dotmd-cli 0.76.7 → 0.77.0

package/src/git.mjs

@@ -3,6 +3,7 @@ import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, lstatSync, openS
 import path from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { commitRename } from './durable-rename.mjs';
+import { ARTIFACT_PREFIX, isOwnedArtifact } from './naming.mjs';
 
 // Best-effort `git check-ignore` for a path. Returns true only when git
 // definitively reports the path is ignored; any failure (not a repo, git
@@ -579,7 +580,7 @@ function prepareMoveIndex(source, target, repoRoot, before, options = {}) {
   const paths = [source, target].map(candidate => path.isAbsolute(candidate) ? path.relative(repoRoot, candidate) : candidate);
   assertSafeGitPaths(paths);
   const { indexDir } = gitIndexLocations(repoRoot);
-  const preparedPath = path.join(indexDir, `.dotmd-index-${process.pid}-${randomUUID()}`);
+  const preparedPath = path.join(indexDir, `${ARTIFACT_PREFIX}index-${process.pid}-${randomUUID()}`);
   const artifactPath = options.artifactPath ?? preparedPath;
   writeGeneration(artifactPath, before);
   let seed = { ...describePrepared(artifactPath, before), state: 'preparing', tempPath: preparedPath, work: null };
@@ -690,7 +691,7 @@ function publishIndexGeneration(repoRoot, expected, desired, prepared, testHooks
 function publishIndexGenerationLocked(repoRoot, expected, desired, prepared, testHooks, notePublished) {
   const { indexPath, indexDir, lockPath } = gitIndexLocations(repoRoot);
   if (expected.indexPath !== indexPath || desired.indexPath !== indexPath) throw new Error('Selected Git index changed since the transaction snapshot; recovery refused to target a different index.');
-  if (!prepared || prepared.state !== 'prepared' || path.dirname(prepared.tempPath) !== indexDir || !path.basename(prepared.tempPath).startsWith('.dotmd-index-') || !preparedMatches(prepared)) throw new Error('Prepared Git index ownership could not be verified.');
+  if (!prepared || prepared.state !== 'prepared' || path.dirname(prepared.tempPath) !== indexDir || !isOwnedArtifact(path.basename(prepared.tempPath), 'index') || !preparedMatches(prepared)) throw new Error('Prepared Git index ownership could not be verified.');
   if ((desired.exists && (prepared.hash !== desired.hash || prepared.size !== desired.size || prepared.mode !== desired.mode)) || (!desired.exists && prepared.size !== 0)) throw new Error('Prepared Git index artifact does not match the desired generation.');
   const publication = prepared.work ?? prepared;
   if (!preparedMatches(publication) || (desired.exists && (publication.hash !== desired.hash || publication.size !== desired.size || publication.mode !== desired.mode)) || (!desired.exists && publication.size !== 0)) throw new Error('Selected-directory Git working index does not match the desired generation.');
@@ -766,12 +767,12 @@ export function stageMovePathsCas(source, target, repoRoot, before, options = {}
 
 export function restoreGitIndexCas(before, ownedAfter, repoRoot, options = {}) {
   const { indexDir } = gitIndexLocations(repoRoot);
-  const preparedPath = options.artifactPath ?? path.join(indexDir, `.dotmd-index-restore-${process.pid}-${randomUUID()}`);
+  const preparedPath = options.artifactPath ?? path.join(indexDir, `${ARTIFACT_PREFIX}index-restore-${process.pid}-${randomUUID()}`);
   let artifact = null;
   try {
     writeGeneration(preparedPath, before);
     const prepared = before;
-    const tempPath = path.join(indexDir, `.dotmd-index-restore-${process.pid}-${randomUUID()}`);
+    const tempPath = path.join(indexDir, `${ARTIFACT_PREFIX}index-restore-${process.pid}-${randomUUID()}`);
     artifact = { ...describePrepared(preparedPath, prepared), state: 'preparing', tempPath, work: null };
     options.testHooks?.afterGitRestoreArtifact?.({ before, ownedAfter, prepared: artifact });
     writeGeneration(tempPath, before);
@@ -802,7 +803,7 @@ export function reclaimPreparedGitIndex(manifestGitIndex, repoRoot, options = {}
   const retainedPaths = [];
   const { indexPath, indexDir, lockPath } = gitIndexLocations(repoRoot);
   if (manifestGitIndex.before?.indexPath !== indexPath || prepared.generation?.indexPath !== indexPath) throw new Error('Recovery environment selects a different Git index than the abandoned transaction.');
-  if (path.dirname(prepared.tempPath) !== indexDir || !path.basename(prepared.tempPath).startsWith('.dotmd-index-')) throw new Error('Abandoned prepared Git index path is unsafe.');
+  if (path.dirname(prepared.tempPath) !== indexDir || !isOwnedArtifact(path.basename(prepared.tempPath), 'index')) throw new Error('Abandoned prepared Git index path is unsafe.');
   if (!existsSync(prepared.path)) {
     // The lock is only ever ours as a hard link to the publication inode, so a
     // lock that does not carry that inode cannot be ours — it belongs to a live

