fdeops 3.8.3 → 3.9.1

package/README.md

@@ -142,9 +142,13 @@ Deterministic, offline, zero tokens - the skill adds judgment on top:
 
 ```bash
 fde scan                          # day-1 recon + ASK ON DAY 1 questions (works via npx)
-fde resume                        # load this workspace's engagement
-fde resume --init <client>        # THE setup step: create + bind an engagement
-fde debrief notes.md              # route meeting notes into memory (also reads stdin)
+fde resume                        # TRIAGE + load this workspace's engagement
+fde resume --init <client>        # THE setup step: create + bind + git-version .fde/
+fde triage                        # TRIAGE only (session hooks / Cursor entry)
+fde debrief notes.md              # route prefixed meeting notes (also reads stdin)
+fde debrief --smart notes.md      # propose routing from messy notes → --apply to confirm
+fde prep "Denise sync"            # grounded walk-in brief from existing memory
+fde doctor                        # lint: stale signals, unset phase, gaps
 fde log decision "descope agreed with Kowalczyk"
 fde log contact "Denise gone quiet" --signal amber
 fde receipts <term>               # dated search; no hit = a gap in the record, not proof of absence
@@ -154,7 +158,7 @@ fde dashboard                     # current engagement fieldbook (add --all for
 
 Optional: `export FDEOPS_ENGAGEMENTS_ROOT=~/path/to/engagements` to isolate init/status/dashboard from the default `~/fde-engagements`.
 
-The latest dated `[signal:...]` token per stakeholder drives the trust column in `status` and `dashboard`; signals older than 21 days show as stale.
+Each `.fde/` is a local git repo (no remote, no telemetry) — dated entries carry an author tag; every write commits so receipts are tamper-evident. Worst-of `[signal:...]` per stakeholder drives trust; signals older than 21 days show as stale.
 
 <p align="center"><img src="media/terminal-demo.svg" alt="fde CLI - status, scan, dashboard" width="720"/></p>
 

package/adapters/cursor.fde.mdc

@@ -18,7 +18,15 @@ When the FDE types **`@fde`** or describes an engagement situation (new customer
 
 Read and write engagement files under the workspace's bound engagement: run `fde resume` to resolve it (binding created once with `fde resume --init <name>`; default `~/fde-engagements/<name>/.fde/`). `FDEOPS_ENGAGEMENT` (expand `~`) overrides when set. Use `./.fde/` only when the engagement approves it and it is gitignored.
 
-On entry, run `fde resume` (fallback `node ~/.claude/fdeops/fde.js resume`) to load `context.md`. Use the CLI for deterministic work - `fde scan | log | receipts | status | dashboard` - instead of improvising shell.
+**On every session entry (before other work):** run `fde triage` (fallback `node ~/.claude/fdeops/fde.js triage`, then `fde resume`). Lead with that TRIAGE block — trust, phase, open risks, next action, record owner/hash. Do not invent stakeholders or status.
+
+Use the CLI for deterministic work - `fde scan | log | debrief | prep | doctor | receipts | status | dashboard` - instead of improvising shell.
+
+### Meeting → memory loop
+- Messy notes: `fde debrief --smart notes.md` → review `.debrief-propose` → `fde debrief --apply`
+- Prefixed notes: `fde debrief notes.md` (or pipe stdin)
+- Walk-in: `fde prep "Denise sync"`
+- Nothing enters the record unreviewed when using `--smart` (confirm with `--apply`)
 
 ## Voice
 

package/bin/fde.js

@@ -12,8 +12,14 @@
  *   fde resume              find this workspace's engagement, print bounded context
  *   fde resume --full       same, but the complete context.md (no bound)
  *   fde resume --init <n>   create + bind an engagement for this workspace
+ *   fde triage              deterministic TRIAGE block (hooks / Cursor entry)
  *   fde log <type> <text>   structured append (decision|risk|delivery|contact)
  *   fde debrief [file]      meeting notes → structured memory (stdin if no file)
+ *   fde debrief --smart     propose routing from messy notes; --apply commits it
+ *   fde prep [label]        grounded walk-in brief from existing .fde/ only
+ *   fde doctor              deterministic memory lint (stale signals, gaps)
+ *   fde garden [--apply]    propose safe consolidations; apply only with --apply
+ *   fde owner [set …]       who keeps this engagement record
  *   fde receipts <term>     "what did we agree?" - search memory with dates
  *   fde capture             session-end snapshot → context.md (hooks use this)
  *   fde status [--all]      current engagement (default) or full portfolio (--all)
@@ -322,6 +328,131 @@ function rmTreeQuiet(dir) {
   try { fs.rmSync(dir, { recursive: true, force: true }) } catch (_) {}
 }
 
+// ---------- versioned engagement memory (tamper-evident receipts) ----------
+// Each .fde/ is its own git repo. Writes auto-commit. No new npm deps - shell git.
+// Skips quietly if git is missing (warn once). Cross-process safety stays on
+// withFileLock + atomic rename; this layer is history + attribution, not locking.
