) {
     const { entry, currentSha, installSha, action } = item;
     let preMutationContent = null;
     if (SESSION_LOAD_PATHS.has(entry.path)) {
-      const targetPath = path41.join(cwd, entry.path);
+      const targetPath = path42.join(cwd, entry.path);
       try {
         preMutationContent = await fsp.readFile(targetPath, "utf-8");
       } catch {
@@ -9385,7 +9802,7 @@ async function upgradeHandler(flags, cli) {
       package_sha: entry.sha256
     };
     if (SESSION_LOAD_PATHS.has(entry.path) && preMutationContent !== null) {
-      const targetPath = path41.join(cwd, entry.path);
+      const targetPath = path42.join(cwd, entry.path);
       let postMutationContent;
       try {
         postMutationContent = await fsp.readFile(targetPath, "utf-8");
@@ -9410,9 +9827,9 @@ async function upgradeHandler(flags, cli) {
 
 // src/commands/uninstall.ts
 init_cjs_shims();
-var fs39 = __toESM(require("fs"), 1);
+var fs40 = __toESM(require("fs"), 1);
 var fsp2 = __toESM(require("fs/promises"), 1);
-var path42 = __toESM(require("path"), 1);
+var path43 = __toESM(require("path"), 1);
 var import_node_child_process15 = require("child_process");
 var USER_ARTIFACT_TIERS = ["user-artifact"];
 var FRAMEWORK_TIERS = ["protocol", "template", "agent", "hook", "skill", "cli-config", "derived"];
@@ -9438,10 +9855,10 @@ function shouldPreserve(entry, preserveSet, removeSet) {
   return false;
 }
 function resolveProjectName(target) {
-  const pkgPath = path42.join(target, "package.json");
-  if (fs39.existsSync(pkgPath)) {
+  const pkgPath = path43.join(target, "package.json");
+  if (fs40.existsSync(pkgPath)) {
     try {
-      const raw = fs39.readFileSync(pkgPath, "utf-8");
+      const raw = fs40.readFileSync(pkgPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.name && typeof parsed.name === "string") {
         return parsed.name;
@@ -9449,7 +9866,7 @@ function resolveProjectName(target) {
     } catch {
     }
   }
-  return path42.basename(target);
+  return path43.basename(target);
 }
 function detectUncommittedChanges(target, manifestPaths, gitRunner) {
   const run = gitRunner ?? ((args) => {
@@ -9478,8 +9895,8 @@ function detectUncommittedChanges(target, manifestPaths, gitRunner) {
   return changedFiles.filter((f) => manifestSet.has(f));
 }
 async function removeFromPackageJson(target, dryRun) {
-  const pkgPath = path42.join(target, "package.json");
-  if (!fs39.existsSync(pkgPath)) return false;
+  const pkgPath = path43.join(target, "package.json");
+  if (!fs40.existsSync(pkgPath)) return false;
   let raw;
   try {
     raw = await fsp2.readFile(pkgPath, "utf-8");
@@ -9520,7 +9937,7 @@ async function removeFile(filePath) {
 }
 async function removeDir(dirPath) {
   try {
-    fs39.rmSync(dirPath, { recursive: true, force: true });
+    fs40.rmSync(dirPath, { recursive: true, force: true });
   } catch {
   }
 }
@@ -9540,12 +9957,12 @@ async function uninstallHandler(opts) {
     for (const t of FRAMEWORK_TIERS) removeSet.add(t);
     for (const u of USER_ARTIFACT_TIERS) removeSet.add(u);
   }
-  const target = opts.path ? path42.resolve(opts.path) : cwd;
-  const cleargateDir = path42.join(target, ".cleargate");
-  const manifestPath = path42.join(cleargateDir, ".install-manifest.json");
-  const uninstalledPath = path42.join(cleargateDir, ".uninstalled");
-  if (!fs39.existsSync(manifestPath)) {
-    if (fs39.existsSync(uninstalledPath)) {
+  const target = opts.path ? path43.resolve(opts.path) : cwd;
+  const cleargateDir = path43.join(target, ".cleargate");
+  const manifestPath = path43.join(cleargateDir, ".install-manifest.json");
+  const uninstalledPath = path43.join(cleargateDir, ".uninstalled");
+  if (!fs40.existsSync(manifestPath)) {
+    if (fs40.existsSync(uninstalledPath)) {
       stdout("already uninstalled");
       exit(0);
       return;
@@ -9554,7 +9971,7 @@ async function uninstallHandler(opts) {
     exit(0);
     return;
   }
-  if (fs39.existsSync(uninstalledPath) && !fs39.existsSync(manifestPath)) {
+  if (fs40.existsSync(uninstalledPath) && !fs40.existsSync(manifestPath)) {
     stdout("already uninstalled");
     exit(0);
     return;
@@ -9576,10 +9993,10 @@ async function uninstallHandler(opts) {
       return;
     }
   }
-  const claudeMdPath = path42.join(target, "CLAUDE.md");
+  const claudeMdPath = path43.join(target, "CLAUDE.md");
   let claudeMdContent = null;
-  if (fs39.existsSync(claudeMdPath)) {
-    claudeMdContent = fs39.readFileSync(claudeMdPath, "utf-8");
+  if (fs40.existsSync(claudeMdPath)) {
+    claudeMdContent = fs40.readFileSync(claudeMdPath, "utf-8");
     if (!claudeMdContent.includes(CLEARGATE_START)) {
       stderr("CLAUDE.md is missing <!-- CLEARGATE:START --> marker");
       exit(1);
@@ -9595,8 +10012,8 @@ async function uninstallHandler(opts) {
   const toPreserve = [];
   const toSkip = [];
   for (const entry of snapshot.files) {
-    const filePath = path42.join(target, entry.path);
-    if (!fs39.existsSync(filePath)) {
+    const filePath = path43.join(target, entry.path);
+    if (!fs40.existsSync(filePath)) {
       toSkip.push(entry);
       continue;
     }
@@ -9653,7 +10070,7 @@ async function uninstallHandler(opts) {
   const removedPaths = [];
   const preservedPaths = [];
   for (const entry of toRemove) {
-    const filePath = path42.join(target, entry.path);
+    const filePath = path43.join(target, entry.path);
     await removeFile(filePath);
     removedPaths.push(entry.path);
   }
@@ -9669,10 +10086,10 @@ async function uninstallHandler(opts) {
       stderr(`Warning: could not strip CLAUDE.md block: ${err.message}`);
     }
   }
-  const settingsPath = path42.join(target, ".claude", "settings.json");
-  if (fs39.existsSync(settingsPath)) {