package/src/guard.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { inspectGitCommandPaths } from './git.mjs';
 import { recordGuardEvent } from './journal.mjs';
+import { readEnv } from './naming.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
@@ -348,7 +349,7 @@ function evalEdit(input, config, deps = {}) {
 // Pure evaluation — `deps.isIgnored(path) -> bool` is injected so tests don't
 // need a real git tree. Returns null (no opinion) or a result object.
 export function evaluateGuard(payload, config, deps = {}) {
-  if (process.env.DOTMD_GUARD === '0') return null;
+  if (readEnv('GUARD') === '0') return null;
   if (!config?.configFound) return null;
   const tool = payload?.tool_name;
   const input = payload?.tool_input || {};

package/src/hints.mjs

@@ -1,13 +1,14 @@
 import { existsSync } from 'node:fs';
 import { readJournalEntries, isJournalEnabled, journalFilePath } from './journal.mjs';
 import { currentSessionId } from './util.mjs';
+import { readEnv } from './naming.mjs';
 
 // F17c: repeat-failure hints. When an agent runs the same broken invocation
 // twice in the same session within HINT_WINDOW_MS, the second die() output is
 // suffixed with a Tip: paragraph informed by the prior failure's recorded
 // stderr. First failures stay terse — don't punish humans typing a command
 // for the first time. The lookup is skipped cleanly when the journal is
-// disabled or DOTMD_NO_HINTS=1, so this costs nothing for non-opt-in users.
+// disabled or RUNLIST_NO_HINTS=1, so this costs nothing for non-opt-in users.
 
 const HINT_WINDOW_MS = 10 * 60 * 1000;
 const OVERLAP_THRESHOLD = 0.75;
@@ -83,7 +84,7 @@ function jaccard(a, b) {
 // journal must never break the error-reporting path.
 export function findRepeatFailureHint(failingArgv, config) {
   try {
-    if (process.env.DOTMD_NO_HINTS === '1') return null;
+    if (readEnv('NO_HINTS') === '1') return null;
     if (!config) return null;
     if (!isJournalEnabled(config)) return null;
     if (!existsSync(journalFilePath(config))) return null;

package/src/host-integration.mjs

@@ -22,6 +22,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { hostSessionSource } from './util.mjs';
+import { readEnv, stateDir } from './naming.mjs';
 
 export const GENERATED_MARKER = 'dotmd-generated:';
 const PLUGIN_FILENAME = 'dotmd.js';
@@ -137,8 +138,8 @@ export function describeSessionIdentity(opts = {}) {
       id: null, scope: 'none', source: null, host: null,
       summary: 'no session identity — `use`, `set`, `baton` and `archive` fail closed',
       advice: underOpencode
-        ? ['dotmd install opencode', 'or set DOTMD_SESSION_ID for this shell']
-        : ['set DOTMD_SESSION_ID for this shell or host session', 'known hosts: dotmd install'],
+        ? ['runlist install opencode', 'or set RUNLIST_SESSION_ID for this shell']
+        : ['set RUNLIST_SESSION_ID for this shell or host session', 'known hosts: runlist install'],
     };
   }
 