+
+const OWNER_FILE = '.owner'
+const DEBRIEF_PROPOSE = '.debrief-propose'
+let _gitWarned = false
+
+function gitBinOk() {
+  try {
+    execFileSync('git', ['--version'], { stdio: 'ignore', timeout: 5000 })
+    return true
+  } catch (_) { return false }
+}
+
+function readOwner(eng) {
+  try {
+    const raw = fs.readFileSync(path.join(eng, OWNER_FILE), 'utf8')
+    const name = (raw.match(/^name:\s*(.+)$/m) || [])[1]
+    const email = (raw.match(/^email:\s*(.+)$/m) || [])[1]
+    if (name && email) return { name: name.trim(), email: email.trim() }
+  } catch (_) {}
+  return null
+}
+
+function writeOwnerIfMissing(eng) {
+  if (readOwner(eng)) return readOwner(eng)
+  const name = sh('git config user.name') || process.env.USER || process.env.LOGNAME || 'fde'
+  const email = sh('git config user.email') || `${String(name).replace(/\s+/g, '.').toLowerCase()}@local`
+  const body = `name: ${name}\nemail: ${email}\n`
+  try {
+    withFileLock(path.join(eng, OWNER_FILE), () => {
+      atomicWriteFile(path.join(eng, OWNER_FILE), body)
+    })
+  } catch (_) {
+    try { atomicWriteFile(path.join(eng, OWNER_FILE), body) } catch (_) {}
+  }
+  return { name, email }
+}
+
+function authorBracket(eng) {
+  const o = writeOwnerIfMissing(eng)
+  const id = (o.email.includes('@') ? o.email.split('@')[0] : o.name)
+    .replace(/[^\w.-]/g, '')
+    .slice(0, 40)
+  return id ? `@${id}` : ''
+}
+
+function datedEntry(eng, date, text, signal) {
+  const who = authorBracket(eng)
+  const bits = [`- [${date}]`]
+  if (who) bits.push(`[${who}]`)
+  if (signal) bits.push(`[signal:${signal}]`)
+  bits.push(text)
+  return bits.join(' ')
+}
+
+function ensureMemoryGit(eng) {
+  if (!eng || !fs.existsSync(eng)) return false
+  if (fs.existsSync(path.join(eng, '.git'))) {
+    writeOwnerIfMissing(eng)
+    return true
+  }
+  if (!gitBinOk()) {
+    if (!_gitWarned) {
+      process.stderr.write('⚠ git not found - engagement memory will not be versioned (receipts stay dated, but not tamper-evident)\n')
+      _gitWarned = true
+    }
+    writeOwnerIfMissing(eng)
+    return false
+  }
+  try {
+    execFileSync('git', ['init'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
+    atomicWriteFile(
+      path.join(eng, '.gitignore'),
+      ['*.lock', '*.tmp', '.last-write', '.debrief-propose', ''].join('\n')
+    )
+    writeOwnerIfMissing(eng)
+    commitMemory(eng, 'init engagement memory')
+    return true
+  } catch (_) {
+    return false
+  }
+}
+
+function commitMemory(eng, message) {
+  if (!eng || !fs.existsSync(path.join(eng, '.git'))) {
+    if (!ensureMemoryGit(eng)) return null
+  }
+  if (!gitBinOk()) return null
+  const owner = writeOwnerIfMissing(eng)
+  try {
+    execFileSync('git', ['add', '-A'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
+    const porcelain = execFileSync('git', ['status', '--porcelain'], {
+      cwd: eng, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    if (!String(porcelain || '').trim()) return null
+    const env = {
+      ...process.env,
+      GIT_AUTHOR_NAME: owner.name,
+      GIT_AUTHOR_EMAIL: owner.email,
+      GIT_COMMITTER_NAME: owner.name,
+      GIT_COMMITTER_EMAIL: owner.email,
+    }
+    execFileSync('git', ['-c', 'commit.gpgsign=false', 'commit', '-m', String(message || 'memory write').slice(0, 72)], {
+      cwd: eng, stdio: 'ignore', timeout: 15000, env,
+    })
+    return execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
+      cwd: eng, encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString().trim()
+  } catch (_) {
+    return null
+  }
+}
+
+function memoryHead(eng) {
+  if (!eng || !fs.existsSync(path.join(eng, '.git'))) return ''
+  try {
+    return execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
+      cwd: eng, encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString().trim()
+  } catch (_) { return '' }
+}
+
 // Pull the body under a "## Heading" up to the next "##" (or EOF).
 function sectionBody(md, heading) {
   const lines = md.split('\n')
@@ -365,7 +496,8 @@ function appendUnderSection(md, heading, entry) {
 // them matched what extractStakeholders actually read). A contact entry
 // carrying a [signal:x] token - however it got there - lands inside
 // "## Signal history"; everything else is a plain end-of-file append.
-function appendLogEntry(eng, type, entry) {
+function appendLogEntry(eng, type, entry, opts = {}) {
+  ensureMemoryGit(eng)
   const p = path.join(eng, LOG_FILES[type])
   if (type === 'contact' && /\[signal:(red|amber|green)\]/i.test(entry)) {
     withFileLock(p, () => {
@@ -377,6 +509,7 @@ function appendLogEntry(eng, type, entry) {
     lockedAppendFile(p, `\n${entry}\n`)
   }
   recordLastWrite(eng, LOG_FILES[type], entry)
+  if (!opts.skipCommit) commitMemory(eng, opts.commitMsg || `log ${type}`)
 }
 
 // phase / trust / top risk / freshness - identical heuristic for status + dashboard.
@@ -418,10 +551,12 @@ function stakeholdersMemoryHealth(eng) {
 
 // Subject key for a signal-history line - first real name word (same spirit as
 // extractStakeholders). A green about Randy must not clear an amber about Denise.
+// Strip author tags [@email-local] so attribution never becomes the subject key.
 function signalSubjectKey(text) {
-  const words = String(text).replace(/\([^)]*\)/g, '').split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
+  const cleaned = String(text).replace(/\[@[^\]]+\]/g, '').replace(/\([^)]*\)/g, '')
+  const words = cleaned.split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
   const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '').toLowerCase()
-  return frag.length >= 3 ? frag : ('anon:' + String(text).slice(0, 48).toLowerCase())
+  return frag.length >= 3 ? frag : ('anon:' + cleaned.slice(0, 48).toLowerCase())
 }
 
 function parsePhase(ctx) {
@@ -470,7 +605,11 @@ function computeSignals(eng) {
     const sm = l.match(/\[signal:(red|amber|green)\]/i)
     if (!sm) continue
     const date = (l.match(/\[(\d{4}-\d{2}-\d{2})\]/) || [])[1] || ''
-    const text = l.replace(/^\s*-\s*/, '').replace(/\[signal:(red|amber|green)\]/i, '').replace(/\[\d{4}-\d{2}-\d{2}\]/, '').trim()
+    const text = l.replace(/^\s*-\s*/, '')
+      .replace(/\[signal:(red|amber|green)\]/i, '')
+      .replace(/\[\d{4}-\d{2}-\d{2}\]/, '')
+      .replace(/\[@[^\]]+\]/g, '')
+      .trim()
     const key = signalSubjectKey(text)
     const prev = byPerson.get(key)
     if (!prev || date >= prev.date) byPerson.set(key, { date, sig: sm[1].toLowerCase(), text })
@@ -613,89 +752,126 @@ function colIndex(headers, rx) { return headers.findIndex(h => rx.test(h)) }
 // a person and a bullet that happens to name them. No token match -> keyword
 // heuristic on the stance/signal cell. No table at all -> empty, never
 // fabricated.