+  const settingsPath = path43.join(target, ".claude", "settings.json");
+  if (fs40.existsSync(settingsPath)) {
     try {
-      const raw = fs39.readFileSync(settingsPath, "utf-8");
+      const raw = fs40.readFileSync(settingsPath, "utf-8");
       const settings = JSON.parse(raw);
       const cleaned = removeClearGateHooks(settings);
       await writeAtomic3(settingsPath, JSON.stringify(cleaned, null, 2) + "\n");
@@ -9687,7 +10104,7 @@ async function uninstallHandler(opts) {
     stdout("Removed @cleargate/cli from package.json. Run `npm install` to update package-lock.json.");
   }
   await removeFile(manifestPath);
-  await removeFile(path42.join(cleargateDir, ".drift-state.json"));
+  await removeFile(path43.join(cleargateDir, ".drift-state.json"));
   const marker = {
     uninstalled_at: now().toISOString(),
     prior_version: snapshot.cleargate_version,
@@ -9712,30 +10129,30 @@ async function uninstallHandler(opts) {
 // src/commands/sync.ts
 init_cjs_shims();
 var fsPromises8 = __toESM(require("fs/promises"), 1);
-var path51 = __toESM(require("path"), 1);
+var path52 = __toESM(require("path"), 1);
 
 // src/lib/sync-log.ts
 init_cjs_shims();
-var fs40 = __toESM(require("fs"), 1);
+var fs41 = __toESM(require("fs"), 1);
 var fsPromises2 = __toESM(require("fs/promises"), 1);
-var path43 = __toESM(require("path"), 1);
+var path44 = __toESM(require("path"), 1);
 function resolveActiveSprintDir(projectRoot, _opts) {
-  const sprintRunsRoot = path43.join(projectRoot, ".cleargate", "sprint-runs");
-  const offSprint = path43.join(sprintRunsRoot, "_off-sprint");
-  if (!fs40.existsSync(sprintRunsRoot)) {
-    fs40.mkdirSync(sprintRunsRoot, { recursive: true });
-    fs40.mkdirSync(offSprint, { recursive: true });
+  const sprintRunsRoot = path44.join(projectRoot, ".cleargate", "sprint-runs");
+  const offSprint = path44.join(sprintRunsRoot, "_off-sprint");
+  if (!fs41.existsSync(sprintRunsRoot)) {
+    fs41.mkdirSync(sprintRunsRoot, { recursive: true });
+    fs41.mkdirSync(offSprint, { recursive: true });
     return offSprint;
   }
-  const entries = fs40.readdirSync(sprintRunsRoot, { withFileTypes: true });
+  const entries = fs41.readdirSync(sprintRunsRoot, { withFileTypes: true });
   const sprintDirs = entries.filter((e) => e.isDirectory() && e.name !== "_off-sprint").map((e) => {
-    const fullPath = path43.join(sprintRunsRoot, e.name);
-    const stat = fs40.statSync(fullPath);
+    const fullPath = path44.join(sprintRunsRoot, e.name);
+    const stat = fs41.statSync(fullPath);
     return { name: e.name, fullPath, mtimeMs: stat.mtimeMs };
   }).sort((a, b) => b.mtimeMs - a.mtimeMs);
   if (sprintDirs.length === 0) {
-    if (!fs40.existsSync(offSprint)) {
-      fs40.mkdirSync(offSprint, { recursive: true });
+    if (!fs41.existsSync(offSprint)) {
+      fs41.mkdirSync(offSprint, { recursive: true });
     }
     return offSprint;
   }
@@ -9746,7 +10163,7 @@ function redactDetail(detail) {
   return detail.replace(/eyJ[A-Za-z0-9._-]+/g, "[REDACTED]");
 }
 async function appendSyncLog(sprintRoot, entry) {
-  const logPath = path43.join(sprintRoot, "sync-log.jsonl");
+  const logPath = path44.join(sprintRoot, "sync-log.jsonl");
   await fsPromises2.mkdir(sprintRoot, { recursive: true });
   const safeEntry = {
     ...entry,
@@ -9756,7 +10173,7 @@ async function appendSyncLog(sprintRoot, entry) {
   await fsPromises2.appendFile(logPath, line, { encoding: "utf8" });
 }
 async function readSyncLog(sprintRoot, filters) {
-  const logPath = path43.join(sprintRoot, "sync-log.jsonl");
+  const logPath = path44.join(sprintRoot, "sync-log.jsonl");
   let raw;
   try {
     raw = await fsPromises2.readFile(logPath, "utf8");
@@ -9862,7 +10279,7 @@ function classify2(local, remote, since) {
 init_cjs_shims();
 var import_node_fs2 = require("fs");
 var os8 = __toESM(require("os"), 1);
-var path44 = __toESM(require("path"), 1);
+var path45 = __toESM(require("path"), 1);
 function promptFourChoice(opts) {
   const { stdin, stdout } = opts;
   stdout("[k]eep mine / [t]ake theirs / [e]dit in $EDITOR / [a]bort: ");
@@ -9932,7 +10349,7 @@ async function promptThreeWayMerge(opts) {
       case "a":
         return { resolution: "aborted", body: local };
       case "e": {
-        const tmpFile = path44.join(os8.tmpdir(), `cleargate-merge-${itemId}-${now()}.md`);
+        const tmpFile = path45.join(os8.tmpdir(), `cleargate-merge-${itemId}-${now()}.md`);
         const markerContent = `<<<<<<< local
 ${local}
 =======
@@ -10032,12 +10449,12 @@ init_config();
 // src/lib/intake.ts
 init_cjs_shims();
 var fsPromises4 = __toESM(require("fs/promises"), 1);
-var path47 = __toESM(require("path"), 1);
+var path48 = __toESM(require("path"), 1);
 
 // src/lib/slug.ts
 init_cjs_shims();
 var fsPromises3 = __toESM(require("fs/promises"), 1);
-var path46 = __toESM(require("path"), 1);
+var path47 = __toESM(require("path"), 1);
 function slugify(title, max = 40) {
   const normalized = title.normalize("NFKD").replace(new RegExp("\\p{M}", "gu"), "");
   const lowered = normalized.toLowerCase();
@@ -10052,8 +10469,8 @@ function slugify(title, max = 40) {
 var PROPOSAL_ID_RE = /^proposal_id:\s*"?PROP-(\d+)"?/m;
 async function nextProposalId(projectRoot) {
   const dirs = [
-    path46.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path46.join(projectRoot, ".cleargate", "delivery", "archive")
+    path47.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path47.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   let maxN = 0;
   for (const dir of dirs) {
@@ -10065,7 +10482,7 @@ async function nextProposalId(projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path46.join(dir, entry.name);
+      const fullPath = path47.join(dir, entry.name);
       try {
