etymd 0.1.0 → 0.2.0

package/dist/index.js

@@ -3,6 +3,7 @@ import { promises } from 'node:fs';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import YAML from 'yaml';
+import os from 'node:os';
 
 // src/core/scan.ts
 
@@ -12,7 +13,7 @@ var PACK_VERSION = "2";
 // package.json
 var package_default = {
   name: "etymd",
-  version: "0.1.0"};
+  version: "0.2.0"};
 
 // src/version.ts
 var VERSION = package_default.version;
@@ -442,6 +443,19 @@ var ARTIFACT_SPECS = [
     path: "PROJECT_CONTEXT.md",
     kind: "state"
   },
+  {
+    id: "decisions",
+    label: "DECISIONS.md (decision record)",
+    path: "DECISIONS.md",
+    kind: "decisions"
+  },
+  { id: "adr-dir", label: "ADR directory (docs/adr)", path: "docs/adr", kind: "decisions" },
+  {
+    id: "decisions-dir",
+    label: "ADR directory (docs/decisions)",
+    path: "docs/decisions",
+    kind: "decisions"
+  },
   { id: "claude", label: "CLAUDE.md (Claude Code pointer)", path: "CLAUDE.md", kind: "adapter" },
   {
     id: "copilot",
@@ -487,12 +501,25 @@ var ARTIFACT_SPECS = [
   }
 ];
 async function detectArtifacts(root) {
-  return Promise.all(
+  const artifacts = await Promise.all(
     ARTIFACT_SPECS.map(async (spec) => ({
       ...spec,
       exists: await pathExists(path.join(root, spec.path))
     }))
   );
+  let adrFiles = false;
+  try {
+    adrFiles = (await promises.readdir(path.join(root, "docs"))).some((f) => /^\d{4}-.+\.md$/.test(f));
+  } catch {
+  }
+  artifacts.push({
+    id: "adr-files",
+    label: "ADR files (docs/NNNN-*.md)",
+    path: "docs",
+    kind: "decisions",
+    exists: adrFiles
+  });
+  return artifacts;
 }
 async function walkTree(root) {
   const state = { budget: 2e4, truncated: false };
@@ -557,7 +584,50 @@ function inferTicketKey(subjects) {
   }
   return bestCount >= 3 ? best : void 0;
 }
-async function scanProject(root) {
+async function collectFreshness(abs, isRepo, artifacts, upstreamRemote) {
+  const dated = artifacts.filter((a) => a.exists && (a.kind === "state" || a.kind === "decisions"));
+  const allUnverifiable = (reason) => ({
+    artifacts: [],
+    unverifiable: dated.map((a) => ({ path: a.path, reason }))
+  });
+  if (!isRepo) return allUnverifiable("not a git repository \u2014 no committer dates to read");
+  if (await git(abs, ["rev-parse", "--is-shallow-repository"]) === "true") {
+    return allUnverifiable("shallow clone \u2014 history is incomplete, committer dates would lie");
+  }
+  const repoLastCommit = upstreamRemote ? await git(abs, ["log", "-1", "--format=%cI", "HEAD", "--not", `--remotes=${upstreamRemote}`]) : await git(abs, ["log", "-1", "--format=%cI"]);
+  if (!repoLastCommit) {
+    if (upstreamRemote) {
+      return allUnverifiable(
+        `no fork-authored commits \u2014 every commit is reachable from \`${upstreamRemote}\`, the fork has not moved`
+      );
+    }
+    return allUnverifiable("repository has no commits yet");
+  }
+  const dirtyRaw = await git(abs, ["diff", "--name-only", "HEAD"]);
+  const dirtyPaths = dirtyRaw ? dirtyRaw.split("\n").filter(Boolean) : [];
+  const isDirty = (p) => dirtyPaths.some((d) => d === p || d.startsWith(`${p}/`));
+  const facts = { repoLastCommit, artifacts: [], unverifiable: [] };
+  await Promise.all(
+    dated.map(async (a) => {
+      const lastCommit = await git(abs, ["log", "-1", "--format=%cI", "--", a.path]);
+      if (!lastCommit) {
+        facts.unverifiable.push({ path: a.path, reason: "untracked \u2014 never committed" });
+        return;
+      }
+      facts.artifacts.push({
+        artifactId: a.id,
+        path: a.path,
+        lastCommit,
+        commitsSince: Date.parse(repoLastCommit) > Date.parse(lastCommit),
+        ...isDirty(a.path) ? { dirty: true } : {}
+      });
+    })
+  );
+  facts.artifacts.sort((x, y) => x.path.localeCompare(y.path));
+  facts.unverifiable.sort((x, y) => x.path.localeCompare(y.path));
+  return facts;
+}
+async function scanProject(root, opts = {}) {
   const abs = path.resolve(root);
   const rootPkg = await readJson(path.join(abs, "package.json"));
   const [packageManager, workspace, ci, artifacts, tree, isRepo] = await Promise.all([
@@ -577,6 +647,7 @@ async function scanProject(root) {
   ]) : [null, null, null, null, null];
   const hooksPath = hooksPathRaw ?? void 0;
   const hooks = await detectHooks(abs, hooksPath, rootPkg);
+  const freshness = await collectFreshness(abs, isRepo, artifacts, opts.upstreamRemote);
   const packages = workspace.packageGlobs.length ? await listWorkspacePackages(abs, workspace.packageGlobs) : [];
   const recentAuthors = authorsRaw ? new Set(authorsRaw.split("\n").filter(Boolean)).size : void 0;
   return {
@@ -603,6 +674,7 @@ async function scanProject(root) {
     ci,
     hooks,
     artifacts,
+    freshness,
     tree
   };
 }
@@ -651,7 +723,8 @@ function deriveProfile(facts) {
 var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
 var DEFAULT_CONFIG = {
   instructions: { include: [], exclude: [] },
-  context: { perFileWords: 4e3, totalWords: 8e3 }
+  context: { perFileWords: 4e3, totalWords: 8e3 },
+  state: { staleAfterDays: 30, maxChars: 9500 }
 };
 function configPath(root) {
   return path.join(root, CONFIG_FILE);
@@ -695,6 +768,7 @@ async function readConfig(root) {
   const obj = parsed;
   const instructions = obj.instructions ?? {};
   const context = obj.context ?? {};
+  const state = obj.state ?? {};
   return {
     present: true,
     problems,
@@ -706,6 +780,10 @@ async function readConfig(root) {
       context: {
         perFileWords: readBudget(context.perFileWords, "context.perFileWords", problems) ?? DEFAULT_CONFIG.context.perFileWords,
         totalWords: readBudget(context.totalWords, "context.totalWords", problems) ?? DEFAULT_CONFIG.context.totalWords
+      },
+      state: {
+        staleAfterDays: readBudget(state.staleAfterDays, "state.staleAfterDays", problems) ?? DEFAULT_CONFIG.state.staleAfterDays,
