kibi-runtime 2.10.0 → 2.12.0

package/dist/index.js

@@ -6737,19 +6737,56 @@ var init_engine_limits = __esm(() => {
   };
 });
 
+// ../cli/dist/package-versions.js
+import { readFileSync as readFileSync2 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+function manifestVersion(manifestPath, expectedName) {
+  try {
+    const manifest = JSON.parse(readFileSync2(manifestPath, "utf8"));
+    return manifest.name === expectedName && typeof manifest.version === "string" ? manifest.version : undefined;
+  } catch {
+    return;
+  }
+}
+function cliVersion() {
+  if (true)
+    return "2.14.0";
+  return manifestVersion(path2.join(moduleDirectory, "..", "package.json"), "kibi-cli") ?? "unknown";
+}
+function coreVersion() {
+  try {
+    const resolved = manifestVersion(require2.resolve("kibi-core/package.json"), "kibi-core");
+    if (resolved)
+      return resolved;
+  } catch {}
+  return manifestVersion(path2.join(moduleDirectory, "..", "..", "core", "package.json"), "kibi-core") ?? "unknown";
+}
+function kibiPackageVersions() {
+  const override = process.env.KIBI_PACKAGE_VERSIONS;
+  return override !== undefined && override.length > 0 ? override : KIBI_BUILT_PACKAGE_VERSIONS;
+}
+var require2, moduleDirectory, KIBI_BUILT_PACKAGE_VERSIONS;
+var init_package_versions = __esm(() => {
+  require2 = createRequire2(import.meta.url);
+  moduleDirectory = path2.dirname(fileURLToPath(import.meta.url));
+  KIBI_BUILT_PACKAGE_VERSIONS = `kibi-cli@${cliVersion()},kibi-core@${coreVersion()}`;
+});
+
 // ../cli/dist/performance-trace.js
 import { constants } from "node:fs";
 import { closeSync, existsSync as existsSync2, lstatSync, openSync, realpathSync, statSync, writeSync } from "node:fs";
-import path2 from "node:path";
+import path3 from "node:path";
 function isWithin(parent, candidate) {
-  const relative = path2.relative(parent, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
+  const relative = path3.relative(parent, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(relative);
 }
 function privateTraceFile() {
   if (process.env[KIBI_PERF_TIMINGS_ENV] !== "1")
     return null;
   const configuredDirectory = process.env[KIBI_PERF_TRACE_DIR_ENV];
-  if (!configuredDirectory || !path2.isAbsolute(configuredDirectory))
+  if (!configuredDirectory || !path3.isAbsolute(configuredDirectory))
     return null;
   try {
     const directoryInfo = lstatSync(configuredDirectory);
@@ -6757,7 +6794,7 @@ function privateTraceFile() {
       return null;
     }
     const directory = realpathSync(configuredDirectory);
-    if (path2.resolve(configuredDirectory) !== directory)
+    if (path3.resolve(configuredDirectory) !== directory)
       return null;
     const directoryStats = statSync(directory);
     if (typeof process.getuid !== "function" || directoryStats.uid !== process.getuid()) {
@@ -6769,7 +6806,7 @@ function privateTraceFile() {
     const currentDirectory = realpathSync(process.cwd());
     if (isWithin(currentDirectory, directory))
       return null;
-    const file = path2.join(directory, `kibi-performance-${process.pid}.jsonl`);
+    const file = path3.join(directory, `kibi-performance-${process.pid}.jsonl`);
     let state = states.get(file);
     if (!state) {
       if (existsSync2(file))
@@ -7138,8 +7175,8 @@ var init_error_terms = () => {};
 
 // ../cli/dist/prolog/swipl-resolver.js
 import { execFileSync, spawnSync } from "node:child_process";
-import { constants as constants2, accessSync, existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
-import path3 from "node:path";
+import { constants as constants2, accessSync, existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
+import path4 from "node:path";
 import { BUNDLED_BINARY_PATH, MANIFEST_FILE, PLATFORM_PACKAGES, locatePlatformPackage, platformKey, sha256File, validateBuildManifest } from "kibi-swipl";
 function detectGlibc() {
   if (process.platform !== "linux")
@@ -7212,8 +7249,8 @@ function inspectBundle(deps) {
   const packageDir = deps.locatePackage(packageName);
   if (packageDir === undefined)
     return { kind: "missing", key, packageName };
-  const manifestPath = path3.join(packageDir, MANIFEST_FILE);
-  const binary = path3.join(packageDir, BUNDLED_BINARY_PATH);
+  const manifestPath = path4.join(packageDir, MANIFEST_FILE);
+  const binary = path4.join(packageDir, BUNDLED_BINARY_PATH);
   if (!existsSync3(manifestPath)) {
     if (!existsSync3(binary))
       return { kind: "empty", key, packageName };
@@ -7233,12 +7270,12 @@ function inspectBundle(deps) {
   let manifest;
   let packageJson;
   try {
-    manifest = JSON.parse(readFileSync2(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
   } catch (error) {
     return corrupt(`${MANIFEST_FILE} is not valid JSON (${error instanceof Error ? error.message : String(error)})`);
   }
   try {
-    packageJson = JSON.parse(readFileSync2(path3.join(packageDir, "package.json"), "utf8"));
+    packageJson = JSON.parse(readFileSync3(path4.join(packageDir, "package.json"), "utf8"));
   } catch (error) {
     return corrupt(`package.json is unreadable (${error instanceof Error ? error.message : String(error)})`);
   }
@@ -7261,7 +7298,7 @@ function inspectBundle(deps) {
   if (actual !== checked.binarySha256) {
     return corrupt(`${BUNDLED_BINARY_PATH} SHA-256 ${actual} does not match the manifest (${checked.binarySha256})`);
   }
-  const home = path3.join(packageDir, checked.home);
+  const home = path4.join(packageDir, checked.home);
   let homeIsDirectory = false;
   try {
     homeIsDirectory = statSync2(home).isDirectory();
@@ -7303,10 +7340,10 @@ function probeVersion(bin, deps) {
   return { kind: "ok", version: parsed.version };
 }
 function findOnPath(env, deps) {
-  for (const directory of (env.PATH ?? "").split(path3.delimiter)) {
-    if (directory === "" || !path3.isAbsolute(directory))
+  for (const directory of (env.PATH ?? "").split(path4.delimiter)) {
+    if (directory === "" || !path4.isAbsolute(directory))
       continue;
-    const candidate = path3.join(directory, "swipl");
+    const candidate = path4.join(directory, "swipl");
     if (!isExecutableFile(candidate))
       continue;
     const probe = probeVersion(candidate, deps);
@@ -7329,7 +7366,7 @@ function resolveFromEnv(override, deps) {
   });
   const packageName = key === undefined ? undefined : PLATFORM_PACKAGES[key].package;
   const invalid = (detail) => new SwiplResolutionError("swipl_env_invalid", `KIBI_SWIPL=${override} ${detail}. Set KIBI_SWIPL to the absolute path of a SWI-Prolog ${MINIMUM_SWIPL_MAJOR}.0+ executable, to "system" to use swipl from PATH, or unset it to use the bundled runtime.`, platform, packageName);
-  if (!path3.isAbsolute(override))
+  if (!path4.isAbsolute(override))
     return fail(invalid("is not an absolute path"));
   if (!isExecutableFile(override)) {
     return fail(invalid("is not an executable file"));
@@ -7454,18 +7491,10 @@ var init_swipl_resolver = __esm(() => {
 // ../cli/dist/prolog.js
 import { spawn } from "node:child_process";
 import { existsSync as existsSync4 } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
-import path4 from "node:path";
+import { createRequire as createRequire3 } from "node:module";
+import path5 from "node:path";
 import { performance } from "node:perf_hooks";
-import { fileURLToPath } from "node:url";
-function packageVersion(packagePath) {
-  try {
-    const packageJson = require2(packagePath);
-    return typeof packageJson.version === "string" ? packageJson.version : "unknown";
-  } catch {
-    return "unknown";
-  }
-}
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function resolveKbPlPath() {
   const overrideKbPath = getKbPlPathOverride();
   if (overrideKbPath) {
@@ -7473,20 +7502,20 @@ function resolveKbPlPath() {
   }
   try {
     try {
-      return require2.resolve("kibi-core/src/kb.pl");
+      return require3.resolve("kibi-core/src/kb.pl");
     } catch {
-      const coreMain = require2.resolve("kibi-core");
-      const coreDir = path4.dirname(coreMain);
-      return path4.join(coreDir, "src", "kb.pl");
+      const coreMain = require3.resolve("kibi-core");
+      const coreDir = path5.dirname(coreMain);
+      return path5.join(coreDir, "src", "kb.pl");
     }
   } catch {}
   let currentDir = importMetaDir;
-  while (currentDir !== path4.dirname(currentDir)) {
-    const candidate = path4.join(currentDir, "packages", "core", "src", "kb.pl");
+  while (currentDir !== path5.dirname(currentDir)) {
+    const candidate = path5.join(currentDir, "packages", "core", "src", "kb.pl");
     if (existsSync4(candidate)) {
       return candidate;
     }
-    currentDir = path4.dirname(currentDir);
+    currentDir = path5.dirname(currentDir);
   }
   throw new Error("Unable to resolve kb.pl. Expected kibi-core to be installed (node_modules) " + "or to be running inside the monorepo checkout.");
 }
@@ -7568,7 +7597,7 @@ class PrologProcess {
         ...launch.env,
         KIBI_RUNTIME_NAME: process.versions.bun !== undefined ? "bun" : "node",
         KIBI_RUNTIME_VERSION: process.versions.bun ?? process.versions.node ?? "unknown",
-        KIBI_PACKAGE_VERSIONS: process.env.KIBI_PACKAGE_VERSIONS ?? KIBI_PACKAGE_VERSIONS
+        KIBI_PACKAGE_VERSIONS: kibiPackageVersions()
       }
     });
     this.clearQueryBuffers();
@@ -7689,7 +7718,7 @@ writeln('${INTERACTIVE_QUERY_FRAME_END}').
             console.error(`[prolog debug] timeout: ${msg}`);
             const runtime = this.errorBuffer.split(`
 `).find((line) => line.includes("__KIBI_RUNTIME__"));
-            console.error(`[prolog debug] runtime=${runtime ?? "unknown"} packages=${process.env.KIBI_PACKAGE_VERSIONS ?? KIBI_PACKAGE_VERSIONS}`);
+            console.error(`[prolog debug] runtime=${runtime ?? "unknown"} packages=${kibiPackageVersions()}`);
           }
           settle();
           this.terminationReason = `query timeout: ${goalLabel}`;
@@ -7888,7 +7917,7 @@ writeln('${INTERACTIVE_QUERY_FRAME_END}').
     ].join(", ");
     const runtimeName = process.versions.bun !== undefined ? "bun" : "node";
     const runtimeVersion = process.versions.bun ?? process.versions.node ?? "unknown";
-    const packageVersions = process.env.KIBI_PACKAGE_VERSIONS ?? KIBI_PACKAGE_VERSIONS;
+    const packageVersions = kibiPackageVersions();
     let child;
     try {
       const launch = this.launchTarget();
@@ -8264,19 +8293,15 @@ writeln('${INTERACTIVE_QUERY_FRAME_END}').
     }
   }
 }
-var importMetaDir, DEFAULT_PROLOG_OUTPUT_MAX_BUFFER_BYTES, PROLOG_OUTPUT_OVERFLOW_ERROR = "Query exceeded bounded Prolog output capacity (ENOBUFS); narrow the operation or reduce stored entity size", INTERACTIVE_QUERY_FRAME_END = "__KIBI_QUERY_FRAME_END__", require2, KIBI_PACKAGE_VERSIONS, PrologProcessTerminatedError;
+var importMetaDir, DEFAULT_PROLOG_OUTPUT_MAX_BUFFER_BYTES, PROLOG_OUTPUT_OVERFLOW_ERROR = "Query exceeded bounded Prolog output capacity (ENOBUFS); narrow the operation or reduce stored entity size", INTERACTIVE_QUERY_FRAME_END = "__KIBI_QUERY_FRAME_END__", require3, PrologProcessTerminatedError;
 var init_prolog = __esm(() => {
+  init_package_versions();
   init_performance_trace();
   init_error_terms();
   init_swipl_resolver();
-  importMetaDir = path4.dirname(fileURLToPath(import.meta.url));
+  importMetaDir = path5.dirname(fileURLToPath2(import.meta.url));
   DEFAULT_PROLOG_OUTPUT_MAX_BUFFER_BYTES = 8 * 1024 * 1024;
-  require2 = createRequire2(import.meta.url);
-  KIBI_PACKAGE_VERSIONS = [
-    `kibi-cli@${packageVersion(path4.join(importMetaDir, "..", "package.json"))}`,
-    `kibi-core@${packageVersion(path4.join(importMetaDir, "..", "..", "core", "package.json"))}`,
-    `kibi-mcp@${packageVersion(path4.join(importMetaDir, "..", "..", "mcp", "package.json"))}`
-  ].join(",");
+  require3 = createRequire3(import.meta.url);
   PrologProcessTerminatedError = class PrologProcessTerminatedError extends Error {
     code = "prolog_process_terminated";
     reason;
@@ -8290,7 +8315,7 @@ var init_prolog = __esm(() => {
 
 // ../cli/dist/prolog/store-lock.js
 import { existsSync as existsSync5, rmSync } from "node:fs";
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { dirname as dirname2, join as join2 } from "node:path";
 function currentBootId() {
   if (cachedBootId !== undefined)
@@ -8300,7 +8325,7 @@ function currentBootId() {
     return cachedBootId;
   }
   try {
-    const raw = readFileSync3("/proc/sys/kernel/random/boot_id", "utf8");
+    const raw = readFileSync4("/proc/sys/kernel/random/boot_id", "utf8");
     cachedBootId = raw.trim();
   } catch {
     cachedBootId = null;
@@ -8342,7 +8367,7 @@ function readStoreLockOwner(storePath) {
       continue;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync3(journalPath, "utf8"));
+      parsed = JSON.parse(readFileSync4(journalPath, "utf8"));
     } catch {
       continue;
     }
@@ -8419,19 +8444,19 @@ var init_store_lock = () => {};
 
 // ../cli/dist/utils/branch-store-locator.js
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync4, readdirSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import path5 from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync5, readdirSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import path6 from "node:path";
 function branchStoreKey(branch) {
   return createHash2("sha256").update(branch, "utf8").digest("hex");
 }
 function branchStoresRoot(workspaceRoot) {
-  return path5.join(path5.resolve(workspaceRoot), ".kb", "branches");
+  return path6.join(path6.resolve(workspaceRoot), ".kb", "branches");
 }
 function branchStorePath(workspaceRoot, branch) {
-  return path5.join(branchStoresRoot(workspaceRoot), branchStoreKey(branch));
+  return path6.join(branchStoresRoot(workspaceRoot), branchStoreKey(branch));
 }
 function branchStoreManifestPath(storePath) {
-  return path5.join(storePath, "branch.json");
+  return path6.join(storePath, "branch.json");
 }
 function expectedBranchStoreManifest(branch) {
   return {
@@ -8445,7 +8470,7 @@ function readBranchStoreManifest(storePath) {
   if (!existsSync6(manifestPath))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync4(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync5(manifestPath, "utf8"));
     if (parsed.version !== BRANCH_STORE_MANIFEST_VERSION || typeof parsed.branch !== "string" || typeof parsed.key !== "string") {
       return null;
     }
@@ -8461,7 +8486,7 @@ function readBranchStoreManifest(storePath) {
 function branchStoreManifestMatches(storePath, branch) {
   const manifest = readBranchStoreManifest(storePath);
   const expected = expectedBranchStoreManifest(branch);
-  return manifest !== null && manifest.version === expected.version && manifest.branch === expected.branch && manifest.key === expected.key && path5.basename(storePath) === expected.key;
+  return manifest !== null && manifest.version === expected.version && manifest.branch === expected.branch && manifest.key === expected.key && path6.basename(storePath) === expected.key;
 }
 function ensureBranchStoreManifest(workspaceRoot, branch) {
   const storePath = branchStorePath(workspaceRoot, branch);
@@ -8485,7 +8510,7 @@ function ensureBranchStoreManifest(workspaceRoot, branch) {
   return storePath;
 }
 function legacyBranchStorePath(workspaceRoot, branch) {
-  return path5.join(branchStoresRoot(workspaceRoot), branch);
+  return path6.join(branchStoresRoot(workspaceRoot), branch);
 }
 function isDirectory(pathname) {
   try {
@@ -8499,8 +8524,8 @@ var init_branch_store_locator = () => {};
 
 // ../cli/dist/utils/branch-resolver.js
 import { execFileSync as rawExecFileSync, execSync as rawExecSync } from "node:child_process";
-import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
-import * as path6 from "node:path";
+import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
+import * as path7 from "node:path";
 function unreadableMigrationJournalError(journalName) {
   return {
     error: `Unreadable branch migration journal '${journalName}' blocks attachment; recover it explicitly before continuing.`,
@@ -8514,7 +8539,7 @@ function _setBranchResolverDepsForTests(deps) {
 function isVolatileArtifact(fileName) {
   if (VOLATILE_ARTIFACTS.has(fileName))
     return true;
-  const ext = path6.extname(fileName).toLowerCase();
+  const ext = path7.extname(fileName).toLowerCase();
   if (VOLATILE_EXTENSIONS.has(ext))
     return true;
   if (fileName.startsWith("journal-") && fileName.endsWith(".log"))
@@ -8683,13 +8708,13 @@ function resolveBranchAttachment(workspaceRoot = process.cwd()) {
   if ("error" in active)
     return active;
   const explicit = Boolean(getBranchOverride());
-  const migrationRoot = path6.join(path6.resolve(workspaceRoot), ".kb", "recovery", "branch-migrations");
+  const migrationRoot = path7.join(path7.resolve(workspaceRoot), ".kb", "recovery", "branch-migrations");
   if (existsSync7(migrationRoot)) {
     for (const journalName of readdirSync2(migrationRoot)) {
       if (!journalName.endsWith(".json"))
         continue;
       try {
-        const journal = JSON.parse(readFileSync5(path6.join(migrationRoot, journalName), "utf8"));
+        const journal = JSON.parse(readFileSync6(path7.join(migrationRoot, journalName), "utf8"));
         if (journal.state !== "committed" && journal.state !== "rolled_back") {
           const id = journalName.slice(0, -5);
           return {
@@ -8762,7 +8787,7 @@ function isValidBranchName(name) {
     const codePoint = character.codePointAt(0) ?? 0;
     return codePoint <= 32 || codePoint === 127;
   });
-  if (name.includes("..") || path6.isAbsolute(name) || name.startsWith("/")) {
+  if (name.includes("..") || path7.isAbsolute(name) || name.startsWith("/")) {
     return false;
   }
   if (name.includes("//") || name.endsWith("/") || name.endsWith(".") || name.includes("\\") || name.startsWith("-") || name.includes("@{") || name.includes("..") || hasControlCharacter || /[~^:?*\[\]]/.test(name)) {
@@ -8795,8 +8820,8 @@ function copyDirectoryClean(sourceDir, targetDir) {
     if (isVolatileArtifact(entry)) {
       continue;
     }
-    const sourcePath = path6.join(sourceDir, entry);
-    const targetPath = path6.join(targetDir, entry);
+    const sourcePath = path7.join(sourceDir, entry);
+    const targetPath = path7.join(targetDir, entry);
     const stat = statSync4(sourcePath);
     if (stat.isDirectory()) {
       mkdirSync3(targetPath, { recursive: true });
@@ -8854,13 +8879,13 @@ var init_branch_resolver = __esm(() => {
 
 // ../cli/dist/utils/canonical-path.js
 import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 function canonicalFilesystemPath(candidate) {
-  let existing = path7.resolve(candidate);
+  let existing = path8.resolve(candidate);
   const missing = [];
   for (;; ) {
     try {
-      return path7.resolve(realpathSync2.native(existing), ...missing);
+      return path8.resolve(realpathSync2.native(existing), ...missing);
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
@@ -8873,10 +8898,10 @@ function canonicalFilesystemPath(candidate) {
       }
       if (entry !== undefined)
         throw error;
-      const parent = path7.dirname(existing);
+      const parent = path8.dirname(existing);
       if (parent === existing)
         throw error;
-      missing.unshift(path7.basename(existing));
+      missing.unshift(path8.basename(existing));
       existing = parent;
     }
   }
@@ -8886,25 +8911,28 @@ var init_canonical_path = () => {};
 // ../cli/dist/engine.js
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash3, randomUUID } from "node:crypto";
-import { chmodSync, closeSync as closeSync2, existsSync as existsSync8, fsyncSync, lstatSync as lstatSync3, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync6, readdirSync as readdirSync3, realpathSync as realpathSync3, renameSync, rmSync as rmSync2, statSync as statSync5, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { chmodSync, closeSync as closeSync2, existsSync as existsSync8, fsyncSync, lstatSync as lstatSync3, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync7, readdirSync as readdirSync3, realpathSync as realpathSync3, renameSync, rmSync as rmSync2, statSync as statSync5, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 import * as net from "node:net";
 import * as os from "node:os";
-import * as path8 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import * as path9 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+function enginePackageVersions() {
+  return kibiPackageVersions();
+}
 function engineSwiplIdentity() {
   return swiplIdentity(resolveSwipl());
 }
 function readJournalGeneration(branchPath) {
-  const currentPath = path8.join(branchPath, "CURRENT");
+  const currentPath = path9.join(branchPath, "CURRENT");
   if (!existsSync8(currentPath))
     return "";
-  return readFileSync6(currentPath, "utf8").trim();
+  return readFileSync7(currentPath, "utf8").trim();
 }
 function readEngineAttachmentIdentity(branchPath) {
   if (!existsSync8(branchPath))
     return null;
   const stats = statSync5(branchPath);
-  let resolved = path8.resolve(branchPath);
+  let resolved = path9.resolve(branchPath);
   try {
     resolved = realpathSync3(branchPath);
   } catch {}
@@ -8978,15 +9006,15 @@ function parseFrames(buffer, onFrame) {
   return buffer.subarray(cursor);
 }
 function runtimeDirectory() {
-  const configured = process.env.KIBI_RUNTIME_DIR ?? process.env.XDG_RUNTIME_DIR ?? path8.join(os.tmpdir(), "kibi-runtime");
+  const configured = process.env.KIBI_RUNTIME_DIR ?? process.env.XDG_RUNTIME_DIR ?? path9.join(os.tmpdir(), "kibi-runtime");
   if (process.platform === "win32") {
     for (const candidate of [
       configured,
-      path8.join(os.tmpdir(), "kibi-runtime")
+      path9.join(os.tmpdir(), "kibi-runtime")
     ]) {
       try {
         mkdirSync4(candidate, { recursive: true, mode: 448 });
-        const probe = path8.join(candidate, `.kibi-write-${process.pid}`);
+        const probe = path9.join(candidate, `.kibi-write-${process.pid}`);
         writeFileSync3(probe, "", { mode: 384 });
         unlinkSync(probe);
         return candidate;
@@ -9001,12 +9029,12 @@ function runtimeDirectory() {
   try {
     configuredIdentity = canonicalFilesystemPath(configured);
   } catch {
-    configuredIdentity = path8.resolve(configured);
+    configuredIdentity = path9.resolve(configured);
   }
   const configuredKey = createHash3("sha256").update(configuredIdentity).digest("hex").slice(0, 32);
   const candidates = [
     configured,
-    path8.join("/tmp", `kb-${euid}-${configuredKey}`)
+    path9.join("/tmp", `kb-${euid}-${configuredKey}`)
   ];
   const maximumBytes = process.platform === "linux" ? 107 : 103;
   const socketName = `kibi-${"0".repeat(32)}.sock`;
@@ -9024,9 +9052,9 @@ function runtimeDirectory() {
       if (!directory.isDirectory() || directory.uid !== euid || (directory.mode & 63) !== 0)
         continue;
       const canonical = canonicalFilesystemPath(candidate);
-      if (Buffer.byteLength(path8.join(canonical, socketName), "utf8") > maximumBytes)
+      if (Buffer.byteLength(path9.join(canonical, socketName), "utf8") > maximumBytes)
         continue;
-      const probe = path8.join(canonical, `.kibi-write-${randomUUID()}`);
+      const probe = path9.join(canonical, `.kibi-write-${randomUUID()}`);
       writeFileSync3(probe, "", { mode: 384, flag: "wx" });
       unlinkSync(probe);
       return canonical;
@@ -9047,7 +9075,7 @@ function fsyncPath(filePath) {
   }
 }
 function fsyncJournaledBranchStore(branchPath) {
-  const rdfRoot = path8.join(branchPath, "rdf");
+  const rdfRoot = path9.join(branchPath, "rdf");
   const directories = [];
   const pending = existsSync8(rdfRoot) ? [rdfRoot] : [];
   while (pending.length > 0) {
@@ -9056,7 +9084,7 @@ function fsyncJournaledBranchStore(branchPath) {
       break;
     directories.push(directory);
     for (const entry of readdirSync3(directory, { withFileTypes: true })) {
-      const entryPath = path8.join(directory, entry.name);
+      const entryPath = path9.join(directory, entry.name);
       if (entry.isDirectory())
         pending.push(entryPath);
       else if (entry.isFile() && entry.name !== "lock")
@@ -9064,7 +9092,7 @@ function fsyncJournaledBranchStore(branchPath) {
     }
   }
   for (const metadata of ["CURRENT", "storage.json", "kb.rdf"]) {
-    fsyncPath(path8.join(branchPath, metadata));
+    fsyncPath(path9.join(branchPath, metadata));
   }
   if (process.platform !== "win32") {
     for (const directory of directories.reverse())
@@ -9078,18 +9106,18 @@ function engineSocketPath(workspaceRoot, branch) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\kibi-${key}`;
   }
-  return path8.join(runtimeDirectory(), `kibi-${key}.sock`);
+  return path9.join(runtimeDirectory(), `kibi-${key}.sock`);
 }
 function enginePidPath(workspaceRoot, branch) {
   const socket = engineSocketPath(workspaceRoot, branch);
   if (process.platform === "win32") {
-    return path8.join(runtimeDirectory(), `kibi-${createHash3("sha256").update(`${path8.resolve(workspaceRoot)}\x00${branch}`).digest("hex")}.pid`);
+    return path9.join(runtimeDirectory(), `kibi-${createHash3("sha256").update(`${path9.resolve(workspaceRoot)}\x00${branch}`).digest("hex")}.pid`);
   }
   return `${socket}.pid`;
 }
 function engineStartLockPath(workspaceRoot, branch) {
   if (process.platform === "win32") {
-    return path8.join(runtimeDirectory(), `kibi-${createHash3("sha256").update(`${path8.resolve(workspaceRoot)}\x00${branch}`).digest("hex")}.start.lock`);
+    return path9.join(runtimeDirectory(), `kibi-${createHash3("sha256").update(`${path9.resolve(workspaceRoot)}\x00${branch}`).digest("hex")}.start.lock`);
   }
   return `${engineSocketPath(workspaceRoot, branch)}.start.lock`;
 }
@@ -9098,7 +9126,7 @@ function enginePublicationLockPath(workspaceRoot, branch) {
 }
 function publicationLockOwner(lockPath) {
   try {
-    const [pidText, createdText] = readFileSync6(lockPath, "utf8").trim().split(":");
+    const [pidText, createdText] = readFileSync7(lockPath, "utf8").trim().split(":");
     const pid = Number.parseInt(pidText ?? "", 10);
     const createdAt = Number.parseInt(createdText ?? "", 10);
     if (!Number.isInteger(pid) || pid <= 1 || !Number.isFinite(createdAt)) {
@@ -9146,7 +9174,7 @@ function publicationLockIsActive(lockPath) {
 }
 function acquireEnginePublicationLease(workspaceRoot, branch) {
   const lockPath = enginePublicationLockPath(workspaceRoot, branch);
-  mkdirSync4(path8.dirname(lockPath), { recursive: true, mode: 448 });
+  mkdirSync4(path9.dirname(lockPath), { recursive: true, mode: 448 });
   let descriptor = null;
   try {
     descriptor = openSync2(lockPath, "wx", 384);
@@ -9200,7 +9228,7 @@ function tryAcquireStartLock(lockPath) {
     return descriptor;
   } catch {
     try {
-      const stamp = readFileSync6(lockPath, "utf8").trim().split(":");
+      const stamp = readFileSync7(lockPath, "utf8").trim().split(":");
       const pid = Number.parseInt(stamp[0] ?? "", 10);
       const created = Number.parseInt(stamp[1] ?? "", 10);
       let age = 0;
@@ -9238,12 +9266,12 @@ function releaseStartLock(lockPath, descriptor) {
   } catch {}
 }
 function recoverStaleJournalLock(branchPath) {
-  const lockPath = path8.join(branchPath, "rdf", "lock");
+  const lockPath = path9.join(branchPath, "rdf", "lock");
   if (!existsSync8(lockPath))
     return;
   let contents = "";
   try {
-    contents = readFileSync6(lockPath, "utf8");
+    contents = readFileSync7(lockPath, "utf8");
   } catch {
     return;
   }
@@ -9263,11 +9291,11 @@ function recoverStaleJournalLock(branchPath) {
   }
 }
 function daemonEntry() {
-  const moduleDirectory = path8.dirname(fileURLToPath2(import.meta.url));
+  const moduleDirectory = path9.dirname(fileURLToPath3(import.meta.url));
   const candidates = [
-    path8.join(moduleDirectory, "engine-daemon.js"),
-    path8.join(moduleDirectory, "..", "dist", "engine-daemon.js"),
-    path8.join(moduleDirectory, "..", "node_modules", "kibi-cli", "dist", "engine-daemon.js")
+    path9.join(moduleDirectory, "engine-daemon.js"),
+    path9.join(moduleDirectory, "..", "dist", "engine-daemon.js"),
+    path9.join(moduleDirectory, "..", "node_modules", "kibi-cli", "dist", "engine-daemon.js")
   ];
   for (const candidate of candidates) {
     if (existsSync8(candidate))
@@ -9309,7 +9337,7 @@ async function connectWithRetry(socketPath, timeoutMs) {
     const errorPath = `${socketPath}.error`;
     if (existsSync8(errorPath)) {
       try {
-        const diagnostic = readFileSync6(errorPath, "utf8").trim();
+        const diagnostic = readFileSync7(errorPath, "utf8").trim();
         if (diagnostic)
           throw new Error(diagnostic);
       } catch (error) {
@@ -9440,7 +9468,8 @@ class EngineClient {
               stdio: "ignore",
               env: {
                 ...process.env,
-                KIBI_ENGINE_PROTOCOL: String(ENGINE_PROTOCOL_VERSION)
+                KIBI_ENGINE_PROTOCOL: String(ENGINE_PROTOCOL_VERSION),
+                KIBI_PACKAGE_VERSIONS: enginePackageVersions()
               }
             });
             await new Promise((resolve, reject) => {
@@ -9542,7 +9571,7 @@ class EngineClient {
             ...limits,
             id,
             protocolVersion: ENGINE_PROTOCOL_VERSION,
-            packageVersions: ENGINE_PACKAGE_VERSIONS,
+            packageVersions: enginePackageVersions(),
             prologIdentity: engineSwiplIdentity(),
             workspaceRoot: this.workspaceRoot,
             branch: this.branch
@@ -9641,7 +9670,7 @@ class EngineClient {
       method: "cancel",
       cancelOf: requestId,
       protocolVersion: ENGINE_PROTOCOL_VERSION,
-      packageVersions: ENGINE_PACKAGE_VERSIONS,
+      packageVersions: enginePackageVersions(),
       prologIdentity: engineSwiplIdentity(),
       workspaceRoot: this.workspaceRoot,
       branch: this.branch
@@ -9685,23 +9714,49 @@ class EngineClient {
       return null;
     return parseEngineAttachmentIdentity(status.bindings.JsonString);
   }
-  async daemonRuntimeMatches() {
+  async daemonHandshake() {
     const reply = await this.request({
       method: "handshake"
     });
-    return reply?.prologIdentity === engineSwiplIdentity();
+    return {
+      prologIdentity: typeof reply?.prologIdentity === "string" ? reply.prologIdentity : null,
+      packageVersions: typeof reply?.packageVersions === "string" ? reply.packageVersions : null
+    };
+  }
+  async inspectLiveDaemon() {
+    const wasConnected = this.isRunning();
+    if (!wasConnected)
+      await this.connect(false);
+    if (!this.isRunning())
+      return null;
+    try {
+      return await this.daemonHandshake();
+    } finally {
+      if (!wasConnected)
+        await this.terminate();
+    }
+  }
+  async daemonRuntimeMismatch() {
+    const daemon = await this.daemonHandshake();
+    const packageVersions = enginePackageVersions();
+    if (daemon.packageVersions !== packageVersions)
+      return `Kibi engine is running other package versions (${daemon.packageVersions ?? "not reported"}) than this client (${packageVersions})`;
+    if (daemon.prologIdentity !== engineSwiplIdentity())
+      return `Kibi engine is running a different SWI-Prolog than this client resolved (${engineSwiplIdentity()})`;
+    return null;
   }
   async reconcileRuntime() {
     if (this.replacingStaleDaemon || this.socket === null)
       return;
-    if (await this.daemonRuntimeMatches())
+    if (await this.daemonRuntimeMismatch() === null)
       return;
     this.replacingStaleDaemon = true;
     try {
       await this.shutdownConnectedDaemon();
       await this.connect(true);
-      if (!await this.daemonRuntimeMatches()) {
-        throw new Error(`Kibi engine is running a different SWI-Prolog than this client resolved (${engineSwiplIdentity()}); run 'kibi engine stop' and retry`);
+      const mismatch = await this.daemonRuntimeMismatch();
+      if (mismatch !== null) {
+        throw new Error(`${mismatch} after replacing it; run 'kibi engine stop' and retry`);
       }
     } finally {
       this.replacingStaleDaemon = false;
@@ -9765,7 +9820,7 @@ class EngineClient {
   getPid() {
     const pidPath = enginePidPath(this.workspaceRoot, this.branch);
     try {
-      return Number.parseInt(readFileSync6(pidPath, "utf8").trim(), 10) || 0;
+      return Number.parseInt(readFileSync7(pidPath, "utf8").trim(), 10) || 0;
     } catch {
       return 0;
     }
@@ -9796,12 +9851,12 @@ class EngineClient {
 }
 async function ensureJournaledBranchStoreAsync(branchPath) {
   mkdirSync4(branchPath, { recursive: true });
-  const markerPath = path8.join(branchPath, "storage.json");
-  const marker = existsSync8(markerPath) ? readFileSync6(markerPath, "utf8") : "";
+  const markerPath = path9.join(branchPath, "storage.json");
+  const marker = existsSync8(markerPath) ? readFileSync7(markerPath, "utf8") : "";
   if (marker.includes("kibi.rdf-journal.v1")) {
-    const rdfDirectory = path8.join(branchPath, "rdf");
-    const currentPath = path8.join(branchPath, "CURRENT");
-    const sentinelPath = path8.join(branchPath, "kb.rdf");
+    const rdfDirectory = path9.join(branchPath, "rdf");
+    const currentPath = path9.join(branchPath, "CURRENT");
+    const sentinelPath = path9.join(branchPath, "kb.rdf");
     if (!existsSync8(rdfDirectory) || !existsSync8(currentPath)) {
       recoverInterruptedGeneration(branchPath);
       if (existsSync8(rdfDirectory) && existsSync8(currentPath)) {
@@ -9813,9 +9868,9 @@ async function ensureJournaledBranchStoreAsync(branchPath) {
         }
         return;
       }
-      const legacyRdf = path8.join(branchPath, "kb.rdf");
-      const legacyAudit = path8.join(branchPath, "audit.log");
-      const legacyContents = existsSync8(legacyRdf) ? readFileSync6(legacyRdf, "utf8") : "";
+      const legacyRdf = path9.join(branchPath, "kb.rdf");
+      const legacyAudit = path9.join(branchPath, "audit.log");
+      const legacyContents = existsSync8(legacyRdf) ? readFileSync7(legacyRdf, "utf8") : "";
       if (existsSync8(legacyAudit) || existsSync8(legacyRdf) && !legacyContents.includes("kibi.rdf-journal.v1")) {
         rmSync2(rdfDirectory, { recursive: true, force: true });
         rmSync2(currentPath, { force: true });
@@ -9833,29 +9888,29 @@ async function ensureJournaledBranchStoreAsync(branchPath) {
       return;
     }
   }
-  const legacyRdf = path8.join(branchPath, "kb.rdf");
-  const legacyAudit = path8.join(branchPath, "audit.log");
+  const legacyRdf = path9.join(branchPath, "kb.rdf");
+  const legacyAudit = path9.join(branchPath, "audit.log");
   if (!existsSync8(legacyRdf) && !existsSync8(legacyAudit)) {
-    mkdirSync4(path8.join(branchPath, "rdf"), { recursive: true });
+    mkdirSync4(path9.join(branchPath, "rdf"), { recursive: true });
     writeFileSync3(markerPath, `{"format":"kibi.rdf-journal.v1","schemaVersion":1}
 `, { mode: 384 });
-    writeFileSync3(path8.join(branchPath, "CURRENT"), `generation-1:0
+    writeFileSync3(path9.join(branchPath, "CURRENT"), `generation-1:0
 `, {
       mode: 384
     });
-    writeFileSync3(path8.join(branchPath, "kb.rdf"), `KIBI_STORAGE_FORMAT=kibi.rdf-journal.v1
+    writeFileSync3(path9.join(branchPath, "kb.rdf"), `KIBI_STORAGE_FORMAT=kibi.rdf-journal.v1
 `, { mode: 384 });
     return;
   }
   if (existsSync8(legacyRdf)) {
-    const legacyContents = readFileSync6(legacyRdf, "utf8");
+    const legacyContents = readFileSync7(legacyRdf, "utf8");
     if (!/<rdf:RDF(?:\s|>)/.test(legacyContents)) {
       throw new Error(`Legacy Kibi store is corrupt at ${legacyRdf}: expected RDF/XML root`);
     }
   }
-  const parent = path8.dirname(branchPath);
-  const migrationKey = createHash3("sha256").update(path8.resolve(branchPath)).digest("hex").slice(0, 16);
-  const staging = path8.join(parent, `.${migrationKey}.migration.${process.pid}.${Date.now()}`);
+  const parent = path9.dirname(branchPath);
+  const migrationKey = createHash3("sha256").update(path9.resolve(branchPath)).digest("hex").slice(0, 16);
+  const staging = path9.join(parent, `.${migrationKey}.migration.${process.pid}.${Date.now()}`);
   mkdirSync4(staging, { recursive: true, mode: 448 });
   const testOneShot = false;
   const migrator = new PrologProcess({
@@ -9883,35 +9938,35 @@ async function ensureJournaledBranchStoreAsync(branchPath) {
     await migrator.terminate();
   }
   for (const file of ["rdf", "storage.json", "CURRENT"]) {
-    const source = path8.join(staging, file);
+    const source = path9.join(staging, file);
     if (!existsSync8(source))
       continue;
-    const target = path8.join(branchPath, file);
+    const target = path9.join(branchPath, file);
     if (existsSync8(target))
       rmSync2(target, { recursive: true, force: true });
     renameSync(source, target);
   }
   archiveLegacyFiles(branchPath);
-  writeFileSync3(path8.join(branchPath, "kb.rdf"), `KIBI_STORAGE_FORMAT=kibi.rdf-journal.v1
+  writeFileSync3(path9.join(branchPath, "kb.rdf"), `KIBI_STORAGE_FORMAT=kibi.rdf-journal.v1
 `, { mode: 384 });
   fsyncJournaledBranchStore(branchPath);
   rmSync2(staging, { recursive: true, force: true });
 }
 function archiveLegacyFiles(branchPath) {
-  const legacyDir = path8.join(branchPath, "legacy");
+  const legacyDir = path9.join(branchPath, "legacy");
   mkdirSync4(legacyDir, { recursive: true, mode: 448 });
   for (const file of ["kb.rdf", "audit.log"]) {
-    const source = path8.join(branchPath, file);
+    const source = path9.join(branchPath, file);
     if (!existsSync8(source))
       continue;
     if (file === "kb.rdf") {
-      const contents = readFileSync6(source, "utf8");
+      const contents = readFileSync7(source, "utf8");
       if (contents.includes("kibi.rdf-journal.v1"))
         continue;
     }
-    const destination = path8.join(legacyDir, file);
+    const destination = path9.join(legacyDir, file);
     if (existsSync8(destination)) {
-      renameSync(source, path8.join(legacyDir, `${file}.recovery.${Date.now()}`));
+      renameSync(source, path9.join(legacyDir, `${file}.recovery.${Date.now()}`));
     } else {
       renameSync(source, destination);
     }
@@ -9927,12 +9982,12 @@ function recoverInterruptedGeneration(branchPath) {
   const newest = (prefix) => {
     const candidates = entries.filter((entry) => entry.startsWith(prefix)).sort().reverse();
     const candidate = candidates[0];
-    return candidate === undefined ? null : path8.join(branchPath, candidate);
+    return candidate === undefined ? null : path9.join(branchPath, candidate);
   };
   const oldRdf = newest("rdf.old.");
   const oldCurrent = newest("CURRENT.old.");
-  const rdfPath = path8.join(branchPath, "rdf");
-  const currentPath = path8.join(branchPath, "CURRENT");
+  const rdfPath = path9.join(branchPath, "rdf");
+  const currentPath = path9.join(branchPath, "CURRENT");
   if ((!existsSync8(rdfPath) || !existsSync8(currentPath)) && oldRdf && oldCurrent) {
     try {
       if (existsSync8(rdfPath))
@@ -9958,6 +10013,7 @@ function recoverInterruptedGeneration(branchPath) {
 var READ_LIMITED_METHODS, ENGINE_PROTOCOL_VERSION = 1, ENGINE_IDLE_TIMEOUT_MS, ENGINE_PACKAGE_VERSIONS, ENGINE_QUERY_CACHE_MAX_RESULT_BYTES, ENGINE_PUBLICATION_LOCK_STALE_MS = 5000;
 var init_engine = __esm(() => {
   init_engine_limits();
+  init_package_versions();
   init_performance_trace();
   init_prolog();
   init_store_lock();
@@ -9974,7 +10030,7 @@ var init_engine = __esm(() => {
     "search"
   ]);
   ENGINE_IDLE_TIMEOUT_MS = 10 * 60 * 1000;
-  ENGINE_PACKAGE_VERSIONS = process.env.KIBI_PACKAGE_VERSIONS ?? "unknown";
+  ENGINE_PACKAGE_VERSIONS = kibiPackageVersions();
   ENGINE_QUERY_CACHE_MAX_RESULT_BYTES = 8 * 1024 * 1024;
 });
 