         const raw = await fsPromises3.readFile(fullPath, "utf8");
         const fmEnd = extractFrontmatterBlock(raw);
@@ -10083,8 +10500,8 @@ async function nextProposalId(projectRoot) {
 }
 async function findByRemoteId(projectRoot, remoteId) {
   const dirs = [
-    path46.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path46.join(projectRoot, ".cleargate", "delivery", "archive")
+    path47.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path47.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   const escaped = remoteId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`^remote_id:\\s*"?${escaped}"?\\s*$`, "m");
@@ -10097,7 +10514,7 @@ async function findByRemoteId(projectRoot, remoteId) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path46.join(dir, entry.name);
+      const fullPath = path47.join(dir, entry.name);
       try {
         const raw = await fsPromises3.readFile(fullPath, "utf8");
         const fm = extractFrontmatterBlock(raw);
@@ -10134,7 +10551,7 @@ async function runIntakeBranch(opts) {
     labelFilter = "cleargate:proposal",
     now = () => (/* @__PURE__ */ new Date()).toISOString()
   } = opts;
-  const pendingSyncDir = path47.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSyncDir = path48.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let remoteItems = [];
   try {
     remoteItems = await mcp2.call(
@@ -10165,7 +10582,7 @@ async function runIntakeBranch(opts) {
       const slug2 = slugify(item.title ?? "untitled");
       const num2 = proposalId2.replace("PROP-", "");
       const filename2 = `PROPOSAL-${num2}-remote-${slug2}.md`;
-      const targetPath2 = path47.join(pendingSyncDir, filename2);
+      const targetPath2 = path48.join(pendingSyncDir, filename2);
       createdItems.push({
         proposalId: proposalId2,
         remoteId: item.remote_id,
@@ -10178,7 +10595,7 @@ async function runIntakeBranch(opts) {
     const num = proposalId.replace("PROP-", "");
     const slug = slugify(item.title ?? "untitled");
     const filename = `PROPOSAL-${num}-remote-${slug}.md`;
-    const targetPath = path47.join(pendingSyncDir, filename);
+    const targetPath = path48.join(pendingSyncDir, filename);
     const nowTs = now();
     const fm = {
       proposal_id: proposalId,
@@ -10270,8 +10687,8 @@ path/to/new/file.ext - {Explanation of purpose}
 }
 async function hasAnyRemoteAuthored(projectRoot) {
   const dirs = [
-    path47.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path47.join(projectRoot, ".cleargate", "delivery", "archive")
+    path48.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path48.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   for (const dir of dirs) {
     let entries;
@@ -10282,7 +10699,7 @@ async function hasAnyRemoteAuthored(projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path47.join(dir, entry.name);
+      const fullPath = path48.join(dir, entry.name);
       try {
         const raw = await fsPromises4.readFile(fullPath, "utf8");
         const fmEnd = raw.indexOf("\n---", 4);
@@ -10300,9 +10717,9 @@ async function hasAnyRemoteAuthored(projectRoot) {
 
 // src/lib/active-criteria.ts
 init_cjs_shims();
-var fs43 = __toESM(require("fs"), 1);
+var fs44 = __toESM(require("fs"), 1);
 var fsPromises5 = __toESM(require("fs/promises"), 1);
-var path48 = __toESM(require("path"), 1);
+var path49 = __toESM(require("path"), 1);
 async function resolveActiveItems(projectRoot, localItems, nowFn = () => (/* @__PURE__ */ new Date()).toISOString()) {
   const active = /* @__PURE__ */ new Set();
   const now = Date.parse(nowFn());
@@ -10327,7 +10744,7 @@ async function resolveInSprintIds(projectRoot) {
   const ids = /* @__PURE__ */ new Set();
   try {
     const sprintDir = resolveActiveSprintDir(projectRoot);
-    const sprintId = path48.basename(sprintDir);
+    const sprintId = path49.basename(sprintDir);
     if (sprintId === "_off-sprint") return ids;
     const sprintFile = await findSprintFile2(projectRoot, sprintId);
     if (!sprintFile) return ids;
@@ -10342,14 +10759,14 @@ async function resolveInSprintIds(projectRoot) {
   return ids;
 }
 async function findSprintFile2(projectRoot, sprintId) {
-  const pendingSync = path48.join(projectRoot, ".cleargate", "delivery", "pending-sync");
-  const archive = path48.join(projectRoot, ".cleargate", "delivery", "archive");
+  const pendingSync = path49.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const archive = path49.join(projectRoot, ".cleargate", "delivery", "archive");
   for (const dir of [pendingSync, archive]) {
     try {
-      const entries = fs43.readdirSync(dir, { withFileTypes: true });
+      const entries = fs44.readdirSync(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isFile() && entry.name.startsWith(sprintId) && entry.name.endsWith(".md")) {
-          return path48.join(dir, entry.name);
+          return path49.join(dir, entry.name);
         }
       }
     } catch {
@@ -10361,12 +10778,12 @@ async function findSprintFile2(projectRoot, sprintId) {
 // src/lib/comments-cache.ts
 init_cjs_shims();
 var fsPromises6 = __toESM(require("fs/promises"), 1);
-var path49 = __toESM(require("path"), 1);
+var path50 = __toESM(require("path"), 1);
 function cacheDir(projectRoot) {
-  return path49.join(projectRoot, ".cleargate", ".comments-cache");
+  return path50.join(projectRoot, ".cleargate", ".comments-cache");
 }
 function cachePath(projectRoot, remoteId) {
-  return path49.join(cacheDir(projectRoot), `${remoteId}.json`);
+  return path50.join(cacheDir(projectRoot), `${remoteId}.json`);
 }
 async function writeCommentCache(projectRoot, remoteId, comments) {
   const dir = cacheDir(projectRoot);
@@ -10381,7 +10798,7 @@ async function writeCommentCache(projectRoot, remoteId, comments) {