@@ -153,7 +154,7 @@ export function describeSessionIdentity(opts = {}) {
       ? 'restart OpenCode — this session predates the installed integration'
       : 'dotmd install opencode  — for a per-session identity');
   } else if (source.scope === 'terminal') {
-    advice.push('every agent session in this terminal shares this id — set DOTMD_SESSION_ID per session');
+    advice.push('every agent session in this terminal shares this id — set RUNLIST_SESSION_ID per session');
   }
   return {
     id: source.id,
@@ -179,19 +180,19 @@ export function describeSessionIdentity(opts = {}) {
 // OpenCode in the first place, and punish a setup that is working.
 //
 // Once per session per repo, via a marker under the gitignored .dotmd/. Silent
-// under DOTMD_NO_HINTS=1, the switch the repeat-failure hints already use.
+// under RUNLIST_NO_HINTS=1, the switch the repeat-failure hints already use.
 const NOTICE_DIR = 'notices';
 
 function noticeMarkerPath(repoRoot, key) {
   const digest = createHash('sha256').update(key).digest('hex').slice(0, 32);
-  return path.join(path.resolve(repoRoot), '.dotmd', NOTICE_DIR, `${digest}`);
+  return path.join(stateDir(repoRoot), NOTICE_DIR, `${digest}`);
 }
 
 // Returns the notice text the first time it applies in a session, then null.
 // `record: false` answers without consuming the once-per-session budget.
 export function degradedIdentityNotice(repoRoot, opts = {}) {
   const { env = process.env, homedir = os.homedir(), version, record = true } = opts;
-  if (env.DOTMD_NO_HINTS === '1') return null;
+  if (readEnv('NO_HINTS', env) === '1') return null;
   // Cheap env check first: a user on any other host pays nothing for this.
   if (!env.OPENCODE && !env.OPENCODE_PID) return null;
 

package/src/init.mjs

@@ -36,7 +36,7 @@ function detectSessionStartHook(cwd) {
     for (const entry of sessionStart) {
       const inner = Array.isArray(entry?.hooks) ? entry.hooks : [];
       for (const hook of inner) {
-        if (typeof hook?.command === 'string' && /\bdotmd\s+hud\b/.test(hook.command)) {
+        if (typeof hook?.command === 'string' && /\b(?:runlist|dotmd)\s+hud\b/.test(hook.command)) {
           const rel = file.startsWith(cwd) ? path.relative(cwd, file) : file;
           return { wired: true, file: rel };
         }
@@ -46,8 +46,8 @@ function detectSessionStartHook(cwd) {
   return { wired: false };
 }
 
-const STARTER_CONFIG = `// dotmd.config.mjs — document management configuration
-// All exports are optional. See dotmd.config.example.mjs for full reference.
+const STARTER_CONFIG = `// runlist.config.mjs — document management configuration
+// All exports are optional. See runlist.config.example.mjs for full reference.
 
 export const root = 'docs';
 
@@ -212,7 +212,7 @@ const KNOWN_STALE_DAYS = {
 };
 
 function generateDetectedConfig(scan, rootPath) {
-  const lines = [`// dotmd.config.mjs — auto-detected from ${scan.docCount} existing docs`, ''];
+  const lines = [`// runlist.config.mjs — auto-detected from ${scan.docCount} existing docs`, ''];
   lines.push(`export const root = '${rootPath}';`);
   lines.push('');
 
@@ -274,7 +274,7 @@ function generateDetectedConfig(scan, rootPath) {
 
 export async function runInit(cwd, config, opts = {}) {
   const { dryRun = false } = opts;
-  const configPath = path.join(cwd, 'dotmd.config.mjs');
+  const configPath = path.join(cwd, 'runlist.config.mjs');
   const docsDir = path.join(cwd, 'docs');
   const indexPath = path.join(docsDir, 'docs.md');
 