-function extractStakeholders(eng) {
+function parseSignalHistoryEntries(eng) {
+  // Format-agnostic on token position: CLI writes "[date] [signal:x] text";
+  // debrief may put the token at the end. Author tags [@x] are stripped for matching.
   const md = readClean(eng, 'stakeholders.md')
-  const table = parseMdTable(md)
-  if (!table) return []
-  const { headers, rows } = table
-  const nameIdx = colIndex(headers, /name/i)
-  if (nameIdx === -1) return []
-  const roleIdx = colIndex(headers, /^role$/i)
-  const stanceIdx = colIndex(headers, /stance|signal/i)
-  const notesIdx = colIndex(headers, /notes?/i)
-
-  const history = []
-  // Format-agnostic on token position: `fde log contact --signal` writes
-  // "[date] [signal:x] text" (token right after the date), but `fde debrief`
-  // appends the token at the END of whatever the agent wrote per the skill's
-  // own contact: convention - "[date] text [signal:x]". Both are subject-first
-  // once the token is stripped, so match the token anywhere on the line rather
-  // than requiring it immediately after the date; a debrief-written signal was
-  // silently invisible to per-stakeholder matching before this.
   const histText = sectionBody(md, 'Signal history') + '\n' + readEng(eng, SIGNAL_LEDGER)
+  const history = []
   histText.split('\n').forEach(l => {
     const dm = l.trim().match(/^-\s*\[(\d{4}-\d{2}-\d{2})\]\s*(.*)$/i)
     if (!dm) return
     const sm = dm[2].match(/\[signal:(red|amber|green)\]/i)
     if (!sm) return
-    const text = dm[2].replace(/\[signal:(red|amber|green)\]/i, '').trim()
+    const text = dm[2]
+      .replace(/\[signal:(red|amber|green)\]/i, '')
+      .replace(/\[@[^\]]+\]/g, '')
+      .trim()
     history.push({ date: dm[1], signal: sm[1].toLowerCase(), text })
   })
+  return history
+}
 
-  return rows.map(cs => {
-    const name = (cs[nameIdx] || '').trim()
-    if (!name) return null
-    const role = roleIdx !== -1 ? (cs[roleIdx] || '').trim() : ''
-    const stance = stanceIdx !== -1 ? (cs[stanceIdx] || '').trim() : ''
-    const note = notesIdx !== -1 ? (cs[notesIdx] || '').trim() : ''
-
-    // naive match fragment: first real word of the name, skipping honorifics,
-    // so "Dr. Anand Mehta" matches signal-history prose on "Anand", not "Dr."
-    const words = name.replace(/\([^)]*\)/g, '').split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
-    const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '')
-
-    // Match the SUBJECT of the entry, not anyone it mentions in passing -
-    // "Renata declined... told Sam..." is Renata's signal, not Sam's, even
-    // though "Sam" appears in the text. Every real signal-history line in
-    // this codebase's own examples is written subject-first ("Denise skipped
-    // Thursday demo", "Randy opened the sheet..."), so requiring the name at
-    // the START of the entry (not .includes() anywhere in it) is the fix,
-    // not a stricter rule invented for its own sake.
-    let signal = null, matchedDate = null
-    if (frag.length >= 3) {
-      for (const h of history) {
-        if (h.text.trim().toLowerCase().startsWith(frag.toLowerCase()) && (!matchedDate || h.date >= matchedDate)) {
-          signal = h.signal; matchedDate = h.date
+function displayNameFromSignalText(text) {
+  const t = String(text).trim()
+  const proper = t.match(/^([A-Z][a-z]+(?:\s+[A-Z][a-z]+)?)/)
+  if (proper) return proper[1]
+  const word = t.split(/\s+/).find(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
+  return word ? word.replace(/[^A-Za-z0-9.-]/g, '') : t.slice(0, 24)
+}
+
+// Stakeholders for prep/dashboard: table rows PLUS people who only appear in
+// Signal history / .signal-ledger (the common log-shaped path after debrief).
+function extractStakeholders(eng) {
+  const md = readClean(eng, 'stakeholders.md')
+  const table = parseMdTable(md)
+  const history = parseSignalHistoryEntries(eng)
+  const byKey = new Map()
+
+  if (table) {
+    const { headers, rows } = table
+    const nameIdx = colIndex(headers, /name|who/i)
+    if (nameIdx !== -1) {
+      const roleIdx = colIndex(headers, /^role$/i)
+      const stanceIdx = colIndex(headers, /stance|signal/i)
+      const notesIdx = colIndex(headers, /notes?/i)
+      for (const cs of rows) {
+        const name = (cs[nameIdx] || '').trim()
+        if (!name) continue
+        const role = roleIdx !== -1 ? (cs[roleIdx] || '').trim() : ''
+        const stance = stanceIdx !== -1 ? (cs[stanceIdx] || '').trim() : ''
+        const note = notesIdx !== -1 ? (cs[notesIdx] || '').trim() : ''
+        const words = name.replace(/\([^)]*\)/g, '').split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
+        const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '')
+        let signal = null, matchedDate = null
+        if (frag.length >= 3) {
+          for (const h of history) {
+            if (h.text.trim().toLowerCase().startsWith(frag.toLowerCase()) && (!matchedDate || h.date >= matchedDate)) {
+              signal = h.signal; matchedDate = h.date
+            }
+          }
         }
+        if (!signal) {
+          const s = stance.toLowerCase()
+          signal = /champion|steady|\bgreen\b/.test(s) ? 'green'
+            : /resistant|hostile|blocker|\bred\b/.test(s) ? 'red'
+            : 'amber'
+        }
+        byKey.set(signalSubjectKey(name), { name, role, note, signal, source: 'table' })
       }
     }
-    if (!signal) {
-      const s = stance.toLowerCase()
-      signal = /champion|steady|\bgreen\b/.test(s) ? 'green'
-        : /resistant|hostile|blocker|\bred\b/.test(s) ? 'red'
-        : 'amber' // neutral / cooling / warming / not met / unknown / no signal cell at all
+  }
+
+  // Latest signal per subject; fill gaps when the FDE never filled the table.
+  const latest = new Map()
+  for (const h of history) {
+    const key = signalSubjectKey(h.text)
+    const prev = latest.get(key)
+    if (!prev || h.date >= prev.date) latest.set(key, h)
+  }
+  for (const [key, h] of latest) {
+    if (byKey.has(key)) {
+      const cur = byKey.get(key)
+      byKey.set(key, { ...cur, signal: h.signal, note: cur.note || h.text.slice(0, 80) })
+    } else {
+      byKey.set(key, {
+        name: displayNameFromSignalText(h.text),
+        role: '',
+        note: h.text.slice(0, 80),
+        signal: h.signal,
+        source: 'signal',
+      })
     }
-    return { name, role, note, signal }
-  }).filter(Boolean)
+  }
+  return [...byKey.values()]
 }
 
-// Risks: same table parser, matched on a "Risk" column. Real files carry no
-// severity field, so severity is a coarse high/med keyword guess on the risk
-// text itself - a guess, same honesty as computeSignals()'s trust fallback,
-// not a claim of real triage. "## Retired" rows are prose bullets, not table
-// rows, so the table parser above already stops before them - they feed the
-// log instead (see extractLog).