 // src/lib/wiki-comments-render.ts
 init_cjs_shims();
 var fsPromises7 = __toESM(require("fs/promises"), 1);
-var path50 = __toESM(require("path"), 1);
+var path51 = __toESM(require("path"), 1);
 var START = "<!-- cleargate:comments:start -->";
 var END = "<!-- cleargate:comments:end -->";
 function resolveBucket(fm) {
@@ -10426,7 +10843,7 @@ async function renderCommentsSection(opts) {
   const bucket = resolveBucket(localItem.fm);
   const primaryId = getPrimaryId(localItem.fm);
   if (!bucket || !primaryId) return;
-  const wikiPath = path50.join(
+  const wikiPath = path51.join(
     projectRoot,
     ".cleargate",
     "wiki",
@@ -10462,7 +10879,7 @@ async function renderCommentsSection(opts) {
   await writeAtomic4(wikiPath, updated);
 }
 async function writeAtomic4(filePath, content) {
-  await fsPromises7.mkdir(path50.dirname(filePath), { recursive: true });
+  await fsPromises7.mkdir(path51.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises7.writeFile(tmpPath, content, "utf8");
   await fsPromises7.rename(tmpPath, filePath);
@@ -10474,11 +10891,11 @@ async function syncCheckHandler(opts = {}) {
   const env = opts.env ?? process.env;
   const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
   const nowFn = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const markerPath = path51.join(projectRoot, ".cleargate", ".sync-marker.json");
+  const markerPath = path52.join(projectRoot, ".cleargate", ".sync-marker.json");
   const updateMarker = async (nowIso2) => {
     try {
       const content = JSON.stringify({ last_check: nowIso2 });
-      await fsPromises8.mkdir(path51.dirname(markerPath), { recursive: true });
+      await fsPromises8.mkdir(path52.dirname(markerPath), { recursive: true });
       const tmpPath = `${markerPath}.tmp.${Date.now()}`;
       await fsPromises8.writeFile(tmpPath, content, "utf8");
       await fsPromises8.rename(tmpPath, markerPath);
@@ -10561,7 +10978,7 @@ async function syncHandler(opts = {}) {
   const nowFn = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const identity = resolveIdentity(projectRoot);
   const sprintRoot = resolveActiveSprintDir(projectRoot);
-  const sprintId = path51.basename(sprintRoot);
+  const sprintId = path52.basename(sprintRoot);
   let mcp2;
   if (opts.mcp) {
     mcp2 = opts.mcp;
@@ -10622,7 +11039,7 @@ async function syncHandler(opts = {}) {
     exit(2);
     return;
   }
-  const wikiMetaPath = path51.join(projectRoot, ".cleargate", "wiki", "meta.json");
+  const wikiMetaPath = path52.join(projectRoot, ".cleargate", "wiki", "meta.json");
   let lastRemoteSync = "1970-01-01T00:00:00.000Z";
   try {
     const metaRaw = await fsPromises8.readFile(wikiMetaPath, "utf8");
@@ -10863,7 +11280,7 @@ async function syncHandler(opts = {}) {
     };
     await appendSyncLog(sprintRoot, entry);
   }
-  const conflictsFile = path51.join(projectRoot, ".cleargate", ".conflicts.json");
+  const conflictsFile = path52.join(projectRoot, ".cleargate", ".conflicts.json");
   const conflictsContent = {
     generated_at: nowFn(),
     sprint_id: sprintId,
@@ -10871,7 +11288,7 @@ async function syncHandler(opts = {}) {
   };
   await writeAtomic5(conflictsFile, JSON.stringify(conflictsContent, null, 2) + "\n");
   try {
-    await fsPromises8.mkdir(path51.dirname(wikiMetaPath), { recursive: true });
+    await fsPromises8.mkdir(path52.dirname(wikiMetaPath), { recursive: true });
     let meta = {};
     try {
       const raw = await fsPromises8.readFile(wikiMetaPath, "utf8");
@@ -10912,13 +11329,13 @@ async function applyPull(item, localPath, fm, actorEmail, nowFn) {
   await writeAtomic5(localPath, newContent);
 }
 async function writeAtomic5(filePath, content) {
-  await fsPromises8.mkdir(path51.dirname(filePath), { recursive: true });
+  await fsPromises8.mkdir(path52.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises8.writeFile(tmpPath, content, "utf8");
   await fsPromises8.rename(tmpPath, filePath);
 }
 async function scanLocalItems(projectRoot) {
-  const pendingSync = path51.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSync = path52.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   const results = [];
   let entries;
   try {
@@ -10928,7 +11345,7 @@ async function scanLocalItems(projectRoot) {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const fullPath = path51.join(pendingSync, entry.name);
+    const fullPath = path52.join(pendingSync, entry.name);
     try {
       const raw = await fsPromises8.readFile(fullPath, "utf8");
       const { fm, body } = parseFrontmatter(raw);
@@ -10956,7 +11373,7 @@ init_config();
 // src/lib/sync/work-items.ts
 init_cjs_shims();
 var fsPromises9 = __toESM(require("fs/promises"), 1);
-var path52 = __toESM(require("path"), 1);
+var path53 = __toESM(require("path"), 1);
 var import_node_crypto2 = require("crypto");
 var BATCH_SIZE = 100;
 var ATTRIBUTION_FIELDS = /* @__PURE__ */ new Set([
@@ -11004,8 +11421,8 @@ function getItemId2(fm) {
 }
 async function walkDeliveryDirs(projectRoot) {
   const dirs = [
-    path52.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path52.join(projectRoot, ".cleargate", "delivery", "archive")
+    path53.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path53.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   const results = [];
   for (const dir of dirs) {
@@ -11017,7 +11434,7 @@ async function walkDeliveryDirs(projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path52.join(dir, entry.name);
+      const fullPath = path53.join(dir, entry.name);
       try {
         const raw = await fsPromises9.readFile(fullPath, "utf8");
         const { fm, body } = parseFrontmatter(raw);
@@ -11042,7 +11459,7 @@ async function walkDeliveryDirs(projectRoot) {