@@ -10235,9 +10291,25 @@ var init_entity_body_context = __esm(() => {
   };
 });
 
+// ../cli/dist/provenance-stub.js
+function tagList(value) {
+  if (typeof value === "string")
+    return [value];
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function isProvenanceStub(entity) {
+  if (!entity)
+    return false;
+  const type = String(entity.type ?? "");
+  if (type !== "" && type !== "fact")
+    return false;
+  return tagList(entity.tags).includes(PROVENANCE_STUB_TAG);
+}
+var PROVENANCE_STUB_TAG = "bootstrap:provenance-stub";
+
 // ../cli/dist/search-ranking.js
 import fs from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 async function rankEntities(entities, query, workspaceRoot) {
   const queryContext = buildSearchQueryContext(query);
   if (!queryContext.rawTrimmedQuery || queryContext.signalTokens.length === 0) {
@@ -10247,10 +10319,15 @@ async function rankEntities(entities, query, workspaceRoot) {
   for (const entity of entities) {
     const match = await rankEntity(entity, queryContext, workspaceRoot);
     if (match) {
+      if (isProvenanceStub(entity))
+        match.reasons.push("demoted: provenance stub");
       matches.push(match);
     }
   }
   matches.sort((left, right) => {
+    const stubOrder = Number(isProvenanceStub(left.entity)) - Number(isProvenanceStub(right.entity));
+    if (stubOrder !== 0)
+      return stubOrder;
     if (right.score !== left.score) {
       return right.score - left.score;
     }
@@ -10341,9 +10418,9 @@ async function loadMarkdownBody(source, workspaceRoot) {
   if (!normalizedSource.endsWith(".md")) {
     return null;
   }
-  const resolved = path9.resolve(path9.isAbsolute(normalizedSource) ? normalizedSource : path9.join(workspaceRoot, normalizedSource));
-  const normalizedRoot = path9.resolve(workspaceRoot);
-  if (!resolved.startsWith(normalizedRoot + path9.sep)) {
+  const resolved = path10.resolve(path10.isAbsolute(normalizedSource) ? normalizedSource : path10.join(workspaceRoot, normalizedSource));
+  const normalizedRoot = path10.resolve(workspaceRoot);
+  if (!resolved.startsWith(normalizedRoot + path10.sep)) {
     return null;
   }
   try {
@@ -10469,7 +10546,7 @@ var init_search_ranking = __esm(() => {
 });
 
 // ../cli/dist/intent-search.js
-import path10 from "node:path";
+import path11 from "node:path";
 function normalize(value) {
   return value.trim().toLowerCase().replace(/[-_]+/g, " ").replace(/[^a-z0-9\s]+/g, " ").split(/\s+/).filter(Boolean).map((token) => token.length > 4 && token.endsWith("s") && !token.endsWith("ss") ? token.slice(0, -1) : token).map(stem).join(" ");
 }
@@ -10598,7 +10675,7 @@ function entityTokens(entity, body) {
   ENTITY_TOKENS.set(entity, computed);
   return computed;
 }
-function scoreEntity(entity, queryTokens, facets, sourceEvidence, graphEvidence, documentFrequency, documentCount, body, superseded = false) {
+function scoreEntity(entity, queryTokens, facets, sourceEvidence, graphEvidence, documentFrequency, documentCount, body, superseded = false, provenanceStub = false) {
   const { title: titleTokens, metadata: metadataTokens, bodyTokens } = entityTokens(entity, body);
   const allSignalTokens = Array.from(new Set(queryTokens));
   let placed = 0;
@@ -10631,10 +10708,12 @@ function scoreEntity(entity, queryTokens, facets, sourceEvidence, graphEvidence,
   const graphScore = graphEvidence.length > 0 ? Math.min(1, graphEvidence.length / 2) : 0;
   const status = String(entity.status ?? "").trim().toLowerCase();
   const nonGoverning = NON_GOVERNING_STATUSES.has(status) || superseded;
-  const score = Math.min(1, lexicalScore * 0.58 + facetScore * 0.17 + sourceScore * 0.2 + graphScore * 0.05) * (nonGoverning ? NON_GOVERNING_FACTOR : 1);
+  const score = Math.min(1, lexicalScore * 0.58 + facetScore * 0.17 + sourceScore * 0.2 + graphScore * 0.05) * (nonGoverning ? NON_GOVERNING_FACTOR : 1) * (provenanceStub ? PROVENANCE_STUB_FACTOR : 1);
   const reasons = [];
   if (nonGoverning)
     reasons.push(superseded ? "demoted: superseded" : `demoted: ${status}`);
+  if (provenanceStub)
+    reasons.push("demoted: provenance stub");
   if (lexicalScore > 0)
     reasons.push("intent token match");
   if (matchedFacets.length > 0)
@@ -10702,7 +10781,7 @@ async function rankIntentEntities(entities, options2, workspaceRoot, graphEdges
     const entityId = String(entity.id ?? "");
     const graphEvidence = (graphByEntity.get(entityId) ?? []).slice(0, 8);
     const body = bodies.get(entity) ?? null;
-    const scored = scoreEntity(entity, allTokens, facets, sourceEvidence, graphEvidence, documentFrequency, entities.length, body, supersededIds.has(entityId));
+    const scored = scoreEntity(entity, allTokens, facets, sourceEvidence, graphEvidence, documentFrequency, entities.length, body, supersededIds.has(entityId), isProvenanceStub(entity));
     if (scored.score < minScore)
       continue;
     const snippet = body === null ? undefined : bodySnippetLine(String(entity.type ?? ""), body, entity);
@@ -10721,6 +10800,9 @@ async function rankIntentEntities(entities, options2, workspaceRoot, graphEdges
     });
   }
   ranked.sort((left, right) => {
+    const stubOrder = Number(isProvenanceStub(left.entity)) - Number(isProvenanceStub(right.entity));
+    if (stubOrder !== 0)
+      return stubOrder;
     if (right.score !== left.score)
       return right.score - left.score;
     const typeOrder = String(left.entity.type ?? "").localeCompare(String(right.entity.type ?? ""));
@@ -10841,7 +10923,7 @@ function validateIntentSearchInput(input) {
     throw new Error("Search execution failed: minScore must be between 0 and 1");
   }
   for (const location of input.sourceLocations ?? []) {
-    if (!location.path.trim() || path10.isAbsolute(location.path) || location.path.split("/").includes("..")) {
+    if (!location.path.trim() || path11.isAbsolute(location.path) || location.path.split("/").includes("..")) {
       throw new Error("Search execution failed: sourceLocations.path must be workspace-relative");
     }
     if (location.line !== undefined && (!Number.isInteger(location.line) || location.line < 1)) {
@@ -10852,7 +10934,7 @@ function validateIntentSearchInput(input) {
     }
   }
 }
-var GRAPH_RELATIONSHIPS, FACET_NAMES, STOP_WORDS, NON_GOVERNING_STATUSES, NON_GOVERNING_FACTOR = 0.5, AMBIGUOUS_MARGIN = 0.05, MAX_CANDIDATES = 1e4, MAX_GRAPH_SEEDS = 5, MAX_GRAPH_EDGES = 2000, STEM_SUFFIXES, ENTITY_TOKENS, BODY_READ_CONCURRENCY = 32;
+var GRAPH_RELATIONSHIPS, FACET_NAMES, STOP_WORDS, NON_GOVERNING_STATUSES, NON_GOVERNING_FACTOR = 0.5, PROVENANCE_STUB_FACTOR = 0.25, AMBIGUOUS_MARGIN = 0.05, MAX_CANDIDATES = 1e4, MAX_GRAPH_SEEDS = 5, MAX_GRAPH_EDGES = 2000, STEM_SUFFIXES, ENTITY_TOKENS, BODY_READ_CONCURRENCY = 32;
 var init_intent_search = __esm(() => {
   init_entity_body_context();
   init_discovery_entities();
@@ -11089,8 +11171,8 @@ var LATEST_KB_SCHEMA_VERSION = 8;
 
 // ../cli/dist/utils/kb-manifest.js
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync7, renameSync as renameSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import * as path11 from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import * as path12 from "node:path";
 function defaultKbManifest() {
   return {
     manifestVersion: KB_MANIFEST_VERSION,
@@ -11099,7 +11181,7 @@ function defaultKbManifest() {
   };
 }
 function manifestPathFor(workspaceRoot) {
-  return path11.join(workspaceRoot, KB_PATHS.manifest);
+  return path12.join(workspaceRoot, KB_PATHS.manifest);
 }
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -11143,7 +11225,7 @@ function readKbManifestStatus(workspaceRoot) {
   }
   let contents;
   try {
-    contents = readFileSync7(manifestPath, "utf8");
+    contents = readFileSync8(manifestPath, "utf8");
   } catch {
     return {
       state: "invalid",
@@ -11189,7 +11271,7 @@ function readKbManifest(workspaceRoot) {
   return status.state === "ok" ? status.manifest : null;
 }
 function writeAtomically(filePath, content) {
-  mkdirSync5(path11.dirname(filePath), { recursive: true });
+  mkdirSync5(path12.dirname(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync4(tempPath, content, "utf8");
   renameSync2(tempPath, filePath);
@@ -11206,7 +11288,7 @@ var init_kb_manifest = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/activation.js
-import path12 from "node:path";
+import path13 from "node:path";
 function missingManifestActivation(vendored, projectSignal) {
   return activationFor(vendored && !projectSignal ? "vendored_only" : "root_uninitialized");
 }
@@ -11294,21 +11376,21 @@ function sourceCoverageState(files) {
 async function classifyActivation(context, files = []) {
   const sourceFiles = Array.isArray(files) ? files : [];
   const normalizedFiles = sourceFiles.map((file) => {
-    const relative = path12.isAbsolute(file) ? path12.relative(context.workspaceRoot, file) : file;
+    const relative = path13.isAbsolute(file) ? path13.relative(context.workspaceRoot, file) : file;
     return relative.replaceAll("\\", "/");
   });
   const manifestStatus = readKbManifestStatus(context.workspaceRoot);
   if (manifestStatus.state === "missing") {
     const vendored = normalizedFiles.some((file) => file.startsWith("kibi/"));
     const projectSignalFromFiles = normalizedFiles.some((file) => !file.startsWith("kibi/") && /^(README\.md|package\.json|src\/|app\/|packages\/|tests\/)/.test(file));
-    const projectSignalFromDirectories = await Promise.all(["README.md", "package.json", "src", "app", "packages", "tests"].map((target) => exists(context, path12.resolve(context.workspaceRoot, target))));
+    const projectSignalFromDirectories = await Promise.all(["README.md", "package.json", "src", "app", "packages", "tests"].map((target) => exists(context, path13.resolve(context.workspaceRoot, target))));
     const projectSignal = projectSignalFromFiles || projectSignalFromDirectories.some(Boolean);
     return missingManifestActivation(vendored, projectSignal);
   }
   if (manifestStatus.state !== "ok")
     return activationFor("root_partial");
   const targets = [...Object.values(KB_PATHS.lanes), KB_PATHS.symbolsManifest];
-  const resolved = await Promise.all(targets.map((target) => exists(context, path12.resolve(context.workspaceRoot, target))));
+  const resolved = await Promise.all(targets.map((target) => exists(context, path13.resolve(context.workspaceRoot, target))));
   if (resolved.some((value) => !value))
     return activationFor("root_partial");
   if (!context.prolog)
@@ -11328,10 +11410,10 @@ var init_activation = __esm(() => {
 });
 
 // ../cli/dist/public/operations/prolog-json.js
-import path13 from "node:path";
+import path14 from "node:path";
 function resolveCoreModulePath(fileName) {
   const genericOverride = getKbPlPathOverride();
-  return path13.join(path13.dirname(genericOverride ?? resolveKbPlPath()), fileName);
+  return path14.join(path14.dirname(genericOverride ?? resolveKbPlPath()), fileName);
 }
 async function runOperationJsonQuery(prolog, fileName, goal, errorLabel, signal) {
   const modulePath = escapeAtom(resolveCoreModulePath(fileName).replaceAll("\\", "/"));
@@ -11741,6 +11823,8 @@ async function buildSearchAnswer(prolog, matches, options2 = {}) {
       continue;
     }
     if (type === "fact") {
+      if (isProvenanceStub(match.entity))
+        continue;
       const kind = text(entity.fact_kind);
       if (kind === "observation" || kind === "meta") {
         observations.push(brief(entity));
@@ -12128,8 +12212,8 @@ var init_search_answer = __esm(() => {
 });
 
 // ../cli/dist/utils/branch-store.js
-import { existsSync as existsSync10, readFileSync as readFileSync8, statSync as statSync6 } from "node:fs";
-import * as path14 from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, statSync as statSync6 } from "node:fs";
+import * as path15 from "node:path";
 function inspectBranchStore(workspaceRoot, branch) {
   const storePath = branchStorePath(workspaceRoot, branch);
   if (!existsSync10(storePath)) {
@@ -12170,10 +12254,10 @@ function inspectBranchStore(workspaceRoot, branch) {
         recoveryRequired: true
       };
     }
-    const markerPath = path14.join(storePath, "storage.json");
-    const rdfPath = path14.join(storePath, "rdf");
-    const currentPath = path14.join(storePath, "CURRENT");
-    const legacyPath = path14.join(storePath, "kb.rdf");
+    const markerPath = path15.join(storePath, "storage.json");
+    const rdfPath = path15.join(storePath, "rdf");
+    const currentPath = path15.join(storePath, "CURRENT");
+    const legacyPath = path15.join(storePath, "kb.rdf");
     if (existsSync10(markerPath)) {
       if (!existsSync10(rdfPath) || !statSync6(rdfPath).isDirectory()) {
         return {
@@ -12193,7 +12277,7 @@ function inspectBranchStore(workspaceRoot, branch) {
           recoveryRequired: true
         };
       }
-      const current = readFileSync8(currentPath, "utf8").trim();
+      const current = readFileSync9(currentPath, "utf8").trim();
       if (!/^generation-[^:\s]+:\d+$/.test(current)) {
         return {
           state: "unreadable",
@@ -12206,7 +12290,7 @@ function inspectBranchStore(workspaceRoot, branch) {
       return { state: "healthy", path: storePath, recoveryRequired: false };
     }
     if (existsSync10(legacyPath)) {
-      const legacy = readFileSync8(legacyPath, "utf8");
+      const legacy = readFileSync9(legacyPath, "utf8");
       if (!/<rdf:RDF(?:\s|>)/.test(legacy)) {
         return {
           state: "unreadable",
@@ -12270,8 +12354,8 @@ var init_branch_store = __esm(() => {
 });
 
 // ../cli/dist/utils/config.js
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
-import * as path15 from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";
+import * as path16 from "node:path";
 function loadEntityPaths(_cwd = process.cwd()) {
   return CANONICAL_ENTITY_PATHS;
 }
@@ -12283,15 +12367,15 @@ function pickLegacyPathValue(paths, key) {
   return typeof value === "string" ? value : undefined;
 }
 function legacyConfigExists(cwd) {
-  return existsSync11(path15.join(cwd, ".kb", "config.json"));
+  return existsSync11(path16.join(cwd, ".kb", "config.json"));
 }
 function readLegacyKbConfig(cwd) {
-  const configPath = path15.join(cwd, ".kb", "config.json");
+  const configPath = path16.join(cwd, ".kb", "config.json");
   if (!existsSync11(configPath))
     return { kind: "none" };
   let raw;
   try {
-    raw = readFileSync9(configPath, "utf8");
+    raw = readFileSync10(configPath, "utf8");
   } catch (error) {
     return {
       kind: "malformed",
@@ -12852,8 +12936,8 @@ __export(exports_migration_plan, {
   withoutActionCodes: () => withoutActionCodes
 });
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
-import * as path16 from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
+import * as path17 from "node:path";
 function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -13192,11 +13276,11 @@ function readMigrationConfigStatus(workspaceRoot) {
   };
 }
 function readLegacySchemaVersion(workspaceRoot) {
-  const legacyPath = path16.join(workspaceRoot, ".kb", "config.json");
+  const legacyPath = path17.join(workspaceRoot, ".kb", "config.json");
   if (!existsSync12(legacyPath))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync10(legacyPath, "utf8"));
+    const parsed = JSON.parse(readFileSync11(legacyPath, "utf8"));
     return parsed.schemaVersion ?? null;
   } catch {
     return "";
@@ -13385,7 +13469,7 @@ async function readWorkspaceSnapshot(context) {
 }
 
 // ../cli/dist/public/operations/discovery-executors.js
-import path17 from "node:path";
+import path18 from "node:path";
 function requireProlog(context) {
   if (!context.prolog) {
     throw new Error("Discovery operation requires a Prolog context");
@@ -13635,16 +13719,16 @@ async function executeStatus(_input, context) {
     const bootstrapActivation = await classifyActivation(context, bootstrapSourceFiles);
     const incompleteApplications = [];
     if (context.fs?.glob) {
-      const recoveryRoot = path17.join(context.workspaceRoot, ".kb", "recovery");
+      const recoveryRoot = path18.join(context.workspaceRoot, ".kb", "recovery");
       const journals = await context.fs.glob(["bootstrap-*.json"], {
         cwd: recoveryRoot
       });
       for (const journalPath of journals) {
         try {
-          const journal = JSON.parse(await context.fs.readFile(path17.resolve(recoveryRoot, journalPath)));
+          const journal = JSON.parse(await context.fs.readFile(path18.resolve(recoveryRoot, journalPath)));
           if (journal.kind === "bootstrap" && ["rejected", "repair_required", "applying"].includes(journal.state))
             incompleteApplications.push({
-              journalId: path17.basename(journalPath, ".json"),
+              journalId: path18.basename(journalPath, ".json"),
               state: journal.state,
               appliedActions: (journal.results ?? []).filter((row) => row.outcome === "applied").length,
               failedActions: (journal.results ?? []).filter((row) => row.outcome === "failed"),
@@ -13652,7 +13736,7 @@ async function executeStatus(_input, context) {
             });
         } catch (error) {
           incompleteApplications.push({
-            journalId: path17.basename(journalPath, ".json"),
+            journalId: path18.basename(journalPath, ".json"),
             state: "unreadable",
             detail: error instanceof Error ? error.message : String(error)
           });
@@ -14317,12 +14401,12 @@ var init_entity_origin = __esm(() => {
 });
 
 // ../cli/dist/utils/manifest-paths.js
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 function resolveSymbolsManifestPaths(workspaceRoot) {
-  const symbolsPath = path18.join(workspaceRoot, CANONICAL_ENTITY_PATHS.symbols);
+  const symbolsPath = path19.join(workspaceRoot, CANONICAL_ENTITY_PATHS.symbols);
   return {
     symbolsPath,
-    coordinatesPath: path18.join(workspaceRoot, DEFAULT_COORDINATES_PATH)
+    coordinatesPath: path19.join(workspaceRoot, DEFAULT_COORDINATES_PATH)
   };
 }
 var DEFAULT_SYMBOLS_PATH, DEFAULT_COORDINATES_PATH;
@@ -14333,22 +14417,22 @@ var init_manifest_paths = __esm(() => {
 });
 
 // ../cli/dist/utils/repo-relative-path.js
-import path19 from "node:path";
+import path20 from "node:path";
 function normalizeRepoRelativePath(workspaceRoot, candidate) {
   if (candidate.trim() === "")
     return null;
   let slashed = candidate.replaceAll("\\", "/");
   const foreignAbsolute = /^[A-Za-z]:\//.test(slashed) || slashed.startsWith("//");
   if (slashed.startsWith("/") || foreignAbsolute) {
-    if (foreignAbsolute && path19.sep === "/")
+    if (foreignAbsolute && path20.sep === "/")
       return null;
-    const root = path19.resolve(workspaceRoot);
-    const relative = path19.relative(root, path19.resolve(candidate));
-    if (relative === "" || path19.isAbsolute(relative))
+    const root = path20.resolve(workspaceRoot);
+    const relative = path20.relative(root, path20.resolve(candidate));
+    if (relative === "" || path20.isAbsolute(relative))
       return null;
     slashed = relative.replaceAll("\\", "/");
   }
-  const normalized = path19.posix.normalize(slashed).replace(/\/+$/, "");
+  const normalized = path20.posix.normalize(slashed).replace(/\/+$/, "");
   if (normalized === "" || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     return null;
   }
@@ -14358,8 +14442,8 @@ var init_repo_relative_path = () => {};
 
 // ../cli/dist/extractors/symbol-coordinates.js
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync13, readFileSync as readFileSync11 } from "node:fs";
-import * as path20 from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "node:fs";
+import * as path21 from "node:path";
 function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -14570,11 +14654,11 @@ function manifestSourceFile(record) {
   return;
 }
 function defaultResolveSourceText(sourceFile) {
-  const absolute = path20.isAbsolute(sourceFile) ? sourceFile : path20.resolve(process.cwd(), sourceFile);
+  const absolute = path21.isAbsolute(sourceFile) ? sourceFile : path21.resolve(process.cwd(), sourceFile);
   if (!existsSync13(absolute))
     return null;
   try {
-    const content = readFileSync11(absolute, "utf8");
+    const content = readFileSync12(absolute, "utf8");
     return typeof content === "string" ? content : null;
   } catch {
     return null;
@@ -14685,8 +14769,8 @@ var init_symbol_coordinates = __esm(() => {
 