+// Risks: table rows AND dated CLI/debrief bullets. Empty template cells ignored.
 function extractRisks(eng) {
   const md = readClean(eng, 'risks.md')
-  const table = parseMdTable(md)
-  if (!table) return []
-  const riskIdx = colIndex(table.headers, /^risk$/i)
-  if (riskIdx === -1) return []
-  const HIGH = /critical|blocker|exposure|breach|urgent|at risk|at stake|\brace\b/i
-  return table.rows.map(cs => {
-    const text = (cs[riskIdx] || '').trim()
-    return text ? { text, severity: HIGH.test(text) ? 'high' : 'med' } : null
-  }).filter(Boolean)
+  const body = md.split(/^#{1,6}\s+Retired\b/im)[0] || md
+  const HIGH = /critical|blocker|exposure|breach|urgent|at risk|at stake|\brace\b|rollback|no test/i
+  const out = []
+  const seen = new Set()
+  const push = (text) => {
+    const t = String(text || '').trim()
+    if (!t || seen.has(t.toLowerCase())) return
+    seen.add(t.toLowerCase())
+    out.push({ text: t, severity: HIGH.test(t) ? 'high' : 'med' })
+  }
+  const table = parseMdTable(body)
+  if (table) {
+    const riskIdx = colIndex(table.headers, /^risk$/i)
+    if (riskIdx !== -1) {
+      for (const cs of table.rows) push(cs[riskIdx])
+    }
+  }
+  for (const raw of body.split('\n')) {
+    const t = raw.trim()
+    const m = t.match(/^-\s*\[\d{4}-\d{2}-\d{2}\]\s*(?:\[@[^\]]+\]\s*)?(.*)$/)
+    if (m) push(m[1])
+  }
+  return out
 }
 
 // Best-effort scan for "before -> after" metric callouts in delivery/decisions
@@ -917,6 +1093,12 @@ function cmdResume(args) {
     // NDA surface: engagement notes must not silently leave the machine via file sync
     const syncHit = /icloud|mobile documents|dropbox|onedrive|google drive|box sync/i.exec(ENGAGEMENTS_ROOT)
     if (syncHit) console.log(`⚠ engagements root is inside a synced folder ("${syncHit[0]}") - client notes will leave this machine via sync. See PRIVACY.md.`)
+    // Tamper-evident fieldbook: version .fde/ with git (local only, no remote).
+    if (ensureMemoryGit(fdeDir)) {
+      const owner = readOwner(fdeDir)
+      const head = memoryHead(fdeDir)
+      console.log(`memory git: ${head || 'ready'}${owner ? `  owner: ${owner.email}` : ''}`)
+    }
     return
   }
   if (args[0] === '--bind') {
@@ -999,7 +1181,8 @@ function cmdLogUndo() {
     if (led != null) withFileLock(ledgerPath, () => { atomicWriteFile(ledgerPath, led.endsWith('\n') ? led : led + '\n') })
   }
   try { fs.unlinkSync(metaPath) } catch (_) {}
-  console.log(`undid last write → ${meta.file}`)
+  const hash = commitMemory(eng, `undo ${meta.file}`)
+  console.log(`undid last write → ${meta.file}${hash ? ` @${hash}` : ''}`)
 }
 
 function cmdLog(args) {
@@ -1027,8 +1210,8 @@ function cmdLog(args) {
       console.error('usage: fde log phase <land|discover|plan|build|ship|close>')
       process.exit(1)
     }
-    setContextPhase(eng, phase)
-    console.log(`phase → ${phase}`)
+    const hash = setContextPhase(eng, phase)
+    console.log(`phase → ${phase}${hash ? ` @${hash}` : ''}`)
     return
   }
 
@@ -1038,12 +1221,14 @@ function cmdLog(args) {
   if (hit && !force) { refuseSecret('log text', hit); process.exit(1) }
   if (hit && force) console.error(`warning: logging possible ${hit} (--force)`)
   const date = new Date().toISOString().slice(0, 10)
-  const entry = `- [${date}] ${signal ? `[signal:${signal}] ` : ''}${text}`
+  const entry = datedEntry(eng, date, text, signal || '')
   appendLogEntry(eng, type, entry)
-  console.log(`logged → ${LOG_FILES[type]}${signal ? ` (signal:${signal})` : ''}`)
+  const hash = memoryHead(eng)
+  console.log(`logged → ${LOG_FILES[type]}${signal ? ` (signal:${signal})` : ''}${hash ? ` @${hash}` : ''}`)
 }
 
 function setContextPhase(eng, phase) {
+  ensureMemoryGit(eng)
   const p = path.join(eng, 'context.md')
   let md = readEng(eng, 'context.md')
   if (!md) md = '# Engagement context\n\n'
@@ -1057,6 +1242,7 @@ function setContextPhase(eng, phase) {
     md = md.replace(/\*\*Last updated:\*\*\s*.*/i, `**Last updated:** ${today}`)
   }
   withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+  return commitMemory(eng, `phase ${phase}`)
 }
 
 
@@ -1065,21 +1251,79 @@ function setContextPhase(eng, phase) {
 // LOG_FILES target as dated bullets; everything else lands in context.md as one
 // dated debrief block. contact: lines may carry an inline [signal:x] token
 // anywhere in the text - preserved verbatim so computeSignals can trust it.
-// Real notes arrive as markdown: "- decision: ...", "* contact: ...",
-// "**Decision:** ..." - strip bullet/bold dressing before matching, or the
-// prefix silently misses and a [signal:x] token lands in context.md, which
-// signal parsing never reads. Silent loss is the one failure a memory tool
-// cannot have. --dry-run prints the routing without writing anything.
-function cmdDebrief(args) {
-  args = args.slice()
-  const dryIdx = args.indexOf('--dry-run')
-  const dry = dryIdx !== -1
-  if (dry) args.splice(dryIdx, 1)
-  let force = false
-  const forceIdx = args.indexOf('--force')
-  if (forceIdx !== -1) { force = true; args.splice(forceIdx, 1) }
-  const eng = resolveEngagement({ forWrite: true })
-  if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
+// --smart: heuristic propose from messy prose (confirm with --apply). No network.