@@ -288,14 +288,14 @@ export async function runInit(cwd, config, opts = {}) {
   const scan = existsSync(docsDir) ? scanExistingDocs(docsDir) : null;
 
   if (existsSync(configPath)) {
-    process.stdout.write(`  ${dryTag}${dim('exists')}  dotmd.config.mjs\n`);
+    process.stdout.write(`  ${dryTag}${dim('exists')}  ${path.basename(config.configPath)}\n`);
   } else {
     if (scan && scan.docCount > 0) {
       if (!dryRun) writeFileSync(configPath, generateDetectedConfig(scan, 'docs'), 'utf8');
-      process.stdout.write(`  ${dryTag}${green('create')}  dotmd.config.mjs (detected ${scan.docCount} docs)\n`);
+      process.stdout.write(`  ${dryTag}${green('create')}  runlist.config.mjs (detected ${scan.docCount} docs)\n`);
     } else {
       if (!dryRun) writeFileSync(configPath, STARTER_CONFIG, 'utf8');
-      process.stdout.write(`  ${dryTag}${green('create')}  dotmd.config.mjs\n`);
+      process.stdout.write(`  ${dryTag}${green('create')}  runlist.config.mjs\n`);
     }
   }
 
@@ -377,9 +377,10 @@ export async function runInit(cwd, config, opts = {}) {
     process.stdout.write(`                 export const root = [${subs.map(s => `'${s}'`).join(', ')}];\n`);
   }
 
-  // .gitignore: two rules.
+  // .gitignore: three rules.
   //
-  //   .dotmd/                 — session ownership records
+  //   .runlist/               — session ownership records
+  //   .dotmd/                 — legacy state during the compatibility window
   //   <docs>/prompts/*.md     — the LIVE saved-prompt queue
   //
   // The second one is load-bearing. Saved prompts are session-local by design and
@@ -392,6 +393,7 @@ export async function runInit(cwd, config, opts = {}) {
   const docsRel = path.relative(cwd, docsDir).split(path.sep).join('/');
   const promptsIgnore = `/${docsRel ? `${docsRel}/` : ''}prompts/*.md`;
   const ignoreRules = [
+    { line: '.runlist/', accepts: (l) => l === '.runlist/' || l === '.runlist' },
     { line: '.dotmd/', accepts: (l) => l === '.dotmd/' || l === '.dotmd' },
     { line: promptsIgnore, accepts: (l) => l === promptsIgnore || l === promptsIgnore.slice(1) },
   ];

package/src/journal-read.mjs

@@ -32,7 +32,7 @@ export function runJournal(argv, config) {
   if (!existsSync(file)) {
     if (!isJournalEnabled(config)) {
       process.stderr.write(
-        'Journal is opt-in. Enable with `DOTMD_JOURNAL=1` (env) or `journal: true` (in dotmd.config.mjs).\n',
+        'Journal is opt-in. Enable with `RUNLIST_JOURNAL=1` (env) or `journal: true` (in runlist.config.mjs).\n',
       );
       return;
     }

package/src/journal.mjs

@@ -2,8 +2,8 @@ import { existsSync, mkdirSync, appendFileSync, statSync, renameSync, readFileSy
 import path from 'node:path';
 import os from 'node:os';
 import { currentSessionId } from './util.mjs';
+import { readEnv, stateDir } from './naming.mjs';
 
-const JOURNAL_DIR = '.dotmd';
 const JOURNAL_FILE = 'journal.jsonl';
 const JOURNAL_BACKUP = 'journal.jsonl.1';
 const ROTATE_SIZE_BYTES = 5 * 1024 * 1024;
@@ -118,17 +118,17 @@ export function sanitizeTelemetryText(value, secrets = []) {
 }
 
 export function isJournalEnabled(config) {
-  if (process.env.DOTMD_JOURNAL === '1') return true;
-  if (process.env.DOTMD_JOURNAL === '0') return false;
+  if (readEnv('JOURNAL') === '1') return true;
+  if (readEnv('JOURNAL') === '0') return false;
   return config?.journal === true;
 }
 
 export function journalFilePath(config) {
-  return path.join(config.repoRoot, JOURNAL_DIR, JOURNAL_FILE);
+  return path.join(stateDir(config.repoRoot), JOURNAL_FILE);
 }
 