 // ../cli/dist/extractors/manifest.js
 import { createHash as createHash9 } from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync12, statSync as statSync7 } from "node:fs";
-import * as path21 from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync13, statSync as statSync7 } from "node:fs";
+import * as path22 from "node:path";
 function inferEntityTypeFromId(id) {
   const upper = id.toUpperCase();
   if (upper.startsWith("REQ-"))
@@ -14859,14 +14943,14 @@ function resolveCoordinatesPath(manifestPath, coordinatesPath) {
   if (coordinatesPath) {
     return coordinatesPath;
   }
-  return path21.join(path21.dirname(manifestPath), path21.basename(DEFAULT_COORDINATES_PATH));
+  return path22.join(path22.dirname(manifestPath), path22.basename(DEFAULT_COORDINATES_PATH));
 }
 function readCoordinateArtifactFromFile(coordinatesPath) {
   if (!existsSync14(coordinatesPath)) {
     return null;
   }
   try {
-    const parsed = parseCoordinateArtifact(readFileSync12(coordinatesPath, "utf8"));
+    const parsed = parseCoordinateArtifact(readFileSync13(coordinatesPath, "utf8"));
     if (parsed.status === "invalid") {
       throw new ManifestError(parsed.reason, coordinatesPath, "coordinate-artifact");
     }
@@ -14880,17 +14964,17 @@ function readCoordinateArtifactFromFile(coordinatesPath) {
 }
 function sourceTextResolver(manifestPath) {
   const bases = [process.cwd()];
-  const grandparent = path21.resolve(path21.dirname(path21.dirname(manifestPath)));
+  const grandparent = path22.resolve(path22.dirname(path22.dirname(manifestPath)));
   if (!bases.includes(grandparent))
     bases.push(grandparent);
   return (sourceFile) => {
     let resolved = null;
     for (const base of bases) {
-      const absolute = path21.isAbsolute(sourceFile) ? sourceFile : path21.resolve(base, sourceFile);
+      const absolute = path22.isAbsolute(sourceFile) ? sourceFile : path22.resolve(base, sourceFile);
       if (!existsSync14(absolute))
         continue;
       try {
-        const content = readFileSync12(absolute, "utf8");
+        const content = readFileSync13(absolute, "utf8");
         if (typeof content === "string") {
           resolved = content;
           break;
@@ -14901,7 +14985,7 @@ function sourceTextResolver(manifestPath) {
   };
 }
 function readManifestWithCoordinateOverlay(manifestPath, coordinatesPath) {
-  const manifestContent = readFileSync12(manifestPath, "utf8");
+  const manifestContent = readFileSync13(manifestPath, "utf8");
   const manifestRecords = extractManifestSymbolRecordsString(manifestContent, manifestPath);
   const coordinateArtifact = readCoordinateArtifactFromFile(resolveCoordinatesPath(manifestPath, coordinatesPath));
   return mergeCoordinatesWithManifest(manifestRecords, coordinateArtifact, {
@@ -14923,7 +15007,7 @@ function scopeSourceFiles(manifestPath) {
     return hit.sourceFiles;
   const sourceFiles = new Map;
   if (stamp !== "missing") {
-    const records = extractManifestSymbolRecordsString(readFileSync12(manifestPath, "utf8"), manifestPath);
+    const records = extractManifestSymbolRecordsString(readFileSync13(manifestPath, "utf8"), manifestPath);
     for (const record of records) {
       const sourceFile = typeof record.sourceFile === "string" && record.sourceFile !== "" ? record.sourceFile : typeof record.source === "string" && record.source !== "" ? record.source : undefined;
       if (typeof record.id === "string" && sourceFile !== undefined) {
@@ -14941,7 +15025,7 @@ function scopeFileHash(absolutePath) {
   const hit = scopeFileHashCache.get(absolutePath);
   if (hit && hit.stamp === stamp)
     return hit.hash;
-  const hash = createHash9("sha256").update(readFileSync12(absolutePath)).digest("hex");
+  const hash = createHash9("sha256").update(readFileSync13(absolutePath)).digest("hex");
   scopeFileHashCache.set(absolutePath, { stamp, hash });
   return hash;
 }
@@ -14950,7 +15034,7 @@ function resolveBoundSymbolScope(manifestPath, symbolIds) {
   if (wanted.length === 0)
     return [];
   const sourceFiles = scopeSourceFiles(manifestPath);
-  const workspaceRoot = path21.dirname(path21.dirname(path21.resolve(manifestPath)));
+  const workspaceRoot = path22.dirname(path22.dirname(path22.resolve(manifestPath)));
   const scope = [];
   for (const symbolId of wanted) {
     const sourceFile = sourceFiles.get(symbolId);
@@ -14959,7 +15043,7 @@ function resolveBoundSymbolScope(manifestPath, symbolIds) {
     const relative = normalizeRepoRelativePath(workspaceRoot, sourceFile);
     scope.push({
       symbolId,
-      sourceHash: relative === null ? OUTSIDE_WORKSPACE_SCOPE_HASH : scopeFileHash(path21.join(workspaceRoot, relative))
+      sourceHash: relative === null ? OUTSIDE_WORKSPACE_SCOPE_HASH : scopeFileHash(path22.join(workspaceRoot, relative))
     });
   }
   scope.sort((left, right) => left.symbolId.localeCompare(right.symbolId));
@@ -22477,7 +22561,7 @@ var init_proof_receipt = __esm(() => {
 
 // ../cli/dist/extractors/markdown.js
 import { createHash as createHash11 } from "node:crypto";
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 function validateExtractedEntity() {
   extractedEntityValidator ??= ajv.compile(entity_schema_default);
   return extractedEntityValidator;
@@ -22956,7 +23040,7 @@ function extractFromMarkdownString(content, filePath) {
 function extractFromMarkdown(filePath) {
   let content;
   try {
-    content = readFileSync13(filePath, "utf8");
+    content = readFileSync14(filePath, "utf8");
   } catch (error) {
     throw new FrontmatterError(`Failed to read file: ${error instanceof Error ? error.message : String(error)}`, filePath, { classification: "File Read Error" });
   }
@@ -23461,7 +23545,7 @@ var init_rule_registry = __esm(() => {
 
 // ../cli/dist/utils/strict-modeling.js
 import { createHash as createHash12 } from "node:crypto";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 function normalizeSubjectKey2(value) {
   const normalized = value.trim().toLowerCase().replace(/[\\/]+/g, ".").replace(/[^a-z0-9.]+/g, "_").replace(/_+/g, "_").replace(/\.+/g, ".").replace(/(^[._]+|[._]+$)/g, "");
   if (!normalized) {
@@ -23791,7 +23875,7 @@ function resolveEntitySourcePaths() {
   };
 }
 function normalizeEntityDirectory(directory) {
-  return directory.split(path22.sep).join("/").replace(/\/+$/g, "");
+  return directory.split(path23.sep).join("/").replace(/\/+$/g, "");
 }
 function buildEntitySourcePath(directory, entityId) {
   return `${directory}/${entityId}.md`;
@@ -24903,9 +24987,9 @@ function cleanPredicate(value) {
 }
 
 // ../cli/dist/operations/modeling/requirement-heuristics.js
-import path23 from "node:path";
+import path24 from "node:path";
 function fallbackSubjectFromSource(source) {
-  const basename = path23.basename(source, path23.extname(source)).replace(/[-_]+/g, " ").trim();
+  const basename = path24.basename(source, path24.extname(source)).replace(/[-_]+/g, " ").trim();
   return basename || "Requirement";
 }
 function buildFallbackClaim(statement, source, confidence, provenance) {
@@ -26205,7 +26289,7 @@ var init_project_config = __esm(() => {
 
 // ../cli/dist/plugins/resolve-package.js
 import * as fs3 from "node:fs";
-import { createRequire as createRequire3 } from "node:module";
+import { createRequire as createRequire4 } from "node:module";
 import { dirname as dirname6, isAbsolute as isAbsolute5, join as join12, relative as relative2, resolve as resolve6 } from "node:path";
 import { pathToFileURL } from "node:url";
 function readJson(path) {
@@ -26361,7 +26445,7 @@ function resolveProjectLocalPackage(workspaceRoot, packageName) {
   if (!hasDeclaredProjectDependency(root, packageName, manifest)) {
     throw new PluginResolutionError("UNDECLARED_DEPENDENCY", `Plugin package '${packageName}' must be listed in dependencies, devDependencies, or optionalDependencies of ${join12(root, "package.json")}`);
   }
-  const consumerRequire = createRequire3(join12(root, "package.json"));
+  const consumerRequire = createRequire4(join12(root, "package.json"));
   let packageInfo = null;
   try {
     packageInfo = packageJsonForResolvedFile(consumerRequire.resolve(`${packageName}/package.json`), packageName);
@@ -26754,10 +26838,10 @@ var init_registry = __esm(() => {
 });
 
 // ../cli/dist/operations/modeling/vocabulary-alignment.js
-import path24 from "node:path";
+import path25 from "node:path";
 import { rankSubjectCandidates } from "kibi-plugin-builtin";
 function semanticQualityModulePath() {
-  return path24.join(path24.dirname(resolveKbPlPath()), "semantic_quality.pl");
+  return path25.join(path25.dirname(resolveKbPlPath()), "semantic_quality.pl");
 }
 function parseJsonBinding(raw) {
   if (raw === undefined || raw === "")
@@ -27390,6 +27474,12 @@ function provenanceBody(title, provenance) {
 ${provenance}
 `;
 }
+function provenanceStubBody(title, provenance) {
+  return `${title.trim()}
+
+${provenance} This entry is a provenance stub: the provider found the source but no claim about it, so it is tagged bootstrap:provenance-stub, ranked after every other search match and not counted as knowledge by gap or coverage reports.
+`;
+}
 function provenanceRequirementBody(statement, provenance, reference) {
   return renderRequirementBody({
     statement,
@@ -27730,7 +27820,7 @@ var init_requirement_claims = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/markdown-candidates.js
-import path25 from "node:path";
+import path26 from "node:path";
 function headingSignals(heading, sourcePath, textRef, minConfidence) {
   const result = [];
   for (const [kind, pattern, confidence] of [
@@ -27756,7 +27846,7 @@ function genericHeadingCandidate(item, heading, line, existingIds, minConfidence
   const confidence = type === "adr" ? 0.9 : type === "fact" ? 0.8 : 0;
   if (!type || confidence < minConfidence)
     return null;
-  const id = `${type === "adr" ? "ADR" : "FACT"}-GEN-${slug(heading, 60) || slug(path25.basename(relativePath))}`.toUpperCase();
+  const id = `${type === "adr" ? "ADR" : "FACT"}-GEN-${slug(heading, 60) || slug(path26.basename(relativePath))}`.toUpperCase();
   if (existingIds.has(id))
     return null;
   const entity = {
@@ -27922,7 +28012,7 @@ var init_markdown_candidates = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/candidates.js
-import path26 from "node:path";
+import path27 from "node:path";
 function typedCandidates(item, existingIds) {
   const results = item.kind === "symbol_manifest" ? extractFromManifestString(item.content ?? "", item.relativePath ?? item.label) : [
     extractFromMarkdownString(item.content ?? "", item.relativePath ?? item.label)
@@ -27954,6 +28044,19 @@ function typedCandidates(item, existingIds) {
     ];
   });
 }
+function providerClaim(item) {
+  const claim = typeof item.data.claim === "string" ? item.data.claim.trim() : "";
+  return claim.length > 0 ? claim : undefined;
+}
+function isProvenanceStubCandidate(candidate) {
+  return candidate.applyPlan.some((payload) => {
+    const properties = payload.properties;
+    if (properties === null || typeof properties !== "object")
+      return false;
+    const tags = properties.tags;
+    return Array.isArray(tags) && tags.includes(PROVENANCE_STUB_TAG);
+  });
+}
 function providerCandidate(item, existingIds, minConfidence) {
   if (!new Set([
     "repo_metadata",
@@ -27967,18 +28070,22 @@ function providerCandidate(item, existingIds, minConfidence) {
   const id = `FACT-GEN-${slug(`${item.kind}-${relativePath}`, 64) || "evidence"}`.toUpperCase();
   if (confidence < minConfidence || existingIds.has(id))
     return [];
-  const symbolTitle = item.kind === "source_symbols" && /\.(?:[cm]?[jt]sx?)$/i.test(relativePath) ? `Source symbols: ${path26.basename(relativePath, path26.extname(relativePath))}` : undefined;
+  const symbolTitle = item.kind === "source_symbols" && /\.(?:[cm]?[jt]sx?)$/i.test(relativePath) ? `Source symbols: ${path27.basename(relativePath, path27.extname(relativePath))}` : undefined;
   const title = (typeof item.data.title === "string" ? item.data.title : undefined) ?? symbolTitle ?? `Bootstrap evidence from ${relativePath}`;
+  const claim = providerClaim(item);
+  const stub = claim === undefined;
   const entity = {
     type: "fact",
     id,
     title,
     status: "active",
-    fact_kind: typeof item.data.factKind === "string" ? item.data.factKind : item.kind === "repo_metadata" ? "meta" : "observation",
+    fact_kind: stub ? "meta" : typeof item.data.factKind === "string" ? item.data.factKind : item.kind === "repo_metadata" ? "meta" : "observation",
     source: `bootstrap:${item.provider}:${relativePath}`,
-    text_ref: relativePath
+    text_ref: relativePath,
+    ...stub ? { tags: [PROVENANCE_STUB_TAG] } : {}
   };
   const evidence = Array.isArray(item.data.evidence) ? item.data.evidence.filter((value) => typeof value === "string") : [`provider:${item.provider}`, `${item.provider}:${relativePath}`];
+  const provenance = `${bootstrapProvenance(item.provider, relativePath, confidence)}${evidence.length > 0 ? ` Evidence: ${evidence.join("; ")}.` : ""}`;
   return [
     {
       candidateId: `prov:${item.kind}:${slug(relativePath, 96) || "evidence"}`,
@@ -27991,7 +28098,9 @@ function providerCandidate(item, existingIds, minConfidence) {
       evidence,
       relationships: [],
       applyPlan: [
-        withDocumentBody(upsert(entity), provenanceBody(title, `${bootstrapProvenance(item.provider, relativePath, confidence)}${evidence.length > 0 ? ` Evidence: ${evidence.join("; ")}.` : ""}`))
+        withDocumentBody(upsert(entity), stub ? provenanceStubBody(title, provenance) : provenanceBody(`${title.trim()}
+
+${claim}`, provenance))
       ]
     }
   ];
@@ -28084,7 +28193,7 @@ var init_cli_errors = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/discovery-evidence.js
-import path27 from "node:path";
+import path28 from "node:path";
 function isScanFilesystem(value) {
   return Boolean(value && "glob" in value && typeof value.glob === "function");
 }
@@ -28114,7 +28223,7 @@ function classifyFile(relativePath, content) {
 function evidenceData(provider, relativePath, content) {
   if (provider === "repo_metadata") {
     const languages = new Set;
-    if (/^package\.json$/i.test(path27.basename(relativePath))) {
+    if (/^package\.json$/i.test(path28.basename(relativePath))) {
       try {
         const parsed = JSON.parse(content);
         const text = JSON.stringify(parsed);
@@ -28131,7 +28240,7 @@ function evidenceData(provider, relativePath, content) {
     if (/pyproject\.toml$/i.test(relativePath))
       languages.add("python");
     return {
-      title: `Repository metadata: ${path27.basename(relativePath)}`,
+      title: `Repository metadata: ${path28.basename(relativePath)}`,
       factKind: "meta",
       confidence: relativePath.includes("tsconfig") ? 0.9 : 0.86,
       evidence: [`repo_metadata:${relativePath}`],
@@ -28152,13 +28261,16 @@ function evidenceData(provider, relativePath, content) {
         `test_topology:${relativePath}`,
         ...frameworks.map((item) => `framework:${item}`)
       ],
-      frameworks
+      frameworks,
+      ...frameworks.length > 0 ? {
+        claim: `${relativePath} is a test file that runs under ${frameworks.join(", ")}.`
+      } : {}
     };
   }
   if (provider === "source_symbols") {
     const symbolCount = Array.from(content.matchAll(/\b(?:export\s+)?(?:function|class|const|let|var|interface|type)\s+([A-Za-z_$][\w$]*)/g)).length;
     return {
-      title: `Source module: ${path27.basename(relativePath, path27.extname(relativePath))}`,
+      title: `Source module: ${path28.basename(relativePath, path28.extname(relativePath))}`,
       factKind: "observation",
       confidence: 0.82,
       evidence: [`source_symbols:${relativePath}`],
@@ -28177,7 +28289,7 @@ function layoutEvidence(workspaceRoot, files, ignored) {
     kind: "repo_layout",
     label: root,
     relativePath: root,
-    absolutePath: path27.join(workspaceRoot, root),
+    absolutePath: path28.join(workspaceRoot, root),
     data: {
       title: `Repository layout: ${root} directory`,
       factKind: "observation",
@@ -28206,14 +28318,14 @@ async function scanEvidence(context) {
   for (const relativePath of files) {
     if (ignored.has(relativePath))
       continue;
-    const absolutePath = path27.resolve(context.workspaceRoot, relativePath);
+    const absolutePath = path28.resolve(context.workspaceRoot, relativePath);
     try {
       const content = await fs.readFile(absolutePath);
       const classification = classifyFile(relativePath, content);
       if (!classification)
         continue;
       const [provider, kind] = classification;
-      if (provider === "repo_metadata" && path27.basename(relativePath) === "package.json") {
+      if (provider === "repo_metadata" && path28.basename(relativePath) === "package.json") {
         try {
           JSON.parse(content);
         } catch {
@@ -28315,7 +28427,7 @@ var init_types = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/discovery.js
-import path28 from "node:path";
+import path29 from "node:path";
 async function migrationWarning(context) {
   try {
     const status = readKbManifestStatus(context.workspaceRoot);
@@ -28329,7 +28441,7 @@ async function migrationWarning(context) {
 function languages(evidence) {
   return [
     ...new Set(evidence.flatMap((item) => {
-      const extension = path28.extname(item.label).slice(1);
+      const extension = path29.extname(item.label).slice(1);
       const fromExtension = item.kind === "source_symbols" ? [LANGUAGE_NAMES[extension] ?? extension] : [];
       const fromMetadata = Array.isArray(item.data.languages) ? item.data.languages.filter((value) => typeof value === "string") : [];
       return [...fromExtension, ...fromMetadata];
@@ -28697,12 +28809,12 @@ var init_intent_claims = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/guidance-actions.js
-import path29 from "node:path";
+import path30 from "node:path";
 function relative3(root, target) {
-  if (!path29.isAbsolute(target))
+  if (!path30.isAbsolute(target))
     return target;
-  const value = path29.relative(root, target);
-  return value.startsWith("..") || path29.isAbsolute(value) ? target.split(path29.sep).join("/") : value.split(path29.sep).join("/");
+  const value = path30.relative(root, target);
+  return value.startsWith("..") || path30.isAbsolute(value) ? target.split(path30.sep).join("/") : value.split(path30.sep).join("/");
 }
 function summary(values, limit = 3) {
   if (values.length === 0)
@@ -28770,12 +28882,12 @@ function buildActions(root, activation, declared, candidates, signals) {
 var init_guidance_actions = () => {};
 
 // ../cli/dist/operations/bootstrap/guidance.js
-import path30 from "node:path";
+import path31 from "node:path";
 function relative4(root, target) {
-  if (!path30.isAbsolute(target))
+  if (!path31.isAbsolute(target))
     return target;
-  const value = path30.relative(root, target);
-  return value.startsWith("..") || path30.isAbsolute(value) ? target.split(path30.sep).join("/") : value.split(path30.sep).join("/");
+  const value = path31.relative(root, target);
+  return value.startsWith("..") || path31.isAbsolute(value) ? target.split(path31.sep).join("/") : value.split(path31.sep).join("/");
 }
 function summary2(values, limit = 3) {
   if (values.length === 0)
@@ -29030,7 +29142,16 @@ function presentBootstrap(input) {
   const suppression = suppressionCounts(input.suppressedCandidates);
   const suppressedTotal = suppression.reduce((sum, row) => sum + row.count, 0);
   const suppressionSummary = suppressedTotal > 0 ? ` Suppressed ${suppressedTotal} candidate(s) by reason: ${suppression.map((row) => `${row.reason} ${row.count}`).join(", ")}.` : "";
-  const limitSummary = suppression.some((row) => row.reason === "over_limit") ? " Discovered candidates over maxCandidates are over_limit; raise the limit or narrow entityTypes. Declared intent claims do not count against it." : "";
+  const provenanceStubs = input.candidates.filter(isProvenanceStubCandidate);
+  const overLimitRows = input.suppressedCandidates.filter((row) => row.reason === "over_limit");
+  const overLimitStubs = overLimitRows.filter((row) => row.provenanceStub === true).length;
+  const limitSummary = overLimitRows.length > 0 ? ` Discovered candidates over maxCandidates are over_limit (${overLimitStubs} of ${overLimitRows.length} are provenance stubs that state no claim); raise the limit only for the ${overLimitRows.length - overLimitStubs} with a claim, or narrow entityTypes. Declared intent claims do not count against it.` : "";
+  const discoverySummary = {
+    ...input.discoverySummary,
+    candidatesWithClaims: input.candidates.length - provenanceStubs.length,
+    provenanceStubs: provenanceStubs.length,
+    suppressedProvenanceStubs: overLimitStubs
+  };
   const tldr = (confidenceLevel === "low" && !input.activation.applyBlocked ? `Low-confidence bootstrap (${String(guidance.confidence.score)}): review diagnostics before proceeding. ${baseTldr}` : baseTldr) + suppressionSummary + limitSummary;
   const rawActions = input.candidates.flatMap((candidate) => candidate.applyPlan.map((payload) => ({ candidate, payload })));
   const actionIds = new Map;
@@ -29093,7 +29214,7 @@ function presentBootstrap(input) {
     declaredContext,
     contextQuestions: contextQuestions.slice(0, 4),
     confidence: guidance.confidence,
-    discoverySummary: input.discoverySummary,
+    discoverySummary,
     candidates: input.candidates,
     actions,
     sourceWrites: [],
@@ -29124,7 +29245,7 @@ function presentBootstrap(input) {
     promptBlock: guidance.promptBlock,
     recommendedActions: guidance.actions,
     declaredContext,
-    discoverySummary: input.discoverySummary,
+    discoverySummary,
     candidates: input.candidates,
     actions,
     sourceWrites: [],
@@ -29139,6 +29260,7 @@ function presentBootstrap(input) {
   };
 }
 var init_presentation = __esm(() => {
+  init_candidates();
   init_guidance();
   init_types();
 });
@@ -31262,7 +31384,7 @@ var init_validation2 = __esm(() => {
 
 // ../cli/dist/operations/bootstrap/generate.js
 import { createHash as createHash18 } from "node:crypto";
-import path31 from "node:path";
+import path32 from "node:path";
 function filterSourceOnlySignals(signals, entityTypes) {
   return entityTypes && entityTypes.length > 0 ? signals.filter((signal) => entityTypes.includes(signal.kind)) : signals;
 }
@@ -31289,7 +31411,7 @@ function selectBootstrapCandidates(input, existingIds, entityTypes, maximum) {
       return 0;
     if (candidate.entityType === "req" && ["typed_markdown", "generic_markdown"].includes(candidate.sourceKind))
       return 1;
-    return 2;
+    return isProvenanceStubCandidate(candidate) ? 3 : 2;
   };
   const suppressed = [];
   const sourceOnlySignals = [];
@@ -31349,11 +31471,21 @@ function selectBootstrapCandidates(input, existingIds, entityTypes, maximum) {
   const candidates = [];
   let discoveredCount = 0;
   let overLimit = 0;
+  let overLimitStubs = 0;
   for (const candidate of selected.values()) {
     const discovered = candidate.sourceKind !== "intent_claim";
     if (discovered && discoveredCount >= maximum) {
-      suppress(candidate, "over_limit");
+      const stub = isProvenanceStubCandidate(candidate);
+      suppressed.push({
+        candidateId: candidate.candidateId,
+        reason: "over_limit",
+        sourcePath: candidate.sourcePath,
+        entityType: candidate.entityType,
+        provenanceStub: stub
+      });
       overLimit += 1;
+      if (stub)
+        overLimitStubs += 1;
       continue;
     }
     const conflict = candidate.applyPlan.find((payload) => {
@@ -31383,7 +31515,7 @@ function selectBootstrapCandidates(input, existingIds, entityTypes, maximum) {
     candidates.push(candidate);
   }
   if (overLimit > 0)
-    diagnostics.push(`${overLimit} discovered candidate(s) exceeded maxCandidates ${maximum} and are suppressed as over_limit; declared intent claims do not count against it.`);
+    diagnostics.push(`${overLimit} discovered candidate(s) exceeded maxCandidates ${maximum} and are suppressed as over_limit, ${overLimitStubs} of them provenance stubs that state no claim (raise the limit only for the ${overLimit - overLimitStubs} with a claim); declared intent claims do not count against it.`);
   return {
     candidates,
     suppressed,
@@ -31437,7 +31569,7 @@ async function expectedSnapshots(context, evidencePaths) {
     } else {
       for (const relative of new Set(evidencePaths)) {
         try {
-          const resolved = path31.resolve(context.workspaceRoot, relative);
+          const resolved = path32.resolve(context.workspaceRoot, relative);
           if (!(await context.fs.stat(resolved)).isFile())
             continue;
           sourceHashes[relative] = sha2562(await context.fs.readFile(resolved));
@@ -31761,7 +31893,7 @@ var init_bootstrap = __esm(() => {
 });
 
 // ../cli/dist/commands/aggregated-checks.js
-import path32 from "node:path";
+import path33 from "node:path";
 function ontologyQualitySetting(raw) {
   if (raw === undefined || raw.trim() === "")
     return "default";
@@ -31778,7 +31910,7 @@ function ontologyQualityOverridesGoal(env = process.env) {
 }
 async function runAggregatedChecks(prolog, rulesAllowlist) {
   const violations = [];
-  const checksPlPath = path32.join(path32.dirname(resolveKbPlPath()), "checks.pl");
+  const checksPlPath = path33.join(path33.dirname(resolveKbPlPath()), "checks.pl");
   const checksPlPathEscaped = escapeAtom(checksPlPath);
   const fallbackQuery = `(   predicate_property(checks:check_all_json_with_options(_, _), _)
     ->  call(checks:check_all_json_with_options(JsonString, false))
@@ -32497,7 +32629,7 @@ var init_source_classification = __esm(() => {
 
 // ../cli/dist/plugins/source-analysis-service.js
 import { createHash as createHash20 } from "node:crypto";
-import * as path33 from "node:path";
+import * as path34 from "node:path";
 function detectSourceLanguage(filePath) {
   return extensionLanguage(filePath);
 }
@@ -32544,9 +32676,9 @@ function providerBudgetMs(hostTimeoutMs) {
   return Math.max(1, hostTimeoutMs - grace);
 }
 function inferModuleTitle(filePath) {
-  const extension = path33.extname(filePath);
-  const basename = path33.basename(filePath, extension);
-  return basename.length > 0 ? basename : path33.basename(filePath);
+  const extension = path34.extname(filePath);
+  const basename = path34.basename(filePath, extension);
+  return basename.length > 0 ? basename : path34.basename(filePath);
 }
 function createConservativeFallbackAnalysis(filePath, fallbackReason) {
   const language = detectSourceLanguage(filePath);
@@ -32787,8 +32919,8 @@ var init_source_analysis_service = __esm(() => {
 
 // ../cli/dist/plugins/maintenance-source-analysis.js
 import { createHash as createHash21 } from "node:crypto";
-import { readFileSync as readFileSync16, realpathSync as realpathSync5 } from "node:fs";
-import { createRequire as createRequire4 } from "node:module";
+import { readFileSync as readFileSync17, realpathSync as realpathSync5 } from "node:fs";
+import { createRequire as createRequire5 } from "node:module";
 import { dirname as dirname7, isAbsolute as isAbsolute6, join as join13, relative as relative5, resolve as resolve7 } from "node:path";
 function digestFile(root, file) {
   const candidate = resolve7(root, file);
@@ -32799,7 +32931,7 @@ function digestFile(root, file) {
   const actualRel = relative5(realpathSync5(root), actual);
   if (actualRel.startsWith("..") || isAbsolute6(actualRel))
     throw new Error(`Approved asset escapes its package: ${file}`);
-  return createHash21("sha256").update(readFileSync16(actual)).digest("hex");
+  return createHash21("sha256").update(readFileSync17(actual)).digest("hex");
 }
 function verifyFiles(root, files) {
   if (Object.keys(files).length === 0)
@@ -32810,11 +32942,11 @@ function verifyFiles(root, files) {
   }
 }
 function dependencyRoot(importer, packageName) {
-  const require2 = createRequire4(join13(importer, "package.json"));
+  const require2 = createRequire5(join13(importer, "package.json"));
   let current = dirname7(require2.resolve(packageName));
   for (;; ) {
     try {
-      const json = JSON.parse(readFileSync16(join13(current, "package.json"), "utf8"));
+      const json = JSON.parse(readFileSync17(join13(current, "package.json"), "utf8"));
       if (json.name === packageName)
         return current;
     } catch {}
@@ -32825,7 +32957,7 @@ function dependencyRoot(importer, packageName) {
   }
 }
 function builtinRuntimeIdentity() {
-  const manifest = createRequire4(import.meta.url)("kibi-plugin-builtin/package.json");
+  const manifest = createRequire5(import.meta.url)("kibi-plugin-builtin/package.json");
   if (manifest.name !== "kibi-plugin-builtin" || typeof manifest.version !== "string")
     throw new Error("Builtin source analyzer identity is invalid");
   return { name: manifest.name, version: manifest.version };
@@ -32858,13 +32990,13 @@ function fingerprintMaintenanceSourceSet(workspaceRoot, projectConfig) {
 }
 function verifyApprovedSourceAnalyzer(root, approval) {
   verifyFiles(root, approval.files);
-  const manifest = JSON.parse(readFileSync16(join13(root, "package.json"), "utf8"));
+  const manifest = JSON.parse(readFileSync17(join13(root, "package.json"), "utf8"));
   if (manifest.name !== approval.packageName || manifest.version !== approval.version)
     throw new Error("Source analyzer package identity does not match host approval");
   for (const dependency of approval.dependencies) {
     const depRoot = dependencyRoot(root, dependency.packageName);
     verifyFiles(depRoot, dependency.files);
-    const metadata = JSON.parse(readFileSync16(join13(depRoot, "package.json"), "utf8"));
+    const metadata = JSON.parse(readFileSync17(join13(depRoot, "package.json"), "utf8"));
     if (metadata.version !== dependency.version)
       throw new Error(`Unapproved source runtime version: ${dependency.packageName}`);
   }
@@ -40403,9 +40535,9 @@ var init_dist2 = __esm(() => {
 // ../cli/dist/relationships/shards.js
 import * as crypto from "node:crypto";
 import * as fs4 from "node:fs";
-import * as path34 from "node:path";
+import * as path35 from "node:path";
 function getRelationshipsDir(kbRoot) {
-  return path34.join(kbRoot, "relationships");
+  return path35.join(kbRoot, "relationships");
 }
 function shardForFromId(fromId) {
   const hash = crypto.createHash("sha256").update(fromId).digest("hex");
@@ -40413,7 +40545,7 @@ function shardForFromId(fromId) {
 }
 function computeShardPath(kbRoot, entityId) {
   const shardName = shardForFromId(entityId);
-  return path34.join(getRelationshipsDir(kbRoot), `${shardName}.yaml`);
+  return path35.join(getRelationshipsDir(kbRoot), `${shardName}.yaml`);
 }
 function readShard(shardPath) {
   if (!fs4.existsSync(shardPath)) {
@@ -40585,7 +40717,7 @@ function appendRelationship(kbRoot, relationship) {
   const next = renderShardWithRelationship(shardPath, existing, relationship);
   if (next !== null) {
     if (existing === null) {
-      fs4.mkdirSync(path34.dirname(shardPath), { recursive: true });
+      fs4.mkdirSync(path35.dirname(shardPath), { recursive: true });
     }
     atomicWriteText(shardPath, next);
   }
@@ -40618,7 +40750,7 @@ function listShards(kbRoot) {
   if (!fs4.existsSync(relationshipsDir)) {
     return [];
   }
-  return fs4.readdirSync(relationshipsDir).filter((f) => f.endsWith(".yaml")).map((f) => path34.join(relationshipsDir, f));
+  return fs4.readdirSync(relationshipsDir).filter((f) => f.endsWith(".yaml")).map((f) => path35.join(relationshipsDir, f));
 }
 function readAllShards(kbRoot) {
   const shards = listShards(kbRoot);
@@ -40639,7 +40771,7 @@ var init_shards = __esm(() => {
 });
 
 // ../cli/dist/extractors/relationships.js
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 function extractRelationshipShard(shardPath) {
   try {
     const records = readShard(shardPath);
@@ -40672,7 +40804,7 @@ function convertRecordToRelationship(record) {
   return relationship;
 }
 function getRelationshipsDir2(kbRoot) {
-  return path35.join(kbRoot, "relationships");
+  return path36.join(kbRoot, "relationships");
 }
 function validateRelationships(relationships, validEntityIds) {
   const errors = [];
@@ -41079,8 +41211,8 @@ var init_symbol_extract = __esm(() => {
 });
 
 // ../cli/dist/public/impact/diagnostics.js
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
-import * as path36 from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync19 } from "node:fs";
+import * as path37 from "node:path";
 function isNarrowerSymbol(manifestSymbolName, candidate, sourceSymbols) {
   if (candidate.name === manifestSymbolName)
     return false;
@@ -41104,14 +41236,14 @@ function readSourceSymbols(sourceFile, sourceContentByFile, workspaceRoot) {
       content: stagedContent
     });
   }
-  const absolutePath = path36.isAbsolute(sourceFile) ? sourceFile : path36.resolve(workspaceRoot, sourceFile);
+  const absolutePath = path37.isAbsolute(sourceFile) ? sourceFile : path37.resolve(workspaceRoot, sourceFile);
   if (!existsSync18(absolutePath))
     return [];
   return extractSymbolsFromStagedFile({
     path: sourceFile,
     status: "M",
     hunkRanges: [{ start: 1, end: Number.MAX_SAFE_INTEGER }],
-    content: readFileSync18(absolutePath, "utf8")
+    content: readFileSync19(absolutePath, "utf8")
   });
 }
 function getGranularSymbolsForSourceFile(sourceFile, options2) {
@@ -41477,14 +41609,14 @@ function hasMeaningfulSourceDiff(diffText) {
 