   return results;
 }
 async function writeAtomic6(filePath, content) {
-  await fsPromises9.mkdir(path52.dirname(filePath), { recursive: true });
+  await fsPromises9.mkdir(path53.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises9.writeFile(tmpPath, content, "utf8");
   await fsPromises9.rename(tmpPath, filePath);
@@ -11109,9 +11526,9 @@ async function syncWorkItems(opts) {
 
 // src/lib/admin-url.ts
 init_cjs_shims();
-var fs44 = __toESM(require("fs"), 1);
+var fs45 = __toESM(require("fs"), 1);
 var os10 = __toESM(require("os"), 1);
-var path53 = __toESM(require("path"), 1);
+var path54 = __toESM(require("path"), 1);
 var DEFAULT_BASE = "https://admin.cleargate.soula.ge/";
 function adminUrl(urlPath, opts) {
   const env = opts?.env ?? process.env;
@@ -11134,8 +11551,8 @@ function adminUrl(urlPath, opts) {
 function readLocalConfig() {
   const home = os10.homedir();
   if (!home) return null;
-  const configPath = path53.join(home, ".cleargate", "config.json");
-  const raw = fs44.readFileSync(configPath, "utf8");
+  const configPath = path54.join(home, ".cleargate", "config.json");
+  const raw = fs45.readFileSync(configPath, "utf8");
   return JSON.parse(raw);
 }
 
@@ -11250,7 +11667,7 @@ async function syncWorkItemsHandler(opts = {}) {
 // src/commands/pull.ts
 init_cjs_shims();
 var fsPromises10 = __toESM(require("fs/promises"), 1);
-var path54 = __toESM(require("path"), 1);
+var path55 = __toESM(require("path"), 1);
 init_acquire();
 init_config();
 async function pullHandler(idOrRemoteId, opts = {}) {
@@ -11365,7 +11782,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
     result: "ok"
   };
   await appendSyncLog(sprintRoot, entry);
-  stdout(`pull: ${remoteId} applied to ${path54.relative(projectRoot, localPath)}
+  stdout(`pull: ${remoteId} applied to ${path55.relative(projectRoot, localPath)}
 `);
   if (opts.comments) {
     const comments = await mcp2.call(
@@ -11388,7 +11805,7 @@ async function resolveRemoteId(idOrRemoteId, projectRoot) {
   if (/^[A-Z]+-\d+/.test(idOrRemoteId)) {
     return idOrRemoteId;
   }
-  const pendingSync = path54.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSync = path55.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let entries;
   try {
     entries = await fsPromises10.readdir(pendingSync, { withFileTypes: true });
@@ -11398,7 +11815,7 @@ async function resolveRemoteId(idOrRemoteId, projectRoot) {
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
     try {
-      const raw = await fsPromises10.readFile(path54.join(pendingSync, entry.name), "utf8");
+      const raw = await fsPromises10.readFile(path55.join(pendingSync, entry.name), "utf8");
       const { fm } = parseFrontmatter(raw);
       for (const key of ["story_id", "epic_id", "proposal_id", "cr_id", "bug_id"]) {
         if (fm[key] === idOrRemoteId && typeof fm["remote_id"] === "string") {
@@ -11411,7 +11828,7 @@ async function resolveRemoteId(idOrRemoteId, projectRoot) {
   return null;
 }
 async function findLocalFile(remoteId, projectRoot) {
-  const pendingSync = path54.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSync = path55.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let entries;
   try {
     entries = await fsPromises10.readdir(pendingSync, { withFileTypes: true });
@@ -11420,7 +11837,7 @@ async function findLocalFile(remoteId, projectRoot) {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const fullPath = path54.join(pendingSync, entry.name);
+    const fullPath = path55.join(pendingSync, entry.name);
     try {
       const raw = await fsPromises10.readFile(fullPath, "utf8");
       const { fm } = parseFrontmatter(raw);
@@ -11431,7 +11848,7 @@ async function findLocalFile(remoteId, projectRoot) {
   return null;
 }
 async function writeAtomic7(filePath, content) {
-  await fsPromises10.mkdir(path54.dirname(filePath), { recursive: true });
+  await fsPromises10.mkdir(path55.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises10.writeFile(tmpPath, content, "utf8");
   await fsPromises10.rename(tmpPath, filePath);
@@ -11446,8 +11863,9 @@ function getItemId3(fm) {
 
 // src/commands/push.ts
 init_cjs_shims();
+var fs46 = __toESM(require("fs"), 1);
 var fsPromises11 = __toESM(require("fs/promises"), 1);
-var path55 = __toESM(require("path"), 1);
+var path56 = __toESM(require("path"), 1);
 init_acquire();
 init_config();
 async function pushHandler(fileOrId, opts = {}) {
@@ -11457,6 +11875,13 @@ async function pushHandler(fileOrId, opts = {}) {
   const stderr = opts.stderr ?? ((s) => process.stderr.write(s));
   const exit = opts.exit ?? ((c) => process.exit(c));
   const nowFn = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const migrationLockPath = path56.join(projectRoot, ".cleargate", ".migration-lock");
+  if (fs46.existsSync(migrationLockPath)) {
+    stderr(`Error: CR-067 migration in progress (.migration-lock held); retry in 30s
+`);
+    exit(75);
+    return;
+  }
   const identity = resolveIdentity(projectRoot);
   const sprintRoot = resolveActiveSprintDir(projectRoot);
   async function resolveMcp() {
@@ -11523,7 +11948,20 @@ async function pushHandler(fileOrId, opts = {}) {
 }
 async function handlePush(filePath, ctx) {
   const { projectRoot, identity, sprintRoot, nowFn, resolveMcp, stdout, stderr, exit } = ctx;
-  const resolvedPath = path55.isAbsolute(filePath) ? filePath : path55.resolve(projectRoot, filePath);
+  const resolvedPath = path56.isAbsolute(filePath) ? filePath : path56.resolve(projectRoot, filePath);
+  if (SPRINT_RUNS_PATH_REGEX.test(resolvedPath)) {
+    if (!SPRINT_REPORT_PATH_REGEX.test(resolvedPath)) {
+      stderr(
+        `Error: path not in allowlist. Only sprint report files are accepted from sprint-runs/.