+        maxChars: readBudget(state.maxChars, "state.maxChars", problems) ?? DEFAULT_CONFIG.state.maxChars
       }
     }
   };
@@ -714,6 +792,7 @@ async function readConfig(root) {
 // src/core/context.ts
 var ALWAYS_LOADED = [
   { path: "AGENTS.md", role: "operating contract" },
+  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
   { path: "CLAUDE.md", role: "Claude Code pointer" },
   { path: "GEMINI.md", role: "Gemini pointer" },
   { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
@@ -1652,7 +1731,13 @@ function packageManagerUsage(text) {
   }
   return counts;
 }
-var KNOWN_DOC_REFS = ["AGENTS.md", "CLAUDE.md", "PROJECT_CONTEXT.md", "GEMINI.md"];
+var KNOWN_DOC_REFS = [
+  "AGENTS.md",
+  "CLAUDE.md",
+  "PROJECT_CONTEXT.md",
+  "DECISIONS.md",
+  "GEMINI.md"
+];
 function extractDocRefs(text) {
   return KNOWN_DOC_REFS.filter((name) => text.includes(name));
 }
@@ -1950,6 +2035,206 @@ var instructionTruthLens = {
     };
   }
 };
+var LENS_ID4 = "state-freshness";
+var DECISIONS_FORMAT_MARKER = "<!-- decisions-format: 1 -->";
+var MS_PER_DAY = 864e5;
+function parseDecisionEntries(text) {
+  const headings = [...text.matchAll(/^## .*$/gm)];
+  const entries = [];
+  for (let i = 0; i < headings.length; i++) {
+    const h = headings[i];
+    const m = /^## (D-(\d+))\b/.exec(h[0]);
+    if (!m) continue;
+    const start = (h.index ?? 0) + h[0].length;
+    const end = i + 1 < headings.length ? headings[i + 1].index : void 0;
+    entries.push({ id: m[1], num: Number(m[2]), block: text.slice(start, end) });
+  }
+  return entries;
+}
+function checkIdSequence(file, entries) {
+  const findings = [];
+  const nextFree = Math.max(0, ...entries.map((e) => e.num)) + 1;
+  const seen = /* @__PURE__ */ new Map();
+  const duplicated = /* @__PURE__ */ new Set();
+  let prev;
+  for (const entry of entries) {
+    if (seen.has(entry.num)) {
+      if (!duplicated.has(entry.num)) {
+        duplicated.add(entry.num);
+        findings.push({
+          id: `${LENS_ID4}/duplicate-id:${file}:${entry.id}`,
+          lens: LENS_ID4,
+          tier: "gap",
+          claim: `${file} carries more than one ${entry.id} entry`,
+          evidence: [`${file}: ${entry.id} appears twice`],
+          why: "Two decisions under one id cannot be cited, superseded, or dismissed unambiguously \u2014 append races collide exactly here.",
+          action: `Rename the later entry to D-${String(nextFree).padStart(3, "0")} (the next free id).`,
+          effort: "S",
+          confidence: "high"
+        });
+      }
+    } else {
+      seen.set(entry.num, entry);
+      if (prev && entry.num < prev.num) {
+        findings.push({
+          id: `${LENS_ID4}/id-order:${file}:${entry.id}`,
+          lens: LENS_ID4,
+          tier: "gap",
+          claim: `${file} lists ${entry.id} after ${prev.id} \u2014 ids out of append order`,
+          evidence: [`${file}: ${prev.id} precedes ${entry.id}`],
+          why: "An append-only record reads in id order; out-of-order ids make the newest decision hard to find and the next id hard to pick.",
+          action: `Rename the out-of-order entry into sequence (next free id: D-${String(nextFree).padStart(3, "0")}).`,
+          effort: "S",
+          confidence: "high"
+        });
+      }
+      prev = entry;
+    }
+  }
+  return findings;
+}
+function checkFormatFields(file, entries, today) {
+  const findings = [];
+  for (const entry of entries) {
+    if (!/Scope[\s*]*:/.test(entry.block)) {
+      findings.push({
+        id: `${LENS_ID4}/scope-missing:${file}:${entry.id}`,
+        lens: LENS_ID4,
+        tier: "gap",
+        claim: `${file} ${entry.id} has no Scope: field`,
+        evidence: [`${file}: ${entry.id}`],
+        why: "A decision without a scope binds nobody \u2014 a reader cannot tell whether it covers the project they are working in.",
+        action: "Add a Scope: line naming what the decision binds.",
+        effort: "S",
+        confidence: "high"
+      });
+    }
+    const revisit = /Revisit[\s*]*:[\s*]*(\d{4}-\d{2}-\d{2})/.exec(entry.block);
+    if (revisit && revisit[1] < today) {
+      findings.push({
+        id: `${LENS_ID4}/revisit-due:${file}:${entry.id}`,
+        lens: LENS_ID4,
+        tier: "gap",
+        claim: `${file} ${entry.id} was due for revisit on ${revisit[1]}`,
+        evidence: [`${file}: ${entry.id} Revisit: ${revisit[1]}`],
+        why: "Review debt is due \u2014 a Revisit date is a promise to re-evaluate, and a past one silently hardens into policy.",
+        action: "Re-evaluate the decision: supersede it or move the Revisit date.",
+        effort: "S",
+        confidence: "high"
+      });
+    }
+  }
+  return findings;
+}
+var stateFreshnessLens = {
+  id: LENS_ID4,
+  version: "1",
+  title: "State freshness",
+  kind: "truth",
+  async run(ctx) {
+    const budgets = ctx.config?.config.state ?? DEFAULT_CONFIG.state;
+    const findings = [];
+    const disclosures = [...ctx.config?.problems ?? []];
+    const outOfScope = [];
+    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const stateArtifacts = ctx.facts.artifacts.filter((a) => a.kind === "state" && a.exists);
+    const decisionArtifacts = ctx.facts.artifacts.filter((a) => a.kind === "decisions" && a.exists);
+    if (stateArtifacts.length === 0 && decisionArtifacts.length === 0) {
+      disclosures.push("No state or decisions artifacts detected \u2014 nothing to check.");
+    }
+    const freshness = ctx.facts.freshness;
+    if (!freshness) {
+      disclosures.push("Scan carried no freshness facts \u2014 staleness unchecked.");
+    } else {
+      for (const u of freshness.unverifiable) {
+        disclosures.push(`Freshness of ${u.path} is unverifiable (${u.reason}) \u2014 not flagged.`);
+      }
+      for (const a of stateArtifacts) {