 // ../cli/dist/public/impact/source-changes.js
 import { execFileSync as execFileSync3, execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync19, lstatSync as lstatSync4, readFileSync as readFileSync19, realpathSync as realpathSync6 } from "node:fs";
-import * as path37 from "node:path";
+import { existsSync as existsSync19, lstatSync as lstatSync4, readFileSync as readFileSync20, realpathSync as realpathSync6 } from "node:fs";
+import * as path38 from "node:path";
 function isSupportedSourcePath(filePath) {
   return isQualifiedSourcePath(filePath);
 }
 function normalizeSourceFile(workspaceRoot, sourceFile) {
-  const relativePath = path37.isAbsolute(sourceFile) ? path37.relative(workspaceRoot, sourceFile) : sourceFile;
-  return relativePath.split(path37.sep).join("/");
+  const relativePath = path38.isAbsolute(sourceFile) ? path38.relative(workspaceRoot, sourceFile) : sourceFile;
+  return relativePath.split(path38.sep).join("/");
 }
 function uniqueSorted2(values) {
   return [...new Set(values)].sort();
@@ -41497,16 +41629,16 @@ function runGit3(workspaceRoot, args) {
   });
 }
 function readWorkingTreeSource(workspaceRoot, sourceFile) {
-  const absolutePath = path37.resolve(workspaceRoot, sourceFile);
-  const relative = path37.relative(workspaceRoot, absolutePath);
-  if (!relative || relative.startsWith("..") || path37.isAbsolute(relative))
+  const absolutePath = path38.resolve(workspaceRoot, sourceFile);
+  const relative = path38.relative(workspaceRoot, absolutePath);
+  if (!relative || relative.startsWith("..") || path38.isAbsolute(relative))
     throw new Error("Source path must remain inside the workspace");
   if (!existsSync19(absolutePath) || !lstatSync4(absolutePath).isFile())
     return null;
-  const actualRelative = path37.relative(realpathSync6(workspaceRoot), realpathSync6(absolutePath));
-  if (actualRelative.startsWith("..") || path37.isAbsolute(actualRelative))
+  const actualRelative = path38.relative(realpathSync6(workspaceRoot), realpathSync6(absolutePath));
+  if (actualRelative.startsWith("..") || path38.isAbsolute(actualRelative))
     throw new Error("Source path escapes the workspace");
-  const bytes = readFileSync19(absolutePath);
+  const bytes = readFileSync20(absolutePath);
   if (bytes.includes(0))
     return null;
   try {
@@ -41582,7 +41714,7 @@ function getExplicitSourceChanges(workspaceRoot, sourceFileFilter) {
   });
 }
 function collectSourceChanges(options2) {
-  const workspaceRoot = path37.resolve(options2.workspaceRoot);
+  const workspaceRoot = path38.resolve(options2.workspaceRoot);
   const sourceFileFilter = new Set((options2.sourceFiles ?? []).map((sourceFile) => normalizeSourceFile(workspaceRoot, sourceFile)).filter(isSupportedSourcePath));
   if (options2.staged)
     return getStagedSourceChanges(workspaceRoot, sourceFileFilter);
@@ -41598,13 +41730,13 @@ var init_source_changes = __esm(() => {
 
 // ../cli/dist/public/impact/manifest.js
 import { existsSync as existsSync20 } from "node:fs";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 function toTraceabilityRelationships(relationships) {
   return relationships.filter((relationship) => isTraceabilityRelationshipType(relationship.type)).map((relationship) => ({ type: relationship.type, to: relationship.to }));
 }
 function readImpactManifestResults(workspaceRoot) {
   const symbolsPath = CANONICAL_ENTITY_PATHS.symbols;
-  const absolutePath = path38.isAbsolute(symbolsPath) ? symbolsPath : path38.resolve(workspaceRoot, symbolsPath);
+  const absolutePath = path39.isAbsolute(symbolsPath) ? symbolsPath : path39.resolve(workspaceRoot, symbolsPath);
   if (!existsSync20(absolutePath))
     return [];
   return extractFromManifest(absolutePath).map((result) => ({
@@ -41965,9 +42097,9 @@ var init_symbol_quality = __esm(() => {
 });
 
 // ../cli/dist/public/impact/analyzer.js
-import * as path39 from "node:path";
+import * as path40 from "node:path";
 async function analyzeChangedFileImpact(options2) {
-  const workspaceRoot = path39.resolve(options2.workspaceRoot);
+  const workspaceRoot = path40.resolve(options2.workspaceRoot);
   const snapshot = options2.staged ? captureStagedSnapshot(workspaceRoot) : undefined;
   const filter = new Set((options2.sourceFiles ?? []).map((file) => normalizeSourceFile(workspaceRoot, file)));
   const snapshotAnalysisInventory = snapshot ? snapshot.inventory.filter((file) => filter.size === 0 || filter.has(file.path)) : undefined;
@@ -43055,7 +43187,7 @@ var init_requirement_quality = __esm(() => {
 
 // ../cli/dist/public/impact/full-kb-quality.js
 import { readFile } from "node:fs/promises";
-import path40 from "node:path";
+import path41 from "node:path";
 function stringField(entity, key) {
   const value = entity[key];
   return typeof value === "string" ? value : "";
@@ -43485,7 +43617,7 @@ function telemetryReadDiagnostic(message) {
 async function collectTelemetryDiagnostics(workspaceRoot, now) {
   if (workspaceRoot === undefined)
     return [];
-  const usageLogPath = path40.join(workspaceRoot, ".kb", "usage.log");
+  const usageLogPath = path41.join(workspaceRoot, ".kb", "usage.log");
   let contents;
   try {
     contents = await readFile(usageLogPath, "utf8");
@@ -43661,7 +43793,7 @@ function buildSummary(input) {
 }
 
 // ../cli/dist/utils/entity-id-style.js
-import * as path41 from "node:path";
+import * as path42 from "node:path";
 function isNumericEntityId(id) {
   return NUMERIC_ENTITY_ID_PATTERN.test(id.trim());
 }
@@ -43672,7 +43804,7 @@ function markdownSourceStem(sourcePath) {
   if (!normalized.endsWith(".md") || normalized.includes("://")) {
     return;
   }
-  return path41.posix.basename(normalized, ".md");
+  return path42.posix.basename(normalized, ".md");
 }
 function entityIdStyleIssues(input) {
   const id = input.id.trim();
@@ -43798,8 +43930,8 @@ var init_prolog_query_plan_safety = __esm(() => {
 
 // ../cli/dist/public/operations/check-helpers.js
 import { execSync as execSync3 } from "node:child_process";
-import { readFileSync as readFileSync20 } from "node:fs";
-import path42 from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import path43 from "node:path";
 function partitionCheckFindings(findings) {
   const violations = [];
   const qualityDiagnostics = [];
@@ -43826,11 +43958,11 @@ function partitionCheckFindings(findings) {
 }
 function resolveChecksPlPath() {
   const override = getKbPlPathOverride();
-  return path42.join(path42.dirname(override ?? resolveKbPlPath()), "checks.pl");
+  return path43.join(path43.dirname(override ?? resolveKbPlPath()), "checks.pl");
 }
 function collectQueryPlanSafetyViolations() {
   const checksPlPath = resolveChecksPlPath();
-  const source = readFileSync20(checksPlPath, "utf8");
+  const source = readFileSync21(checksPlPath, "utf8");
   return analyzePrologQueryPlanSafety(source).map((v) => ({
     rule: "query-plan-safety",
     entityId: v.predicate,
@@ -43888,8 +44020,8 @@ var init_check_helpers = __esm(() => {
 });
 
 // ../cli/dist/operations/migration/kb-sources.js
-import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync21, readdirSync as readdirSync5, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import path43 from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync22, readdirSync as readdirSync5, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import path44 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 function walkMarkdown(directory, files) {
   let entries;
@@ -43899,7 +44031,7 @@ function walkMarkdown(directory, files) {
     return;
   }
   for (const entry of entries) {
-    const absolute = path43.join(directory, entry.name);
+    const absolute = path44.join(directory, entry.name);
     if (entry.isDirectory()) {
       walkMarkdown(absolute, files);
     } else if (entry.isFile() && entry.name.endsWith(".md") && entry.name !== "README.md") {
@@ -43911,7 +44043,7 @@ function listLaneMarkdownFiles(workspaceRoot, lanes = ENTITY_LANES) {
   const result = [];
   for (const lane of lanes) {
     const files = [];
-    const laneRoot = path43.join(workspaceRoot, KB_PATHS.lanes[lane]);
+    const laneRoot = path44.join(workspaceRoot, KB_PATHS.lanes[lane]);
     if (!existsSync21(laneRoot))
       continue;
     walkMarkdown(laneRoot, files);
@@ -43919,7 +44051,7 @@ function listLaneMarkdownFiles(workspaceRoot, lanes = ENTITY_LANES) {
       result.push({
         lane,
         absolutePath,
-        relativePath: path43.relative(workspaceRoot, absolutePath).replaceAll(path43.sep, "/")
+        relativePath: path44.relative(workspaceRoot, absolutePath).replaceAll(path44.sep, "/")
       });
     }
   }
@@ -44047,14 +44179,14 @@ function withoutTopLevelField(content, key) {
   return match === null ? content : `${slice.prefix}${text}${slice.suffix}`;
 }
 function writeFileAtomically(filePath, content) {
-  mkdirSync7(path43.dirname(filePath), { recursive: true });
+  mkdirSync7(path44.dirname(filePath), { recursive: true });
   const tempPath = `${filePath}.kibi-migrate-${process.pid}-${Date.now()}`;
   writeFileSync6(tempPath, content, "utf8");
   renameSync4(tempPath, filePath);
 }
 function readText(filePath) {
   try {
-    return readFileSync21(filePath, "utf8");
+    return readFileSync22(filePath, "utf8");
   } catch {
     return null;
   }
@@ -44065,7 +44197,7 @@ var init_kb_sources = __esm(() => {
 });
 
 // ../cli/dist/public/operations/entity-context.js
-import path44 from "node:path";
+import path45 from "node:path";
 function readAuthoredEntity(content, relativePath) {
   const slice = sliceFrontmatter(content);
   if (slice === null)
@@ -44081,7 +44213,7 @@ function readAuthoredEntity(content, relativePath) {
   }
   const record = data;
   const type = typeof record.type === "string" ? record.type : inferTypeFromPath(relativePath) ?? "";
-  const id = typeof record.id === "string" && record.id.trim() !== "" ? record.id.trim() : path44.basename(relativePath, ".md");
+  const id = typeof record.id === "string" && record.id.trim() !== "" ? record.id.trim() : path45.basename(relativePath, ".md");
   const newline = slice.suffix.indexOf(`
 `);
   return {
@@ -44139,7 +44271,7 @@ function authoredSupersededIds(workspaceRoot, entities) {
     }
   }
   try {
-    for (const relationship of readAllShards(path44.join(workspaceRoot, ".kb"))) {
+    for (const relationship of readAllShards(path45.join(workspaceRoot, ".kb"))) {
       if (relationship.type === "supersedes")
         superseded.add(relationship.to);
     }
@@ -44228,8 +44360,8 @@ var init_entity_context = __esm(() => {
 });
 
 // ../cli/dist/public/operations/origin-review.js
-import { readFileSync as readFileSync22 } from "node:fs";
-import path45 from "node:path";
+import { readFileSync as readFileSync23 } from "node:fs";
+import path46 from "node:path";
 function markdownHasRationaleSection(content) {
   const body = content.startsWith("---") ? content.replace(/^---\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/, "") : content;
   return RATIONALE_HEADING.test(body);
@@ -44240,13 +44372,13 @@ function rationaleSectionReader(workspaceRoot) {
     const source = text3(entity.source);
     if (source === undefined || !source.endsWith(".md"))
       return false;
-    const file = path45.resolve(workspaceRoot, source);
+    const file = path46.resolve(workspaceRoot, source);
     const cached = cache.get(file);
     if (cached !== undefined)
       return cached;
     let found = false;
     try {
-      found = markdownHasRationaleSection(readFileSync22(file, "utf8"));
+      found = markdownHasRationaleSection(readFileSync23(file, "utf8"));
     } catch {
       found = false;
     }
@@ -46585,7 +46717,7 @@ var init_predicate_schema_conformance = __esm(() => {
 
 // ../cli/dist/operations/migration/source-paths.js
 import { existsSync as existsSync22 } from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 function scalarText(value) {
   if (typeof value === "string")
     return value.trim();
@@ -46609,7 +46741,7 @@ function scanAuthoredSources(workspaceRoot) {
     const slice = sliceFrontmatter(content);
     if (slice === null)
       continue;
-    const id = scalarText(readTopLevelField(slice.text, "id")) || path46.basename(file.relativePath, ".md");
+    const id = scalarText(readTopLevelField(slice.text, "id")) || path47.basename(file.relativePath, ".md");
     entityIds.add(id);
     const value = readTopLevelField(slice.text, "source");
     if (value === undefined || value === null)
@@ -46618,7 +46750,7 @@ function scanAuthoredSources(workspaceRoot) {
       continue;
     refs.push({ entityId: id, file: file.relativePath, value });
   }
-  const symbols = readText(path46.join(workspaceRoot, KB_PATHS.symbolsManifest));
+  const symbols = readText(path47.join(workspaceRoot, KB_PATHS.symbolsManifest));
   if (symbols !== null) {
     for (const match of symbols.matchAll(SYMBOL_ID_LINE)) {
       const id = unquote(match[1] ?? "");
@@ -46664,15 +46796,15 @@ function resolveAuthoredSource(value, context) {
   return { kind: "dangling" };
 }
 function workspacePathExists(workspaceRoot) {
-  const root = path46.resolve(workspaceRoot);
+  const root = path47.resolve(workspaceRoot);
   const cache = new Map;
   return (relativePath) => {
     const cached = cache.get(relativePath);
     if (cached !== undefined)
       return cached;
-    const absolute = path46.resolve(root, relativePath);
-    const fromRoot = path46.relative(root, absolute);
-    const exists = !fromRoot.startsWith("..") && !path46.isAbsolute(fromRoot) && existsSync22(absolute);
+    const absolute = path47.resolve(root, relativePath);
+    const fromRoot = path47.relative(root, absolute);
+    const exists = !fromRoot.startsWith("..") && !path47.isAbsolute(fromRoot) && existsSync22(absolute);
     cache.set(relativePath, exists);
     return exists;
   };
@@ -46714,7 +46846,7 @@ function classifySources(workspaceRoot) {
 }
 function withEditability(workspaceRoot, repairs) {
   return repairs.map((repair) => {
-    const content = readText(path46.join(workspaceRoot, repair.file));
+    const content = readText(path47.join(workspaceRoot, repair.file));
     if (content !== null && editedContent(content, repair.fix) !== null) {
       return repair;
     }
@@ -46782,7 +46914,7 @@ function applySourcePathRepairs(workspaceRoot, planned) {
         continue;
       }
     }
-    const absolute = path46.join(workspaceRoot, repair.file);
+    const absolute = path47.join(workspaceRoot, repair.file);
     const content = readText(absolute);
     const next = content === null ? null : editedContent(content, repair.fix);
     if (next === null) {
@@ -52345,15 +52477,15 @@ var require_out4 = __commonJS(function(exports2, module2) {
 import { execFile } from "node:child_process";
 import { createHash as createHash24 } from "node:crypto";
 import * as fs5 from "node:fs";
-import { existsSync as existsSync23, readFileSync as readFileSync24, readdirSync as readdirSync6, unlinkSync as unlinkSync4 } from "node:fs";
-import * as path47 from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync25, readdirSync as readdirSync6, unlinkSync as unlinkSync4 } from "node:fs";
+import * as path48 from "node:path";
 import { promisify } from "node:util";
 async function gitTrackedPaths(cwd) {
   const result = await execFileAsync("git", ["-C", cwd, "ls-files", "--cached", "-z", "--"], { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 });
   return new Set(result.stdout.toString("utf8").split("\x00").filter(Boolean).map((value) => value.replaceAll("\\", "/")));
 }
 function pendingSourcePaths(cwd, recoverMissing) {
-  const root = path47.join(cwd, ".kb", "recovery", "pending-sources");
+  const root = path48.join(cwd, ".kb", "recovery", "pending-sources");
   if (!existsSync23(root)) {
     return { paths: new Map, recoveredReceipts: [] };
   }
@@ -52362,14 +52494,14 @@ function pendingSourcePaths(cwd, recoverMissing) {
   for (const name of readdirSync6(root)) {
     if (!name.endsWith(".json"))
       continue;
-    const receiptPath = path47.join(root, name);
+    const receiptPath = path48.join(root, name);
     try {
-      const raw = readFileSync24(receiptPath, "utf8");
+      const raw = readFileSync25(receiptPath, "utf8");
       const receipt = JSON.parse(raw);
       if (typeof receipt.path === "string" && receipt.path.length > 0 && typeof receipt.afterHash === "string" && /^[a-f0-9]{64}$/i.test(receipt.afterHash)) {
         const relative = receipt.path.replaceAll("\\", "/");
-        const absolute = path47.resolve(cwd, relative);
-        if (!absolute.startsWith(`${path47.resolve(cwd)}${path47.sep}`)) {
+        const absolute = path48.resolve(cwd, relative);
+        if (!absolute.startsWith(`${path48.resolve(cwd)}${path48.sep}`)) {
           throw new Error(`Pending source receipt escapes workspace: ${relative}`);
         }
         if (!existsSync23(absolute)) {
@@ -52384,7 +52516,7 @@ function pendingSourcePaths(cwd, recoverMissing) {
           }
           throw new Error(`Pending source is missing: ${relative}. If the file was deleted on purpose, run 'kibi branch recover --apply' to rebuild the branch KB from the sources that remain.`);
         }
-        const actual = createHash24("sha256").update(readFileSync24(absolute)).digest("hex");
+        const actual = createHash24("sha256").update(readFileSync25(absolute)).digest("hex");
         if (actual !== receipt.afterHash) {
           throw new Error(`Pending source hash drift blocks sync for ${relative}; expected ${receipt.afterHash}, found ${actual}`);
         }
@@ -52421,10 +52553,10 @@ function unlinkOrEnoent(absolute) {
   }
 }
 function clearRecoveredPendingSourceReceipts(cwd, receipts) {
-  const root = path47.resolve(cwd, ".kb", "recovery", "pending-sources");
+  const root = path48.resolve(cwd, ".kb", "recovery", "pending-sources");
   for (const receipt of receipts) {
-    const absolute = path47.resolve(receipt.receiptPath);
-    if (!absolute.startsWith(`${root}${path47.sep}`)) {
+    const absolute = path48.resolve(receipt.receiptPath);
+    if (!absolute.startsWith(`${root}${path48.sep}`)) {
       throw new Error(`Pending source receipt escapes recovery root: ${absolute}`);
     }
     if (!existsSync23(absolute))
@@ -52451,7 +52583,7 @@ function clearRecoveredPendingSourceReceipts(cwd, receipts) {
 function filterTracked(cwd, files, tracked, pending) {
   const retained = [];
   for (const file of files) {
-    const relative = path47.relative(cwd, file).replaceAll(path47.sep, "/");
+    const relative = path48.relative(cwd, file).replaceAll(path48.sep, "/");
     if (tracked.has(relative)) {
       retained.push(file);
       continue;
@@ -52500,7 +52632,7 @@ async function discoverSourceFiles(cwd, options2 = {}) {
     entityMarkdownFiles = filterTracked(cwd, entityMarkdownFiles, tracked, new Set(pending.paths.keys()));
     manifestFiles = filterTracked(cwd, manifestFiles, tracked, new Set(pending.paths.keys()));
     for (const relative of pending.paths.keys()) {
-      const absolute = path47.resolve(cwd, relative);
+      const absolute = path48.resolve(cwd, relative);
       if (!existsSync23(absolute))
         continue;
       if (relative.endsWith(".md") && !entityMarkdownFiles.includes(absolute)) {
@@ -52510,21 +52642,21 @@ async function discoverSourceFiles(cwd, options2 = {}) {
         manifestFiles.push(absolute);
       }
     }
-    const pendingRoot = path47.join(cwd, ".kb", "recovery", "pending-sources");
+    const pendingRoot = path48.join(cwd, ".kb", "recovery", "pending-sources");
     if (options2.consumeTrackedPendingReceipts !== false && existsSync23(pendingRoot)) {
       for (const name of readdirSync6(pendingRoot)) {
         if (!name.endsWith(".json"))
           continue;
         try {
-          const receipt = JSON.parse(readFileSync24(path47.join(pendingRoot, name), "utf8"));
+          const receipt = JSON.parse(readFileSync25(path48.join(pendingRoot, name), "utf8"));
           if (typeof receipt.path === "string" && tracked.has(receipt.path.replaceAll("\\", "/"))) {
-            unlinkSync4(path47.join(pendingRoot, name));
+            unlinkSync4(path48.join(pendingRoot, name));
           }
         } catch {}
       }
     }
   }
-  const relationshipsDir = getRelationshipsDir2(path47.join(cwd, ".kb"));
+  const relationshipsDir = getRelationshipsDir2(path48.join(cwd, ".kb"));
   return {
     markdownFiles: entityMarkdownFiles,
     manifestFiles,
@@ -52542,15 +52674,15 @@ var init_discovery2 = __esm(() => {
 });
 
 // ../cli/dist/commands/sync/extraction.js
-import * as path48 from "node:path";
+import * as path49 from "node:path";
 function normalizeExtractionSources(results, workspaceRoot) {
-  const root = path48.resolve(workspaceRoot);
+  const root = path49.resolve(workspaceRoot);
   const normalize = (value) => {
     if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(value))
       return value;
-    const absolute = path48.isAbsolute(value) ? path48.resolve(value) : undefined;
-    if (absolute?.startsWith(`${root}${path48.sep}`)) {
-      return path48.relative(root, absolute).replaceAll(path48.sep, "/");
+    const absolute = path49.isAbsolute(value) ? path49.resolve(value) : undefined;
+    if (absolute?.startsWith(`${root}${path49.sep}`)) {
+      return path49.relative(root, absolute).replaceAll(path49.sep, "/");
     }
     return value.replaceAll("\\", "/");
   };
@@ -52903,7 +53035,7 @@ var init_relationships2 = __esm(() => {
 
 // ../cli/dist/public/operations/source-relationship-parity.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import path49 from "node:path";
+import path50 from "node:path";
 function relationshipKey(relationship) {
   return `${relationship.type}\x00${relationship.from}\x00${relationship.to}`;
 }
@@ -53034,14 +53166,14 @@ async function collectSourceRelationshipParityViolations(workspaceRoot, prolog)
   if (extraction.errors.length > 0) {
     return extraction.errors.map(({ file, message }) => ({
       rule: "source-relationship-parity",
-      entityId: path49.relative(workspaceRoot, file).replaceAll(path49.sep, "/"),
-      source: path49.relative(workspaceRoot, file).replaceAll(path49.sep, "/"),
+      entityId: path50.relative(workspaceRoot, file).replaceAll(path50.sep, "/"),
+      source: path50.relative(workspaceRoot, file).replaceAll(path50.sep, "/"),
       description: `Authored relationship parity could not inspect source: ${message}`,
       suggestion: "Repair the authored source, then rerun kb_check."
     }));
   }
   const authored = extraction.results.flatMap(({ entity, relationships }) => relationships.map((relationship) => authoredRelationship(relationship, entity.source)));
-  for (const relationship of readAllShards(path49.join(workspaceRoot, ".kb"))) {
+  for (const relationship of readAllShards(path50.join(workspaceRoot, ".kb"))) {
     authored.push({
       type: relationship.type,
       from: relationship.from,
@@ -54946,10 +55078,39 @@ function nameOrStopWordReason(value, context = {}) {
     return `it repeats the argument name ${token} and the claim does not name it`;
   return null;
 }
+function isParticipantArgumentType(type) {
+  return PARTICIPANT_ARGUMENT_TYPES.has(type ? bindingToken(type) : "");
+}
+function subjectKeyParticipantReason(value, context = {}) {
+  if (!isParticipantArgumentType(context.argumentType))
+    return null;
+  if (matchesConstant(value, context))
+    return null;
+  const token = bindingToken(value);
+  if (token === "")
+    return null;
+  const subject = (context.constrainedSubjects ?? []).find((key) => bindingToken(key) === token);
+  if (subject === undefined)
+    return null;
+  return `"${value}" is the requirement's subject key ${subject}, which the predicate fact already carries as its subject_key, so it names no ${bindingToken(context.argumentType ?? "")}`;
+}
+function clauseBindingReason(value, context = {}) {
+  const type = context.argumentType ? bindingToken(context.argumentType) : "";
+  if (!NAMING_ARGUMENT_TYPES.has(type))
+    return null;
+  if (matchesConstant(value, context))
+    return null;
+  const words = bindingToken(value).split("_").filter(Boolean);
+  if (words.length <= MAX_NAMING_BINDING_WORDS)
+    return null;
+  return `it is a ${words.length}-word clause of the claim, not a short name for this ${type}`;
+}
 function classifyBinding(value, text, explicit, canonical = false, context = {}) {
   const normalized = value.trim();
   if (nameOrStopWordReason(normalized, { ...context, text }) !== null)
     return "placeholder";
+  if (subjectKeyParticipantReason(normalized, context) !== null)
+    return "placeholder";
   const constant = matchesConstant(normalized, context);
   if (canonical && (constant || !isGenericPlaceholder(normalized)))
     return "extracted";
@@ -54957,6 +55118,8 @@ function classifyBinding(value, text, explicit, canonical = false, context = {})
     return "explicit";
   if (!normalized || isGenericPlaceholder(normalized))
     return "placeholder";
+  if (clauseBindingReason(normalized, context) !== null)
+    return "placeholder";
   if (textContainsValue(text, normalized))
     return "extracted";
   return "inferred";
@@ -54967,7 +55130,7 @@ function aggregateBindingProvenance(values) {
 function bindingCanBeApplied(value) {
   return value === "explicit" || value === "requirement" || value === "extracted";
 }
-var PLACEHOLDER_VALUES, DERIVED_CUE_ALIASES, STOP_WORD_BINDINGS, PROVENANCE_ORDER;
+var PLACEHOLDER_VALUES, DERIVED_CUE_ALIASES, STOP_WORD_BINDINGS, NAMING_ARGUMENT_TYPES, PARTICIPANT_ARGUMENT_TYPES, MAX_NAMING_BINDING_WORDS = 3, PROVENANCE_ORDER;
 var init_predicate_bindings = __esm(() => {
   PLACEHOLDER_VALUES = new Set([
     "unknown",
@@ -55108,6 +55271,21 @@ var init_predicate_bindings = __esm(() => {
     "example",
     "placeholder"
   ]);
+  NAMING_ARGUMENT_TYPES = new Set([
+    "entity",
+    "actor",
+    "actor_scope",
+    "resource",
+    "owner",
+    "role",
+    "component"
+  ]);
+  PARTICIPANT_ARGUMENT_TYPES = new Set([
+    "actor",
+    "actor_scope",
+    "role",
+    "owner"
+  ]);
   PROVENANCE_ORDER = [
     "explicit",
     "requirement",
@@ -55813,11 +55991,14 @@ function buildSuggestion(schema, text, subject, score, argumentBindings = {}, po
   const inferredArgs = inferArgs(schema, text, subject);
   const canonicalLauncherArgs = exactLauncherPredicateArgs(schema.predicate_name, text);
   const hasExactBinding = (name) => typeof argumentBindings[name] === "string" && argumentBindings[name].trim().length > 0;
-  const requirementSubjectArgument = diagnostics?.requirementSubject && diagnostics.explicitSubject !== true && !hasExactBinding("subject") ? schema.argument_names.indexOf("subject") : -1;
+  const subjectArgument = schema.argument_names.indexOf("subject");
+  const explicitSubject = diagnostics?.explicitSubject === true;
+  const reviewedSubject = explicitSubject ? subject : diagnostics?.requirementSubject;
+  const reviewedSubjectArgument = reviewedSubject !== undefined && !hasExactBinding("subject") ? subjectArgument : -1;
   const boundArgs = schema.argument_names.map((name, index) => {
     const exactBinding = argumentBindings[name];
-    if (index === requirementSubjectArgument)
-      return diagnostics?.requirementSubject ?? "unknown";
+    if (index === reviewedSubjectArgument)
+      return reviewedSubject ?? "unknown";
     return typeof exactBinding === "string" && exactBinding.trim().length > 0 ? exactBinding.trim() : inferredArgs[index] ?? "unknown";
   });
   const vocabulary = {
@@ -55827,16 +56008,27 @@ function buildSuggestion(schema, text, subject, score, argumentBindings = {}, po
   const conformance = predicateArgumentConformance(schema.argument_names, boundArgs, vocabulary);
   const predicateArgs = applyArgumentRewrites(boundArgs, conformance.rewrites);
   const undeclaredArguments = new Set(conformance.undeclared.map((value) => value.argumentName));
+  const hintedFirstArgument = explicitSubject && subjectArgument < 0 && !hasExactBinding(schema.argument_names[0] ?? "") && predicateArgs[0] === subject && !isParticipantArgumentType(schema.argument_types[0]) ? 0 : -1;
+  const constrainedSubjects = diagnostics?.constrainedSubjects ?? [];
   const bindingProvenanceByArgument = Object.fromEntries(schema.argument_names.map((name, index) => [
     name,
-    index === requirementSubjectArgument && !undeclaredArguments.has(name) ? "requirement" : classifyBinding(predicateArgs[index] ?? "unknown", text, typeof argumentBindings[name] === "string" && argumentBindings[name].trim().length > 0 || diagnostics?.explicitSubject === true && index === 0, canonicalLauncherArgs?.[index] === predicateArgs[index] && !(index === 0 && predicateArgs[index] === "launcher" && diagnostics?.explicitSubject !== true && typeof argumentBindings[name] !== "string"), index === 0 && diagnostics?.explicitSubject === true && typeof argumentBindings[name] !== "string" ? { constants: schema.argument_constants?.[name] } : {
+    index === reviewedSubjectArgument && !undeclaredArguments.has(name) ? explicitSubject ? classifyBinding(predicateArgs[index] ?? "unknown", text, true) : "requirement" : classifyBinding(predicateArgs[index] ?? "unknown", text, hasExactBinding(name) || index === hintedFirstArgument, canonicalLauncherArgs?.[index] === predicateArgs[index] && !(index === 0 && predicateArgs[index] === "launcher" && !explicitSubject && typeof argumentBindings[name] !== "string"), index === hintedFirstArgument ? { constants: schema.argument_constants?.[name] } : {
       argumentName: name,
       argumentNames: schema.argument_names,
-      constants: schema.argument_constants?.[name]
+      argumentType: schema.argument_types[index],
+      constants: schema.argument_constants?.[name],
+      constrainedSubjects
     })
   ]));
+  const subjectKey = constrainedSubjects.length === 0 ? null : subjectArgument >= 0 ? predicateArgs[subjectArgument] ?? null : reviewedSubject ?? null;
+  const subjectPairing = constrainedSubjects.length === 0 ? "not_required" : subjectKey !== null && constrainedSubjects.includes(subjectKey) ? "paired" : "unpaired";
   const bindingProvenance = aggregateBindingProvenance(Object.values(bindingProvenanceByArgument));
   const unboundArguments = schema.argument_names.filter((name) => undeclaredArguments.has(name) || !bindingCanBeApplied(bindingProvenanceByArgument[name] ?? "placeholder"));
+  if (subjectPairing === "unpaired") {
+    const missing = subjectArgument >= 0 ? "subject" : "subject_key";
+    if (!unboundArguments.includes(missing))
+      unboundArguments.push(missing);
+  }
   const canonicalKey = `${schema.predicate_name}(${predicateArgs.join(",")})`;
   const polarity = polarityHint ?? (predicateArgs.at(-1) === "deny" || /\b(?:must\s+not|shall\s+not|never|cannot|can't|forbidden|prohibited)\b/i.test(text) ? "deny" : "assert");
   return {
@@ -55849,6 +56041,8 @@ function buildSuggestion(schema, text, subject, score, argumentBindings = {}, po
     unbound_arguments: unboundArguments,
     binding_provenance: bindingProvenance,
     binding_provenance_by_argument: bindingProvenanceByArgument,
+    subject_key: subjectKey,
+    subject_pairing: subjectPairing,
     eligibility: diagnostics?.eligibility ?? "eligible",
     rejection_reasons: [...diagnostics?.rejectionReasons ?? []],
     applicability_score: diagnostics?.applicabilityScore ?? score,
@@ -55891,6 +56085,7 @@ function buildPredicateApplyPlan(suggestion, args) {
           ...suggestion.schema.tags.map((tag) => `predicate:${tag}`)
         ],
         fact_kind: "predicate",
+        ...suggestion.subject_key ? { subject_key: suggestion.subject_key } : {},
         predicate_name: suggestion.predicate_name,
         predicate_args: suggestion.predicate_args,
         canonical_key: suggestion.canonical_key,
@@ -56046,9 +56241,14 @@ function exampleArguments(example) {
   args.push(current.trim());
   return args.filter(Boolean);
 }
-function unboundReason(candidate, name, value, text) {
+function noParticipantGuidance(type) {
+  return `The claim names no ${type}. Bind the participant the claim names (a noun of at most 3 words), never the requirement's subject key; if the claim names no ${type}, this schema does not fit the claim: record_ontology_gap instead.`;
+}
+function unboundReason(candidate, name, value, text, requirementSubjects) {
   const schema = candidate.schema;
   const provenance = candidate.binding_provenance_by_argument[name];
+  const type = schema.argument_types[schema.argument_names.indexOf(name)];
+  const participant = isParticipantArgumentType(type);
   const nameReason = nameOrStopWordReason(value, {
     argumentName: name,
     argumentNames: schema.argument_names,
@@ -56057,8 +56257,21 @@ function unboundReason(candidate, name, value, text) {
   });
   if (nameReason !== null)
     return `The value "${value}" is not a binding: ${nameReason}.`;
+  const subjectReason = subjectKeyParticipantReason(value, {
+    argumentType: type,
+    constants: schema.argument_constants?.[name],
+    constrainedSubjects: requirementSubjects
+  });
+  if (subjectReason !== null)
+    return `The value "${value}" is not a binding: ${subjectReason}. ${noParticipantGuidance(String(type))}`;
+  const clauseReason = clauseBindingReason(value, {
+    argumentType: type,
+    constants: schema.argument_constants?.[name]
+  });
+  if (clauseReason !== null)
+    return participant ? `The value "${value}" is not a binding: ${clauseReason}. Bind a noun of at most 3 words. ${noParticipantGuidance(String(type))}` : `The value "${value}" is not a binding: ${clauseReason}. Bind a noun of at most 3 words, or the requirement's subject key.`;
   if (!value.trim() || isGenericPlaceholder(value))
-    return "The claim text names no value for this argument.";
+    return participant ? noParticipantGuidance(String(type)) : "The claim text names no value for this argument.";
   if (provenance === "inferred")
     return `The value "${value}" was inferred and does not appear in the claim text; confirm it or pass the exact value.`;
   if (schema.argument_constants?.[name])
@@ -56068,12 +56281,25 @@ function unboundReason(candidate, name, value, text) {
 function buildBindingHints(candidate, text, requirementSubjects = []) {
   const schema = candidate.schema;
   const parsedExamples = schema.examples.map(exampleArguments);
+  const namesSubject = schema.argument_names.includes("subject");
   return candidate.unbound_arguments.map((name) => {
+    if (name === "subject_key" && !namesSubject)
+      return {
+        argument: name,
+        position: -1,
+        type: "subject_key",
+        description: "The subject the predicate fact is about; recorded as its subject_key because the schema names no subject argument.",
+        examples: requirementSubjects.slice(0, MAX_EXAMPLES),
+        currentValue: candidate.subject_key ?? "",
+        provenance: "placeholder",
+        reason: `The ${schema.predicate_name} schema does not name the requirement's subject, so kb_check pairs the predicate with the subject fact only through subject_key. Pass subjectHint with one of the subjects the requirement constrains.`
+      };
     const position = schema.argument_names.indexOf(name);
     const constants = schema.argument_constants?.[name];
     const exampleValues = parsedExamples.map((args) => args[position]).filter((value) => typeof value === "string");
+    const offersSubjects = name === "subject" || !namesSubject && schema.argument_types[position] === "entity";
     const examples = Array.from(new Set([
-      ...name === "subject" ? requirementSubjects : [],
+      ...offersSubjects ? requirementSubjects : [],
       ...constants ?? [],
       ...exampleValues
     ])).slice(0, MAX_EXAMPLES);
@@ -56088,7 +56314,7 @@ function buildBindingHints(candidate, text, requirementSubjects = []) {
       examples,
       currentValue: current,
       provenance: candidate.binding_provenance_by_argument[name] ?? "placeholder",
-      reason: unboundReason(candidate, name, current, text)
+      reason: name === "subject" && candidate.subject_pairing === "unpaired" && bindingCanBeApplied(candidate.binding_provenance_by_argument[name] ?? "placeholder") ? `The value "${current}" is not a subject the requirement constrains (${requirementSubjects.join(", ")}), so kb_check would not pair the predicate with the subject fact. Bind one of them.` : unboundReason(candidate, name, current, text, requirementSubjects)
     };
   });
 }
@@ -56275,8 +56501,8 @@ async function constrainedSubjectKeys(prolog, requirementId, warnings) {
 async function handleKbSuggestPredicates(prolog, args, context) {
   const text = normalizeText2(args.text);
   const warnings = [];
-  const requirementSubjects = hasSubjectHint(args.subjectHint) ? [] : await constrainedSubjectKeys(prolog, args.requirementId, warnings);
-  const requirementSubject = requirementSubjects.length === 1 ? requirementSubjects[0] : undefined;
+  const requirementSubjects = await constrainedSubjectKeys(prolog, args.requirementId, warnings);
+  const requirementSubject = !hasSubjectHint(args.subjectHint) && requirementSubjects.length === 1 ? requirementSubjects[0] : undefined;
   const subject = inferSubject(text, args.subjectHint, {
     requirementId: args.requirementId,
     subjectKey: requirementSubject
@@ -56322,7 +56548,8 @@ async function handleKbSuggestPredicates(prolog, args, context) {
       applicabilityScore: applicability.applicabilityScore,
       scoreComponents: ranked.components,
       explicitSubject: Boolean(args.subjectHint?.trim()),
-      ...requirementSubject ? { requirementSubject } : {}
+      ...requirementSubject ? { requirementSubject } : {},
+      constrainedSubjects: requirementSubjects
     });
   });
   const evaluatedCandidates = withMarginRejection(initialCandidates).sort((left, right) => {
@@ -56358,6 +56585,9 @@ async function handleKbSuggestPredicates(prolog, args, context) {
     warnings.push(`${args.requirementId} already grounds this claim (${claimKey}) through ${groundingSummary}. A modeled claim takes exactly one logical grounding relationship, so adding requires_predicate beside it fails the proposition-complete rule. ${replacementPlan ? "Keep the existing grounding, or follow replacementPlan to swap it for the predicate." : "Keep the existing grounding; no predicate replacement is available yet."}`);
   }
   const bindingHints = recommendedAction === "provide_argument_bindings" && recommendedCandidate ? buildBindingHints(recommendedCandidate, text, requirementSubjects) : [];
+  if (recommendedCandidate?.subject_pairing === "unpaired") {
+    warnings.push(unpairedSubjectWarning(recommendedCandidate, args, requirementSubjects));
+  }
   const recommendedPredicateSchema = !recommendedCandidate && !unavailableSchema ? buildPredicateSchemaDraft(text, subject) : null;
   const groundedPrefix = alreadyGrounded ? `${args.requirementId} already grounds this claim through ${groundingSummary}. ` : "";
   const textSummary = groundedPrefix + (replacementPlan ? `To use ${completeCandidate?.predicate_name} instead, follow replacementPlan and link requires_predicate to ${plannedFactId}; otherwise keep the existing grounding.` : completeCandidate ? `Suggested ${candidates.length} predicate candidate(s). Top applicable match: ${completeCandidate.predicate_name}. Apply the predicate fact ${plannedFactId}, then link requires_predicate to that fact id (not a candidate id).` : recommendedCandidate ? `Matched ${recommendedCandidate.predicate_name}, but exact reviewed values are still required for: ${recommendedCandidate.unbound_arguments.join(", ")}. Bind them from the claim text: ${describeBindingHints(bindingHints)}. A value that repeats an argument name or a stop word stays unbound. No apply plan was generated.` : unavailableSchema ? `Requested predicate schema ${args.schemaId} is unavailable or semantically inapplicable. No apply plan was generated.` : alreadyGrounded ? "No predicate candidate passed the semantic applicability gate; keep the existing grounding and record the ontology-gap observation in applyPlan so the missing schema stays visible." : "No predicate candidate passed the semantic applicability gate; record an ontology gap and review the generated schema draft instead of silently writing prose.");
@@ -56385,6 +56615,12 @@ async function handleKbSuggestPredicates(prolog, args, context) {
     applyPlan
   };
 }
+function unpairedSubjectWarning(candidate, args, constrainedSubjects) {
+  const subjects = constrainedSubjects.join(", ");
+  const schemaNamesSubject = candidate.schema.argument_names.includes("subject");
+  const cause = schemaNamesSubject ? `its subject argument is ${candidate.subject_key ?? "unbound"}, not a subject ${args.requirementId} constrains (${subjects})` : `the ${candidate.predicate_name} schema does not name the requirement's subject (its arguments are ${candidate.schema.argument_names.join(", ")}) and its subject_key ${candidate.subject_key === null ? "cannot be chosen" : `${candidate.subject_key} is not`} one of the subjects ${args.requirementId} constrains (${subjects})`;
+  return `${candidate.predicate_name} is not offered for grounding because ${cause}, so kb_check would report strict-req-fact-pairing after the link. Pass subjectHint with one of ${subjects} and retry.`;
+}
 async function storedRequirementProperties(prolog, requirementId, warnings) {
   if (prolog === null)
     return null;
@@ -56413,8 +56649,14 @@ function buildGroundingReplacementPlan(requirementId, factId, predicatePlan, exi
     relationships
   });
   const restate = stored === null ? `add the requirement's stored title and status as properties (they could not be read), keep this relationship only` : "the properties restate the stored title, status and metadata; kb_upsert keeps the stored proposition ledger";
+  const transientRules = ["logic-coverage", "strict-req-fact-pairing"];
   return {
     relationshipTarget: factId,
+    expected: {
+      kbCheckAfterStep: [[], transientRules, []],
+      kbCheckAfterLastStep: [],
+      rollbackWhen: "kb_check after the last step is not clean"
+    },
     steps: [
       {
         operation: "kb_upsert",
@@ -56439,9 +56681,9 @@ function buildGroundingReplacementPlan(requirementId, factId, predicatePlan, exi
     rollback: {
       operation: "kb_upsert",
       input: requirementUpsert(existing.map((row) => row.relationship)),
-      reason: "Only if the last step fails: restore the retracted grounding link so the claim is grounded again."
+      reason: `Only if kb_check after the last step is not clean (it still reports ${transientRules.join(" or ")} for ${requirementId}, or the step failed): restore the retracted grounding link so the claim is grounded again.`
     },
-    instructions: `Only replace the grounding when the predicate states the claim at least as precisely as ${existing.map((row) => row.factId).join(", ")}. Apply the steps unchanged, in order and back to back: linking requires_predicate before the retraction is rejected because the claim would have two groundings, and between the retraction and the link the claim is ungrounded, so kb_check reports logic-coverage for ${requirementId} until the last step lands. If the last step fails, apply rollback. Run kb_check after the last step.`
+    instructions: `Only replace the grounding when the predicate states the claim at least as precisely as ${existing.map((row) => row.factId).join(", ")}. Apply the steps unchanged, in order and back to back: linking requires_predicate before the retraction is rejected because the claim would have two groundings, and between the retraction and the link the claim is ungrounded and its subject unpaired, so kb_check reports both ${transientRules.join(" and ")} for ${requirementId} until the last step lands (see expected.kbCheckAfterStep). Run kb_check after the last step; if it is not clean, apply rollback.`
   };
 }
 async function executeSuggestPredicates(args, context) {
@@ -60351,7 +60593,7 @@ var require_gray_matter = __commonJS(function(exports2, module2) {
 });
 