+// --dry-run prints the routing without writing anything.
+function inferContactSignal(text) {
+  const t = String(text)
+  if (/\b(hostile|blocker|fired|refused|walked out|\bred\b|escalat(?:ed|ion) to (?:cto|legal))\b/i.test(t)) return 'red'
+  if (/\b(gone quiet|unresponsive|skipped|cooling|seemed cold|no-show|missed the|amber)\b/i.test(t)) return 'amber'
+  if (/\b(champion|helping|opened the|warming|supportive|on board|\bgreen\b|saw demo)\b/i.test(t)) return 'green'
+  return ''
+}
+
+function looksLikePersonLine(text) {
+  // "Denise …" / "Randy opened…" — capitalized subject + field verb.
+  return /^[A-Z][a-z]{1,20}\b/.test(text) &&
+    /\b(helping|quiet|skipped|said|will|opened|resistant|champion|warm|cold|unresponsive|demo|sheet|slack)\b/i.test(text)
+}
+
+function smartProposeText(input) {
+  const out = []
+  for (const raw of input.split('\n')) {
+    const line = raw.trim()
+    if (!line) continue
+    let bare = line
+      .replace(/^[-*+]\s+/, '')
+      .replace(/^\*\*(decision|risk|delivery|contact|next):?\*\*:?\s*/i, '$1: ')
+    if (/^(decision|risk|delivery|contact|next):\s*/i.test(bare)) {
+      let routed = bare.replace(/^(decision|risk|delivery|contact|next):\s*/i, (m, t) => `${t.toLowerCase()}: `)
+      if (/^contact:/i.test(routed) && !/\[signal:(red|amber|green)\]/i.test(routed)) {
+        const sig = inferContactSignal(routed)
+        if (sig) routed = routed.replace(/\s*$/, ` [signal:${sig}]`)
+      }
+      out.push(routed)
+      continue
+    }
+    if (/^(next action|follow-?ups?|action items?|todo):\s*/i.test(bare) ||
+        /\b(next action|walk in with|follow up with)\b/i.test(bare)) {
+      const next = bare.replace(/^(next action|follow-?ups?|action items?|todo):\s*/i, '').trim()
+      out.push(`next: ${next}`)
+      continue
+    }
+    if (/\b(we (decided|agreed)|decision:|descope|agreed to|agreement was|freeze scope)\b/i.test(bare)) {
+      out.push(`decision: ${bare}`)
+    } else if (/\b(open question|who signs|unclear who|unresolved)\b/i.test(bare)) {
+      out.push(`risk: ${bare}`)
+    } else if (/\b(risk|blocker|concern|at risk|worried|exposure|mitigation|no tested|no rollback)\b/i.test(bare)) {
+      out.push(`risk: ${bare}`)
+    } else if (/\b(shipped|delivered|deployed|merged PR|rolled out|went live)\b/i.test(bare)) {
+      out.push(`delivery: ${bare}`)
+    } else if (looksLikePersonLine(bare) ||
+               /\b(gone quiet|champion|resistant|unresponsive|skipped|cooling|signal:)\b/i.test(bare)) {
+      const sig = inferContactSignal(bare)
+      out.push(sig ? `contact: ${bare} [signal:${sig}]` : `contact: ${bare}`)
+    } else {
+      out.push(bare)
+    }
+  }
+  return out.join('\n') + (out.length ? '\n' : '')
+}
+
+function setNextAction(eng, text) {
+  ensureMemoryGit(eng)
+  const bullet = `- ${String(text).replace(/^[-*]\s+/, '').trim()}`
+  const p = path.join(eng, 'context.md')
+  let md = readEng(eng, 'context.md')
+  if (!md) md = '# Engagement context\n\n'
+  if (/^##\s+Next action\b/im.test(md)) {
+    md = md.replace(/(^##\s+Next action\b[^\n]*\n)([\s\S]*?)(?=^##\s|\s*$)/im, `$1\n${bullet}\n\n`)
+  } else {
+    md = md.replace(/\n*$/, `\n\n## Next action\n\n${bullet}\n`)
+  }
+  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+}
+
+function readDebriefInput(args) {
   let input = ''
   if (args[0]) {
     const notesPath = args[0].replace(/^~/, HOME)
@@ -1097,36 +1341,46 @@ function cmdDebrief(args) {
     }
     input = buf.toString('utf8')
   } else {
-    try { input = fs.readFileSync(0, 'utf8') } catch (_) {} // stdin until EOF
+    try { input = fs.readFileSync(0, 'utf8') } catch (_) {}
     if (Buffer.byteLength(input, 'utf8') > DEBRIEF_MAX_BYTES) {
       console.error(`debrief refused: stdin is over ${DEBRIEF_MAX_BYTES} bytes. Split the notes.`)
       process.exit(1)
     }
   }
+  return input
+}
+
+function routeDebriefInput(eng, input, { dry, force }) {
   const d = new Date()
   const date = d.toISOString().slice(0, 10)
-  const counts = { decision: 0, risk: 0, delivery: 0, contact: 0 }
+  const counts = { decision: 0, risk: 0, delivery: 0, contact: 0, next: 0 }
   const ctxLines = []
+  let nextAction = ''
+  ensureMemoryGit(eng)
   for (const raw of input.split('\n')) {
     let line = raw.trim()
     if (!line) continue
-    // markdown dressing: leading bullets (-, *, +) and bold around the prefix
-    const bare = line.replace(/^[-*+]\s+/, '').replace(/^\*\*(decision|risk|delivery|contact):?\*\*:?\s*/i, '$1: ')
-    const m = bare.match(/^(decision|risk|delivery|contact):\s*(.+)$/i)
+    const bare = line.replace(/^[-*+]\s+/, '').replace(/^\*\*(decision|risk|delivery|contact|next):?\*\*:?\s*/i, '$1: ')
+    const m = bare.match(/^(decision|risk|delivery|contact|next):\s*(.+)$/i)
     if (m) {
       const type = m[1].toLowerCase()
-      const body = m[2]
+      let body = m[2]
+      if (type === 'next') {
+        if (dry) console.log(`→ context.md ## Next action  - ${body}`)
+        else nextAction = body
+        counts.next++
+        continue
+      }
+      const sigInline = (body.match(/\[signal:(red|amber|green)\]/i) || [])[1]
+      if (sigInline) body = body.replace(/\[signal:(red|amber|green)\]/i, '').trim()
       const hit = findSecretHit(body)
       if (hit && !force) {
         console.error(`skipped ${type} line - looks like a ${hit}. Redact it, or re-run with --force.`)
         continue
       }
-      const entry = `- [${date}] ${body}`
+      const entry = datedEntry(eng, date, body, type === 'contact' && sigInline ? sigInline.toLowerCase() : '')
       if (dry) console.log(`→ ${LOG_FILES[type]}  ${entry}`)
-      // appendLogEntry, not a blind append: a contact: line may carry an
-      // inline [signal:x] token (the skill's own convention) and must land
-      // inside "## Signal history" the same way `fde log --signal` does.