 export function journalBackupPath(config) {
-  return path.join(config.repoRoot, JOURNAL_DIR, JOURNAL_BACKUP);
+  return path.join(stateDir(config.repoRoot), JOURNAL_BACKUP);
 }
 
 function firstEntry(file) {
@@ -206,7 +206,7 @@ export function appendJournalEntry(config, entry) {
       ...(Array.isArray(entry?.argv) ? { argv: sanitized.argv } : {}),
       ...(entry?.err ? { err: sanitizeTelemetryText(entry.err, sanitized.secrets) } : {}),
     };
-    const dir = path.join(config.repoRoot, JOURNAL_DIR);
+    const dir = stateDir(config.repoRoot);
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
     const file = journalFilePath(config);
     maybeRotate(file, journalBackupPath(config), safeEntry);
@@ -267,11 +267,11 @@ export function recordCliInvocation({ config, startMs, args, err, version }) {
 
 // Global error log: always-on, cross-repo, captured per failed invocation.
 // Independent of `isJournalEnabled` so silent failures stop disappearing.
-// DOTMD_ERROR_LOG_DIR overrides the default location (for tests, or for
+// RUNLIST_ERROR_LOG_DIR overrides the default location (for tests, or for
 // users who want the log somewhere other than ~/.claude/logs).
 
 export function globalErrorLogDir() {
-  return process.env.DOTMD_ERROR_LOG_DIR || path.join(os.homedir(), '.claude', 'logs');
+  return readEnv('ERROR_LOG_DIR') || path.join(os.homedir(), '.claude', 'logs');
 }
 
 export function globalErrorLogPath() {

package/src/markdown-code-spans.mjs

@@ -0,0 +1,47 @@
+function maskRange(value, start, end) {
+  return value.slice(0, start)
+    + value.slice(start, end).replace(/[^\n]/g, 'x')
+    + value.slice(end);
+}
+
+// Markdown code spans close only on a backtick run of the same length as their
+// opener. The mask is deliberately the same length as the source so consumers
+// can inspect neutralized Markdown while applying any edits at source offsets.
+// `state` lets the conservative multiline behavior used by the reference
+// rewriter survive: after an unmatched opener, nothing is treated as prose
+// until a compatible closer appears.
+export function maskInlineCodeLine(line, state = { run: null }) {
+  const ranges = [];
+  const runs = [...line.matchAll(/`+/g)];
+  let index = 0;
+
+  if (state.run !== null) {
+    const closingIndex = runs.findIndex(candidate => candidate[0].length === state.run);
+    if (closingIndex === -1) return maskRange(line, 0, line.length);
+    const closing = runs[closingIndex];
+    ranges.push([0, closing.index + closing[0].length]);
+    index = closingIndex + 1;
+    state.run = null;
+  }
+
+  for (; index < runs.length; index++) {
+    const opening = runs[index];
+    const closingIndex = runs.findIndex((candidate, candidateIndex) =>
+      candidateIndex > index && candidate[0].length === opening[0].length);
+    if (closingIndex === -1) {
+      ranges.push([opening.index, line.length]);
+      state.run = opening[0].length;
+      break;
+    }
+    const closing = runs[closingIndex];
+    ranges.push([opening.index, closing.index + closing[0].length]);
+    index = closingIndex;
+  }
+
+  return ranges.reduceRight((masked, [start, end]) => maskRange(masked, start, end), line);
+}
+
+export function maskInlineCodeSpans(value) {
+  const state = { run: null };
+  return value.split('\n').map(line => maskInlineCodeLine(line, state)).join('\n');
+}