 // ../cli/dist/public/skill-system/validation.js
-import { existsSync as existsSync24, readFileSync as readFileSync25, realpathSync as realpathSync7, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync26, realpathSync as realpathSync7, statSync as statSync9 } from "node:fs";
 import { dirname as dirname9, resolve as resolve15 } from "node:path";
 function assertMaxBytes(pathLike, maxBytes) {
   const size = statSync9(pathLike).size;
@@ -60361,7 +60603,7 @@ function assertMaxBytes(pathLike, maxBytes) {
 function parseSkillBundle(rootDir) {
   const path = resolve15(rootDir, SKILL_FILE_NAME);
   assertMaxBytes(path, SKILL_MARKDOWN_MAX_BYTES);
-  const parsed = import_gray_matter.default(readFileSync25(path, "utf8"));
+  const parsed = import_gray_matter.default(readFileSync26(path, "utf8"));
   const [error] = validateManifestData(parsed.data);
   if (error)
     throw error;
@@ -60425,9 +60667,9 @@ var init_validation3 = __esm(() => {
 });
 
 // ../cli/dist/public/skill-system/loader.js
-import { existsSync as existsSync25, readFileSync as readFileSync26, readdirSync as readdirSync7, realpathSync as realpathSync8 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync27, readdirSync as readdirSync7, realpathSync as realpathSync8 } from "node:fs";
 import { dirname as dirname10, join as join18, resolve as resolve16 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function listBundledSkills() {
   return listFrom(bundledSkillsDir);
 }
@@ -60472,14 +60714,14 @@ function readBundle(bundle, id, resourcePath) {
     throw new SkillResourceNotFoundError(id, resourcePath);
   }
   assertMaxBytes(candidate, RESOURCE_MAX_BYTES);
-  return readFileSync26(candidate, "utf8");
+  return readFileSync27(candidate, "utf8");
 }
 var defaultBundledSkillsDir, bundledSkillsDir;
 var init_loader = __esm(() => {
   init_errors();
   init_paths();
   init_validation3();
-  defaultBundledSkillsDir = resolve16(dirname10(fileURLToPath3(import.meta.url)), "../skills");
+  defaultBundledSkillsDir = resolve16(dirname10(fileURLToPath4(import.meta.url)), "../skills");
   bundledSkillsDir = defaultBundledSkillsDir;
 });
 
@@ -62272,17 +62514,17 @@ var init_audit = __esm(() => {
 import { createHash as createHash27 } from "node:crypto";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs6 from "node:fs";
-import path50 from "node:path";
+import path51 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
 function digest3(value) {
   return createHash27("sha256").update(value).digest("hex");
 }
 function pendingReceiptPath(workspaceRoot, relativePath) {
-  return path50.join(workspaceRoot, ".kb", "recovery", "pending-sources", `${digest3(relativePath)}.json`);
+  return path51.join(workspaceRoot, ".kb", "recovery", "pending-sources", `${digest3(relativePath)}.json`);
 }
 function writePendingSourceReceipt(workspaceRoot, relativePath, afterHash) {
   const receiptPath = pendingReceiptPath(workspaceRoot, relativePath);
-  fs6.mkdirSync(path50.dirname(receiptPath), { recursive: true, mode: 448 });
+  fs6.mkdirSync(path51.dirname(receiptPath), { recursive: true, mode: 448 });
   fs6.writeFileSync(receiptPath, `${JSON.stringify({
     version: 1,
     path: relativePath,
@@ -62310,34 +62552,34 @@ function authoredPath(value) {
   return normalized;
 }
 function resolveContainedSourcePath(workspaceRoot, relative) {
-  if (path50.isAbsolute(relative) || relative.split(/[\\/]/).some((part) => part === ".." || part === "")) {
+  if (path51.isAbsolute(relative) || relative.split(/[\\/]/).some((part) => part === ".." || part === "")) {
     throw new OperationError("SOURCE_PATH_INVALID", `document.path must be a workspace-relative path without traversal: ${relative}`);
   }
-  const absolute = path50.resolve(workspaceRoot, relative);
-  const root = path50.resolve(workspaceRoot);
-  if (absolute !== root && !absolute.startsWith(`${root}${path50.sep}`)) {
+  const absolute = path51.resolve(workspaceRoot, relative);
+  const root = path51.resolve(workspaceRoot);
+  if (absolute !== root && !absolute.startsWith(`${root}${path51.sep}`)) {
     throw new OperationError("SOURCE_PATH_INVALID", `document.path escapes the workspace: ${relative}`);
   }
-  const workspaceRelative = path50.relative(root, absolute).replaceAll(path50.sep, "/");
+  const workspaceRelative = path51.relative(root, absolute).replaceAll(path51.sep, "/");
   if (isDerivedKbPath(workspaceRelative)) {
     throw new OperationError("SOURCE_PATH_INVALID", `document.path cannot target Kibi's derived state under ${workspaceRelative}: ${relative}`);
   }
   const realRoot = canonicalFilesystemPath(root);
   const real = canonicalFilesystemPath(absolute);
-  if (real !== realRoot && !real.startsWith(`${realRoot}${path50.sep}`)) {
+  if (real !== realRoot && !real.startsWith(`${realRoot}${path51.sep}`)) {
     throw new OperationError("SOURCE_PATH_INVALID", `document.path resolves outside the workspace: ${relative}`);
   }
   return absolute;
 }
 function normalizeAuthoredSourcePath(workspaceRoot, source) {
   const normalized = source.replaceAll("\\", "/");
-  const root = path50.resolve(workspaceRoot);
+  const root = path51.resolve(workspaceRoot);
   let relative = normalized;
-  if (path50.isAbsolute(normalized)) {
-    const absolute = path50.resolve(normalized);
-    relative = absolute === root || absolute.startsWith(`${root}${path50.sep}`) ? path50.relative(root, absolute) : path50.relative(canonicalFilesystemPath(root), canonicalFilesystemPath(absolute));
+  if (path51.isAbsolute(normalized)) {
+    const absolute = path51.resolve(normalized);
+    relative = absolute === root || absolute.startsWith(`${root}${path51.sep}`) ? path51.relative(root, absolute) : path51.relative(canonicalFilesystemPath(root), canonicalFilesystemPath(absolute));
   }
-  return path50.relative(path50.resolve(workspaceRoot), resolveContainedSourcePath(workspaceRoot, relative)).replaceAll(path50.sep, "/");
+  return path51.relative(path51.resolve(workspaceRoot), resolveContainedSourcePath(workspaceRoot, relative)).replaceAll(path51.sep, "/");
 }
 function bodyAndFrontmatter(content) {
   if (!content.startsWith("---"))
@@ -62383,13 +62625,13 @@ function sourcePath(context, input, entity, existing) {
   if (!relative) {
     throw new OperationError("DOCUMENT_PATH_REQUIRED", `No writable source target is available for ${input.type}; provide document.path explicitly`);
   }
-  if (path50.isAbsolute(relative)) {
-    const root = path50.resolve(context.workspaceRoot);
-    const absolute = path50.resolve(relative);
-    if (absolute !== root && !absolute.startsWith(`${root}${path50.sep}`)) {
+  if (path51.isAbsolute(relative)) {
+    const root = path51.resolve(context.workspaceRoot);
+    const absolute = path51.resolve(relative);
+    if (absolute !== root && !absolute.startsWith(`${root}${path51.sep}`)) {
       throw new OperationError("SOURCE_PATH_INVALID", `document.path resolves outside the workspace: ${relative}`);
     }
-    relative = path50.relative(root, absolute).replaceAll(path50.sep, "/");
+    relative = path51.relative(root, absolute).replaceAll(path51.sep, "/");
   }
   return resolveContainedSourcePath(context.workspaceRoot, relative);
 }
@@ -62608,7 +62850,7 @@ function renderSymbolManifest(entity, relationships, existingContent) {
   return doc.toString(AUTHORED_YAML_OPTIONS);
 }
 function renderSourceDeletion(sourcePathValue, entityId, entityType, existingContent) {
-  const extension = path50.extname(sourcePathValue).toLowerCase();
+  const extension = path51.extname(sourcePathValue).toLowerCase();
   if (extension === ".md" || extension === ".mdx") {
     const parsed = bodyAndFrontmatter(existingContent);
     if (String(parsed.frontmatter.id ?? "") !== entityId) {
@@ -62638,7 +62880,7 @@ function renderSourceDeletion(sourcePathValue, entityId, entityType, existingCon
   throw new OperationError("SOURCE_FORMAT_UNSUPPORTED", `Unsupported authored source format: ${extension || "unknown"}`);
 }
 function renderMarkdownRelationshipDeletion(sourcePathValue, existingContent, selector) {
-  const extension = path50.extname(sourcePathValue).toLowerCase();
+  const extension = path51.extname(sourcePathValue).toLowerCase();
   if (extension !== ".md" && extension !== ".mdx") {
     throw new OperationError("SOURCE_FORMAT_UNSUPPORTED", `Relationship declarations can only be patched in Markdown documents: ${sourcePathValue}`);
   }
@@ -62697,7 +62939,7 @@ ${frontmatter.toString(AUTHORED_YAML_OPTIONS)}---${body.startsWith(`
   };
 }
 function renderYamlRelationshipDeletion(sourcePathValue, existingContent, selector) {
-  const extension = path50.extname(sourcePathValue).toLowerCase();
+  const extension = path51.extname(sourcePathValue).toLowerCase();
   if (extension !== ".yaml" && extension !== ".yml") {
     throw new OperationError("SOURCE_FORMAT_UNSUPPORTED", `Relationship declarations can only be patched in YAML symbol manifests: ${sourcePathValue}`);
   }
@@ -62740,7 +62982,7 @@ function renderYamlRelationshipDeletion(sourcePathValue, existingContent, select
   return removed ? { body: doc.toString(AUTHORED_YAML_OPTIONS), removed: true } : { body: existingContent, removed: false };
 }
 function renderSourceDocument(input, entity, existingContent, relativePath) {
-  const extension = path50.extname(relativePath).toLowerCase();
+  const extension = path51.extname(relativePath).toLowerCase();
   if (extension === ".yaml" || extension === ".yml") {
     if (input.type !== "symbol") {
       throw new OperationError("SOURCE_FORMAT_UNSUPPORTED", `YAML source authoring is supported only for symbol manifests, not ${input.type}`);
@@ -62756,7 +62998,7 @@ async function writeSourceForUpsert(input, entity, existing, context, sourceDocu
   if (!context?.fs)
     return null;
   const absolute = sourcePath(context, input, entity, existing);
-  const relative = path50.relative(context.workspaceRoot, absolute).replaceAll("\\", "/");
+  const relative = path51.relative(context.workspaceRoot, absolute).replaceAll("\\", "/");
   let before;
   try {
     before = await context.fs.readFile(absolute);
@@ -62764,7 +63006,7 @@ async function writeSourceForUpsert(input, entity, existing, context, sourceDocu
     before = undefined;
   }
   const after = before !== undefined && sourceDocumentOverride !== undefined ? sourceDocumentOverride : renderSourceDocument(input, entity, before, relative);
-  await context.fs.mkdir(path50.dirname(absolute));
+  await context.fs.mkdir(path51.dirname(absolute));
   const temporary = `${absolute}.kibi-source-${process.pid}-${randomUUID2()}`;
   try {
     await context.fs.writeFile(temporary, after);
@@ -62848,7 +63090,7 @@ async function writeSourceForUpsert(input, entity, existing, context, sourceDocu
   return { receipt, rollback };
 }
 function canonicalSourcePath(context, input, entity, existing) {
-  return path50.relative(context.workspaceRoot, sourcePath(context, input, entity, existing)).replaceAll(path50.sep, "/");
+  return path51.relative(context.workspaceRoot, sourcePath(context, input, entity, existing)).replaceAll(path51.sep, "/");
 }
 var AUTHORED_YAML_OPTIONS, GENERATED_SYMBOL_FIELDS;
 var init_source_authoring = __esm(() => {
@@ -62870,8 +63112,8 @@ var init_source_authoring = __esm(() => {
 
 // ../cli/dist/operations/mutation/plan-apply-journal.js
 import { createHash as createHash28, randomUUID as randomUUID3 } from "node:crypto";
-import { closeSync as closeSync3, existsSync as existsSync26, fsyncSync as fsyncSync2, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync27, readdirSync as readdirSync8, renameSync as renameSync5, statSync as statSync10, unlinkSync as unlinkSync5, writeSync as writeSync2 } from "node:fs";
-import path51 from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync26, fsyncSync as fsyncSync2, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync28, readdirSync as readdirSync8, renameSync as renameSync5, statSync as statSync10, unlinkSync as unlinkSync5, writeSync as writeSync2 } from "node:fs";
+import path52 from "node:path";
 function planApplyJournalId(planHash) {
   return `plan-apply-${planHash.slice(0, 16).toLowerCase()}`;
 }
@@ -62888,8 +63130,8 @@ function journalLocation(context) {
   const attachment = context.branchAttachment ?? resolveBranchAttachment(context.workspaceRoot);
   if ("error" in attachment)
     return null;
-  const storeDirectory = path51.join(attachment.storePath, JOURNAL_DIRECTORY);
-  const fallback = path51.join(path51.resolve(context.workspaceRoot), ".kb", "recovery", JOURNAL_DIRECTORY, branchStoreKey(attachment.kbBranch));
+  const storeDirectory = path52.join(attachment.storePath, JOURNAL_DIRECTORY);
+  const fallback = path52.join(path52.resolve(context.workspaceRoot), ".kb", "recovery", JOURNAL_DIRECTORY, branchStoreKey(attachment.kbBranch));
   let storeReady = false;
   try {
     storeReady = statSync10(attachment.storePath).isDirectory() && existsSync26(branchStoreManifestPath(attachment.storePath));
@@ -62915,7 +63157,7 @@ function fsyncDirectory(directory) {
   } catch {}
 }
 function writeJournal(journalPath, journal) {
-  const directory = path51.dirname(journalPath);
+  const directory = path52.dirname(journalPath);
   mkdirSync8(directory, { recursive: true, mode: 448 });
   const temporary = `${journalPath}.tmp-${process.pid}-${randomUUID3()}`;
   try {
@@ -62945,7 +63187,7 @@ function isFileWrite(value) {
   const entry = value;
   const before = entry.before;
   const after = entry.after;
-  return typeof entry.path === "string" && entry.path !== "" && !path51.isAbsolute(entry.path) && !entry.path.split(/[\\/]/).includes("..") && (entry.origin === "plan" || entry.origin === "entity-document" || entry.origin === "relationship-shard") && (entry.mode === "write" || entry.mode === "delete") && (before === null ? entry.beforeHash === null : typeof before === "string" && entry.beforeHash === contentHash(before)) && (after === null ? entry.afterHash === null : typeof after === "string" && entry.afterHash === contentHash(after)) && entry.mode === "delete" === (after === null);
+  return typeof entry.path === "string" && entry.path !== "" && !path52.isAbsolute(entry.path) && !entry.path.split(/[\\/]/).includes("..") && (entry.origin === "plan" || entry.origin === "entity-document" || entry.origin === "relationship-shard") && (entry.mode === "write" || entry.mode === "delete") && (before === null ? entry.beforeHash === null : typeof before === "string" && entry.beforeHash === contentHash(before)) && (after === null ? entry.afterHash === null : typeof after === "string" && entry.afterHash === contentHash(after)) && entry.mode === "delete" === (after === null);
 }
 function parseJournal(journalId, text) {
   const parsed = JSON.parse(text);
@@ -62965,10 +63207,10 @@ function unrecoverableJournal(journalPath, detail) {
   throw new OperationError("PARTIAL_COMMIT_REPAIR_REQUIRED", `Plan application journal ${journalPath} cannot be recovered automatically: ${detail}. Kibi will not apply or recover plans on this branch until it is resolved: restore each listed file to its journaled before or after bytes and retry, or reconcile the workspace and branch store by hand (kibi sync) and remove the journal`, false);
 }
 function readJournalFile(journalPath) {
-  const journalId = path51.basename(journalPath, ".json");
+  const journalId = path52.basename(journalPath, ".json");
   let text;
   try {
-    text = readFileSync27(journalPath, "utf8");
+    text = readFileSync28(journalPath, "utf8");
   } catch (error) {
     unrecoverableJournal(journalPath, `unreadable (${errorText(error)})`);
   }
@@ -62985,9 +63227,9 @@ function openPlanApplyJournal(context, planHash) {
   }
   const journalId = planApplyJournalId(planHash);
   let existing = null;
-  let journalPath = path51.join(location.primary, `${journalId}.json`);
+  let journalPath = path52.join(location.primary, `${journalId}.json`);
   for (const directory of location.all) {
-    const candidate = path51.join(directory, `${journalId}.json`);
+    const candidate = path52.join(directory, `${journalId}.json`);
     if (existsSync26(candidate)) {
       existing = readJournalFile(candidate);
       journalPath = candidate;
@@ -63028,7 +63270,7 @@ async function currentHash(fsPort, absolute) {
   }
 }
 async function publishWorkspaceFile(fsPort, absolute, content) {
-  await fsPort.mkdir(path51.dirname(absolute));
+  await fsPort.mkdir(path52.dirname(absolute));
   if (fsPort.rename) {
     const staged = `${absolute}.kibi-stage-${process.pid}-${randomUUID3()}`;
     try {
@@ -63049,7 +63291,7 @@ async function publishWorkspaceFile(fsPort, absolute, content) {
       await fsPort.fsync(absolute);
   }
   if (fsPort.fsync)
-    await fsPort.fsync(path51.dirname(absolute)).catch(() => {
+    await fsPort.fsync(path52.dirname(absolute)).catch(() => {
       return;
     });
 }
@@ -63064,12 +63306,12 @@ async function removeWorkspaceFile(fsPort, absolute, relative) {
       throw error;
   }
   if (fsPort.fsync)
-    await fsPort.fsync(path51.dirname(absolute)).catch(() => {
+    await fsPort.fsync(path52.dirname(absolute)).catch(() => {
       return;
     });
 }
 async function setFile(fsPort, workspaceRoot, relative, content) {
-  const absolute = path51.resolve(workspaceRoot, relative);
+  const absolute = path52.resolve(workspaceRoot, relative);
   if (content === null)
     await removeWorkspaceFile(fsPort, absolute, relative);
   else
@@ -63084,7 +63326,7 @@ async function moveJournaledFiles(fsPort, workspaceRoot, journalPath, files, sid
   const pending = [];
   const conflicts = [];
   for (const file of files) {
-    const actual = await currentHash(fsPort, path51.resolve(workspaceRoot, file.path));
+    const actual = await currentHash(fsPort, path52.resolve(workspaceRoot, file.path));
     const wanted = side === "before" ? file.beforeHash : file.afterHash;
     if (actual === wanted)
       continue;
@@ -63106,11 +63348,11 @@ async function moveJournaledFiles(fsPort, workspaceRoot, journalPath, files, sid
 }
 function removeOrphanedStagedFiles(workspaceRoot, files) {
   for (const file of files) {
-    const absolute = path51.resolve(workspaceRoot, file.path);
-    const prefix = `${path51.basename(absolute)}.kibi-stage-`;
+    const absolute = path52.resolve(workspaceRoot, file.path);
+    const prefix = `${path52.basename(absolute)}.kibi-stage-`;
     let names;
     try {
-      names = readdirSync8(path51.dirname(absolute));
+      names = readdirSync8(path52.dirname(absolute));
     } catch {
       continue;
     }
@@ -63118,7 +63360,7 @@ function removeOrphanedStagedFiles(workspaceRoot, files) {
       if (!name.startsWith(prefix))
         continue;
       try {
-        unlinkSync5(path51.join(path51.dirname(absolute), name));
+        unlinkSync5(path52.join(path52.dirname(absolute), name));
       } catch {}
     }
   }
@@ -63232,7 +63474,7 @@ function openPlanApplyJournalById(context, journalId) {
     throw new Error("Plan journal recovery failed: the KB branch could not be resolved");
   }
   for (const directory of location.all) {
-    const candidate = path51.join(directory, `${journalId}.json`);
+    const candidate = path52.join(directory, `${journalId}.json`);
     if (existsSync26(candidate)) {
       return { journalPath: candidate, journal: readJournalFile(candidate) };
     }
@@ -63255,7 +63497,7 @@ async function recoverPendingPlanApplyJournals(context, options2) {
     }
     for (const name of names) {
       if (name.endsWith(".json") && isPlanApplyJournalId(name.slice(0, -5))) {
-        candidates.push(path51.join(directory, name));
+        candidates.push(path52.join(directory, name));
       }
     }
   }
@@ -63322,10 +63564,10 @@ async function saveAtomicMutation(prolog, goals, operation) {
 }
 
 // ../cli/dist/operations/mutation/workspace-mutation-lock.js
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync28, renameSync as renameSync6, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import * as path52 from "node:path";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync29, renameSync as renameSync6, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import * as path53 from "node:path";
 function lockPath(workspaceRoot, lockFileRelative) {
-  return path52.join(workspaceRoot, lockFileRelative);
+  return path53.join(workspaceRoot, lockFileRelative);
 }
 function randomToken() {
   return `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
@@ -63379,7 +63621,7 @@ function removeLockDirectory(fileSystem, target) {
   const result = retryTransientFilesystemOperation(() => fileSystem.rmdirSync(target));
   if (result.ok)
     return;
-  const ownerPath = path52.join(target, OWNER_FILE);
+  const ownerPath = path53.join(target, OWNER_FILE);
   throw new WorkspaceMutationLockError(`failed to remove workspace mutation lock directory at ${target} after ${result.attempts} attempt(s): ${errorDetail(result.error)}; lock remains fail-closed. ${manualCleanupGuidance(target, ownerPath)}`);
 }
 function removeLockOwner(fileSystem, target, ownerPath, ignoreMissing) {
@@ -63450,7 +63692,7 @@ function reclaimDeadLock(fileSystem, target, holder, token) {
       return "changed";
     throw new WorkspaceMutationLockError(`failed to reclaim workspace mutation lock at ${target} from dead pid ${holder.pid}: ${errorDetail(error)}`);
   }
-  const tombstoneOwner = path52.join(tombstone, OWNER_FILE);
+  const tombstoneOwner = path53.join(tombstone, OWNER_FILE);
   let moved = null;
   try {
     moved = readLockRecord(fileSystem.readFileSync(tombstoneOwner));
@@ -63511,10 +63753,10 @@ async function acquireWorkspaceMutationLock(workspaceRoot, options2 = {}) {
   const fileSystem = options2.fileSystem ?? NODE_FILE_SYSTEM;
   const isProcessAlive = options2.isProcessAlive ?? defaultIsProcessAlive;
   const target = lockPath(workspaceRoot, options2.lockFileRelative ?? DEFAULT_LOCK_FILE_RELATIVE);
-  const ownerPath = path52.join(target, OWNER_FILE);
+  const ownerPath = path53.join(target, OWNER_FILE);
   const token = randomToken();
   const deadline = now() + timeoutMs;
-  const parentPath = path52.dirname(target);
+  const parentPath = path53.dirname(target);
   const parentResult = retryTransientFilesystemOperation(() => fileSystem.mkdirSync(parentPath, { recursive: true }));
   if (!parentResult.ok) {
     throw new WorkspaceMutationLockError(`failed to create workspace mutation lock parent at ${parentPath} after ${parentResult.attempts} attempt(s): ${errorDetail(parentResult.error)}`);
@@ -63637,12 +63879,12 @@ async function acquireWorkspaceMutationLock(workspaceRoot, options2 = {}) {
 var DEFAULT_LOCK_FILE_RELATIVE, OWNER_FILE = "owner.json", DEFAULT_TIMEOUT_MS = 15000, RETRY_INTERVAL_MS = 25, MAX_RELEASE_FILESYSTEM_ATTEMPTS = 3, MAX_MISSING_OWNER_REREADS = 4, NODE_FILE_SYSTEM, WorkspaceMutationLockError;
 var init_workspace_mutation_lock = __esm(() => {
   init_cli_errors();
-  DEFAULT_LOCK_FILE_RELATIVE = path52.join(".kb", "recovery", "source-authoring.lock");
+  DEFAULT_LOCK_FILE_RELATIVE = path53.join(".kb", "recovery", "source-authoring.lock");
   NODE_FILE_SYSTEM = {
     mkdirSync: (target, options2) => {
       mkdirSync9(target, options2);
     },
-    readFileSync: (target) => readFileSync28(target, "utf8"),
+    readFileSync: (target) => readFileSync29(target, "utf8"),
     writeFileSync: (target, data, options2) => {
       writeFileSync8(target, data, options2);
     },
@@ -63657,8 +63899,8 @@ var init_workspace_mutation_lock = __esm(() => {
 