+        const fact = freshness.artifacts.find((f) => f.artifactId === a.id);
+        if (!fact || !freshness.repoLastCommit) continue;
+        if (fact.dirty) {
+          disclosures.push(
+            `${a.path} has uncommitted changes \u2014 modified since its last commit; treated fresh-now, not flagged.`
+          );
+          continue;
+        }
+        if (!fact.commitsSince) continue;
+        const gapDays = Math.floor(
+          (Date.parse(freshness.repoLastCommit) - Date.parse(fact.lastCommit)) / MS_PER_DAY
+        );
+        if (gapDays <= budgets.staleAfterDays) continue;
+        const escalated = gapDays > budgets.staleAfterDays * 3;
+        findings.push({
+          id: `${LENS_ID4}/stale-state:${a.path}`,
+          lens: LENS_ID4,
+          tier: escalated ? "risk" : "gap",
+          claim: `${a.path} trails the repo by ${gapDays} days of commit traffic \u2014 it says "now" but the repo moved on`,
+          evidence: [
+            `${a.path} last commit: ${fact.lastCommit}`,
+            `repo last commit: ${freshness.repoLastCommit}`
+          ],
+          why: escalated ? `Over three times the ${budgets.staleAfterDays}-day threshold while commits kept landing \u2014 every session starts from a picture of the project that is no longer true.` : `A state doc more than ${budgets.staleAfterDays} days behind continued commit traffic misleads every session that loads it.`,
+          action: "Refresh the state doc (or record why it is still current).",
+          effort: "S",
+          confidence: "high"
+        });
+      }
+    }
+    for (const a of stateArtifacts) {
+      const text = await readText(path.join(ctx.root, a.path));
+      if (text === null) {
+        disclosures.push(`${a.path} could not be read \u2014 unexamined, not clean.`);
+        outOfScope.push(a.path);
+        continue;
+      }
+      if (text.length > budgets.maxChars) {
+        findings.push({
+          id: `${LENS_ID4}/state-over-budget:${a.path}`,
+          lens: LENS_ID4,
+          tier: "gap",
+          claim: `${a.path} is ${text.length} chars \u2014 over the ${budgets.maxChars}-char state budget`,
+          evidence: [`${a.path}: ${text.length} chars`],
+          why: "Session-injection hooks truncate state around 10,000 chars \u2014 an over-budget state doc gets cut mid-sentence, and every session pays its full weight before the task begins.",
+          action: "Trim to budget; move overflow into decisions/docs and keep a pointer.",
+          effort: "M",
+          confidence: "high"
+        });
+      }
+    }
+    for (const a of decisionArtifacts) {
+      const text = await readText(path.join(ctx.root, a.path));
+      if (text === null) {
+        disclosures.push(
+          `${a.path} recognized as a decisions convention (directory) \u2014 age-exempt; per-entry format checks apply only to marker-carrying decisions files.`
+        );
+        continue;
+      }
+      const entries = parseDecisionEntries(text);
+      findings.push(...checkIdSequence(a.path, entries));
+      if (!text.includes(DECISIONS_FORMAT_MARKER)) {
+        disclosures.push(
+          `${a.path} carries no \`${DECISIONS_FORMAT_MARKER}\` marker \u2014 format checks skipped (forward-only, never retroactive); id-sequence checks still ran.`
+        );
+        outOfScope.push(a.path);
+        continue;
+      }
+      findings.push(...checkFormatFields(a.path, entries, today));
+    }
+    disclosures.push(
+      `Thresholds: staleAfterDays ${budgets.staleAfterDays} (3x escalates to risk), state budget ${budgets.maxChars} chars (${budgets.staleAfterDays === DEFAULT_CONFIG.state.staleAfterDays && budgets.maxChars === DEFAULT_CONFIG.state.maxChars ? `defaults \u2014 override under \`state\` in ${CONFIG_FILE}` : `set in ${CONFIG_FILE}`}). Decisions artifacts are exempt from age \u2014 old decisions are history, not defects.`
+    );
+    return {
+      lens: LENS_ID4,
+      version: "1",
+      title: "State freshness",
+      kind: "truth",
+      status: "ran",
+      disclosures,
+      findings,
+      ...outOfScope.length ? { outOfScope } : {}
+    };
+  }
+};
 
 // src/engine/finding.ts
 var TIER_ORDER = { risk: 0, gap: 1, polish: 2 };
@@ -2043,14 +2328,26 @@ function visibleFindings(findings, ledger) {
 }
 
 // src/engine/run.ts
-var LENSES = [instructionTruthLens, gateIntegrityLens, contextEconomyLens];
+var LENSES = [
+  instructionTruthLens,
+  stateFreshnessLens,
+  gateIntegrityLens,
+  contextEconomyLens
+];
 async function runAudit(root, opts = {}) {
-  const facts = await scanProject(root);
-  if ((opts.persistLedger ?? true) || await pathExists(path.join(root, ETYMD_DIR))) {
+  const facts = await scanProject(root, { upstreamRemote: opts.upstreamRemote });
+  const ledgerRoot = opts.ledgerRoot ?? root;
+  if (!opts.readOnlyRoot && ((opts.persistLedger ?? true) || await pathExists(path.join(root, ETYMD_DIR)))) {
     await writeCachedFacts(root, facts);
   }
   const baseline = await readBaseline(root);
-  const config = await readConfig(root);
+  let config = await readConfig(root);
+  if (opts.stateBudgets) {
+    config = {
+      ...config,
+      config: { ...config.config, state: { ...config.config.state, ...opts.stateBudgets } }
+    };
+  }
   const profile = baseline?.profile ?? deriveProfile(facts);
   const selected = LENSES.filter(
     (lens) => (!opts.kind || lens.kind === opts.kind) && (!opts.lensIds || opts.lensIds.includes(lens.id))
@@ -2073,12 +2370,13 @@ async function runAudit(root, opts = {}) {
     }
   }
   const all = reports.flatMap((r) => r.findings);
-  const previous = await readLedger(root);
+  const previous = await readLedger(ledgerRoot);
   const outOfScope = reports.flatMap((r) => r.outOfScope ?? []);
   const { ledger, diff } = reconcileLedger(previous, all, void 0, outOfScope);
   const fullRun = selected.length === LENSES.length;