-      else appendLogEntry(eng, type, entry)
+      else appendLogEntry(eng, type, entry, { skipCommit: true })
       counts[type]++
     } else {
       if (findSecretHit(line) && !force) {
@@ -1136,14 +1390,69 @@ function cmdDebrief(args) {
       ctxLines.push(line)
     }
   }
+  if (nextAction && !dry) setNextAction(eng, nextAction)
   if (ctxLines.length) {
     const stamp = `${date} ${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`
     if (dry) ctxLines.forEach(l => console.log(`→ context.md  - ${l}`))
     else lockedAppendFile(path.join(eng, 'context.md'), `\n## Debrief - ${stamp}\n${ctxLines.map(l => `- ${l}`).join('\n')}\n`)
   }
-  const plural = { decision: 'decisions', risk: 'risks', delivery: 'deliveries', contact: 'contacts' }
+  return { counts, ctxLines, date, nextAction }
+}
+
+function cmdDebrief(args) {
+  args = args.slice()
+  const dryIdx = args.indexOf('--dry-run')
+  const dry = dryIdx !== -1
+  if (dry) args.splice(dryIdx, 1)
+  const smartIdx = args.indexOf('--smart')
+  const smart = smartIdx !== -1
+  if (smart) args.splice(smartIdx, 1)
+  const applyIdx = args.indexOf('--apply')
+  const apply = applyIdx !== -1
+  if (apply) args.splice(applyIdx, 1)
+  let force = false
+  const forceIdx = args.indexOf('--force')
+  if (forceIdx !== -1) { force = true; args.splice(forceIdx, 1) }
+
+  const eng = resolveEngagement({ forWrite: true })
+  if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
+
+  let input = ''
+  if (apply && !smart && !args[0]) {
+    try { input = fs.readFileSync(path.join(eng, DEBRIEF_PROPOSE), 'utf8') } catch (_) {
+      console.error('nothing to apply - run: fde debrief --smart <notes.md>   then   fde debrief --apply')
+      process.exit(1)
+    }
+  } else {
+    input = readDebriefInput(args)
+  }
+
+  if (smart) {
+    const proposed = smartProposeText(input)
+    const proposePath = path.join(eng, DEBRIEF_PROPOSE)
+    withFileLock(proposePath, () => { atomicWriteFile(proposePath, proposed) })
+    console.log('SMART PROPOSE (heuristic - review before apply; no new facts invented beyond line rewrites)\n')
+    routeDebriefInput(eng, proposed, { dry: true, force })
+    if (!apply) {
+      console.log(`\nproposal saved → ${proposePath}`)
+      console.log('confirm:  fde debrief --apply')
+      console.log('(edit the propose file first if a line mis-routed)')
+      return
+    }
+    input = proposed
+  }
+
+  const { counts, ctxLines } = routeDebriefInput(eng, input, { dry, force })
+  if (!dry) {
+    const hash = commitMemory(eng, 'debrief')
+    try { fs.unlinkSync(path.join(eng, DEBRIEF_PROPOSE)) } catch (_) {}
+    if (hash) console.log(`memory @${hash}`)
+  }
+  const plural = {
+    decision: 'decisions', risk: 'risks', delivery: 'deliveries', contact: 'contacts', next: 'next actions',
+  }
   const parts = Object.keys(counts).filter(t => counts[t])
-    .map(t => `${counts[t]} ${counts[t] === 1 ? t : plural[t]}`)
+    .map(t => `${counts[t]} ${counts[t] === 1 ? (t === 'next' ? 'next action' : t) : plural[t]}`)
   if (ctxLines.length) parts.push(`${ctxLines.length} context line${ctxLines.length === 1 ? '' : 's'}`)
   const verb = dry ? 'debrief would route' : 'debrief routed'
   console.log(parts.length ? `${verb} → ${parts.join(', ')}` : 'debrief empty - nothing routed')
@@ -1196,6 +1505,7 @@ function cmdReceipts(args) {
 function cmdCapture() {
   const eng = resolveEngagement({ forWrite: true })
   if (!eng) process.exit(0) // silent: capture must never break a session
+  // Workspace git facts (cwd), not the engagement memory repo.
   const branch = sh('git branch --show-current')
   const lastCommit = sh("git log -1 --format='%h %s'").slice(0, 100)
   // porcelain lines are "XY path" - sh() trims, so parse by first whitespace
@@ -1212,7 +1522,206 @@ function cmdCapture() {
   if (branch) block += `- workspace: \`${branch}\` @ ${lastCommit || 'no commits yet'}\n`
   if (changed) block += `- uncommitted: ${changed}\n`
   if (updated) block += `- engagement files updated: ${updated}\n`
-  try { lockedAppendFile(path.join(eng, 'context.md'), block, { soft: true }) } catch (_) {}
+  try {
+    ensureMemoryGit(eng)
+    lockedAppendFile(path.join(eng, 'context.md'), block, { soft: true })
+    commitMemory(eng, 'session capture')
+  } catch (_) {}
+}
+
+function cmdTriage() {
+  const eng = resolveEngagement()
+  if (!eng) {
+    console.error('no engagement - run: fde resume --init <name>')
+    process.exit(2)
+  }
+  console.log(resumeTriage(eng))
+  const owner = readOwner(eng) || writeOwnerIfMissing(eng)
+  const head = memoryHead(eng)
+  if (owner || head) {
+    console.log(`  record: ${owner ? owner.email : '?'}${head ? `  memory@${head}` : '  (unversioned)'}`)
+  }
+}
+
+function cmdOwner(args) {
+  const eng = resolveEngagement({ forWrite: args[0] === 'set' })
+  if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
+  if (args[0] === 'set') {
+    const email = args[1]
+    if (!email || !email.includes('@')) {
+      console.error('usage: fde owner set <email> [name...]')