 // ../cli/dist/operations/mutation/delete.js
 import { createHash as createHash29, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync27, readFileSync as readFileSync29, writeFileSync as writeFileSync9 } from "node:fs";
-import path53 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync30, writeFileSync as writeFileSync9 } from "node:fs";
+import path54 from "node:path";
 function requireProlog3(context) {
   if (context.prolog === undefined)
     throw new Error("Delete operation requires a Prolog runtime");
@@ -63694,7 +63936,7 @@ function sourceIsAuthored(source) {
 function fileHash(pathname) {
   if (!existsSync27(pathname))
     return null;
-  return createHash29("sha256").update(readFileSync29(pathname)).digest("hex");
+  return createHash29("sha256").update(readFileSync30(pathname)).digest("hex");
 }
 async function executeRelationshipDeleteUnlocked(selectors, context, onCommitted = () => {
   return;
@@ -63710,7 +63952,7 @@ async function executeRelationshipDeleteUnlocked(selectors, context, onCommitted
   if (attachment.migrationRequired && (context.branchAttachment !== undefined || context.fs !== undefined)) {
     throw new Error(`Delete blocked: migrate legacy branch storage first with 'kibi branch migrate --from ${attachment.kbBranch} --to ${attachment.gitBranch} --apply'`);
   }
-  const shardRoot = path53.join(context.workspaceRoot, ".kb");
+  const shardRoot = path54.join(context.workspaceRoot, ".kb");
   let shardRecords = [];
   try {
     shardRecords = readAllShards(shardRoot);
@@ -63789,7 +64031,7 @@ async function executeRelationshipDeleteUnlocked(selectors, context, onCommitted
     };
   const originalShardBytes = new Map(listShards(shardRoot).map((shardPath) => [
     shardPath,
-    readFileSync29(shardPath, "utf8")
+    readFileSync30(shardPath, "utf8")
   ]));
   const originalShardHashes = new Map(listShards(shardRoot).map((shardPath) => [shardPath, fileHash(shardPath)]));
   let shardRemovals;
@@ -63808,7 +64050,7 @@ async function executeRelationshipDeleteUnlocked(selectors, context, onCommitted
   const writeSourcePatch = async (relative, body) => {
     assertFilesystemCapableRuntime(context.fs);
     const absolute = resolveContainedSourcePath(context.workspaceRoot, relative);
-    await context.fs.mkdir(path53.dirname(absolute));
+    await context.fs.mkdir(path54.dirname(absolute));
     const temporary = `${absolute}.kibi-relationship-${process.pid}-${randomUUID4()}`;
     try {
       await context.fs.writeFile(temporary, body);
@@ -63873,7 +64115,7 @@ async function executeRelationshipDeleteUnlocked(selectors, context, onCommitted
     const after = fileHash(shardPath);
     if (before === after)
       return [];
-    const relative = path53.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
+    const relative = path54.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
     if (after !== null) {
       writePendingSourceReceipt(context.workspaceRoot, relative, after);
     }
@@ -64009,7 +64251,7 @@ async function executeDelete(input, context) {
           authoredRequirementIds.push(id);
         if (context.fs) {
           const relativeSource = normalizeAuthoredSourcePath(context.workspaceRoot, source);
-          const sourcePath = path53.join(context.workspaceRoot, relativeSource);
+          const sourcePath = path54.join(context.workspaceRoot, relativeSource);
           try {
             const original = sourceBodies.get(relativeSource) ?? await context.fs.readFile(sourcePath);
             if (!sourceBodies.has(relativeSource)) {
@@ -64041,12 +64283,12 @@ async function executeDelete(input, context) {
     if (authoredIds.length > 0 && context.sourcePlanApplication !== true) {
       if (context.fs) {
         const deleted = new Set(authoredIds);
-        for (const shardPath of listShards(path53.join(context.workspaceRoot, ".kb"))) {
+        for (const shardPath of listShards(path54.join(context.workspaceRoot, ".kb"))) {
           const selectors = readShard(shardPath).filter((record) => deleted.has(record.from)).map(({ type, from, to }) => ({ type, from, to }));
           if (selectors.length === 0)
             continue;
-          const relativeShard = path53.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
-          const original = readFileSync29(shardPath, "utf8");
+          const relativeShard = path54.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
+          const original = readFileSync30(shardPath, "utf8");
           const body = renderShardWithout(original, selectors, shardPath);
           const beforeHash = createHash29("sha256").update(original).digest("hex");
           sourceHashes[relativeShard] = beforeHash;
@@ -64144,13 +64386,13 @@ var init_delete = __esm(() => {
 });
 
 // ../cli/dist/operations/mutation/context-warning.js
-import { readFileSync as readFileSync30 } from "node:fs";
-import path54 from "node:path";
+import { readFileSync as readFileSync31 } from "node:fs";
+import path55 from "node:path";
 function readBody(workspaceRoot, source) {
   if (typeof source !== "string" || !source.endsWith(".md"))
     return;
   try {
-    return readAuthoredEntity(readFileSync30(path54.resolve(workspaceRoot, source), "utf8"), source)?.body ?? undefined;
+    return readAuthoredEntity(readFileSync31(path55.resolve(workspaceRoot, source), "utf8"), source)?.body ?? undefined;
   } catch {
     return;
   }
@@ -64190,7 +64432,7 @@ var init_context_warning = __esm(() => {
 });
 
 // ../cli/dist/operations/mutation/symbol-granularity.js
-import path55 from "node:path";
+import path56 from "node:path";
 import { collectGranularityCandidates } from "kibi-plugin-builtin";
 function candidate(name, kind) {
   return { name, kind, role: inferSymbolRole(kind) };
@@ -64215,7 +64457,7 @@ async function validateSymbolGranularity(entity, relationships, context) {
   const fs = context.fs;
   if (fs === undefined)
     return;
-  const sourcePath = path55.isAbsolute(entity.sourceFile) ? entity.sourceFile : path55.resolve(context.workspaceRoot, entity.sourceFile);
+  const sourcePath = path56.isAbsolute(entity.sourceFile) ? entity.sourceFile : path56.resolve(context.workspaceRoot, entity.sourceFile);
   let content;
   try {
     const stat = await fs.stat(sourcePath);
@@ -64547,10 +64789,10 @@ var init_saga = __esm(() => {
 });
 
 // ../cli/dist/operations/mutation/symbol-compiler-lock.js
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync31, rmdirSync as rmdirSync2, unlinkSync as unlinkSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import * as path56 from "node:path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync32, rmdirSync as rmdirSync2, unlinkSync as unlinkSync7, writeFileSync as writeFileSync10 } from "node:fs";
+import * as path57 from "node:path";
 function lockPath2(workspaceRoot) {
-  return path56.join(workspaceRoot, LOCK_FILE_RELATIVE);
+  return path57.join(workspaceRoot, LOCK_FILE_RELATIVE);
 }
 function randomToken2() {
   return `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
@@ -64604,7 +64846,7 @@ function removeLockDirectory2(fileSystem, target) {
   const result = retryTransientFilesystemOperation2(() => fileSystem.rmdirSync(target));
   if (result.ok)
     return;
-  const ownerPath = path56.join(target, OWNER_FILE2);
+  const ownerPath = path57.join(target, OWNER_FILE2);
   throw new SymbolCompilerLockError(`failed to remove symbol compiler lock directory at ${target} after ${result.attempts} attempt(s): ${errorDetail2(result.error)}; lock remains fail-closed. ${manualCleanupGuidance2(target, ownerPath)}`);
 }
 function removeLockOwner2(fileSystem, target, ownerPath, ignoreMissing) {
@@ -64693,10 +64935,10 @@ async function acquireSymbolCompilerLock(workspaceRoot, options2 = {}) {
   const fileSystem = options2.fileSystem ?? NODE_FILE_SYSTEM2;
   const isProcessAlive = options2.isProcessAlive ?? defaultIsProcessAlive2;
   const target = lockPath2(workspaceRoot);
-  const ownerPath = path56.join(target, OWNER_FILE2);
+  const ownerPath = path57.join(target, OWNER_FILE2);
   const token = randomToken2();
   const deadline = now() + timeoutMs;
-  const parentPath = path56.dirname(target);
+  const parentPath = path57.dirname(target);
   const parentResult = retryTransientFilesystemOperation2(() => fileSystem.mkdirSync(parentPath, { recursive: true }));
   if (!parentResult.ok) {
     throw new SymbolCompilerLockError(`failed to create symbol compiler lock parent at ${parentPath} after ${parentResult.attempts} attempt(s): ${errorDetail2(parentResult.error)}`);
@@ -64799,12 +65041,12 @@ async function withSymbolCompilerLock(workspaceRoot, operation, options2 = {}) {
 var LOCK_FILE_RELATIVE, OWNER_FILE2 = "owner.json", DEFAULT_TIMEOUT_MS2 = 15000, RETRY_INTERVAL_MS2 = 25, MAX_RELEASE_FILESYSTEM_ATTEMPTS2 = 3, NODE_FILE_SYSTEM2, SymbolCompilerLockError;
 var init_symbol_compiler_lock = __esm(() => {
   init_cli_errors();
-  LOCK_FILE_RELATIVE = path56.join(".kb", ".symbol-compiler.lock");
+  LOCK_FILE_RELATIVE = path57.join(".kb", ".symbol-compiler.lock");
   NODE_FILE_SYSTEM2 = {
     mkdirSync: (target, options2) => {
       mkdirSync10(target, options2);
     },
-    readFileSync: (target) => readFileSync31(target, "utf8"),
+    readFileSync: (target) => readFileSync32(target, "utf8"),
     writeFileSync: (target, data, options2) => {
       writeFileSync10(target, data, options2);
     },
@@ -64818,7 +65060,7 @@ var init_symbol_compiler_lock = __esm(() => {
 
 // ../cli/dist/extractors/symbols-coordinator.js
 import * as fs7 from "node:fs";
-import * as path57 from "node:path";
+import * as path58 from "node:path";
 function analyzeSourceText(filePathOrEntries, contentOrWorkspaceRoot, optionsOrDeps) {
   if (Array.isArray(filePathOrEntries)) {
     return enrichSymbolCoordinates(filePathOrEntries, contentOrWorkspaceRoot, optionsOrDeps);
@@ -64859,13 +65101,13 @@ async function enrichSymbolCoordinates(entries, workspaceRoot, deps) {
     const resolved = resolveSourcePath(entry.sourceFile, workspaceRoot);
     if (!resolved || !fs7.statSync(resolved.absolutePath).isFile())
       continue;
-    const ext = path57.extname(resolved.absolutePath).toLowerCase();
+    const ext = path58.extname(resolved.absolutePath).toLowerCase();
     if (isTsJsSourcePath(resolved.absolutePath)) {
       tsIndices.push(index);
       tsEntries.push(entry);
       continue;
     }
-    const logicalPath = path57.relative(workspaceRoot, resolved.absolutePath).replaceAll("\\", "/");
+    const logicalPath = path58.relative(workspaceRoot, resolved.absolutePath).replaceAll("\\", "/");
     let analysis = analyses.get(logicalPath);
     const firstAnalysis = analysis === undefined;
     if (!analysis) {
@@ -64954,7 +65196,7 @@ function enrichWithRegexHeuristic(entry, absolutePath) {
 function resolveSourcePath(sourceFile, workspaceRoot) {
   if (!sourceFile)
     return null;
-  const absolutePath = path57.isAbsolute(sourceFile) ? sourceFile : path57.resolve(workspaceRoot, sourceFile);
+  const absolutePath = path58.isAbsolute(sourceFile) ? sourceFile : path58.resolve(workspaceRoot, sourceFile);
   if (!fs7.existsSync(absolutePath))
     return null;
   return { absolutePath };
@@ -64981,9 +65223,9 @@ function detectSourceLanguage2(filePath) {
   return extensionLanguage(filePath);
 }
 function inferModuleTitle2(filePath) {
-  const extension = path57.extname(filePath);
-  const basename = path57.basename(filePath, extension);
-  return basename.length > 0 ? basename : path57.basename(filePath);
+  const extension = path58.extname(filePath);
+  const basename = path58.basename(filePath, extension);
+  return basename.length > 0 ? basename : path58.basename(filePath);
 }
 var DEFAULT_SOURCE_ANALYSIS_PROVIDERS;
 var init_symbols_coordinator = __esm(() => {
@@ -65003,8 +65245,8 @@ var init_symbols_coordinator2 = __esm(() => {
 
 // ../cli/dist/operations/mutation/symbol-refresh.js
 import { createHash as createHash30, randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync29, readFileSync as readFileSync33, renameSync as renameSync7, unlinkSync as unlinkSync8, writeFileSync as writeFileSync11 } from "node:fs";
-import * as path58 from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync34, renameSync as renameSync7, unlinkSync as unlinkSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import * as path59 from "node:path";
 function record2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -65015,15 +65257,15 @@ function coordinate(value) {
   return typeof sourceFile === "string" && typeof sourceLine === "number" && typeof sourceColumn === "number" && typeof sourceEndLine === "number" && typeof sourceEndColumn === "number" ? { sourceFile, sourceLine, sourceColumn, sourceEndLine, sourceEndColumn } : null;
 }
 async function manifestPath(context) {
-  return path58.join(context.workspaceRoot, CANONICAL_ENTITY_PATHS.symbols);
+  return path59.join(context.workspaceRoot, CANONICAL_ENTITY_PATHS.symbols);
 }
 function artifactPathFor(manifest) {
-  return path58.join(path58.dirname(manifest), "symbol-coordinates.yaml");
+  return path59.join(path59.dirname(manifest), "symbol-coordinates.yaml");
 }
 function sourceTextFor(sourceFile, workspaceRoot) {
-  const absolute = path58.isAbsolute(sourceFile) ? sourceFile : path58.resolve(workspaceRoot, sourceFile);
+  const absolute = path59.isAbsolute(sourceFile) ? sourceFile : path59.resolve(workspaceRoot, sourceFile);
   try {
-    return readFileSync33(absolute, "utf8");
+    return readFileSync34(absolute, "utf8");
   } catch {
     return null;
   }
@@ -65051,7 +65293,7 @@ function replaceArtifactAtomically(targetPath, content) {
   }
 }
 function publishArtifact(targetPath, content) {
-  const before = existsSync29(targetPath) ? readFileSync33(targetPath, "utf8") : null;
+  const before = existsSync29(targetPath) ? readFileSync34(targetPath, "utf8") : null;
   const beforeHash = before === null ? null : contentHash2(before);
   const afterHash = contentHash2(content);
   replaceArtifactAtomically(targetPath, content);
@@ -65063,7 +65305,7 @@ function publishArtifact(targetPath, content) {
       if (!existsSync29(targetPath)) {
         throw new CoordinateArtifactError(`coordinate artifact disappeared before rollback: ${targetPath}`);
       }
-      const current = readFileSync33(targetPath, "utf8");
+      const current = readFileSync34(targetPath, "utf8");
       if (contentHash2(current) !== afterHash) {
         throw new CoordinateArtifactError(`coordinate artifact changed after publication; refusing rollback: ${targetPath}`);
       }
@@ -65230,8 +65472,8 @@ var init_warnings = () => {};
 
 // ../cli/dist/operations/mutation/upsert.js
 import { createHash as createHash31 } from "node:crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync34, unlinkSync as unlinkSync9, writeFileSync as writeFileSync12 } from "node:fs";
-import path59 from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync35, unlinkSync as unlinkSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import path60 from "node:path";
 function requireProlog4(context) {
   if (context.prolog === undefined) {
     throw new Error("Upsert operation requires a Prolog runtime");
@@ -65250,21 +65492,21 @@ function parseChangeKind(value) {
 function fileHash2(pathname) {
   if (!existsSync30(pathname))
     return null;
-  return createHash31("sha256").update(readFileSync34(pathname)).digest("hex");
+  return createHash31("sha256").update(readFileSync35(pathname)).digest("hex");
 }
 function textHash(value) {
   return createHash31("sha256").update(value).digest("hex");
 }
 function assertRelationshipShardContained(workspaceRoot, shardPath) {
-  const root = path59.resolve(workspaceRoot);
-  const relationshipRoot = path59.resolve(root, ".kb", "relationships");
-  const absolute = path59.resolve(shardPath);
-  if (!absolute.startsWith(`${relationshipRoot}${path59.sep}`)) {
+  const root = path60.resolve(workspaceRoot);
+  const relationshipRoot = path60.resolve(root, ".kb", "relationships");
+  const absolute = path60.resolve(shardPath);
+  if (!absolute.startsWith(`${relationshipRoot}${path60.sep}`)) {
     throw new OperationError("SOURCE_PATH_INVALID", `Relationship shard escapes the canonical workspace lane: ${shardPath}`);
   }
   const realRoot = canonicalFilesystemPath(root);
   const real = canonicalFilesystemPath(absolute);
-  if (real !== realRoot && !real.startsWith(`${realRoot}${path59.sep}`)) {
+  if (real !== realRoot && !real.startsWith(`${realRoot}${path60.sep}`)) {
     throw new OperationError("SOURCE_PATH_INVALID", `Relationship shard follows a symlink outside the workspace: ${shardPath}`);
   }
 }
@@ -65277,7 +65519,7 @@ function restoreRelationshipShard(shardPath, before, expectedAfterHash) {
       currentHash = null;
     }
     if (currentHash !== expectedAfterHash) {
-      console.warn(`Skipped relationship shard rollback for ${path59.relative(process.cwd(), shardPath)}: shard changed after the Kibi write.`);
+      console.warn(`Skipped relationship shard rollback for ${path60.relative(process.cwd(), shardPath)}: shard changed after the Kibi write.`);
       return;
     }
   }
@@ -65327,7 +65569,7 @@ async function effectiveRelationships(input, entity, relationships, context, sta
   }
 }
 function reextractCanonicalSymbolEntity(symbolId, authoredRelativePath, workspaceRoot) {
-  const absoluteManifest = path59.resolve(workspaceRoot, authoredRelativePath);
+  const absoluteManifest = path60.resolve(workspaceRoot, authoredRelativePath);
   let records;
   try {
     records = readManifestWithCoordinateOverlay(absoluteManifest);
@@ -65463,12 +65705,12 @@ async function executeUpsert(input, context, options2 = {}) {
         const to = typeof relationship.to === "string" ? relationship.to : "";
         if (!type || !from || !to)
           continue;
-        const shardPath = computeShardPath(path59.join(context.workspaceRoot, ".kb"), from);
+        const shardPath = computeShardPath(path60.join(context.workspaceRoot, ".kb"), from);
         assertRelationshipShardContained(context.workspaceRoot, shardPath);
         if (!relationshipShardBefore.has(shardPath)) {
-          relationshipShardBefore.set(shardPath, existsSync30(shardPath) ? readFileSync34(shardPath, "utf8") : null);
+          relationshipShardBefore.set(shardPath, existsSync30(shardPath) ? readFileSync35(shardPath, "utf8") : null);
         }
-        appendRelationship(path59.join(context.workspaceRoot, ".kb"), {
+        appendRelationship(path60.join(context.workspaceRoot, ".kb"), {
           type,
           from,
           to,
@@ -65480,7 +65722,7 @@ async function executeUpsert(input, context, options2 = {}) {
       }
     }
     if (input.type === "symbol" && context.fs !== undefined && context.sourceFirst !== false && sourceWrite !== null) {
-      const refresh = await refreshSymbolCoordinatesForManifest(input.id, path59.resolve(context.workspaceRoot, sourceWrite.receipt.path), context);
+      const refresh = await refreshSymbolCoordinatesForManifest(input.id, path60.resolve(context.workspaceRoot, sourceWrite.receipt.path), context);
       const coordinatePublication = refresh.publication;
       if (coordinatePublication !== undefined) {
         saga.add({
@@ -65581,14 +65823,14 @@ async function executeUpsert(input, context, options2 = {}) {
       const expectedAfterHash = relationshipShardAfterHash.get(shardPath) ?? null;
       if (afterHash === null) {
         if (expectedAfterHash !== null) {
-          const relative = path59.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
+          const relative = path60.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
           shardWarnings.push(`Relationship shard vanished after write: ${relative}`);
         }
         continue;
       }
       if (afterHash === beforeHash)
         continue;
-      const relative = path59.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
+      const relative = path60.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
       writePendingSourceReceipt(context.workspaceRoot, relative, afterHash);
       relationshipSourceWrites.push({
         path: relative,
@@ -66433,15 +66675,15 @@ function formatSyncSummary(summary) {
 }
 
 // ../cli/dist/commands/sync/manifest.js
-import { existsSync as existsSync31, readFileSync as readFileSync35, renameSync as renameSync8, unlinkSync as unlinkSync10, writeFileSync as writeFileSync13 } from "node:fs";
-import * as path60 from "node:path";
+import { existsSync as existsSync31, readFileSync as readFileSync36, renameSync as renameSync8, unlinkSync as unlinkSync10, writeFileSync as writeFileSync13 } from "node:fs";
+import * as path61 from "node:path";
 function resolveDeps2(overrides) {
   return {
     dumpYAML: dump,
     enrichSymbolCoordinates,
     existsSync: existsSync31,
     parseYAML: load,
-    readFileSync: readFileSync35,
+    readFileSync: readFileSync36,
     renameSync: renameSync8,
     unlinkSync: unlinkSync10,
     writeFileSync: writeFileSync13,
@@ -66465,7 +66707,7 @@ function extractedCoordinates(entry) {
   } : null;
 }
 function readSourceText(sourceFile, workspaceRoot, deps) {
-  const absolute = path60.isAbsolute(sourceFile) ? sourceFile : path60.resolve(workspaceRoot, sourceFile);
+  const absolute = path61.isAbsolute(sourceFile) ? sourceFile : path61.resolve(workspaceRoot, sourceFile);
   if (!deps.existsSync(absolute))
     return null;
   try {
@@ -66618,9 +66860,9 @@ async function refreshManifestCoordinates(manifestPath, workspaceRoot, deps) {
   if (!deps?.quiet) {
     const counts = `(refreshed=${refreshed}, unchanged=${unchanged}, failed=${failures.length})`;
     if (coordinatesPath !== null) {
-      console.log(`✓ Refreshed symbol coordinates in ${path60.relative(workspaceRoot, coordinatesPath)} ${counts}`);
+      console.log(`✓ Refreshed symbol coordinates in ${path61.relative(workspaceRoot, coordinatesPath)} ${counts}`);
     } else {
-      console.log(`✓ Normalized symbol manifest ${path60.relative(workspaceRoot, manifestPath)} ${counts}`);
+      console.log(`✓ Normalized symbol manifest ${path61.relative(workspaceRoot, manifestPath)} ${counts}`);
     }
     const maxReportedFailures = 10;
     for (const failure of failures.slice(0, maxReportedFailures)) {
@@ -66641,7 +66883,7 @@ function isEligibleForCoordinateRefresh(sourceFile, workspaceRoot, deps) {
   const resolved = resolveDeps2(deps);
   if (!sourceFile)
     return false;
-  const absolute = path60.isAbsolute(sourceFile) ? sourceFile : path60.resolve(workspaceRoot, sourceFile);
+  const absolute = path61.isAbsolute(sourceFile) ? sourceFile : path61.resolve(workspaceRoot, sourceFile);
   return resolved.existsSync(absolute);
 }
 function isRecord16(value) {
@@ -66683,8 +66925,8 @@ var init_manifest3 = __esm(() => {
 
 // ../cli/dist/commands/sync/untracked-targets.js
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync32, readFileSync as readFileSync36 } from "node:fs";
-import * as path61 from "node:path";
+import { existsSync as existsSync32, readFileSync as readFileSync37 } from "node:fs";
+import * as path62 from "node:path";
 function findUntrackedDocumentMatches(workspaceRoot, missingIds, deps = {}) {
   const resolved = { ...defaultDeps3, ...deps };
   const matches = new Map;
@@ -66712,7 +66954,7 @@ function findUntrackedDocumentMatches(workspaceRoot, missingIds, deps = {}) {
       break;
     if (!relative.endsWith(".md"))
       continue;
-    const absolute = path61.resolve(workspaceRoot, relative.replaceAll("\\", "/"));
+    const absolute = path62.resolve(workspaceRoot, relative.replaceAll("\\", "/"));
     if (!resolved.existsSync(absolute))
       continue;
     let content;
@@ -66723,7 +66965,7 @@ function findUntrackedDocumentMatches(workspaceRoot, missingIds, deps = {}) {
     }
     const id = frontmatterId(content);
     if (id !== null && remaining.has(id)) {
-      const workspaceRelative = path61.relative(workspaceRoot, absolute).replaceAll("\\", "/");
+      const workspaceRelative = path62.relative(workspaceRoot, absolute).replaceAll("\\", "/");
       matches.set(id, workspaceRelative);
       remaining.delete(id);
     }
@@ -66751,12 +66993,12 @@ var init_untracked_targets = __esm(() => {
   defaultDeps3 = {
     execFileSync: (file, args, options2) => execFileSync7(file, args, options2),
     existsSync: existsSync32,
-    readFileSync: readFileSync36
+    readFileSync: readFileSync37
   };
 });
 