-  if ((opts.persistLedger ?? true) && fullRun) {
-    await writeLedger(root, ledger);
+  const ledgerWritable = !opts.readOnlyRoot || ledgerRoot !== root;
+  if ((opts.persistLedger ?? true) && fullRun && ledgerWritable) {
+    await writeLedger(ledgerRoot, ledger);
   }
   return {
     facts,
@@ -2091,5 +2389,732 @@ async function runAudit(root, opts = {}) {
     diff
   };
 }
+function expandTilde(p) {
+  if (p === "~") return os.homedir();
+  if (p.startsWith("~/")) return path.join(os.homedir(), p.slice(2));
+  return p;
+}
+var REBUILD_RECIPE = 'rebuild it beside the manifest: {"machineProfile":"corp","dirs":{"<name>":"~/path/to/worktree"}}';
+var SAFE_NAME = /^[^\s/\\:.][^\s/\\:]*$/;
+function rejectUnsafeName(name, where, manifest, manifestFile) {
+  if (SAFE_NAME.test(name)) return false;
+  manifest.problems.push({
+    kind: "bad-shape",
+    file: manifestFile,
+    detail: `${where} name ${JSON.stringify(name)} is not a single path-safe segment \u2014 entry skipped (names build finding ids and corp/<name>/ persistence paths)`
+  });
+  return true;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function asString(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function asStringMap(value) {
+  const rec = asRecord(value);
+  if (!rec) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(rec)) if (typeof v === "string") out[k] = v;
+  return out;
+}
+async function readLocal(localPath, problems) {
+  const raw = await readText(localPath);
+  if (raw === null) return { present: false, data: {} };
+  try {
+    const parsed = asRecord(JSON.parse(raw));
+    if (!parsed) {
+      problems.push({
+        kind: "parse-error",
+        file: path.basename(localPath),
+        detail: "must contain a JSON object \u2014 local mappings unusable"
+      });
+      return { present: true, data: {} };
+    }
+    return { present: true, data: parsed };
+  } catch (err) {
+    problems.push({
+      kind: "parse-error",
+      file: path.basename(localPath),
+      detail: `not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 local mappings unusable`
+    });
+    return { present: true, data: {} };
+  }
+}
+function loadRegistryEntries(projects, manifest, manifestFile) {
+  const corpNames = [];
+  for (const [i, rawEntry] of projects.entries()) {
+    const rec = asRecord(rawEntry);
+    const name = rec ? asString(rec.name) : void 0;
+    if (!rec || !name) {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: `projects[${i}] has no usable name \u2014 the entry cannot be resolved or audited`
+      });
+      continue;
+    }
+    if (rejectUnsafeName(name, `projects[${i}]`, manifest, manifestFile)) continue;
+    const profile = rec.profile === "corp" ? "corp" : "personal";
+    if (rec.profile !== void 0 && rec.profile !== "corp" && rec.profile !== "personal") {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: `\`${name}\` declares unknown profile \`${String(rec.profile)}\` \u2014 read as personal`
+      });
+    }
+    const contract = {};
+    const contractRec = asRecord(rec.contract);
+    if (contractRec) {
+      for (const [k, v] of Object.entries(contractRec)) {
+        if (typeof v === "string") contract[k] = v;
+        else {
+          manifest.problems.push({
+            kind: "bad-shape",
+            file: manifestFile,
+            detail: `\`${name}\`.contract.${k} is not a string \u2014 ignored`
+          });
+        }
+      }
+    }
+    const entry = {
+      name,
+      kind: asString(rec.kind),
+      profile,
+      private: rec.private === true,
+      path: asString(rec.path),
+      upstream: asString(rec.upstream),
+      trust: asString(rec.trust),
+      staleAfterDays: typeof rec.staleAfterDays === "number" ? rec.staleAfterDays : void 0,
+      stateBudget: typeof rec.stateBudget === "number" ? rec.stateBudget : void 0,
+      contract,
+      links: asStringMap(rec.links)
+    };
+    if (entry.profile === "corp" || entry.private) {
+      corpNames.push(name);
+      if (!manifest.localPresent) {
+        entry.unresolved = `registry.local.json is absent \u2014 ${REBUILD_RECIPE}`;
+      } else if (manifest.machineProfile === "personal") {
+        entry.unresolved = 'corp entries do not resolve under machineProfile "personal" \u2014 absent on this machine by design';
+      } else {
+        const dir = manifest.localDirs[name];
+        if (!dir) {
+          entry.unresolved = `no \`dirs\` mapping for \`${name}\` in ${path.basename(manifest.localPath)}`;
+        } else {
+          entry.resolvedRoot = path.resolve(manifest.dir, expandTilde(dir));
+        }
+      }
+    } else if (entry.path) {
+      entry.resolvedRoot = path.resolve(manifest.root ?? manifest.dir, expandTilde(entry.path));
+    } else {
+      entry.unresolved = "personal entry declares no `path` \u2014 nothing to resolve";
+    }
+    manifest.entries.push(entry);
+  }
+  if (corpNames.length && !manifest.localPresent) {
+    manifest.problems.push({
+      kind: "local-missing",
+      file: path.basename(manifest.localPath),
+      detail: `${corpNames.length} corp/private entr${corpNames.length === 1 ? "y" : "ies"} (${corpNames.join(", ")}) cannot resolve without it \u2014 ${REBUILD_RECIPE}`
+    });
+  }
+}
+function loadCorpusEntries(sources, manifest, manifestFile) {
+  for (const [i, rawEntry] of sources.entries()) {
+    const rec = asRecord(rawEntry);
+    const name = rec ? asString(rec.name) : void 0;
+    if (!rec || !name) {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: `sources[${i}] has no usable name \u2014 the entry cannot be resolved`
+      });
+      continue;
+    }
+    if (rejectUnsafeName(name, `sources[${i}]`, manifest, manifestFile)) continue;
+    const entry = {
+      name,
+      kind: asString(rec.shape),
+      profile: "personal",
+      private: rec.private === true,
+      path: asString(rec.path),