+  Allowed: .cleargate/sprint-runs/SPRINT-NN/REPORT.md
+           .cleargate/sprint-runs/SPRINT-NN/SPRINT-NN_REPORT.md
+  Got:     "${resolvedPath}"
+`
+      );
+      exit(2);
+      return;
+    }
+  }
   let rawContent;
   try {
     rawContent = await fsPromises11.readFile(resolvedPath, "utf8");
@@ -11553,7 +11991,7 @@ async function handlePush(filePath, ctx) {
     return;
   }
   const itemId = getItemId4(fm);
-  const type = getItemType2(fm);
+  const type = getItemTypeWithPathOverride(resolvedPath, fm);
   if (!type) {
     stderr(`Error: cannot determine item type from frontmatter in "${resolvedPath}".
 `);
@@ -11566,6 +12004,9 @@ async function handlePush(filePath, ctx) {
     if (h1) payloadForPush["title"] = h1;
   }
   payloadForPush["body"] = body;
+  if (payloadForPush["origin"] === void 0) {
+    payloadForPush["origin"] = "cleargate-cli";
+  }
   const mcp2 = await resolveMcp();
   let result;
   try {
@@ -11649,8 +12090,8 @@ async function handleRevert(idOrRemoteId, ctx) {
   void localPath;
 }
 async function resolveLocalItem(idOrRemoteId, projectRoot) {
-  const pendingSync = path55.join(projectRoot, ".cleargate", "delivery", "pending-sync");
-  const archive = path55.join(projectRoot, ".cleargate", "delivery", "archive");
+  const pendingSync = path56.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const archive = path56.join(projectRoot, ".cleargate", "delivery", "archive");
   for (const dir of [pendingSync, archive]) {
     let entries;
     try {
@@ -11660,7 +12101,7 @@ async function resolveLocalItem(idOrRemoteId, projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path55.join(dir, entry.name);
+      const fullPath = path56.join(dir, entry.name);
       try {
         const raw = await fsPromises11.readFile(fullPath, "utf8");
         const { fm } = parseFrontmatter(raw);
@@ -11679,23 +12120,26 @@ async function resolveLocalItem(idOrRemoteId, projectRoot) {
   return null;
 }
 async function writeAtomic8(filePath, content) {
-  await fsPromises11.mkdir(path55.dirname(filePath), { recursive: true });
+  await fsPromises11.mkdir(path56.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises11.writeFile(tmpPath, content, "utf8");
   await fsPromises11.rename(tmpPath, filePath);
 }
 function getItemId4(fm) {
-  for (const key of ["story_id", "epic_id", "proposal_id", "cr_id", "bug_id"]) {
+  for (const key of ["story_id", "epic_id", "proposal_id", "sprint_id", "cr_id", "bug_id"]) {
     const val = fm[key];
     if (typeof val === "string" && val) return val;
   }
   return "unknown";
 }
+var SPRINT_RUNS_PATH_REGEX = /\.cleargate[\\/]sprint-runs[\\/]/;
+var SPRINT_REPORT_PATH_REGEX = /\.cleargate[\\/]sprint-runs[\\/]SPRINT-\d{2,}[\\/](REPORT|SPRINT-\d{2,}_REPORT)\.md$/;
 function getItemType2(fm) {
   const typeMap = {
     story_id: "story",
     epic_id: "epic",
     proposal_id: "proposal",
+    sprint_id: "sprint",
     cr_id: "cr",
     bug_id: "bug"
   };
@@ -11704,11 +12148,15 @@ function getItemType2(fm) {
   }
   return null;
 }
+function getItemTypeWithPathOverride(localPath, fm) {
+  if (SPRINT_REPORT_PATH_REGEX.test(localPath)) return "sprint_report";
+  return getItemType2(fm);
+}
 
 // src/commands/conflicts.ts
 init_cjs_shims();
 var fsPromises12 = __toESM(require("fs/promises"), 1);
-var path56 = __toESM(require("path"), 1);
+var path57 = __toESM(require("path"), 1);
 init_acquire();
 init_config();
 var RESOLUTION_HINTS = {
@@ -11746,7 +12194,7 @@ async function conflictsHandler(opts = {}) {
       }
     }
   }
-  const conflictsFile = path56.join(projectRoot, ".cleargate", ".conflicts.json");
+  const conflictsFile = path57.join(projectRoot, ".cleargate", ".conflicts.json");
   let data;
   try {
     const raw = await fsPromises12.readFile(conflictsFile, "utf8");
@@ -11834,8 +12282,8 @@ function formatEntry(entry) {
 
 // src/commands/admin-login.ts
 init_cjs_shims();
-var fs45 = __toESM(require("fs"), 1);
-var path57 = __toESM(require("path"), 1);
+var fs47 = __toESM(require("fs"), 1);
+var path58 = __toESM(require("path"), 1);
 var os11 = __toESM(require("os"), 1);
 var DEFAULT_MCP_URL = "http://localhost:3000";
 function resolveMcpUrl(mcpUrlFlag, env) {
@@ -11844,14 +12292,14 @@ function resolveMcpUrl(mcpUrlFlag, env) {
 function resolveAuthFilePath(opts) {
   if (opts.authFilePath) return opts.authFilePath;
   const homedirFn = opts.homedir ?? os11.homedir;
-  return path57.join(homedirFn(), ".cleargate", "admin-auth.json");
+  return path58.join(homedirFn(), ".cleargate", "admin-auth.json");
 }
 function writeAdminAuth(filePath, token) {
-  const dir = path57.dirname(filePath);
-  fs45.mkdirSync(dir, { recursive: true });
+  const dir = path58.dirname(filePath);
+  fs47.mkdirSync(dir, { recursive: true });
   const payload = JSON.stringify({ version: 1, token }, null, 2);
-  fs45.writeFileSync(filePath, payload, { encoding: "utf8", mode: 384 });
-  fs45.chmodSync(filePath, 384);
+  fs47.writeFileSync(filePath, payload, { encoding: "utf8", mode: 384 });
+  fs47.chmodSync(filePath, 384);
 }
 async function adminLoginHandler(opts = {}) {
   const fetchFn = opts.fetch ?? globalThis.fetch;
@@ -11961,8 +12409,8 @@ async function adminLoginHandler(opts = {}) {
 
 // src/commands/hotfix.ts