package/src/naming.mjs

@@ -0,0 +1,55 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+// Canonical product-owned names and the spellings accepted during migration.
+// Writers use the current names. Readers accept both so a new build can safely
+// recover work left by an older build. Migration is intentionally one-way.
+export const PRODUCT_NAME = 'runlist';
+export const LEGACY_PRODUCT_NAME = 'dotmd';
+
+export const STATE_DIR = '.runlist';
+export const LEGACY_STATE_DIR = '.dotmd';
+
+export const ARTIFACT_PREFIX = '.runlist-';
+export const LEGACY_ARTIFACT_PREFIX = '.dotmd-';
+
+export const CONFIG_FILENAMES = [
+  'runlist.config.mjs',
+  '.runlist.config.mjs',
+  'runlist.config.js',
+  'dotmd.config.mjs',
+  '.dotmd.config.mjs',
+  'dotmd.config.js',
+];
+
+export const ENV_PREFIX = 'RUNLIST_';
+export const LEGACY_ENV_PREFIX = 'DOTMD_';
+
+// Prefer current state, but let an explicitly refused migration keep operating
+// against the untouched legacy directory.
+export function stateDir(repoRoot) {
+  const root = path.resolve(repoRoot);
+  const current = path.join(root, STATE_DIR);
+  if (existsSync(current)) return current;
+  const legacy = path.join(root, LEGACY_STATE_DIR);
+  if (existsSync(legacy)) return legacy;
+  return current;
+}
+
+export function isOwnedArtifact(basename, kind = '') {
+  const suffix = kind ? `${kind}-` : '';
+  return basename.startsWith(`${ARTIFACT_PREFIX}${suffix}`)
+    || basename.startsWith(`${LEGACY_ARTIFACT_PREFIX}${suffix}`);
+}
+
+export function isSidecarArtifact(basename, kind = '') {
+  const suffix = kind ? `${kind}-` : '';
+  return basename.includes(`${ARTIFACT_PREFIX}${suffix}`)
+    || basename.includes(`${LEGACY_ARTIFACT_PREFIX}${suffix}`);
+}
+
+export function readEnv(name, env = process.env) {
+  const current = env[`${ENV_PREFIX}${name}`];
+  if (current !== undefined) return current;
+  return env[`${LEGACY_ENV_PREFIX}${name}`];
+}

package/src/pickup.mjs

@@ -6,6 +6,7 @@ import os from 'node:os';
 import { currentProcessOwner, mutateFileSet, processOwnerLiveness, processStartIdentity, replaceSnapshot, snapshotFile, withPathLocks } from './atomic-mutation.mjs';
 import { extractFrontmatter, parseSimpleFrontmatter } from './frontmatter.mjs';
 import { asString, hostSessionId, relTime } from './util.mjs';
+import { readEnv, stateDir } from './naming.mjs';
 
 export const OWNERSHIP_SCHEMA = 2;
 export const HOOK_DELIVERY_LEASE_MS = 30_000;
@@ -13,14 +14,14 @@ export const HOOK_DELIVERY_LEASE_MS = 30_000;
 export function authoritativeSessionId(env = process.env) {
   const id = hostSessionId(env);
   if (id) return id;
-  // Name the host when we can recognize it. The generic "set DOTMD_SESSION_ID"
+  // Name the host when we can recognize it. The generic "set RUNLIST_SESSION_ID"
   // is the fallback of last resort, and a poor one to reach for first: exported
   // from a shell profile it gives every session in that shell ONE id, which is
   // the collision the ownership record exists to prevent.
   const host = env.OPENCODE || env.OPENCODE_PID ? 'opencode' : null;
   throw new Error(host
-    ? `No authoritative session identity. Run \`dotmd install ${host}\` to give each ${host} session its own, or set DOTMD_SESSION_ID for this shell.`
-    : 'No authoritative session identity. Set DOTMD_SESSION_ID for this shell or host session, or see `dotmd install` for supported hosts.');
+    ? `No authoritative session identity. Run \`runlist install ${host}\` to give each ${host} session its own, or set RUNLIST_SESSION_ID for this shell.`
+    : 'No authoritative session identity. Set RUNLIST_SESSION_ID for this shell or host session, or see `runlist install` for supported hosts.');
 }
 