+      contract: {},
+      links: {}
+    };
+    const localDir = manifest.localDirs[name];
+    if (localDir) {
+      entry.resolvedRoot = path.resolve(manifest.dir, "..", expandTilde(localDir));
+    } else if (entry.path) {
+      entry.resolvedRoot = path.resolve(manifest.dir, expandTilde(entry.path));
+    } else {
+      entry.resolvedRoot = path.resolve(manifest.dir, "..", name);
+    }
+    manifest.entries.push(entry);
+  }
+}
+async function loadFleetManifest(manifestPath) {
+  const abs = path.resolve(manifestPath);
+  const dir = path.dirname(abs);
+  const manifestFile = path.basename(abs);
+  const raw = await readText(abs);
+  if (raw === null) {
+    throw new Error(`cannot read fleet manifest \`${abs}\``);
+  }
+  const manifest = {
+    shape: "registry",
+    manifestPath: abs,
+    dir,
+    corpHosts: [],
+    labels: {},
+    localDirs: {},
+    localPath: path.join(dir, "registry.local.json"),
+    localPresent: false,
+    entries: [],
+    problems: []
+  };
+  let parsed = null;
+  try {
+    parsed = asRecord(JSON.parse(raw));
+    if (!parsed) {
+      manifest.problems.push({
+        kind: "parse-error",
+        file: manifestFile,
+        detail: "must contain a JSON object \u2014 no entries loaded"
+      });
+      return manifest;
+    }
+  } catch (err) {
+    manifest.problems.push({
+      kind: "parse-error",
+      file: manifestFile,
+      detail: `not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 no entries loaded`
+    });
+    return manifest;
+  }
+  if (Array.isArray(parsed.projects)) {
+    manifest.shape = "registry";
+    const local = await readLocal(manifest.localPath, manifest.problems);
+    manifest.localPresent = local.present;
+    manifest.localDirs = asStringMap(local.data.dirs);
+    manifest.labels = asStringMap(local.data.labels);
+    manifest.corpHosts = Array.isArray(local.data.corpHosts) ? local.data.corpHosts.filter((h) => typeof h === "string") : [];
+    manifest.machineProfile = local.data.machineProfile === "corp" || local.data.machineProfile === "personal" ? local.data.machineProfile : void 0;
+    const rootRaw = asString(local.data.root) ?? asString(parsed.root);
+    if (rootRaw) manifest.root = path.resolve(dir, expandTilde(rootRaw));
+    loadRegistryEntries(parsed.projects, manifest, manifestFile);
+  } else if (Array.isArray(parsed.sources)) {
+    manifest.shape = "corpus";
+    manifest.localPath = path.join(dir, "sources.local.json");
+    const local = await readLocal(manifest.localPath, manifest.problems);
+    manifest.localPresent = local.present;
+    manifest.localDirs = asStringMap(local.data.dirs);
+    loadCorpusEntries(parsed.sources, manifest, manifestFile);
+  } else {
+    manifest.problems.push({
+      kind: "bad-shape",
+      file: manifestFile,
+      detail: "neither a `projects` (registry) nor a `sources` (corpus) array \u2014 no entries loaded"
+    });
+  }
+  return manifest;
+}
+var pExecFile2 = promisify(execFile);
+var FLEET_LENS = "fleet-manifest";
+var FLEET_JSON_SCHEMA = "fleet-experimental-0.2";
+var CORP_WALL_ARTIFACTS = ["PROJECT_CONTEXT.md", "DECISIONS.md"];
+function finding3(id, tier, claim, evidence, why, action) {
+  return {
+    id,
+    lens: FLEET_LENS,
+    tier,
+    claim,
+    evidence,
+    why,
+    ...action ? { action } : {},
+    effort: "S",
+    confidence: "high"
+  };
+}
+function corpPersistenceRoot(manifest, name) {
+  const corpDir = path.join(manifest.dir, "corp");
+  const root = path.resolve(corpDir, name);
+  if (path.dirname(root) !== corpDir || root === corpDir) {
+    throw new Error(
+      `entry name ${JSON.stringify(name)} escapes the corp persistence zone \u2014 refusing to resolve a ledger root for it`
+    );
+  }
+  return root;
+}
+function stateBudgetsFor(entry) {
+  const overlay = {};
+  if (entry.staleAfterDays !== void 0) overlay.staleAfterDays = entry.staleAfterDays;
+  if (entry.stateBudget !== void 0) overlay.maxChars = entry.stateBudget;
+  return Object.keys(overlay).length ? overlay : void 0;
+}
+async function gitGrepFiles(root, needle, mode = "fixed") {
+  try {
+    const matchFlag = mode === "regex" ? "-E" : "-F";
+    const { stdout } = await pExecFile2("git", ["grep", "-I", "-l", matchFlag, "-e", needle], {
+      cwd: root,
+      timeout: 8e3
+    });
+    return stdout.split("\n").filter(Boolean);
+  } catch (err) {
+    if (err.code === 1) return [];
+    return null;
+  }
+}
+var MACHINE_PATH_RE = /\/Users\/[A-Za-z0-9._@-]{2,}([/"']|$)/m;
+var MACHINE_PATH_GREP = String.raw`/Users/[A-Za-z0-9._@-]{2,}(/|"|'|$)`;
+async function realpathOr(p) {
+  try {
+    return await promises.realpath(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+function emailMatchesCorpHosts(email, hosts) {
+  const domain = email.split("@")[1]?.toLowerCase();
+  if (!domain) return false;
+  return hosts.some((h) => {
+    const host = h.toLowerCase();
+    if (domain === host) return true;
+    if (domain.includes(".") && host.endsWith(`.${domain}`) && domain.split(".").length >= host.split(".").length - 1) {
+      return true;
+    }
+    return domain.endsWith(`.${host}`);
+  });
+}
+var PROBLEM_TIER = {
+  "parse-error": "risk",
+  "bad-shape": "risk",
+  "local-missing": "gap"
+};
+async function checkManifest(manifest) {
+  const findings = [];
+  const disclosures = [];
+  const manifestFile = path.basename(manifest.manifestPath);
+  const localFile = path.basename(manifest.localPath);
+  for (const p of manifest.problems) {
+    findings.push(
+      finding3(
+        `${FLEET_LENS}/${p.kind}:${p.file}`,
+        PROBLEM_TIER[p.kind] ?? "gap",
+        `${p.file}: ${p.detail}`,
+        [p.file],
+        "A manifest that cannot be read is a fleet whose claims cannot be verified \u2014 every consumer is flying blind.",
+        "Fix the file; the manifest pair is the fleet's single source of truth."