 // ../cli/dist/commands/sync/persistence.js
-import * as path62 from "node:path";
+import * as path63 from "node:path";
 function getEntityField(entity, field) {
   return entity[field];
 }
@@ -66834,8 +67076,8 @@ function sourceLookupCandidates(sourceFile) {
   return [
     ...new Set([
       sourceFile,
-      path62.relative(process.cwd(), sourceFile),
-      path62.basename(sourceFile)
+      path63.relative(process.cwd(), sourceFile),
+      path63.basename(sourceFile)
     ])
   ];
 }
@@ -67123,7 +67365,7 @@ async function persistEntities(prolog, results, entityIds, options2 = {}) {
   return { entityCount, kbModified };
 }
 function semanticEntityContext(entity, sourceFile) {
-  const displaySource = path62.isAbsolute(sourceFile) ? path62.relative(process.cwd(), sourceFile) : sourceFile;
+  const displaySource = path63.isAbsolute(sourceFile) ? path63.relative(process.cwd(), sourceFile) : sourceFile;
   const details = [`source=${displaySource}`];
   if (entity.type === "fact") {
     const factKind = getEntityField(entity, "fact_kind");
@@ -67144,7 +67386,7 @@ async function persistRelationships(prolog, results, shardRelationships, options
   let kbModified = false;
   const idLookup = new Map;
   for (const { entity } of results) {
-    const filename = path62.basename(entity.source, ".md");
+    const filename = path63.basename(entity.source, ".md");
     idLookup.set(filename, entity.id);
     idLookup.set(entity.id, entity.id);
   }
@@ -67342,7 +67584,7 @@ var init_persistence = __esm(() => {
 // ../cli/dist/commands/sync/staging.js
 import { existsSync as existsSync33, mkdirSync as mkdirSync11, renameSync as renameSync9, rmSync as rmSync4, writeFileSync as writeFileSync14 } from "node:fs";
 import { copyFileSync as copyFileSync2 } from "node:fs";
-import * as path63 from "node:path";
+import * as path64 from "node:path";
 function resolveDeps3(overrides) {
   return {
     copyCleanSnapshot,
@@ -67367,15 +67609,15 @@ function resolveDeps3(overrides) {
   };
 }
 function createUniqueStagingPath(currentBranch, rootDir, pid = process.pid, now = Date.now()) {
-  return path63.join(rootDir, ".kb", "branches", `${currentBranch}.staging.${pid}.${now}`);
+  return path64.join(rootDir, ".kb", "branches", `${currentBranch}.staging.${pid}.${now}`);
 }
 function abandonedStagingBranch(branch) {
   return branch ? branch : undefined;
 }
 async function cleanupAbandonedStagingDirectories(stagingPath, deps) {
   const resolved = resolveDeps3(deps);
-  const stagingDir = path63.dirname(stagingPath);
-  const stagingBase = path63.basename(stagingPath);
+  const stagingDir = path64.dirname(stagingPath);
+  const stagingBase = path64.basename(stagingPath);
   const match = /^(?<branch>.*)\.staging\.(?<pid>\d+)\.(?<timestamp>\d+)$/.exec(stagingBase);
   if (!match?.groups) {
     return;
@@ -67394,7 +67636,7 @@ async function cleanupAbandonedStagingDirectories(stagingPath, deps) {
     if (candidate === stagingPath) {
       continue;
     }
-    const candidateBase = path63.basename(candidate);
+    const candidateBase = path64.basename(candidate);
     const candidateMatch = new RegExp(`^${escapeRegex2(branch)}\\.staging\\.(\\d+)\\.(\\d+)$`).exec(candidateBase);
     if (!candidateMatch) {
       continue;
@@ -67420,25 +67662,25 @@ async function prepareStagingEnvironment(stagingPath, livePath, rebuild, deps) {
   } else {
     await copySchemaToStaging(stagingPath, resolved);
   }
-  const markerPath = path63.join(stagingPath, "storage.json");
+  const markerPath = path64.join(stagingPath, "storage.json");
   const canWriteMetadata = deps === undefined || deps.writeFileSync !== undefined;
   if (canWriteMetadata && resolved.existsSync(stagingPath) && !resolved.existsSync(markerPath)) {
-    resolved.mkdirSync(path63.join(stagingPath, "rdf"), { recursive: true });
+    resolved.mkdirSync(path64.join(stagingPath, "rdf"), { recursive: true });
     resolved.writeFileSync(markerPath, `{"format":"kibi.rdf-journal.v1","schemaVersion":1}
 `, { mode: 384 });
     const generation = rebuild ? `generation-${process.pid}-${Date.now()}` : "generation-1";
-    resolved.writeFileSync(path63.join(stagingPath, "CURRENT"), `${generation}:0
+    resolved.writeFileSync(path64.join(stagingPath, "CURRENT"), `${generation}:0
 `, { mode: 384 });
-    resolved.writeFileSync(path63.join(stagingPath, "kb.rdf"), `KIBI_STORAGE_FORMAT=kibi.rdf-journal.v1
+    resolved.writeFileSync(path64.join(stagingPath, "kb.rdf"), `KIBI_STORAGE_FORMAT=kibi.rdf-journal.v1
 `, { mode: 384 });
   }
 }
 async function copySchemaToStaging(stagingPath, deps) {
   const possibleSchemaPaths = [
-    path63.resolve(deps.cwd(), "node_modules", "kibi-cli", "schema"),
-    path63.resolve(deps.cwd(), "..", "..", "schema"),
-    path63.resolve(deps.moduleDir, "..", "..", "schema"),
-    path63.resolve(deps.cwd(), "packages", "cli", "schema")
+    path64.resolve(deps.cwd(), "node_modules", "kibi-cli", "schema"),
+    path64.resolve(deps.cwd(), "..", "..", "schema"),
+    path64.resolve(deps.moduleDir, "..", "..", "schema"),
+    path64.resolve(deps.cwd(), "packages", "cli", "schema")
   ];
   let schemaSourceDir = null;
   for (const p of possibleSchemaPaths) {
@@ -67454,19 +67696,19 @@ async function copySchemaToStaging(stagingPath, deps) {
     cwd: schemaSourceDir,
     absolute: false
   });
-  const schemaDestDir = path63.join(stagingPath, "schema");
+  const schemaDestDir = path64.join(stagingPath, "schema");
   if (!deps.existsSync(schemaDestDir)) {
     deps.mkdirSync(schemaDestDir, { recursive: true });
   }
   for (const file of schemaFiles) {
-    const sourcePath = path63.join(schemaSourceDir, file);
-    const destPath = path63.join(schemaDestDir, file);
+    const sourcePath = path64.join(schemaSourceDir, file);
+    const destPath = path64.join(schemaDestDir, file);
     deps.copyFileSync(sourcePath, destPath);
   }
 }
 function atomicPublish(stagingPath, livePath, deps) {
   const resolved = resolveDeps3(deps);
-  const liveParent = path63.dirname(livePath);
+  const liveParent = path64.dirname(livePath);
   if (!resolved.existsSync(liveParent)) {
     resolved.mkdirSync(liveParent, { recursive: true });
   }
@@ -67481,7 +67723,7 @@ function atomicPublish(stagingPath, livePath, deps) {
 }
 function atomicPublishGeneration(stagingPath, livePath, deps) {
   const resolved = resolveDeps3(deps);
-  const liveParent = path63.dirname(livePath);
+  const liveParent = path64.dirname(livePath);
   if (!resolved.existsSync(liveParent)) {
     resolved.mkdirSync(liveParent, { recursive: true });
   }
@@ -67490,11 +67732,11 @@ function atomicPublishGeneration(stagingPath, livePath, deps) {
     return;
   }
   const generationStamp = `${Date.now()}.${process.pid}`;
-  const liveRdf = path63.join(livePath, "rdf");
-  const stagedRdf = path63.join(stagingPath, "rdf");
+  const liveRdf = path64.join(livePath, "rdf");
+  const stagedRdf = path64.join(stagingPath, "rdf");
   const oldRdf = `${liveRdf}.old.${generationStamp}`;
-  const liveCurrent = path63.join(livePath, "CURRENT");
-  const stagedCurrent = path63.join(stagingPath, "CURRENT");
+  const liveCurrent = path64.join(livePath, "CURRENT");
+  const stagedCurrent = path64.join(stagingPath, "CURRENT");
   const oldCurrent = `${liveCurrent}.old.${generationStamp}`;
   if (!resolved.existsSync(stagedRdf) || !resolved.existsSync(stagedCurrent)) {
     throw new Error("Rebuilt journal generation is missing rdf or CURRENT");
@@ -67548,8 +67790,8 @@ var init_staging = __esm(() => {
 // ../cli/dist/commands/sync.js
 import { execSync as execSync4 } from "node:child_process";
 import { createHash as createHash32 } from "node:crypto";
-import { existsSync as existsSync34, mkdirSync as mkdirSync12, readFileSync as readFileSync37, readdirSync as readdirSync9, renameSync as renameSync10, writeFileSync as writeFileSync15 } from "node:fs";
-import * as path64 from "node:path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync12, readFileSync as readFileSync38, readdirSync as readdirSync9, renameSync as renameSync10, writeFileSync as writeFileSync15 } from "node:fs";
+import * as path65 from "node:path";
 function relationshipKey2(relationship) {
   return `${relationship.type}\x00${relationship.from}\x00${relationship.to}`;
 }
@@ -67591,14 +67833,14 @@ function trackedRelationshipFiles(workspaceRoot, relationshipsDir, recoverMissin
     return [];
   }
   const pending = new Set;
-  const pendingRoot = path64.join(workspaceRoot, ".kb", "recovery", "pending-sources");
+  const pendingRoot = path65.join(workspaceRoot, ".kb", "recovery", "pending-sources");
   if (existsSync34(pendingRoot)) {
     for (const receiptName of readdirSync9(pendingRoot)) {
       if (!receiptName.endsWith(".json"))
         continue;
       let receipt;
       try {
-        receipt = JSON.parse(readFileSync37(path64.join(pendingRoot, receiptName), "utf8"));
+        receipt = JSON.parse(readFileSync38(path65.join(pendingRoot, receiptName), "utf8"));
       } catch {
         continue;
       }
@@ -67608,26 +67850,26 @@ function trackedRelationshipFiles(workspaceRoot, relationshipsDir, recoverMissin
       const relative = receipt.path.replaceAll("\\", "/");
       if (!relative.startsWith(".kb/relationships/"))
         continue;
-      const absolute = path64.resolve(workspaceRoot, relative);
-      if (!absolute.startsWith(`${path64.resolve(workspaceRoot)}${path64.sep}`)) {
+      const absolute = path65.resolve(workspaceRoot, relative);
+      if (!absolute.startsWith(`${path65.resolve(workspaceRoot)}${path65.sep}`)) {
         throw new SyncError(`Pending source path escapes workspace: ${relative}`);
       }
       if (!existsSync34(absolute)) {
         if (recoverMissingPendingSources) {
-          const receiptPath = path64.join(pendingRoot, receiptName);
+          const receiptPath = path65.join(pendingRoot, receiptName);
           if (!recoveredPendingReceiptPaths.some((candidate) => candidate.receiptPath === receiptPath)) {
             recoveredPendingReceiptPaths.push({
               receiptPath,
               path: relative,
               afterHash: receipt.afterHash,
-              rawHash: createHash32("sha256").update(readFileSync37(receiptPath)).digest("hex")
+              rawHash: createHash32("sha256").update(readFileSync38(receiptPath)).digest("hex")
             });
           }
           continue;
         }
         throw new SyncError(`Pending source is missing: ${relative}.${PENDING_SOURCE_RECOVERY_HINT}`);
       }
-      const actual = createHash32("sha256").update(readFileSync37(absolute)).digest("hex");
+      const actual = createHash32("sha256").update(readFileSync38(absolute)).digest("hex");
       if (actual !== receipt.afterHash) {
         throw new SyncError(`Pending source hash drift blocks sync for ${relative}`);
       }
@@ -67635,8 +67877,8 @@ function trackedRelationshipFiles(workspaceRoot, relationshipsDir, recoverMissin
     }
   }
   try {
-    return readdirSync9(relationshipsDir).filter((file) => file.endsWith(".yaml") || file.endsWith(".yml")).map((file) => path64.join(relationshipsDir, file)).filter((file) => {
-      const relative = path64.relative(workspaceRoot, file).replaceAll(path64.sep, "/");
+    return readdirSync9(relationshipsDir).filter((file) => file.endsWith(".yaml") || file.endsWith(".yml")).map((file) => path65.join(relationshipsDir, file)).filter((file) => {
+      const relative = path65.relative(workspaceRoot, file).replaceAll(path65.sep, "/");
       return tracked.has(relative) || pending.has(relative);
     }).sort();
   } catch {
@@ -67740,7 +67982,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
   } : (...args) => console.log(...args);
   const rebuild = options2.rebuild ?? false;
   const recoveryBackupPath = options2.recoveryBackupPath;
-  const workspaceRoot = path64.resolve(options2.workspaceRoot ?? process.cwd());
+  const workspaceRoot = path65.resolve(options2.workspaceRoot ?? process.cwd());
   const startTime = Date.now();
   const diagnostics = [];
   const entityCounts = {};
@@ -67824,7 +68066,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
       console.log("[kibi-debug] manifestFiles:", manifestFiles.length);
     }
     const sourceFiles = [...markdownFiles, ...manifestFiles].sort();
-    const cachePath = path64.join(livePathForEngine, "sync-cache.json");
+    const cachePath = path65.join(livePathForEngine, "sync-cache.json");
     const syncCache = readSyncCache(cachePath, undefined, {
       compilerFingerprint: SYNC_COMPILER_FINGERPRINT
     });
@@ -67832,7 +68074,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
     const nowMs = Date.now();
     const currentSourceKeys = new Set(sourceFiles.map((file) => toCacheKey(workspaceRoot, file)));
     const relationshipShardFiles = existsSync34(relationshipsDir) ? trackedRelationshipFiles(workspaceRoot, relationshipsDir, recoveryBackupPath !== undefined, recoveredPendingReceiptPaths) : [];
-    const fastPathSourceHashOf = (file) => manifestFiles.includes(file) ? hashManifestWithCoordinates(workspaceRoot, file, path64.join(path64.dirname(file), "symbol-coordinates.yaml")) : hashFile(workspaceRoot, file);
+    const fastPathSourceHashOf = (file) => manifestFiles.includes(file) ? hashManifestWithCoordinates(workspaceRoot, file, path65.join(path65.dirname(file), "symbol-coordinates.yaml")) : hashFile(workspaceRoot, file);
     if (!validateOnly && !rebuild && !options2.refreshSymbolCoordinates && runtime.createProlog === undefined && compilerCacheHasEntityDelta(syncCache) && compilerCacheIsFresh(syncCache, workspaceRoot, sourceFiles, nowMs) && compilerCacheFilesMatch(syncCache, workspaceRoot, sourceFiles, relationshipShardFiles, fastPathSourceHashOf)) {
       await checkpointNoopSync(workspaceRoot, currentBranch);
       info("✓ Imported 0 entities, 0 relationships (no changes)");
@@ -67857,7 +68099,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
         refreshedManifestKeys.add(toCacheKey(workspaceRoot, file));
       }
     }
-    const coordinatesPathForManifest = (manifestFile) => path64.join(path64.dirname(manifestFile), "symbol-coordinates.yaml");
+    const coordinatesPathForManifest = (manifestFile) => path65.join(path65.dirname(manifestFile), "symbol-coordinates.yaml");
     const effectiveSourceHash = (file) => manifestFiles.includes(file) ? hashManifestWithCoordinates(workspaceRoot, file, coordinatesPathForManifest(file)) : hashFile(workspaceRoot, file);
     const changedSourceHashes = new Map;
     for (const file of sourceFiles) {
@@ -67882,7 +68124,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
     const changedMarkdownFiles = [];
     const changedManifestFiles = [];
     const forceEntitySourceKeys = new Set;
-    const deletedSourceFiles = Object.keys(syncCache.hashes).filter((key) => !currentSourceKeys.has(key)).map((key) => path64.resolve(workspaceRoot, key));
+    const deletedSourceFiles = Object.keys(syncCache.hashes).filter((key) => !currentSourceKeys.has(key)).map((key) => path65.resolve(workspaceRoot, key));
     const currentRelationshipKeys = new Set;
     for (const shardPath of relationshipShardFiles) {
       const key = toCacheKey(workspaceRoot, shardPath);
@@ -68226,7 +68468,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
             evictedSemanticContracts[key] = nextSemanticContracts[key] === true;
           }
         }
-        writeSyncCache(path64.join(livePath, "sync-cache.json"), {
+        writeSyncCache(path65.join(livePath, "sync-cache.json"), {
           version: SYNC_CACHE_VERSION,
           hashes: evictedHashes,
           relationshipHashes: nextRelationshipHashes,
@@ -68353,7 +68595,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
       }
       await prolog.query("kb_detach");
       await prolog.terminate();
-      const journaledLive = existsSync34(path64.join(livePath, "storage.json"));
+      const journaledLive = existsSync34(path65.join(livePath, "storage.json"));
       if (recoveryBackupPath !== undefined) {
         if (!existsSync34(livePath)) {
           throw new SyncError(`Recovery target disappeared before publication: ${livePath}`);
@@ -68361,7 +68603,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
         if (existsSync34(recoveryBackupPath)) {
           throw new SyncError(`Recovery backup path already exists: ${recoveryBackupPath}`);
         }
-        mkdirSync12(path64.dirname(recoveryBackupPath), { recursive: true });
+        mkdirSync12(path65.dirname(recoveryBackupPath), { recursive: true });
         renameSync10(livePath, recoveryBackupPath);
         try {
           renameSync10(stagingPath, livePath);
@@ -68397,7 +68639,7 @@ async function syncCommand(options2 = {}, runtime = {}) {
           evictedSemanticContracts[key] = nextSemanticContracts[key] === true;
         }
       }
-      const liveCachePath = path64.join(livePath, "sync-cache.json");
+      const liveCachePath = path65.join(livePath, "sync-cache.json");
       writeSyncCache(liveCachePath, {
         version: SYNC_CACHE_VERSION,
         hashes: evictedHashes,
@@ -68490,7 +68732,7 @@ var init_sync = __esm(() => {
 // ../cli/dist/commands/branch.js
 import { createHash as createHash33 } from "node:crypto";
 import * as fs8 from "node:fs";
-import * as path65 from "node:path";
+import * as path66 from "node:path";
 function isSupportedLegacyBranchMigration(from, to) {
   return from === to;
 }
@@ -68498,12 +68740,12 @@ function hashLegacyStore(sourcePath) {
   const hash = createHash33("sha256");
   const visit = (directory, relative = "") => {
     for (const entry of fs8.readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
-      const absolute = path65.join(directory, entry.name);
-      const child = relative ? path65.join(relative, entry.name) : entry.name;
+      const absolute = path66.join(directory, entry.name);
+      const child = relative ? path66.join(relative, entry.name) : entry.name;
       if (entry.isDirectory())
         visit(absolute, child);
       else if (entry.isFile()) {
-        hash.update(child.replaceAll(path65.sep, "/"));
+        hash.update(child.replaceAll(path66.sep, "/"));
         hash.update("\x00");
         hash.update(fs8.readFileSync(absolute));
         hash.update("\x00");
@@ -68529,7 +68771,7 @@ function migrationJournalPath(workspaceRoot, id) {
   if (!/^[A-Za-z0-9._-]+$/.test(id)) {
     throw new Error("branch migration journal ID is invalid");
   }
-  return path65.join(workspaceRoot, ".kb", "recovery", "branch-migrations", `${id}.json`);
+  return path66.join(workspaceRoot, ".kb", "recovery", "branch-migrations", `${id}.json`);
 }
 function writeMigrationJournal(journalPath, journal) {
   fs8.writeFileSync(journalPath, `${JSON.stringify(journal, null, 2)}
@@ -68549,9 +68791,9 @@ function recoverBranchMigration(workspaceRoot, id, apply) {
   const journal = JSON.parse(fs8.readFileSync(journalPath, "utf8"));
   if (journal.version !== 2)
     throw new Error("Unsupported branch migration journal version");
-  const root = path65.resolve(workspaceRoot);
-  const paths = ["sourcePath", "targetPath", "stagingPath", "backupPath"].map((key) => path65.resolve(root, String(journal[key])));
-  if (paths.some((candidate) => !candidate.startsWith(`${root}${path65.sep}`))) {
+  const root = path66.resolve(workspaceRoot);
+  const paths = ["sourcePath", "targetPath", "stagingPath", "backupPath"].map((key) => path66.resolve(root, String(journal[key])));
+  if (paths.some((candidate) => !candidate.startsWith(`${root}${path66.sep}`))) {
     throw new Error("Branch migration journal path escapes workspace");
   }
   const [sourcePath, targetPath, stagingPath, backupPath] = completeBranchJournalPaths(paths);
@@ -68604,7 +68846,7 @@ function createEmptyBranchKb(branch, workspaceRoot) {
   console.log(`Created branch KB: ${branch} (${kbPath})`);
 }
 async function branchEnsureCommand(options2) {
-  const workspaceRoot = path65.resolve(options2?.workspaceRoot ?? process.cwd());
+  const workspaceRoot = path66.resolve(options2?.workspaceRoot ?? process.cwd());
   const branchResult = resolveBranchAttachment(workspaceRoot);
   if ("error" in branchResult) {
     console.error(getBranchDiagnostic(undefined, branchResult.error));
@@ -68625,7 +68867,7 @@ async function branchEnsureCommand(options2) {
   createEmptyBranchKb(currentBranch, workspaceRoot);
 }
 async function branchMigrateCommand(options2 = {}) {
-  const workspaceRoot = path65.resolve(options2.workspaceRoot ?? process.cwd());
+  const workspaceRoot = path66.resolve(options2.workspaceRoot ?? process.cwd());
   if (options2.recoverJournal !== undefined) {
     recoverBranchMigration(workspaceRoot, options2.recoverJournal, options2.apply === true);
     return;
@@ -68699,18 +68941,18 @@ async function branchMigrateCommand(options2 = {}) {
     }
     fs8.mkdirSync(root, { recursive: true });
     const migrationId = `${Date.now()}-${from.replaceAll("/", "__")}-${to.replaceAll("/", "__")}`;
-    const journalPath = path65.join(workspaceRoot, ".kb", "recovery", "branch-migrations", `${migrationId}.json`);
+    const journalPath = path66.join(workspaceRoot, ".kb", "recovery", "branch-migrations", `${migrationId}.json`);
     const stagingPath = `${targetPath}.staging-${process.pid}-${Date.now()}`;
-    const backupPath = path65.join(workspaceRoot, ".kb", "recovery", "branch-migrations", `${migrationId}-legacy`);
-    fs8.mkdirSync(path65.dirname(backupPath), { recursive: true });
+    const backupPath = path66.join(workspaceRoot, ".kb", "recovery", "branch-migrations", `${migrationId}-legacy`);
+    fs8.mkdirSync(path66.dirname(backupPath), { recursive: true });
     const journal = {
       version: 2,
       from,
       to,
-      sourcePath: path65.relative(workspaceRoot, sourcePath),
-      targetPath: path65.relative(workspaceRoot, targetPath),
-      stagingPath: path65.relative(workspaceRoot, stagingPath),
-      backupPath: path65.relative(workspaceRoot, backupPath),
+      sourcePath: path66.relative(workspaceRoot, sourcePath),
+      targetPath: path66.relative(workspaceRoot, targetPath),
+      stagingPath: path66.relative(workspaceRoot, stagingPath),
+      backupPath: path66.relative(workspaceRoot, backupPath),
       approvalHash,
       state: "prepared"
     };
@@ -68747,7 +68989,7 @@ async function branchMigrateCommand(options2 = {}) {
   }
 }
 async function branchRecoverCommand(options2 = {}) {
-  const workspaceRoot = path65.resolve(options2.workspaceRoot ?? process.cwd());
+  const workspaceRoot = path66.resolve(options2.workspaceRoot ?? process.cwd());
   const attachment = resolveBranchAttachment(workspaceRoot);
   if ("error" in attachment) {
     throw new Error(`Failed to resolve active branch: ${attachment.error}`);
@@ -68760,7 +69002,7 @@ async function branchRecoverCommand(options2 = {}) {
     throw new Error(`Branch KB is missing at ${inspection.path}; run 'kibi branch ensure' instead.`);
   }
   const stamp = new Date().toISOString().replaceAll(":", "-");
-  const backupPath = path65.join(workspaceRoot, ".kb", "recovery", attachment.kbBranch, stamp);
+  const backupPath = path66.join(workspaceRoot, ".kb", "recovery", attachment.kbBranch, stamp);
   console.log(`Branch KB recovery preview: ${attachment.kbBranch}`);
   console.log(`Store: ${inspection.path}`);
   console.log(`State: ${inspection.state}${inspection.errorCode ? ` (${inspection.errorCode})` : ""}`);
@@ -68784,15 +69026,15 @@ async function branchRecoverCommand(options2 = {}) {
   if (!checkpoint.success) {
     throw new Error("Recovered branch KB could not establish a fresh checkpoint.");
   }
-  const auditPath = path65.join(workspaceRoot, ".kb", "migrations", `${attachment.kbBranch.replaceAll("/", "__")}.recovery.json`);
-  fs8.mkdirSync(path65.dirname(auditPath), { recursive: true });
+  const auditPath = path66.join(workspaceRoot, ".kb", "migrations", `${attachment.kbBranch.replaceAll("/", "__")}.recovery.json`);
+  fs8.mkdirSync(path66.dirname(auditPath), { recursive: true });
   fs8.writeFileSync(auditPath, `${JSON.stringify({
     version: 1,
     branch: attachment.kbBranch,
     recoveredAt: new Date().toISOString(),
     priorState: inspection.state,
     priorErrorCode: inspection.errorCode ?? null,
-    backupPath: path65.relative(workspaceRoot, backupPath),
+    backupPath: path66.relative(workspaceRoot, backupPath),
     strategy: "rebuild_from_authored_sources"
   }, null, 2)}
 `, "utf8");
@@ -68809,7 +69051,7 @@ var init_branch = __esm(() => {
 
 // ../cli/dist/operations/migration/inventory-rederive.js
 import { createHash as createHash34 } from "node:crypto";
-import path66 from "node:path";
+import path67 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 function isRecord17(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -68856,7 +69098,7 @@ class FactClaimIndex {
     this.workspaceRoot = workspaceRoot;
   }
   claimKey(factId) {
-    const direct = path66.join(this.workspaceRoot, KB_PATHS.lanes.facts, `${factId}.md`);
+    const direct = path67.join(this.workspaceRoot, KB_PATHS.lanes.facts, `${factId}.md`);
     try {
       const result = extractFromMarkdown(direct);
       if (result.entity.id === factId)
@@ -69030,7 +69272,7 @@ function planOne(workspaceRoot, relativePath, entity, extracted, shards, facts)
 }
 function readShardRelationships(workspaceRoot) {
   try {
-    return readAllShards(path66.join(workspaceRoot, ".kb")).map(({ type, from, to }) => ({ type, from, to }));
+    return readAllShards(path67.join(workspaceRoot, ".kb")).map(({ type, from, to }) => ({ type, from, to }));
   } catch {
     return [];
   }
@@ -69040,7 +69282,7 @@ function planInventoryRederivation(workspaceRoot, onlyId) {
   const facts = new FactClaimIndex(workspaceRoot);
   const plans = [];
   const files = listLaneMarkdownFiles(workspaceRoot, ["requirements"]);
-  const preferred = onlyId === undefined ? files : files.filter((file) => path66.basename(file.relativePath, ".md") === onlyId);
+  const preferred = onlyId === undefined ? files : files.filter((file) => path67.basename(file.relativePath, ".md") === onlyId);
   for (const file of preferred.length > 0 ? preferred : files) {
     let result;
     try {
@@ -69137,7 +69379,7 @@ function applyInventoryRederivation(workspaceRoot, requirementId, expectedContra
   if (expectedContractHash !== undefined && plan.contractHash !== expectedContractHash) {
     throw new Error(`Requirement ${requirementId} changed since planning; rerun kibi migrate and approve the new plan.`);
   }
-  const absolute = path66.join(workspaceRoot, plan.path);
+  const absolute = path67.join(workspaceRoot, plan.path);
   const content = readText(absolute);
   const next = content === null ? null : rewriteContract(content, plan.contract);
   if (next === null) {
@@ -69183,7 +69425,7 @@ var init_inventory_rederive = __esm(() => {
 });
 
 // ../cli/dist/operations/migration/origin-backfill.js
-import path67 from "node:path";
+import path68 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "node:util";
 function isRecord18(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -69225,8 +69467,8 @@ function inspect(workspaceRoot, absolutePath, relativePath) {
       migrated: "origin" in origin && origin.origin.kind === "migration" && origin.origin.ref === SCHEMA6_MIGRATION_ORIGIN_REF
     };
   }
-  const id = typeof data.id === "string" && data.id.trim() !== "" ? data.id.trim() : path67.basename(relativePath, ".md");
-  const type = typeof data.type === "string" ? data.type : inferTypeFromPath(path67.join(workspaceRoot, relativePath)) ?? "";
+  const id = typeof data.id === "string" && data.id.trim() !== "" ? data.id.trim() : path68.basename(relativePath, ".md");
+  const type = typeof data.type === "string" ? data.type : inferTypeFromPath(path68.join(workspaceRoot, relativePath)) ?? "";
   return { kind: "target", target: { id, type, path: relativePath }, content };
 }
 function planOriginBackfill(workspaceRoot) {
@@ -69307,7 +69549,7 @@ var init_origin_backfill = __esm(() => {
 });
 
 // ../cli/dist/operations/migration/superseded-closure.js
-import path68 from "node:path";
+import path69 from "node:path";
 function reachable(adjacency, start) {
   const seen = new Set;
   const queue = [...adjacency.get(start) ?? []];
@@ -69359,7 +69601,7 @@ function readRequirementsAndEdges(workspaceRoot) {
     } catch {}
   }
   try {
-    relationships.push(...readAllShards(path68.join(workspaceRoot, ".kb")));
+    relationships.push(...readAllShards(path69.join(workspaceRoot, ".kb")));
   } catch {}
   const edges = new Map;
   for (const relationship of relationships) {
@@ -69415,7 +69657,7 @@ function applySupersededClosures(workspaceRoot, planned) {
   for (const closure of planSupersededClosures(workspaceRoot).closures) {
     if (planned !== undefined && !planned.has(closure.id))
       continue;
-    const absolute = path68.join(workspaceRoot, closure.path);
+    const absolute = path69.join(workspaceRoot, closure.path);
     const content = readText(absolute);
     const next = content === null ? null : withTopLevelField(content, "status", CLOSED_REQUIREMENT_STATUS);
     if (next === null) {
@@ -69438,11 +69680,11 @@ var init_superseded_closure = __esm(() => {
 });
 
 // ../cli/dist/commands/init-helpers.js
-import { constants as constants3, chmodSync as chmodSync2, copyFileSync as copyFileSync3, existsSync as existsSync36, lstatSync as lstatSync5, mkdirSync as mkdirSync14, readFileSync as readFileSync39, writeFileSync as writeFileSync17 } from "node:fs";
-import * as path69 from "node:path";
+import { constants as constants3, chmodSync as chmodSync2, copyFileSync as copyFileSync3, existsSync as existsSync36, lstatSync as lstatSync5, mkdirSync as mkdirSync14, readFileSync as readFileSync40, writeFileSync as writeFileSync17 } from "node:fs";
+import * as path70 from "node:path";
 function updateGitIgnore(cwd) {
-  const gitignorePath = path69.join(cwd, ".gitignore");
-  const gitignoreContent = existsSync36(gitignorePath) ? readFileSync39(gitignorePath, "utf8") : "";
+  const gitignorePath = path70.join(cwd, ".gitignore");
+  const gitignoreContent = existsSync36(gitignorePath) ? readFileSync40(gitignorePath, "utf8") : "";
   const ensureEntry = (current, entry) => {
     const lines = current.split(/\r?\n/).map((line) => line.trim());
     if (lines.includes(entry)) {
@@ -69599,8 +69841,8 @@ ${KIBI_BIN_RESOLVER}
 
 // ../cli/dist/commands/legacy-storage-migration.js
 import { createHash as createHash35 } from "node:crypto";
-import { existsSync as existsSync37, mkdirSync as mkdirSync15, readFileSync as readFileSync40, readdirSync as readdirSync11, renameSync as renameSync12, rmSync as rmSync5, statSync as statSync12, writeFileSync as writeFileSync18 } from "node:fs";
-import * as path70 from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync15, readFileSync as readFileSync41, readdirSync as readdirSync11, renameSync as renameSync12, rmSync as rmSync5, statSync as statSync12, writeFileSync as writeFileSync18 } from "node:fs";
+import * as path71 from "node:path";
 function stripGlobToRoot(pattern) {
   const normalized = pattern.replaceAll("\\", "/").replace(/\/+$/, "");
   if (!normalized.includes("*"))
@@ -69638,8 +69880,8 @@ function planLegacyStorageMigration(cwd) {
     if (typeof legacy !== "string" || legacy.trim().length === 0)
       continue;
     const { root, glob } = normalizeLegacySource(legacy);
-    const legacyRoot = path70.resolve(cwd, root);
-    if (legacyRoot === path70.resolve(cwd, KB_PATHS.lanes[lane]))
+    const legacyRoot = path71.resolve(cwd, root);
+    if (legacyRoot === path71.resolve(cwd, KB_PATHS.lanes[lane]))
       continue;
     if (!existsSync37(legacyRoot))
       continue;
@@ -69650,37 +69892,37 @@ function planLegacyStorageMigration(cwd) {
       onlyFiles: true
     });
     for (const file of files.sort()) {
-      const relativeUnderRoot = path70.relative(legacyRoot, file);
-      const destination = path70.join(cwd, KB_PATHS.lanes[lane], relativeUnderRoot);
+      const relativeUnderRoot = path71.relative(legacyRoot, file);
+      const destination = path71.join(cwd, KB_PATHS.lanes[lane], relativeUnderRoot);
       moves.push({
-        from: path70.relative(cwd, file).replaceAll(path70.sep, "/"),
-        to: path70.relative(cwd, destination).replaceAll(path70.sep, "/"),
+        from: path71.relative(cwd, file).replaceAll(path71.sep, "/"),
+        to: path71.relative(cwd, destination).replaceAll(path71.sep, "/"),
         lane
       });
     }
   }
   const legacySymbols = legacyPaths.symbols;
   if (typeof legacySymbols === "string" && legacySymbols.trim().length > 0) {
-    const legacyManifest = path70.resolve(cwd, legacySymbols);
-    if (existsSync37(legacyManifest) && legacyManifest !== path70.resolve(cwd, CANONICAL_ENTITY_PATHS.symbols)) {
+    const legacyManifest = path71.resolve(cwd, legacySymbols);
+    if (existsSync37(legacyManifest) && legacyManifest !== path71.resolve(cwd, CANONICAL_ENTITY_PATHS.symbols)) {
       moves.push({
-        from: path70.relative(cwd, legacyManifest).replaceAll(path70.sep, "/"),
+        from: path71.relative(cwd, legacyManifest).replaceAll(path71.sep, "/"),
         to: CANONICAL_ENTITY_PATHS.symbols,
         lane: "symbols"
       });
     }
     const legacyCoordinates = legacySymbols.replace(/\.ya?ml$/, ".yaml").replace(/symbols\.yaml$/, "symbol-coordinates.yaml");
-    const legacyCoordinatesPath = path70.resolve(cwd, legacyCoordinates);
-    if (existsSync37(legacyCoordinatesPath) && legacyCoordinatesPath !== path70.resolve(cwd, KB_PATHS.symbolCoordinates)) {
+    const legacyCoordinatesPath = path71.resolve(cwd, legacyCoordinates);
+    if (existsSync37(legacyCoordinatesPath) && legacyCoordinatesPath !== path71.resolve(cwd, KB_PATHS.symbolCoordinates)) {
       moves.push({
-        from: path70.relative(cwd, legacyCoordinatesPath).replaceAll(path70.sep, "/"),
+        from: path71.relative(cwd, legacyCoordinatesPath).replaceAll(path71.sep, "/"),
         to: KB_PATHS.symbolCoordinates,
         lane: "symbols"
       });
     }
   }
   for (const move of moves) {
-    const destinationAbsolute = path70.resolve(cwd, move.to);
+    const destinationAbsolute = path71.resolve(cwd, move.to);
     if (!existsSync37(destinationAbsolute))
       continue;
     blockers.push(`Destination ${move.to} already exists; resolve the conflict manually before migrating ${move.from}.`);
@@ -69708,12 +69950,12 @@ function applyLegacyStorageMigration(cwd, plan) {
   }
   const movedFiles = [];
   for (const move of plan.moves) {
-    const sourceAbsolute = path70.resolve(cwd, move.from);
-    const destinationAbsolute = path70.resolve(cwd, move.to);
+    const sourceAbsolute = path71.resolve(cwd, move.from);
+    const destinationAbsolute = path71.resolve(cwd, move.to);
     if (!existsSync37(sourceAbsolute)) {
       continue;
     }
-    mkdirSync15(path70.dirname(destinationAbsolute), { recursive: true });
+    mkdirSync15(path71.dirname(destinationAbsolute), { recursive: true });
     renameSync12(sourceAbsolute, destinationAbsolute);
     movedFiles.push(move.to);
   }
@@ -69727,7 +69969,7 @@ function applyLegacyStorageMigration(cwd, plan) {
   };
   const manifestPath = writeKbManifest(cwd, manifest);
   let retiredLegacyConfig = false;
-  const legacyConfigPath = path70.join(cwd, ".kb", "config.json");
+  const legacyConfigPath = path71.join(cwd, ".kb", "config.json");
   if (existsSync37(legacyConfigPath)) {
     rmSync5(legacyConfigPath);
     retiredLegacyConfig = true;
@@ -69738,7 +69980,7 @@ function applyLegacyStorageMigration(cwd, plan) {
   return {
     movedFiles,
     retiredLegacyConfig,
-    manifestPath: path70.relative(cwd, manifestPath).replaceAll(path70.sep, "/"),
+    manifestPath: path71.relative(cwd, manifestPath).replaceAll(path71.sep, "/"),
     schemaVersion: manifest.schemaVersion,
     semanticAdvisorBackfill: backfill
   };
@@ -69746,11 +69988,11 @@ function applyLegacyStorageMigration(cwd, plan) {
 function pruneEmptyLegacyDirs(cwd, plan) {
   const roots = new Set;
   for (const move of plan.moves) {
-    const absolute = path70.resolve(cwd, move.from);
-    let dir = path70.dirname(absolute);
-    while (dir.startsWith(path70.resolve(cwd)) && dir !== path70.resolve(cwd) && !dir.startsWith(path70.resolve(cwd, KB_ROOT2))) {
+    const absolute = path71.resolve(cwd, move.from);
+    let dir = path71.dirname(absolute);
+    while (dir.startsWith(path71.resolve(cwd)) && dir !== path71.resolve(cwd) && !dir.startsWith(path71.resolve(cwd, KB_ROOT2))) {
       roots.add(dir);
-      dir = path70.dirname(dir);
+      dir = path71.dirname(dir);
     }
   }
   const ordered = [...roots].sort((a, b) => b.length - a.length);
@@ -69763,7 +70005,7 @@ function pruneEmptyLegacyDirs(cwd, plan) {
   }
 }
 function rewritePendingSourceReceiptPaths(cwd, moves) {
-  const pendingRoot = path70.join(cwd, ".kb", "recovery", "pending-sources");
+  const pendingRoot = path71.join(cwd, ".kb", "recovery", "pending-sources");
   if (!existsSync37(pendingRoot))
     return 0;
   const moveByFrom = new Map(moves.map((move) => [move.from, move.to]));
@@ -69771,9 +70013,9 @@ function rewritePendingSourceReceiptPaths(cwd, moves) {
   for (const name of readdirSync11(pendingRoot)) {
     if (!name.endsWith(".json"))
       continue;
-    const receiptPath = path70.join(pendingRoot, name);
+    const receiptPath = path71.join(pendingRoot, name);
     try {
-      const raw = readFileSync40(receiptPath, "utf8");
+      const raw = readFileSync41(receiptPath, "utf8");
       const receipt = JSON.parse(raw);
       if (typeof receipt.path !== "string")
         continue;
@@ -69781,10 +70023,10 @@ function rewritePendingSourceReceiptPaths(cwd, moves) {
       const destination = moveByFrom.get(normalized) ?? (normalized.startsWith("documentation/") ? normalized.replace(/^documentation\//, ".kb/") : undefined);
       if (destination === undefined || destination === normalized)
         continue;
-      const absolute = path70.resolve(cwd, destination);
+      const absolute = path71.resolve(cwd, destination);
       if (!existsSync37(absolute))
         continue;
-      const afterHash = typeof receipt.afterHash === "string" && /^[a-f0-9]{64}$/i.test(receipt.afterHash) ? receipt.afterHash : createHash35("sha256").update(readFileSync40(absolute)).digest("hex");
+      const afterHash = typeof receipt.afterHash === "string" && /^[a-f0-9]{64}$/i.test(receipt.afterHash) ? receipt.afterHash : createHash35("sha256").update(readFileSync41(absolute)).digest("hex");
       writeFileSync18(receiptPath, `${JSON.stringify({ ...receipt, path: destination, afterHash }, null, 2)}
 `, "utf8");
       rewritten += 1;
@@ -70325,26 +70567,26 @@ var require_ignore = __commonJS(function(exports2, module2) {
 });
 