 init_cjs_shims();
-var fs46 = __toESM(require("fs"), 1);
-var path58 = __toESM(require("path"), 1);
+var fs48 = __toESM(require("fs"), 1);
+var path59 = __toESM(require("path"), 1);
 function defaultExit4(code) {
   return process.exit(code);
 }
@@ -11972,7 +12420,7 @@ function maxHotfixId(pendingDir) {
   let max = 0;
   let entries;
   try {
-    entries = fs46.readdirSync(pendingDir);
+    entries = fs48.readdirSync(pendingDir);
   } catch {
     return 0;
   }
@@ -11986,13 +12434,13 @@ function maxHotfixId(pendingDir) {
   return max;
 }
 function countActiveHotfixes(repoRoot) {
-  const pendingDir = path58.join(repoRoot, ".cleargate", "delivery", "pending-sync");
-  const archiveDir = path58.join(repoRoot, ".cleargate", "delivery", "archive");
+  const pendingDir = path59.join(repoRoot, ".cleargate", "delivery", "pending-sync");
+  const archiveDir = path59.join(repoRoot, ".cleargate", "delivery", "archive");
   const sevenDaysAgo = Date.now() - 7 * 24 * 60 * 60 * 1e3;
   let count = 0;
   let pendingEntries = [];
   try {
-    pendingEntries = fs46.readdirSync(pendingDir);
+    pendingEntries = fs48.readdirSync(pendingDir);
   } catch {
   }
   for (const entry of pendingEntries) {
@@ -12000,13 +12448,13 @@ function countActiveHotfixes(repoRoot) {
   }
   let archiveEntries = [];
   try {
-    archiveEntries = fs46.readdirSync(archiveDir);
+    archiveEntries = fs48.readdirSync(archiveDir);
   } catch {
   }
   for (const entry of archiveEntries) {
     if (entry.startsWith("HOTFIX-") && entry.endsWith(".md")) {
       try {
-        const stat = fs46.statSync(path58.join(archiveDir, entry));
+        const stat = fs48.statSync(path59.join(archiveDir, entry));
         if (stat.mtimeMs >= sevenDaysAgo) count++;
       } catch {
       }
@@ -12015,7 +12463,7 @@ function countActiveHotfixes(repoRoot) {
   return count;
 }
 function resolveTemplatePath(repoRoot) {
-  return path58.join(repoRoot, ".cleargate", "templates", "hotfix.md");
+  return path59.join(repoRoot, ".cleargate", "templates", "hotfix.md");
 }
 function hotfixNewHandler(opts, cli) {
   const stdoutFn = cli?.stdout ?? ((s) => process.stdout.write(s + "\n"));
@@ -12034,14 +12482,14 @@ function hotfixNewHandler(opts, cli) {
     );
     return exitFn(1);
   }
-  const pendingDir = path58.join(repoRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingDir = path59.join(repoRoot, ".cleargate", "delivery", "pending-sync");
   const maxId = maxHotfixId(pendingDir);
   const nextId = maxId + 1;
   const idStr = `HOTFIX-${String(nextId).padStart(3, "0")}`;
   const templatePath = resolveTemplatePath(repoRoot);
   let templateContent;
   try {
-    templateContent = fs46.readFileSync(templatePath, "utf8");
+    templateContent = fs48.readFileSync(templatePath, "utf8");
   } catch {
     stderrFn(`[cleargate hotfix new] template not found: ${templatePath}`);
     return exitFn(2);
@@ -12049,10 +12497,10 @@ function hotfixNewHandler(opts, cli) {
   const content = templateContent.replace(/\{ID\}/g, idStr).replace(/\{SLUG\}/g, opts.slug).replace(/\{ISO\}/g, now);
   const fileSlug = opts.slug.replace(/-/g, "_");
   const fileName = `${idStr}_${fileSlug}.md`;
-  const outPath = path58.join(pendingDir, fileName);
+  const outPath = path59.join(pendingDir, fileName);
   try {
-    fs46.mkdirSync(pendingDir, { recursive: true });
-    fs46.writeFileSync(outPath, content, "utf8");
+    fs48.mkdirSync(pendingDir, { recursive: true });
+    fs48.writeFileSync(outPath, content, "utf8");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     stderrFn(`[cleargate hotfix new] write failed: ${msg}`);
@@ -12140,8 +12588,26 @@ var AuthFetcher = class {
   }
 };
 
+// src/auth/service-token-fetcher.ts
+init_cjs_shims();
+var ServiceTokenFetcher = class {
+  constructor(token) {
+    this.token = token;
+  }
+  token;
+  async getAccessToken() {
+    return this.token;
+  }
+};
+
 // src/commands/mcp-serve.ts
 var DEFAULT_BASE_URL = "https://cleargate-mcp.soula.ge";
+var ServiceToken401Error = class extends Error {
+  constructor() {
+    super("service-token-401");
+    this.name = "ServiceToken401Error";
+  }
+};
 async function mcpServeHandler(opts) {
   const fetchFn = opts.fetch ?? globalThis.fetch;
   const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
@@ -12151,32 +12617,44 @@ async function mcpServeHandler(opts) {
     flags: { profile: opts.profile, mcpUrl: opts.mcpUrlFlag }
   });
   const baseUrl = cfg.mcpUrl ?? DEFAULT_BASE_URL;
-  const store = await (opts.createStore ?? createTokenStore)({
-    ...opts.keychainService !== void 0 ? { keychainService: opts.keychainService } : {},
-    ...opts.forceBackend !== void 0 ? { forceBackend: opts.forceBackend } : {}
-  });
-  const fetcher = new AuthFetcher({
-    baseUrl,
-    loadRefresh: () => store.load(opts.profile),
-    saveRefresh: (t) => store.save(opts.profile, t),
-    ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
-    ...opts.now !== void 0 ? { now: opts.now } : {}
-  });
-  try {
-    await fetcher.getAccessToken();
-  } catch (err) {
-    if (err instanceof RefreshError) {
-      stderr(
-        `cleargate mcp serve: refresh failed (${err.status} ${err.code}). Run \`cleargate join <invite-url>\` to re-authenticate.