+      )
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const flaggedDup = /* @__PURE__ */ new Set();
+  for (const entry of manifest.entries) {
+    if (seen.has(entry.name) && !flaggedDup.has(entry.name)) {
+      flaggedDup.add(entry.name);
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/duplicate-name:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` is registered more than once`,
+          [`${manifestFile}: ${entry.name} appears twice`],
+          "Resolution is keyed by name \u2014 a duplicate makes every lookup, dismiss, and delta ambiguous.",
+          "Rename one of the entries."
+        )
+      );
+    }
+    seen.add(entry.name);
+    if (entry.private && entry.path) {
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/private-path-leak:${entry.name}`,
+          "risk",
+          `private entry \`${entry.name}\` carries a \`path\` in the tracked manifest`,
+          [`${manifestFile}: ${entry.name}.path = ${entry.path}`],
+          "A private entry is an opaque alias by design \u2014 a tracked path ties the alias to a real directory for anyone who can read the manifest.",
+          `Delete the path; map the alias in the gitignored ${localFile} instead.`
+        )
+      );
+    }
+    if (entry.resolvedRoot && !await isDirectory(entry.resolvedRoot)) {
+      const viaLocal = manifest.localDirs[entry.name] !== void 0;
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/${viaLocal ? "dangling-dir" : "dangling-path"}:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` resolves to a directory that does not exist`,
+          [`${viaLocal ? localFile : manifestFile}: ${entry.name} \u2192 ${entry.resolvedRoot}`],
+          "A dangling mapping silently drops the project from every sweep \u2014 absent coverage that looks registered.",
+          "Fix the mapping or retire the entry."
+        )
+      );
+    }
+    if (entry.unresolved && manifest.localPresent && manifest.machineProfile !== "personal" && (entry.profile === "corp" || entry.private)) {
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/dangling-dir:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` has no usable directory mapping`,
+          [`${localFile}: ${entry.unresolved}`],
+          "An unmapped corp entry silently drops out of every sweep on the machine that most needs it.",
+          `Add a \`dirs\` mapping for \`${entry.name}\` in ${localFile}.`
+        )
+      );
+    }
+  }
+  for (const entry of manifest.entries) {
+    for (const [rel, target] of Object.entries(entry.links)) {
+      if (!seen.has(target)) {
+        findings.push(
+          finding3(
+            `${FLEET_LENS}/dangling-link:${entry.name}:${target}`,
+            "gap",
+            `\`${entry.name}\` links \`${rel}\` \u2192 \`${target}\`, which is not a registered name`,
+            [`${manifestFile}: ${entry.name}.links.${rel} = ${target}`],
+            "Links are the metadata that keeps moves lossless \u2014 a dead target is a relationship claim nothing can follow.",
+            "Point the link at a registered name or delete it."
+          )
+        );
+      }
+    }
+  }
+  for (const name of Object.keys(manifest.localDirs)) {
+    if (manifest.shape === "registry" && !seen.has(name)) {
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/orphan-dir:${name}`,
+          "gap",
+          `${localFile} maps \`${name}\`, which is not a registered name`,
+          [`${localFile}: dirs.${name}`],
+          "An orphaned mapping is a ghost entry \u2014 it looks covered and is swept by nothing.",
+          "Register the entry or delete the mapping."
+        )
+      );
+    }
+  }
+  const rawManifest = await readText(manifest.manifestPath);
+  if (rawManifest === null) {
+    disclosures.push(`${manifestFile} could not be re-read for the machine-path check \u2014 skipped.`);
+  } else if (MACHINE_PATH_RE.test(rawManifest)) {
+    findings.push(
+      finding3(
+        `${FLEET_LENS}/registry-machine-path:${manifestFile}`,
+        "risk",
+        `${manifestFile} contains an absolute /Users/ path`,
+        [manifestFile],
+        "The tracked manifest is publishable by construction \u2014 a home-directory path ships the machine's identity with it.",
+        `Use \`~\` (expanded consumer-side) or a root-relative path; machine paths belong in ${localFile}.`
+      )
+    );
+  }
+  if (manifest.machineProfile === "personal") {
+    const corpCount = manifest.entries.filter((e) => e.profile === "corp" || e.private).length;
+    if (corpCount) {
+      disclosures.push(
+        `machineProfile "personal": ${corpCount} corp entr${corpCount === 1 ? "y" : "ies"} deliberately absent on this machine \u2014 disclosed, not dangling.`
+      );
+    }
+  }
+  return { findings, disclosures };
+}
+async function checkCorpWallArtifacts(entries, findings) {
+  for (const entry of entries) {
+    if (entry.profile !== "corp" || !entry.resolvedRoot) continue;
+    for (const artifact of CORP_WALL_ARTIFACTS) {
+      if (await pathExists(path.join(entry.resolvedRoot, artifact))) {
+        findings.push(
+          finding3(
+            `${FLEET_LENS}/corp-artifact-in-repo:${entry.name}:${artifact}`,
+            "risk",
+            `corp entry \`${entry.name}\` carries ${artifact} inside its worktree`,
+            [`${entry.resolvedRoot}/${artifact}`],
+            "Agent artifacts for corp repos live outside the repo by policy \u2014 an in-repo copy is one push away from colleagues' eyes and will diverge from the manifest-side truth.",
+            `Move it to the fleet's corp/${entry.name}/ zone and leave a pointer if the harness needs one.`
+          )
+        );
+      }
+    }
+  }
+}
+async function checkCoverage(manifest, findings, disclosures) {
+  if (!manifest.corpHosts.length) {
+    disclosures.push(
+      "Coverage check skipped \u2014 no corpHosts in the local manifest, so a corp remote cannot be recognized."