 export function availableSessionId(env = process.env) {
@@ -38,7 +39,7 @@ export function availableSessionId(env = process.env) {
 // `OPENCODE_PID` is the OpenCode server process, which is exactly that harness:
 // it hosts the session and outlives every tool shell it spawns.
 export function sessionProcessOwner(env = process.env) {
-  const raw = (env.DOTMD_SESSION_PID ?? env.CLAUDE_PID ?? env.OPENCODE_PID)?.trim();
+  const raw = (readEnv('SESSION_PID', env) ?? env.CLAUDE_PID ?? env.OPENCODE_PID)?.trim();
   const pid = Number(raw);
   if (!raw || !Number.isInteger(pid) || pid <= 0) return null;
   return {
@@ -116,7 +117,7 @@ export function classifyPlanPickup(facts) {
 }
 
 function ownershipRoot(config) {
-  return path.join(config.repoRoot, '.dotmd', 'ownership');
+  return path.join(stateDir(config.repoRoot), 'ownership');
 }
 
 export function canonicalPlanIdentity(filePath, config) {

package/src/prompts.mjs

@@ -16,6 +16,7 @@ import {
   readPlanOwnership,
 } from './pickup.mjs';
 import { actionablePromptStatuses, comparePromptDocs } from './status-metadata.mjs';
+import { LEGACY_STATE_DIR, STATE_DIR } from './naming.mjs';
 
 // `resume` is an alias for `use` — agents reach for "resume" when continuing a
 // session; `use` reads as internal mechanics. Both names stay valid; the
@@ -330,8 +331,10 @@ export async function consumePrompt(filePath, config, opts) {
     ...(linkedClaim?.planChanged ? [linkedClaim.repoPath] : []),
     ...(archiveResult?.referencePaths ?? []),
   ].filter(Boolean).map(normalize);
-  const ownershipResultPaths = resultPaths.filter(candidate => candidate.startsWith('.dotmd/ownership/'));
-  const repositoryFiles = [...new Set(resultPaths.filter(candidate => !candidate.startsWith('.dotmd/ownership/')))];
+  const isOwnershipPath = candidate => [STATE_DIR, LEGACY_STATE_DIR]
+    .some(dir => candidate.startsWith(`${dir}/ownership/`));
+  const ownershipResultPaths = resultPaths.filter(isOwnershipPath);
+  const repositoryFiles = [...new Set(resultPaths.filter(candidate => !isOwnershipPath(candidate)))];
   const sessionFiles = [...new Set([
     repoPath,
     consumedPath,

package/src/reference-planner.mjs

@@ -1,6 +1,7 @@
 import { realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { extractFrontmatter } from './frontmatter.mjs';
+import { maskInlineCodeLine } from './markdown-code-spans.mjs';
 
 function slash(value) { return value.split(path.sep).join('/'); }
 
@@ -36,7 +37,7 @@ export class AmbiguousReferenceError extends Error {
   constructor(token, sourcePath, local, repository) {
     super(`Ambiguous reference '${token}' in ${sourcePath}: document-relative resolves to ${local}, repository-relative resolves to ${repository}. Use an explicit unambiguous path.`);
     this.name = 'AmbiguousReferenceError';
-    this.code = 'DOTMD_AMBIGUOUS_REFERENCE';
+    this.code = 'RUNLIST_AMBIGUOUS_REFERENCE';
   }
 }
 
@@ -233,29 +234,37 @@ function rewriteDestination(raw, args) {
   return parsed.angle ? `<${rendered}>` : rendered;
 }
 