+      process.exit(1)
+    }
+    const name = args.slice(2).join(' ') || email.split('@')[0]
+    ensureMemoryGit(eng)
+    withFileLock(path.join(eng, OWNER_FILE), () => {
+      atomicWriteFile(path.join(eng, OWNER_FILE), `name: ${name}\nemail: ${email}\n`)
+    })
+    const hash = commitMemory(eng, 'owner set')
+    console.log(`owner → ${name} <${email}>${hash ? ` @${hash}` : ''}`)
+    return
+  }
+  const o = readOwner(eng) || writeOwnerIfMissing(eng)
+  console.log(`owner: ${o.name} <${o.email}>`)
+  const head = memoryHead(eng)
+  if (head) console.log(`memory HEAD: ${head}`)
+  else console.log('memory HEAD: (unversioned - git init on next write)')
+}
+
+function cmdDoctor() {
+  const eng = resolveEngagement()
+  if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
+  const issues = []
+  const s = computeSignals(eng)
+  if (s.phase === '?') {
+    const hasWork = /\[\d{4}-\d{2}-\d{2}\]/.test(readEng(eng, 'decisions.md') + readEng(eng, 'delivery.md'))
+    if (hasWork) issues.push('phase is unset but dated work exists - run: fde log phase <land|discover|plan|build|ship|close>')
+    else issues.push('phase is unset - set when you know where you are: fde log phase land')
+  }
+  if (s.stale) issues.push(`trust signal is STALE (${s.signalAge}d) - reconfirm with fde log contact ... --signal`)
+  if (s.memoryWarn) issues.push(s.memoryWarn)
+  if (!readOwner(eng)) issues.push('no .owner - run any write or: fde owner set you@firm.com')
+  if (!fs.existsSync(path.join(eng, '.git'))) issues.push('memory not git-versioned - next write will init, or re-run resume --init')
+  const success = readClean(eng, 'success.md')
+  if (!firstLine(success, 80)) issues.push('success.md has no stated done-definition - fill before plan/build')
+  if (!sectionBody(readClean(eng, 'context.md'), 'Next action')) {
+    issues.push('no ## Next action in context.md - Monday morning has nothing to drive')
+  }
+  console.log(`FDE DOCTOR - ${engagementSlugFromPath(eng)}`)
+  console.log(resumeTriage(eng))
+  if (!issues.length) {
+    console.log('\nOK - no structural issues (judgment still yours)')
+    process.exit(0)
+  }
+  console.log(`\n${issues.length} issue(s):`)
+  issues.forEach((i, n) => console.log(`  ${n + 1}. ${i}`))
+  process.exit(1)
+}
+
+function cmdPrep(args) {
+  const eng = resolveEngagement()
+  if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
+  const label = args.join(' ').trim() || 'next meeting'
+  // Grounded brief: only text already in .fde/. No invention (Rowboat meeting-prep rule).
+  console.log(`MEETING PREP — ${label}`)
+  console.log('(grounded in local .fde/ only - if a fact is missing, it is missing)\n')
+  console.log(resumeTriage(eng))
+  const owner = readOwner(eng)
+  const head = memoryHead(eng)
+  if (owner || head) console.log(`  record: ${owner ? owner.email : '?'}${head ? `  @${head}` : ''}`)
+
+  const people = extractStakeholders(eng).slice(0, 8)
+  console.log('\nStakeholders (table + signal history)')
+  if (!people.length) console.log('  (none yet - log contacts with --signal)')
+  else people.forEach(p => console.log(`  [${p.signal}] ${p.name}${p.role ? ` — ${p.role}` : ''}${p.note ? ` · ${p.note.slice(0, 60)}` : ''}`))
+
+  const risks = extractRisks(eng).slice(0, 5)
+  console.log('\nOpen risks (table + dated bullets)')
+  if (!risks.length) console.log('  (none logged)')
+  else risks.forEach(r => console.log(`  [${r.severity}] ${r.text.slice(0, 100)}`))
+
+  const success = firstLine(readClean(eng, 'success.md'), 160)
+  console.log('\nSuccess looks like')
+  console.log(success ? `  ${success}` : '  (success.md empty)')
+
+  const decisions = readClean(eng, 'decisions.md').split('\n')
+    .filter(l => /^-\s*\[\d{4}-\d{2}-\d{2}\]/.test(l.trim()))
+    .slice(-5)
+  console.log('\nRecent decisions')
+  if (!decisions.length) console.log('  (none logged)')
+  else decisions.forEach(l => console.log(`  ${l.trim().slice(0, 120)}`))
+
+  const next = nextActionLine(readClean(eng, 'context.md'))
+  console.log('\nWalk in with')
+  console.log(next ? `  ${next}` : '  (set ## Next action in context.md)')
+}
+
+function cmdGarden(args) {
+  const apply = args.includes('--apply')
+  const eng = resolveEngagement({ forWrite: apply })
+  if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
+  // Gardener contract (from Rowboat note_curation): no new facts, no deleted substance,
+  // reversible via git, confirm before apply. Mechanical only - no LLM rewrite.
+  console.log('GARDEN (contract: no new facts · no deleted substance · reversible via memory git)')
+  console.log(resumeTriage(eng))
+  const proposals = []
+  const s = computeSignals(eng)
+  if (s.stale) {
+    proposals.push({
+      id: 'reconfirm-signal',
+      kind: 'manual',
+      text: `Reconfirm stale ${s.trust} signal (${s.signalAge}d): fde log contact "…" --signal`,
+    })
+  }
+  const ctx = readEng(eng, 'context.md')
+  const sessionBlocks = []
+  const lines = ctx.split('\n')
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^##\s+Session end\s+-\s+(\d{4}-\d{2}-\d{2})\b/)
+    if (!m) continue
+    const age = Math.floor((Date.now() - Date.parse(m[1])) / 86400000)
+    if (age >= 60) sessionBlocks.push({ line: i, date: m[1], age })
+  }
+  if (sessionBlocks.length >= 3) {
+    proposals.push({
+      id: 'archive-sessions',
+      kind: 'apply',
+      text: `Archive ${sessionBlocks.length} session-end blocks older than 60d into context-archive.md`,
+      sessionBlocks,
+    })
+  }
+  if (!proposals.length) {
+    console.log('\nNothing to garden.')
+    return
+  }
+  console.log(`\n${proposals.length} proposal(s):`)
+  proposals.forEach((p, i) => console.log(`  ${i + 1}. [${p.kind}] ${p.text}`))
+  if (!apply) {
+    console.log('\nApply mechanical items only:  fde garden --apply')
+    console.log('Manual items stay yours. Every apply commits to memory git.')