+    );
+    return;
+  }
+  if (!manifest.root || !await isDirectory(manifest.root)) {
+    disclosures.push("Coverage check skipped \u2014 the fleet root is undeclared or missing.");
+    return;
+  }
+  const registered = /* @__PURE__ */ new Set();
+  for (const entry of manifest.entries) {
+    if (entry.resolvedRoot) registered.add(await realpathOr(entry.resolvedRoot));
+  }
+  registered.add(await realpathOr(manifest.dir));
+  const dirents = await promises.readdir(manifest.root, { withFileTypes: true });
+  for (const d of dirents) {
+    if (!d.isDirectory() || d.name.startsWith(".")) continue;
+    const dir = path.join(manifest.root, d.name);
+    if (registered.has(await realpathOr(dir))) continue;
+    if (!await pathExists(path.join(dir, ".git"))) continue;
+    const remotes = await git(dir, ["config", "--get-regexp", "^remote\\..*\\.url"]);
+    if (!remotes) continue;
+    const corpRemote = manifest.corpHosts.find((h) => remotes.includes(h));
+    if (corpRemote) {
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/unregistered-corp-remote:${d.name}`,
+          "risk",
+          `\`${d.name}\` under the fleet root has a corp remote but is not registered`,
+          [`${dir}: remote matches ${corpRemote}`],
+          "The wall is only as good as its census \u2014 an unregistered employer checkout is corp material no sweep, wall check, or transfer plan knows exists.",
+          "Register it as a corp entry (opaque alias + local dirs mapping) or move it out of the fleet root."
+        )
+      );
+    }
+  }
+}
+async function checkManifestRepoMachinePaths(manifest, findings, disclosures) {
+  const isRepo = await git(manifest.dir, ["rev-parse", "--is-inside-work-tree"]) === "true";
+  if (!isRepo) {
+    disclosures.push(
+      "Machine-path check skipped \u2014 the manifest directory is not inside a git repository."
+    );
+    return;
+  }
+  const files = await gitGrepFiles(manifest.dir, MACHINE_PATH_GREP, "regex");
+  if (files === null) {
+    disclosures.push(
+      "Machine-path check could not run (`git grep` failed) \u2014 undetermined, not clean."
+    );
+    return;
+  }
+  for (const file of files) {
+    findings.push(
+      finding3(
+        `${FLEET_LENS}/machine-path:${file}`,
+        "risk",
+        `${file} (tracked in the manifest's repo) contains an absolute /Users/ path`,
+        [file],
+        "The manifest repo is the fleet's publishable surface \u2014 a tracked home-directory path ships the machine's identity in it.",
+        "Replace with `~` or a relative path; machine paths belong only in gitignored local files."
+      )
+    );
+  }
+}
+async function checkHygieneNeedles(manifest, findings, disclosures) {
+  const publicEntries = manifest.entries.filter((e) => e.trust === "public-repo" && e.resolvedRoot);
+  if (!publicEntries.length) return;
+  if (!manifest.localPresent) {
+    disclosures.push(
+      "Hygiene-needle check skipped \u2014 the local manifest (needle source) is absent on this machine."
+    );
+    return;
+  }
+  const needles = [
+    ...new Set(
+      [
+        ...Object.values(manifest.labels),
+        ...Object.values(manifest.localDirs).map((d) => path.basename(expandNeedleDir(d))),
+        ...manifest.corpHosts
+      ].filter((n) => n.length >= 3)
+    )
+  ];
+  if (!needles.length) {
+    disclosures.push("Hygiene-needle check skipped \u2014 the local manifest carries no needles.");
+    return;
+  }
+  for (const entry of publicEntries) {
+    const flagged = /* @__PURE__ */ new Set();
+    for (const needle of needles) {
+      const files = await gitGrepFiles(entry.resolvedRoot, needle);
+      if (files === null) {
+        disclosures.push(
+          `Hygiene-needle check could not run in \`${entry.name}\` \u2014 undetermined, not clean.`
+        );
+        break;
+      }
+      for (const file of files) {
+        if (flagged.has(file)) continue;
+        flagged.add(file);
+        findings.push(
+          finding3(
+            `${FLEET_LENS}/hygiene-needle:${entry.name}:${file}`,
+            "risk",
+            `${file} in public-repo \`${entry.name}\` carries a needle from the fleet's private local manifest`,
+            [`${file}: contains "${needle}"`],
+            "A public repo that names a private label, corp directory, or corp host joins the public and employer identities for anyone who greps.",
+            "Scrub the needle from the tracked file (rewrite history if it already shipped)."
+          )
+        );
+      }
+    }
+  }
+}
+function expandNeedleDir(dir) {
+  return dir.replace(/\/+$/, "");
+}
+async function checkCorpEmails(manifest, findings, disclosures) {
+  if (!manifest.corpHosts.length) {
+    disclosures.push(
+      "Corp-email check skipped \u2014 no corpHosts in the local manifest, so a corp domain cannot be recognized."
+    );
+    return;
+  }
+  for (const entry of manifest.entries) {
+    if (entry.profile !== "personal" || !entry.resolvedRoot) continue;
+    const emails = await git(entry.resolvedRoot, ["log", "-30", "--format=%ae"]);
+    if (emails === null) {
+      disclosures.push(
+        `Corp-email check could not run in \`${entry.name}\` (no readable commit history) \u2014 undetermined, not clean.`
+      );
+      continue;
+    }
+    const lines = emails.split("\n").filter(Boolean);
+    const matched = [...new Set(lines.filter((e) => emailMatchesCorpHosts(e, manifest.corpHosts)))];
+    if (matched.length) {
+      const count = lines.filter((e) => matched.includes(e)).length;
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/corp-email:${entry.name}`,
+          "risk",
+          `recent commits on personal entry \`${entry.name}\` are authored with a corp-host email`,
+          [`${count} of the last ${lines.length} commits: ${matched.join(", ")}`],
+          "A corp email in a personal repo's history ties the two identities together permanently \u2014 and silently, since the machine's global git identity is usually the corp one.",
+          "Set the repo-local identity to the personal one and amend the unpushed commits."
+        )
+      );
+    }
+  }
+}
+async function collectWallFindings(manifest) {
+  const findings = [];
+  const disclosures = [];
+  await checkCorpWallArtifacts(manifest.entries, findings);
+  await checkCoverage(manifest, findings, disclosures);
+  await checkManifestRepoMachinePaths(manifest, findings, disclosures);
+  await checkHygieneNeedles(manifest, findings, disclosures);
+  await checkCorpEmails(manifest, findings, disclosures);
+  return { findings, disclosures };
+}
+function stateAgeDays(facts) {
+  const freshness = facts.freshness;
+  if (!freshness?.repoLastCommit) return null;
+  const stateIds = new Set(
+    facts.artifacts.filter((a) => a.kind === "state" && a.exists).map((a) => a.id)
+  );
+  const dated = freshness.artifacts.filter((f) => stateIds.has(f.artifactId));
+  if (!dated.length) return null;
+  const repoAt = Date.parse(freshness.repoLastCommit);
+  return Math.max(
+    0,
+    ...dated.map(
+      (f) => (
+        // A dirty artifact is treated fresh-now (the refresh is on disk, uncommitted) — the row
+        // must agree with the lens, which discloses instead of flagging it.