-function rewriteMarkdownSegment(segment, args) {
-  // Inline links: angle destinations, escaped whitespace, optional titles.
-  let next = segment.replace(/(\[[^\]]*\]\(\s*)(<[^>\n]+>|(?:\\.|[^\s()])+)(\s+(?:"[^"]*"|'[^']*'|\([^)]*\)))?(\s*\))/g,
-    (match, prefix, destination, title = '', close, offset) => {
-      let escapes = 0;
-      for (let index = offset - 1; index >= 0 && segment[index] === '\\'; index--) escapes++;
-      if (escapes % 2 === 1) return match;
-      const rewritten = rewriteDestination(destination, args);
-      return rewritten === destination ? match : `${prefix}${rewritten}${title}${close}`;
-    });
+function rewriteMarkdownLine(line, masked, args) {
+  const edits = [];
+  const inline = /(\[[^\]]*\]\(\s*)(<[^>\n]+>|(?:\\.|[^\s()])+)(\s+(?:"[^"]*"|'[^']*'|\([^)]*\)))?(\s*\))/g;
+  let match;
+  while ((match = inline.exec(masked)) !== null) {
+    let escapes = 0;
+    for (let index = match.index - 1; index >= 0 && line[index] === '\\'; index--) escapes++;
+    if (escapes % 2 === 1) continue;
+    const start = match.index + match[1].length;
+    const destination = line.slice(start, start + match[2].length);
+    const rewritten = rewriteDestination(destination, args);
+    if (rewritten !== destination) edits.push({ start, end: start + destination.length, value: rewritten });
+  }
+
   // Reference definitions preserve labels, spacing, destinations, and titles.
-  next = next.replace(/^(\s{0,3}\[[^\]]+\]:\s*)(<[^>\n]+>|(?:\\.|[^\s])+)(.*)$/,
-    (match, prefix, destination, tail) => {
-      const rewritten = rewriteDestination(destination, args);
-      return rewritten === destination ? match : `${prefix}${rewritten}${tail}`;
-    });
-  return next;
+  const definition = /^(\s{0,3}\[[^\]]+\]:\s*)(<[^>\n]+>|(?:\\.|[^\s])+)(.*)$/.exec(masked);
+  if (definition) {
+    const start = definition[1].length;
+    const destination = line.slice(start, start + definition[2].length);
+    const rewritten = rewriteDestination(destination, args);
+    if (rewritten !== destination) edits.push({ start, end: start + destination.length, value: rewritten });
+  }
+
+  return edits.sort((left, right) => right.start - left.start)
+    .reduce((next, edit) => next.slice(0, edit.start) + edit.value + next.slice(edit.end), line);
 }
 
 function rewriteMarkdown(body, args) {
   const lines = body.split('\n');
   let fence = null;
-  let inlineRun = null;
+  const inlineState = { run: null };
   let indentedCode = false;
   let htmlBlock = null;
   const containerContext = line => {
@@ -317,36 +326,7 @@ function rewriteMarkdown(body, args) {
       fence = { char: opener[1][0], length: opener[1].length, prefixes: container.prefixes };
       return line;
     }
-    let output = '';
-    let cursor = 0;
-    const runs = [...line.matchAll(/`+/g)];
-    let index = 0;
-    if (inlineRun !== null) {
-      const closingIndex = runs.findIndex(candidate => candidate[0].length === inlineRun);
-      if (closingIndex === -1) return line;
-      const closing = runs[closingIndex];
-      output += line.slice(0, closing.index + closing[0].length);
-      cursor = closing.index + closing[0].length;
-      index = closingIndex + 1;
-      inlineRun = null;
-    }
-    for (; index < runs.length; index++) {
-      const opening = runs[index];
-      const closingIndex = runs.findIndex((candidate, candidateIndex) => candidateIndex > index && candidate[0].length === opening[0].length);
-      if (closingIndex === -1) {
-        output += rewriteMarkdownSegment(line.slice(cursor, opening.index), args);
-        output += line.slice(opening.index);
-        inlineRun = opening[0].length;
-        cursor = line.length;
-        break;
-      }
-      const closing = runs[closingIndex];
-      output += rewriteMarkdownSegment(line.slice(cursor, opening.index), args);
-      output += line.slice(opening.index, closing.index + closing[0].length);
-      cursor = closing.index + closing[0].length;
-      index = closingIndex;
-    }
-    return output + rewriteMarkdownSegment(line.slice(cursor), args);
+    return rewriteMarkdownLine(line, maskInlineCodeLine(line, inlineState), args);
   }).join('\n');
 }
 

package/src/ship.mjs

@@ -20,6 +20,8 @@ const ALLOWLIST_PATTERNS = [
   /^plugins\//,
   /^\.claude-plugin\//,
   /^\.claude\/commands\//,
+  /^runlist\.config\.example\.mjs$/,
+  /^runlist\.config\.mjs$/,
   /^dotmd\.config\.example\.mjs$/,
   /^dotmd\.config\.mjs$/,
   /^package(?:-lock)?\.json$/,