+    return
+  }
+  ensureMemoryGit(eng)
+  let applied = 0
+  for (const p of proposals) {
+    if (p.id !== 'archive-sessions') continue
+    const cutDates = new Set(p.sessionBlocks.map(b => b.date))
+    const keep = []
+    const archive = []
+    let mode = 'keep'
+    let buf = []
+    const flush = () => {
+      if (!buf.length) return
+      ;(mode === 'archive' ? archive : keep).push(...buf)
+      buf = []
+    }
+    for (const line of lines) {
+      const m = line.match(/^##\s+Session end\s+-\s+(\d{4}-\d{2}-\d{2})\b/)
+      if (m) {
+        flush()
+        mode = cutDates.has(m[1]) ? 'archive' : 'keep'
+      } else if (/^##\s+/.test(line) && mode === 'archive') {
+        flush()
+        mode = 'keep'
+      }
+      buf.push(line)
+    }
+    flush()
+    if (!archive.length) continue
+    const archPath = path.join(eng, 'context-archive.md')
+    const prev = fs.existsSync(archPath) ? fs.readFileSync(archPath, 'utf8') : '# Context archive\n\n'
+    withFileLock(archPath, () => {
+      atomicWriteFile(archPath, prev.replace(/\n*$/, '\n\n') + archive.join('\n').trim() + '\n')
+    })
+    withFileLock(path.join(eng, 'context.md'), () => {
+      atomicWriteFile(path.join(eng, 'context.md'), keep.join('\n').replace(/\n*$/, '\n'))
+    })
+    applied++
+    console.log(`applied: archived ${p.sessionBlocks.length} old session-end blocks → context-archive.md`)
+  }
+  const hash = commitMemory(eng, 'garden')
+  if (!applied) console.log('no mechanical proposals applied (manual items remain)')
+  else console.log(`garden done${hash ? ` @${hash}` : ''}`)
 }
 
 function engagementSlugFromPath(eng) {
@@ -2021,24 +2530,36 @@ function printUsage() {
   fde resume --full        load the complete context.md (no bound)
   fde resume --init <name> create + bind engagement for this workspace (rebind replaces)
   fde resume --bind        show what this workspace is bound to, and what resolves
+  fde triage               TRIAGE block only (hooks / Cursor session entry)
   fde log <type> <text>    append decision|risk|delivery|contact (contact takes --signal red|amber|green; --force to allow secret-like text)
   fde log phase <phase>    set engagement phase (land|discover|plan|build|ship|close)
   fde log --undo           remove the last CLI log/debrief entry from memory
-  fde debrief [file]       meeting notes → memory: decision:/risk:/delivery:/contact: lines route, rest → context.md (stdin if no file; --dry-run; --force)
+  fde debrief [file]       meeting notes → memory (prefixed lines; --dry-run; --force)
+  fde debrief --smart      propose routing from messy notes → review → fde debrief --apply
+  fde prep [label]         grounded walk-in brief from existing .fde/ only
+  fde doctor               lint engagement memory (stale signals, gaps)
+  fde garden [--apply]     propose safe consolidations (contract: no new facts; git-reversible)
+  fde owner [set email]    who keeps this engagement record
   fde receipts <term>      "what did we agree?" with dates
   fde capture              session-end memory snapshot (hooks use this)
   fde status [--all]       current engagement status (pass --all for full portfolio)
   fde dashboard [--all]    current engagement fieldbook (pass --all for every client)
   env FDEOPS_ENGAGEMENTS_ROOT  override ~/fde-engagements (init/status/dashboard/registry)
-  writes require a workspace bind (or FDEOPS_ENGAGEMENT) - folder-name match is read-only`)
+  writes require a workspace bind (or FDEOPS_ENGAGEMENT) - folder-name match is read-only
+  .fde/ is git-versioned locally for tamper-evident receipts (no remote, no telemetry)`)
 }
 
 const [cmd, ...args] = process.argv.slice(2)
 switch (cmd) {
   case 'scan': cmdScan(); break
   case 'resume': cmdResume(args); break
+  case 'triage': cmdTriage(); break
   case 'log': cmdLog(args); break
   case 'debrief': cmdDebrief(args); break
+  case 'prep': cmdPrep(args); break
+  case 'doctor': cmdDoctor(); break
+  case 'garden': cmdGarden(args); break
+  case 'owner': cmdOwner(args); break
   case 'receipts': cmdReceipts(args); break
   case 'capture': cmdCapture(); break
   case 'status': cmdStatus(args); break

package/hooks/session-start

@@ -147,7 +147,39 @@ if [ -n "$BOOTSTRAP" ]; then
   CONTENT="$CONTENT$(cat "$BOOTSTRAP")\n\n"
 fi
 
+# Same TRIAGE block as `fde resume` / `fde triage` - Monday morning must not
+# depend on the model remembering to run a CLI command. Prefer the installed
+# fde binary; fall back to the plugin/repo copy of bin/fde.js.
+resolve_fde() {
+  if command -v fde >/dev/null 2>&1; then
+    printf '%s\n' "fde"
+    return 0
+  fi
+  for candidate in \
+    "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/bin/fde.js}" \
+    "$(dirname "$0")/../bin/fde.js" \
+    "$HOME/.claude/fdeops/fde.js" \
+    "$HOME/.claude/plugins/fdeops/bin/fde.js"; do
+    if [ -n "$candidate" ] && [ -f "$candidate" ]; then
+      printf '%s\n' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
 if [ -n "$CONTEXT_FILE" ] && [ -f "$CONTEXT_FILE" ]; then
+  FDE_CMD=$(resolve_fde || true)
+  if [ -n "$FDE_CMD" ]; then
+    if [ "$FDE_CMD" = "fde" ]; then
+      TRIAGE=$(fde triage 2>/dev/null || true)
+    else
+      TRIAGE=$(node "$FDE_CMD" triage 2>/dev/null || true)
+    fi
+    if [ -n "$TRIAGE" ]; then
+      CONTENT="$CONTENT---\n$TRIAGE\n\n"
+    fi
+  fi
   REDACTED_CONTEXT=$(mktemp)
   strip_private "$CONTEXT_FILE" > "$REDACTED_CONTEXT"
   CONTENT="$CONTENT---\nEngagement context ($CONTEXT_FILE):\n$(bounded_context "$REDACTED_CONTEXT")\n"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.8.3",
+  "version": "3.9.1",
   "description": "Field kit for engineers embedded in client work - a real CLI (recon, memory, portfolio), one @fde skill with field judgment on top, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",