+        f.commitsSince && !f.dirty ? Math.floor((repoAt - Date.parse(f.lastCommit)) / 864e5) : 0
+      )
+    )
+  );
+}
+async function sweepEntry(manifest, entry, opts) {
+  const project = {
+    name: entry.name,
+    profile: entry.profile,
+    kind: entry.kind,
+    resolvedRoot: entry.resolvedRoot,
+    unresolved: entry.unresolved,
+    staleAfterDays: entry.staleAfterDays ?? DEFAULT_CONFIG.state.staleAfterDays,
+    stateAgeDays: null,
+    counts: { risk: 0, gap: 0, polish: 0 },
+    findings: [],
+    disclosures: []
+  };
+  const root = entry.resolvedRoot;
+  if (!root) {
+    project.disclosures.push(`not audited: ${entry.unresolved ?? "unresolved"}`);
+    return project;
+  }
+  if (!await isDirectory(root)) {
+    project.unresolved = `resolved directory does not exist: ${root}`;
+    project.disclosures.push(`not audited: ${project.unresolved} \u2014 \`etymd fleet check\` names it`);
+    return project;
+  }
+  let upstreamRemote;
+  if (entry.upstream) {
+    const url = await git(root, ["remote", "get-url", entry.upstream]);
+    const refs = url !== null ? await git(root, ["for-each-ref", "--count=1", `refs/remotes/${entry.upstream}`]) : null;
+    if (url !== null && refs) {
+      upstreamRemote = entry.upstream;
+      project.disclosures.push(
+        `freshness measured on fork-authored commits only (\`--not --remotes=${entry.upstream}\`)`
+      );
+    } else if (url !== null) {
+      project.disclosures.push(
+        `upstream remote \`${entry.upstream}\` has no fetched refs \u2014 freshness measured on all commits`
+      );
+    } else {
+      project.disclosures.push(
+        `upstream remote \`${entry.upstream}\` not found \u2014 freshness measured on all commits`
+      );
+    }
+  }
+  const corp = entry.profile === "corp";
+  const optedIn = !corp && await pathExists(path.join(root, ETYMD_DIR));
+  const result = await runAudit(root, {
+    kind: opts.kind,
+    persistLedger: !corp && opts.persistLedgers === true && optedIn,
+    readOnlyRoot: corp,
+    ledgerRoot: corp ? corpPersistenceRoot(manifest, entry.name) : void 0,
+    stateBudgets: stateBudgetsFor(entry),
+    upstreamRemote
+  });
+  project.findings = result.findings;
+  for (const f of result.findings) project.counts[f.tier] += 1;
+  project.stateAgeDays = stateAgeDays(result.facts);
+  project.staleAfterDays = result.config.config.state.staleAfterDays;
+  for (const [key, value] of Object.entries(entry.contract)) {
+    if (key === "placement" || !value) continue;
+    const exists = await pathExists(path.join(root, value.replace(/#.*$/, "")));
+    project.disclosures.push(
+      `contract override \`${key}: ${value}\` \u2014 registered, existence-checked only (${exists ? "present" : "MISSING"})`
+    );
+  }
+  if (entry.contract.placement === "none") {
+    project.disclosures.push("contract placement `none` \u2014 legitimately absent, by declaration");
+  }
+  return project;
+}
+async function sweepFleet(manifest, opts = {}) {
+  let entries = manifest.entries;
+  if (opts.only?.length) {
+    const known = new Set(entries.map((e) => e.name));
+    const unknown = opts.only.filter((n) => !known.has(n));
+    if (unknown.length) {
+      throw new Error(
+        `--only names not in the manifest: ${unknown.join(", ")} \u2014 run \`etymd fleet check\``
+      );
+    }
+    const wanted = new Set(opts.only);
+    entries = entries.filter((e) => wanted.has(e.name));
+  }
+  if (opts.profile) entries = entries.filter((e) => e.profile === opts.profile);
+  const projects = [];
+  for (const entry of entries) {
+    projects.push(await sweepEntry(manifest, entry, opts));
+  }
+  const wall = await collectWallFindings(manifest);
+  return {
+    schema: FLEET_JSON_SCHEMA,
+    manifest: manifest.manifestPath,
+    sweptAt: (/* @__PURE__ */ new Date()).toISOString(),
+    projects,
+    wall: wall.findings,
+    wallDisclosures: wall.disclosures,
+    outOfScope: projects.filter((p) => !p.resolvedRoot || p.unresolved).map((p) => p.name),
+    problems: manifest.problems.map((p) => `${p.file}: ${p.detail}`)
+  };
+}
 
-export { CONFIG_FILE, DEFAULT_CONFIG, EXTRACTION_THRESHOLD, LENSES, NAME, PACK_VERSION, TOTAL_BUDGET_WORDS, VERSION, applyFiles, baselineCarriesMachinePath, baselinePath, buildGateInventory, cacheFactsPath, configPath, contextEconomyLens, deriveProfile, extractCommandClaims, extractPathClaims, gateIntegrityLens, instructionTruthLens, isAlwaysAppliedCursorRule, listInstructionFiles, measureContext, planWorkflow, rankFindings, readBaseline, readCachedFacts, readConfig, readLedger, reconcileLedger, runAudit, scanProject, withoutMachinePath, writeBaseline, writeCachedFacts, writeLedger };
+export { CONFIG_FILE, DECISIONS_FORMAT_MARKER, DEFAULT_CONFIG, EXTRACTION_THRESHOLD, FLEET_JSON_SCHEMA, FLEET_LENS, LENSES, NAME, PACK_VERSION, TOTAL_BUDGET_WORDS, VERSION, applyFiles, baselineCarriesMachinePath, baselinePath, buildGateInventory, cacheFactsPath, checkManifest, collectWallFindings, configPath, contextEconomyLens, corpPersistenceRoot, deriveProfile, expandTilde, extractCommandClaims, extractPathClaims, gateIntegrityLens, instructionTruthLens, isAlwaysAppliedCursorRule, listInstructionFiles, loadFleetManifest, measureContext, planWorkflow, rankFindings, readBaseline, readCachedFacts, readConfig, readLedger, reconcileLedger, runAudit, scanProject, stateFreshnessLens, sweepFleet, withoutMachinePath, writeBaseline, writeCachedFacts, writeLedger };