+  const serviceToken = process.env["CLEARGATE_SERVICE_TOKEN"] ?? "";
+  let fetcher;
+  let isServiceTokenMode;
+  if (serviceToken.length > 0) {
+    isServiceTokenMode = true;
+    fetcher = new ServiceTokenFetcher(serviceToken);
+    stderr("cleargate mcp serve: auth mode = service-token\n");
+  } else {
+    isServiceTokenMode = false;
+    const store = await (opts.createStore ?? createTokenStore)({
+      ...opts.keychainService !== void 0 ? { keychainService: opts.keychainService } : {},
+      ...opts.forceBackend !== void 0 ? { forceBackend: opts.forceBackend } : {}
+    });
+    const authFetcher = new AuthFetcher({
+      baseUrl,
+      loadRefresh: () => store.load(opts.profile),
+      saveRefresh: (t) => store.save(opts.profile, t),
+      ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
+      ...opts.now !== void 0 ? { now: opts.now } : {}
+    });
+    fetcher = authFetcher;
+    stderr("cleargate mcp serve: auth mode = keychain-refresh\n");
+    try {
+      await authFetcher.getAccessToken();
+    } catch (err) {
+      if (err instanceof RefreshError) {
+        stderr(
+          `cleargate mcp serve: refresh failed (${err.status} ${err.code}). Run \`cleargate join <invite-url>\` to re-authenticate.
 `
-      );
-    } else {
-      stderr(
-        `cleargate mcp serve: ${err instanceof Error ? err.message : String(err)}
+        );
+      } else {
+        stderr(
+          `cleargate mcp serve: ${err instanceof Error ? err.message : String(err)}
 `
-      );
+        );
+      }
+      return exit(1);
     }
-    return exit(1);
   }
   const inputStream = opts.stdin ?? process.stdin;
   const rl = readline5.createInterface({
@@ -12187,12 +12665,27 @@ async function mcpServeHandler(opts) {
   for await (const line of rl) {
     if (!line.trim()) continue;
     try {
-      await proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr);
+      await proxyOne(
+        line,
+        baseUrl,
+        fetcher,
+        isServiceTokenMode,
+        fetchFn,
+        stdout,
+        stderr
+      );
     } catch (err) {
+      if (err instanceof ServiceToken401Error) {
+        stderr(
+          `cleargate mcp serve: CLEARGATE_SERVICE_TOKEN rejected by /mcp (401). Issue a new token in the admin console: Tokens \u2192 Issue \u2192 copy snippet.
+`
+        );
+        return exit(1);
+      }
       const errMsg = err instanceof Error ? err.message : String(err);
       stderr(`cleargate mcp serve: proxy error: ${errMsg}
 `);
-      const id = extractId(line);
+      const id = extractId2(line);
       if (id !== void 0) {
         stdout(
           JSON.stringify({
@@ -12205,7 +12698,7 @@ async function mcpServeHandler(opts) {
     }
   }
 }
-async function proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr) {
+async function proxyOne(line, baseUrl, fetcher, isServiceTokenMode, fetchFn, stdout, stderr) {
   let parsed;
   try {
     parsed = JSON.parse(line);
@@ -12218,6 +12711,9 @@ async function proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr) {
   let access = await fetcher.getAccessToken();
   let res = await postFrame(baseUrl, line, access, fetchFn);
   if (res.status === 401) {
+    if (isServiceTokenMode) {
+      throw new ServiceToken401Error();
+    }
     fetcher.invalidate();
     access = await fetcher.getAccessToken();
     res = await postFrame(baseUrl, line, access, fetchFn);
@@ -12265,7 +12761,7 @@ async function streamSse(res, stdout) {
     }
   }
 }
-function extractId(line) {
+function extractId2(line) {
   try {
     const obj = JSON.parse(line);
     return "id" in obj ? obj.id : void 0;
@@ -12437,8 +12933,8 @@ sprint.command("close <sprint-id>").description("close a sprint \u2014 validates
   }
   sprintCloseHandler(handlerOpts);
 });
-sprint.command("reconcile-lifecycle <sprint-id>").description("CR-017: check lifecycle status of artifacts referenced in this sprint's commits (exits 1 on drift)").option("--since <iso-date>", "start of git log range (default: sprint start_date or 90 days ago)").option("--until <iso-date>", "end of git log range (default: now)").action((sprintId, opts) => {
-  reconcileLifecycleCliHandler({ sprintId, since: opts.since, until: opts.until });
+sprint.command("reconcile-lifecycle <sprint-id>").description("CR-017: check lifecycle status of artifacts referenced in this sprint's commits (exits 1 on drift)").option("--since <iso-date>", "start of git log range (default: sprint start_date or 90 days ago)").option("--until <iso-date>", "end of git log range (default: now)").option("--parents", "audit parent (Epic/Sprint) rollup statuses; read-only (CR-066)").action((sprintId, opts) => {
+  reconcileLifecycleCliHandler({ sprintId, since: opts.since, until: opts.until, parents: opts.parents });
 });
 sprint.command("archive <sprint-id>").description("archive a completed sprint \u2014 move pending-sync files, clear .active, merge + delete sprint branch").option("--dry-run", "print the archive plan without making any changes").option("--allow-wiki-lint-debt", "CR-022 M5: waive wiki-lint findings during archive (mirrors --allow-drift pattern)").action(async (sprintId, opts) => {
   const handlerOpts = { sprintId };