 // ../cli/dist/public/ignore-policy.js
-import { existsSync as existsSync38, readFileSync as readFileSync41, readdirSync as readdirSync12 } from "node:fs";
-import * as path71 from "node:path";
+import { existsSync as existsSync38, readFileSync as readFileSync42, readdirSync as readdirSync12 } from "node:fs";
+import * as path72 from "node:path";
 function readIgnoreFileLines(filePath) {
   if (!existsSync38(filePath))
     return [];
   try {
-    const content = readFileSync41(filePath, "utf8");
+    const content = readFileSync42(filePath, "utf8");
     return content.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
   } catch {
     return [];
   }
 }
 function toPosix(p) {
-  return p.split(path71.sep).join("/");
+  return p.split(path72.sep).join("/");
 }
 function createRepoIgnorePolicy(workspaceRoot) {
-  const root = path71.resolve(workspaceRoot);
-  const rootGitignorePath = path71.join(root, ".gitignore");
+  const root = path72.resolve(workspaceRoot);
+  const rootGitignorePath = path72.join(root, ".gitignore");
   const rootGitPatterns = readIgnoreFileLines(rootGitignorePath);
-  const gitInfoExcludePath = path71.join(root, ".git", "info", "exclude");
+  const gitInfoExcludePath = path72.join(root, ".git", "info", "exclude");
   const gitInfoPatterns = readIgnoreFileLines(gitInfoExcludePath);
   const nestedPatterns = new Map;
   function walk(dirAbs) {
@@ -70356,7 +70598,7 @@ function createRepoIgnorePolicy(workspaceRoot) {
     }
     for (const ent of entries) {
       const name = String(ent.name);
-      const abs = path71.join(dirAbs, name);
+      const abs = path72.join(dirAbs, name);
       if (ent.isDirectory()) {
         if (HARD_DENYLIST.includes(name))
           continue;
@@ -70367,10 +70609,10 @@ function createRepoIgnorePolicy(workspaceRoot) {
         walk(abs);
       } else if (ent.isFile()) {
         if (name === ".gitignore") {
-          if (path71.resolve(dirAbs) === root)
+          if (path72.resolve(dirAbs) === root)
             continue;
           const patterns = readIgnoreFileLines(abs);
-          const relDir = path71.relative(root, dirAbs) || ".";
+          const relDir = path72.relative(root, dirAbs) || ".";
           nestedPatterns.set(toPosix(relDir), patterns);
         }
       }
@@ -70392,8 +70634,8 @@ function createRepoIgnorePolicy(workspaceRoot) {
   }
   const nestedDirsSorted = Array.from(nestedIgnoreMap.keys()).sort((a, b) => b.length - a.length);
   function isPathOutsideWorkspace(absPath) {
-    const rel = path71.relative(root, absPath);
-    return rel === "" ? false : rel.split(path71.sep)[0] === "..";
+    const rel = path72.relative(root, absPath);
+    return rel === "" ? false : rel.split(path72.sep)[0] === "..";
   }
   function matchesHardDeny(relPosix) {
     const segments = relPosix.split("/").filter(Boolean);
@@ -70409,11 +70651,11 @@ function createRepoIgnorePolicy(workspaceRoot) {
     return false;
   }
   function isIgnoredInternal(inputPath) {
-    const abs = path71.isAbsolute(inputPath) ? path71.resolve(inputPath) : path71.resolve(root, inputPath);
-    if (path71.isAbsolute(inputPath) && isPathOutsideWorkspace(abs)) {
+    const abs = path72.isAbsolute(inputPath) ? path72.resolve(inputPath) : path72.resolve(root, inputPath);
+    if (path72.isAbsolute(inputPath) && isPathOutsideWorkspace(abs)) {
       return { ignored: true, reason: "outside_workspace" };
     }
-    const rel = path71.relative(root, abs) || ".";
+    const rel = path72.relative(root, abs) || ".";
     const relPosix = toPosix(rel);
     if (matchesHardDeny(relPosix))
       return { ignored: true, reason: "hard_deny" };
@@ -70524,7 +70766,7 @@ import { execFile as execFile2, execFileSync as execFileSync8 } from "node:child
 import { createHash as createHash36 } from "node:crypto";
 import * as fsSync from "node:fs";
 import * as fs9 from "node:fs/promises";
-import path72 from "node:path";
+import path73 from "node:path";
 import { promisify as promisify2 } from "node:util";
 function includedSnapshotPath(relativePath) {
   return !SNAPSHOT_EXCLUDED_PREFIXES.some((prefix) => relativePath === prefix.slice(0, -1) || relativePath.startsWith(prefix));
@@ -70533,7 +70775,7 @@ function isReceiptOnlyMarkdownChange(workspaceRoot, relativePath) {
   if (!relativePath.endsWith(".md"))
     return false;
   try {
-    const working = snapshotFileContent(relativePath, fsSync.readFileSync(path72.join(workspaceRoot, relativePath)));
+    const working = snapshotFileContent(relativePath, fsSync.readFileSync(path73.join(workspaceRoot, relativePath)));
     const committed = execFileSync8("git", ["-C", workspaceRoot, "show", `HEAD:${relativePath}`], { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 });
     return working.equals(snapshotFileContent(relativePath, committed));
   } catch {
@@ -70557,7 +70799,7 @@ async function workspaceSnapshot(workspaceRoot) {
     digest.update(relativePath);
     digest.update("\x00");
     try {
-      const content = await fs9.readFile(path72.join(workspaceRoot, raw));
+      const content = await fs9.readFile(path73.join(workspaceRoot, raw));
       digest.update(snapshotFileContent(relativePath, content));
     } catch (error) {
       const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "unreadable";
@@ -70751,7 +70993,7 @@ var exports_cli_runtime = {};
 __export(exports_cli_runtime, {
   createCliRuntime: () => createCliRuntime
 });
-import path73 from "node:path";
+import path74 from "node:path";
 function attachmentFailureMessage(attachment) {
   const isNonGitContext = attachment.code === "NOT_A_GIT_REPO" || attachment.code === "GIT_NOT_AVAILABLE";
   return isNonGitContext ? "Kibi requires an active Git branch outside a repository; set KIBI_BRANCH explicitly for a standalone workspace." : `Failed to resolve active branch: ${attachment.error}`;
@@ -70766,7 +71008,7 @@ function createDefaultProlog(root, branch) {
 }
 function workspaceRoot(options2) {
   const envRoot = process.env.KIBI_WORKSPACE ?? process.env.KIBI_PROJECT_ROOT ?? process.env.KIBI_ROOT;
-  return path73.resolve(options2.workspaceRoot ?? envRoot ?? process.cwd());
+  return path74.resolve(options2.workspaceRoot ?? envRoot ?? process.cwd());
 }
 function quoteProlog2(value) {
   return value.replaceAll("'", "''");
@@ -71698,8 +71940,8 @@ var init_repair_plan = __esm(() => {
 });
 
 // ../cli/dist/public/operations/symbol-repair-plan.js
-import { existsSync as existsSync39, readFileSync as readFileSync43 } from "node:fs";
-import path74 from "node:path";
+import { existsSync as existsSync39, readFileSync as readFileSync44 } from "node:fs";
+import path75 from "node:path";
 function sourceFileOf(entity) {
   const value = entity.sourceFile ?? entity.source;
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -71730,7 +71972,7 @@ async function inspectCoordinateRepairs(symbols, workspaceRoot) {
     let source = null;
     if (sourceFile) {
       try {
-        source = readFileSync43(path74.resolve(workspaceRoot, sourceFile), "utf8");
+        source = readFileSync44(path75.resolve(workspaceRoot, sourceFile), "utf8");
       } catch {}
     }
     const extracted = entry.title.length > 0 && coordinatesPresent(enriched[index] ?? {});
@@ -71819,11 +72061,11 @@ async function buildSymbolRepairPlan(rows, context) {
     const source = sourceFileOf(symbol);
     if (!source || extractedByPath.has(source))
       continue;
-    const absolute = path74.isAbsolute(source) ? source : path74.resolve(context.workspaceRoot, source);
+    const absolute = path75.isAbsolute(source) ? source : path75.resolve(context.workspaceRoot, source);
     if (!existsSync39(absolute))
       continue;
     try {
-      const content = readFileSync43(absolute, "utf8");
+      const content = readFileSync44(absolute, "utf8");
       const analysis = analyzeSourceText(absolute, content);
       if (analysis.providerId === null)
         continue;
@@ -71841,7 +72083,7 @@ async function buildSymbolRepairPlan(rows, context) {
     if (!entity)
       return [];
     const source = sourceFileOf(entity);
-    const absolute = source ? path74.isAbsolute(source) ? source : path74.resolve(context.workspaceRoot, source) : null;
+    const absolute = source ? path75.isAbsolute(source) ? source : path75.resolve(context.workspaceRoot, source) : null;
     const exists = absolute !== null && existsSync39(absolute);
     const candidates = currentCandidates(entity, symbols, extractedByPath);
     const extraction = source ? extractedByPath.get(source) : undefined;
@@ -72383,7 +72625,7 @@ __export(exports_schema6, {
   buildSchema6MigrationFragment: () => buildSchema6MigrationFragment,
   migrationSyncAction: () => migrationSyncAction
 });
-import path75 from "node:path";
+import path76 from "node:path";
 function rederiveAction(plan) {
   const changed = plan.changes.filter((change) => change.change !== "kept");
   return migrationAction({
@@ -72450,7 +72692,7 @@ function unapprovedExceptionsFromSources(workspaceRoot) {
     } catch {}
   }
   try {
-    relationships.push(...readAllShards(path75.join(workspaceRoot, ".kb")));
+    relationships.push(...readAllShards(path76.join(workspaceRoot, ".kb")));
   } catch {}
   const superseded = new Set(relationships.filter((relationship) => relationship.type === "supersedes").map((relationship) => relationship.to));
   const exempts = new Map;
@@ -73854,8 +74096,8 @@ var init_cli_json_command = __esm(() => {
 });
 
 // ../cli/dist/commands/migrate.js
-import { existsSync as existsSync40, mkdirSync as mkdirSync16, readFileSync as readFileSync44, renameSync as renameSync13, writeFileSync as writeFileSync19 } from "node:fs";
-import * as path76 from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync16, readFileSync as readFileSync45, renameSync as renameSync13, writeFileSync as writeFileSync19 } from "node:fs";
+import * as path77 from "node:path";
 function migrationStepsFor(fromVersion) {
   const start = Math.max(0, fromVersion ?? 0);
   return SCHEMA_MIGRATION_STEPS.filter((step) => step.from >= start);
@@ -73864,8 +74106,8 @@ function printWarning(message) {
   console.log(`Warning: ${message}`);
 }
 function toRelativePath(cwd, filePath) {
-  const relativePath = path76.relative(cwd, filePath);
-  return relativePath.length > 0 ? relativePath : path76.basename(filePath);
+  const relativePath = path77.relative(cwd, filePath);
+  return relativePath.length > 0 ? relativePath : path77.basename(filePath);
 }
 function resolveMigrationBranch(cwd) {
   const result = resolveBranchAttachment(cwd);
@@ -73892,7 +74134,7 @@ function writeJsonAtomically(filePath, value) {
 `);
 }
 function writeTextAtomically(filePath, content) {
-  mkdirSync16(path76.dirname(filePath), { recursive: true });
+  mkdirSync16(path77.dirname(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync19(tempPath, content, "utf8");
   renameSync13(tempPath, filePath);
@@ -73944,7 +74186,7 @@ function hasTraceabilityRelationship2(symbol) {
   });
 }
 function getGranularNames(cwd, sourceFile) {
-  const absolutePath = path76.isAbsolute(sourceFile) ? sourceFile : path76.join(cwd, sourceFile);
+  const absolutePath = path77.isAbsolute(sourceFile) ? sourceFile : path77.join(cwd, sourceFile);
   if (!existsSync40(absolutePath)) {
     return new Set;
   }
@@ -73952,7 +74194,7 @@ function getGranularNames(cwd, sourceFile) {
     path: sourceFile,
     status: "M",
     hunkRanges: [{ start: 1, end: Number.MAX_SAFE_INTEGER }],
-    content: readFileSync44(absolutePath, "utf8")
+    content: readFileSync45(absolutePath, "utf8")
   });
   return new Set(symbols.map((symbol) => symbol.name));
 }
@@ -73994,11 +74236,11 @@ function addLegacyReasonsToManifestText(content, symbolIds) {
 `);
 }
 function migrateSymbolGranularity(options2) {
-  const manifestPath = options2.manifestPath ?? path76.join(options2.cwd, CANONICAL_ENTITY_PATHS.symbols);
+  const manifestPath = options2.manifestPath ?? path77.join(options2.cwd, CANONICAL_ENTITY_PATHS.symbols);
   if (!existsSync40(manifestPath)) {
     return { count: 0, manifestPath };
   }
-  const manifestContent = readFileSync44(manifestPath, "utf8");
+  const manifestContent = readFileSync45(manifestPath, "utf8");
   const parsed = load(manifestContent);
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     return { count: 0, manifestPath };
@@ -74138,7 +74380,7 @@ async function migrateCommand(options2 = {}) {
   if (options2.applySafe === true || options2.format === "json" || options2.yes !== true && options2.dryRun !== true) {
     return migratePlanCommand(options2);
   }
-  const cwd = path76.resolve(options2.workspaceRoot ?? process.cwd());
+  const cwd = path77.resolve(options2.workspaceRoot ?? process.cwd());
   const branchResult = resolveMigrationBranch(cwd);
   if ("error" in branchResult) {
     console.error(branchResult.error);
@@ -74166,7 +74408,7 @@ async function migrateCommand(options2 = {}) {
     ...branchWarnings,
     ...migrationWarning ? [migrationWarning] : []
   ];
-  const auditPath = path76.join(cwd, ".kb", "migrations", `${branch}.json`);
+  const auditPath = path77.join(cwd, ".kb", "migrations", `${branch}.json`);
   for (const warning of warnings) {
     printWarning(warning);
   }
@@ -74240,7 +74482,7 @@ async function migrateCommand(options2 = {}) {
       const preview = migrateSymbolGranularity({
         cwd,
         dryRun: true,
-        manifestPath: path76.join(cwd, symbolsSource)
+        manifestPath: path77.join(cwd, symbolsSource)
       });
       if (preview.count > 0) {
         console.log(`dry run: would mark ${preview.count} legacy coarse symbol link(s) as legacy-link.`);
@@ -74422,7 +74664,7 @@ async function buildWorkspaceMigrationPlan(workspaceRoot = process.cwd()) {
   return mergeMigrationPlans(plans);
 }
 async function migratePlanCommand(options2) {
-  const workspaceRoot = path76.resolve(options2.workspaceRoot ?? process.cwd());
+  const workspaceRoot = path77.resolve(options2.workspaceRoot ?? process.cwd());
   const plan = await buildWorkspaceMigrationPlan(workspaceRoot);
   if (options2.applySafe === true) {
     if (!options2.approvedPlanHash) {
@@ -74545,7 +74787,7 @@ var init_migrate = __esm(() => {
 
 // ../cli/dist/operations/planning/compile-intent.js
 import { createHash as createHash39 } from "node:crypto";
-import path77 from "node:path";
+import path78 from "node:path";
 function compilePlanHash(plan) {
   const { planHash: _ignored, ...body } = plan;
   return hash2(body);
@@ -74582,7 +74824,7 @@ function requiredIntent(args) {
   return intent;
 }
 function validateLocation(location) {
-  if (!text7(location.path) || path77.isAbsolute(location.path) || location.path.split(/[\\/]/).includes("..")) {
+  if (!text7(location.path) || path78.isAbsolute(location.path) || location.path.split(/[\\/]/).includes("..")) {
     throw new Error("Compile intent failed: sourceLocations.path must be workspace-relative");
   }
 }
@@ -74700,7 +74942,7 @@ async function sourceHashes(context, locations) {
   const hashes = {};
   for (const relative of sourceFilesFor(locations)) {
     try {
-      const contents = context.fs ? await context.fs.readFile(path77.join(context.workspaceRoot, relative)) : null;
+      const contents = context.fs ? await context.fs.readFile(path78.join(context.workspaceRoot, relative)) : null;
       hashes[relative] = contents === null ? null : createHash39("sha256").update(contents).digest("hex");
     } catch {
       hashes[relative] = null;
@@ -74757,7 +74999,7 @@ async function existingRequirementBody(context, source) {
   if (!context.fs || !source.endsWith(".md"))
     return;
   try {
-    const raw = await context.fs.readFile(path77.join(context.workspaceRoot, source));
+    const raw = await context.fs.readFile(path78.join(context.workspaceRoot, source));
     return readAuthoredEntity(String(raw), source)?.body ?? undefined;
   } catch {
     return;
@@ -75287,7 +75529,7 @@ var init_compile_intent = __esm(() => {
 
 // ../cli/dist/operations/planning/apply-plan.js
 import { createHash as createHash40, randomUUID as randomUUID6 } from "node:crypto";
-import path78 from "node:path";
+import path79 from "node:path";
 function text8(value) {
   return typeof value === "string" ? value.trim() : "";
 }
@@ -75352,7 +75594,7 @@ function isBootstrapApplyArgs(args) {
   return "plan" in args && args.plan.version === "kibi.bootstrap-plan.v1";
 }
 function assertSourceWriteStaysInWorkspace(root, absolute, writePath) {
-  if (absolute !== root && !absolute.startsWith(`${root}${path78.sep}`)) {
+  if (absolute !== root && !absolute.startsWith(`${root}${path79.sep}`)) {
     throw new Error(`Apply plan failed: sourceWrites.path escapes workspace: ${writePath}`);
   }
 }
@@ -75532,13 +75774,13 @@ function topologicalActions(actions) {
 async function validateSources(context, sourceHashes) {
   let checked = 0;
   for (const [relative, expected] of Object.entries(sourceHashes)) {
-    if (!relative || path78.isAbsolute(relative) || relative.split(/[\\/]/).includes(".."))
+    if (!relative || path79.isAbsolute(relative) || relative.split(/[\\/]/).includes(".."))
       throw new Error("Apply plan failed: source hash paths must be workspace-relative");
     if (!context.fs)
       throw new Error("Apply plan failed: source hashes require a filesystem-capable runtime");
     let actual;
     try {
-      actual = digest4(await context.fs.readFile(path78.join(context.workspaceRoot, relative)));
+      actual = digest4(await context.fs.readFile(path79.join(context.workspaceRoot, relative)));
     } catch {
       actual = null;
     }
@@ -75549,19 +75791,19 @@ async function validateSources(context, sourceHashes) {
   return checked;
 }
 async function resolveSourceWriteTarget(workspaceRoot, fsPort, write) {
-  if (!write.path || path78.isAbsolute(write.path) || write.path.split(/[\\/]/).includes("..")) {
+  if (!write.path || path79.isAbsolute(write.path) || write.path.split(/[\\/]/).includes("..")) {
     throw new Error(`Apply plan failed: sourceWrites.path must be workspace-relative: ${write.path}`);
   }
-  const absolute = path78.resolve(workspaceRoot, write.path);
-  const root = path78.resolve(workspaceRoot);
+  const absolute = path79.resolve(workspaceRoot, write.path);
+  const root = path79.resolve(workspaceRoot);
   assertSourceWriteStaysInWorkspace(root, absolute, write.path);
-  const relative = path78.relative(root, absolute).split(path78.sep).join("/");
+  const relative = path79.relative(root, absolute).split(path79.sep).join("/");
   if (relative === ".kb" || isDerivedKbPath(relative)) {
     throw new Error("Apply plan failed: sourceWrites.path cannot target Kibi's derived .kb runtime trees");
   }
   const realRoot = canonicalFilesystemPath(root);
   const realExisting = canonicalFilesystemPath(absolute);
-  if (realExisting !== realRoot && !realExisting.startsWith(`${realRoot}${path78.sep}`)) {
+  if (realExisting !== realRoot && !realExisting.startsWith(`${realRoot}${path79.sep}`)) {
     throw new Error(`Apply plan failed: sourceWrites.path follows a symlink outside the workspace: ${write.path}`);
   }
   const existing = await fsPort.readFile(absolute).catch(() => {
@@ -75592,7 +75834,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
     throw new Error("Apply plan failed: sourceWrites require a filesystem-capable runtime");
   }
   const fsPort = context.fs;
-  const journalPath = path78.join(context.workspaceRoot, ".kb", "recovery", `source-writes-${planHash.slice(0, 16)}.json`);
+  const journalPath = path79.join(context.workspaceRoot, ".kb", "recovery", `source-writes-${planHash.slice(0, 16)}.json`);
   const journalId = `source-writes-${planHash.slice(0, 16)}`;
   const sameEntries = (entries) => entries.length === writes.length && entries.every((entry) => writes.some((write) => write.path === entry.path && (write.mode ?? "write") === entry.mode && write.beforeHash === entry.beforeHash && write.afterHash === entry.afterHash));
   const readJournal = async () => {
@@ -75615,7 +75857,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
     let allAfter = true;
     for (const entry of prior.entries) {
       try {
-        const current = await context.fs.readFile(path78.resolve(context.workspaceRoot, entry.path));
+        const current = await context.fs.readFile(path79.resolve(context.workspaceRoot, entry.path));
         if (entry.afterHash === null || digest4(current) !== entry.afterHash) {
           allAfter = false;
         }
@@ -75637,7 +75879,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
   }
   if (prior && (prior.state === "prepared" || prior.state === "publishing_sources")) {
     for (const entry of prior.entries) {
-      const absolute = path78.resolve(context.workspaceRoot, entry.path);
+      const absolute = path79.resolve(context.workspaceRoot, entry.path);
       let current;
       try {
         current = await context.fs.readFile(absolute);
@@ -75670,7 +75912,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
       const { absolute, existing, mode } = await resolveSourceWriteTarget(context.workspaceRoot, fsPort, write);
       originals.push({ absolute, body: existing });
       paths.push(write.path);
-      const stageBase = path78.join(context.workspaceRoot, ".kb", "recovery", `${journalId}-${entries.length}`);
+      const stageBase = path79.join(context.workspaceRoot, ".kb", "recovery", `${journalId}-${entries.length}`);
       entries.push({
         path: write.path,
         mode,
@@ -75681,7 +75923,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
         afterStage: `${stageBase}.after`
       });
     }
-    await context.fs.mkdir(path78.dirname(journalPath));
+    await context.fs.mkdir(path79.dirname(journalPath));
     for (let index = 0;index < writes.length; index += 1) {
       const original = originals[index];
       const entry = entries[index];
@@ -75702,7 +75944,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
       const write = writes[index];
       if (!absolute || !write)
         continue;
-      await context.fs.mkdir(path78.dirname(absolute));
+      await context.fs.mkdir(path79.dirname(absolute));
       await context.fs.writeFile(journalPath, `${JSON.stringify({ version: 1, planHash, state: "publishing_sources", entries }, null, 2)}
 `);
       if ((write.mode ?? "write") === "delete") {
@@ -75754,7 +75996,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
       } catch {}
     }
     try {
-      await context.fs.mkdir(path78.dirname(journalPath));
+      await context.fs.mkdir(path79.dirname(journalPath));
       await context.fs.writeFile(journalPath, `${JSON.stringify({ version: 1, planHash, state: "rolled_back", entries }, null, 2)}
 `);
     } catch {}
@@ -75771,7 +76013,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
 async function markSourceJournal(context, journalId, state) {
   if (!journalId || !context.fs)
     return;
-  const journalPath = path78.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
+  const journalPath = path79.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
   try {
     const current = JSON.parse(await context.fs.readFile(journalPath));
     await context.fs.writeFile(journalPath, `${JSON.stringify({ ...current, state }, null, 2)}
@@ -75786,7 +76028,7 @@ async function executeSourceRecovery(args, context, onCommitted = () => {
   if (!/^[A-Za-z0-9._-]+$/.test(args.recoveryJournalId)) {
     throw new Error("Source recovery journal ID is invalid");
   }
-  const journalPath = path78.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
+  const journalPath = path79.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
   const journal = JSON.parse(await context.fs.readFile(journalPath));
   if (journal.version !== 1 || typeof journal.planHash !== "string" || !Array.isArray(journal.entries) || !["sources_committed", "compiled_published", "repair_required"].includes(journal.state ?? "")) {
     throw new Error("Source recovery requires a committed or repair_required journal");
@@ -75902,7 +76144,7 @@ async function executeBootstrapPlan(args, context, recovery = false, remainingAc
   if (!status)
     throw new Error("Bootstrap apply failed: status returned no payload");
   const journalId = `bootstrap-${args.plan.planHash.slice(0, 16)}`;
-  const journalPath = path78.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
+  const journalPath = path79.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
   if (!recovery && context.fs) {
     try {
       await context.fs.readFile(journalPath);
@@ -75935,7 +76177,7 @@ async function executeBootstrapPlan(args, context, recovery = false, remainingAc
   const writeJournal = async (state, activeActionId, currentCheckpoint = lastCheckpoint) => {
     if (!context.fs)
       return;
-    await context.fs.mkdir(path78.dirname(journalPath));
+    await context.fs.mkdir(path79.dirname(journalPath));
     await context.fs.writeFile(journalPath, `${JSON.stringify({
       version: 2,
       kind: "bootstrap",
@@ -76205,7 +76447,7 @@ async function dispatchApplyPlan(args, context, onCommitted, recovered) {
         throw new Error("Bootstrap recovery requires a filesystem-capable runtime");
       if (!/^bootstrap-[a-f0-9]{16}$/.test(args.recoveryJournalId))
         throw new Error("Bootstrap recovery journal ID is invalid");
-      const journalPath = path78.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
+      const journalPath = path79.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
       const journal = JSON.parse(await context.fs.readFile(journalPath));
       if (journal.version !== 2 || journal.kind !== "bootstrap" || !journal.plan)
         throw new Error("Bootstrap recovery journal is invalid");
@@ -76389,7 +76631,7 @@ async function planFileWrites(context, prolog, fsPort, sourceWrites, steps, now)
     const relative = canonicalSourcePath(context, step.input, step.entity, existing);
     let file = files.get(relative);
     if (file === undefined) {
-      const existingBytes = await fsPort.readFile(path78.join(workspaceRoot, relative)).catch(() => {
+      const existingBytes = await fsPort.readFile(path79.join(workspaceRoot, relative)).catch(() => {
         return;
       });
       const before = existingBytes ?? null;
@@ -76414,8 +76656,8 @@ async function planFileWrites(context, prolog, fsPort, sourceWrites, steps, now)
     file.after = after;
     file.afterHash = contentHash(after);
   }
-  const root = path78.resolve(workspaceRoot);
-  const kbRoot = path78.join(workspaceRoot, ".kb");
+  const root = path79.resolve(workspaceRoot);
+  const kbRoot = path79.join(workspaceRoot, ".kb");
   const createdAt = now.toISOString();
   for (const step of steps) {
     for (const relationship of step.relationships) {
@@ -76426,7 +76668,7 @@ async function planFileWrites(context, prolog, fsPort, sourceWrites, steps, now)
         continue;
       const shardPath = computeShardPath(kbRoot, from);
       assertRelationshipShardContained(workspaceRoot, shardPath);
-      const relative = path78.relative(root, path78.resolve(shardPath)).split(path78.sep).join("/");
+      const relative = path79.relative(root, path79.resolve(shardPath)).split(path79.sep).join("/");
       let file = files.get(relative);
       if (file === undefined) {
         const existing = await fsPort.readFile(shardPath).catch(() => null);
@@ -76911,7 +77153,7 @@ async function applyingBootstrapJournal(args, context) {
     return;
   if (!/^bootstrap-[a-f0-9]{16}$/.test(args.recoveryJournalId))
     return;
-  const journalPath = path78.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
+  const journalPath = path79.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
   try {
     const journal = JSON.parse(await context.fs.readFile(journalPath));
     return journal.kind === "bootstrap" && journal.state === "applying" ? journalPath : undefined;
@@ -77631,10 +77873,10 @@ function evaluateContractAgainstRun(artifact, contract) {
 var MAX_ATTRIBUTED_MEMBERS = 5;
 
 // ../cli/dist/proof/integrations.js
-import { existsSync as existsSync41, readFileSync as readFileSync45 } from "node:fs";
-import path79 from "node:path";
+import { existsSync as existsSync41, readFileSync as readFileSync46 } from "node:fs";
+import path80 from "node:path";
 function integrationsPath(workspaceRoot) {
-  return path79.join(workspaceRoot, PROOF_INTEGRATIONS_PATH);
+  return path80.join(workspaceRoot, PROOF_INTEGRATIONS_PATH);
 }
 function proofIntegrationErrors(value) {
   const file = record5(value);
@@ -77691,7 +77933,7 @@ function loadProofIntegrations(workspaceRoot) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync45(filePath, "utf8"));
+    parsed = JSON.parse(readFileSync46(filePath, "utf8"));
   } catch (error) {
     return {
       available: false,
@@ -78539,9 +78781,9 @@ init_ir();
 import { createHash as createHash41 } from "node:crypto";
 
 // src/skill-system/loader.ts
-import { existsSync as existsSync44, readFileSync as readFileSync47, readdirSync as readdirSync13, realpathSync as realpathSync10 } from "node:fs";
+import { existsSync as existsSync44, readFileSync as readFileSync48, readdirSync as readdirSync13, realpathSync as realpathSync10 } from "node:fs";
 import { dirname as dirname21, join as join32, resolve as resolve29 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/skill-system/errors.ts
 class SkillNotFoundError2 extends Error {
@@ -78724,7 +78966,7 @@ function isStringArray2(value) {
 }
 
 // src/skill-system/loader.ts
-var moduleDir = dirname21(fileURLToPath4(import.meta.url));
+var moduleDir = dirname21(fileURLToPath5(import.meta.url));
 var overrideSkillsDir;
 function defaultBundledSkillsDir2() {
   return existsSync44(resolve29(moduleDir, "skills")) ? resolve29(moduleDir, "skills") : resolve29(moduleDir, "../skills");
@@ -78785,7 +79027,7 @@ function readBundle2(bundle, id, resourcePath) {
     throw new SkillResourceNotFoundError2(id, resourcePath);
   }
   assertMaxBytes2(candidate, RESOURCE_MAX_BYTES2);
-  return readFileSync47(candidate, "utf8");
+  return readFileSync48(candidate, "utf8");
 }
 // src/skill-operations.ts
 function assertNonEmptyString2(value, field) {
@@ -78942,7 +79184,7 @@ init_symbols_coordinator2();
 // ../cli/dist/env/bootstrap.js
 import fs11 from "node:fs";
 import os2 from "node:os";
-import path80 from "node:path";
+import path81 from "node:path";
 var WORKSPACE_ENV_KEYS = [
   "KIBI_WORKSPACE",
   "KIBI_PROJECT_ROOT",
@@ -78968,13 +79210,13 @@ function readFirstEnv(env, keys) {
   return null;
 }
 function nextAncestorDirectory2(current) {
-  const parent = path80.dirname(current);
+  const parent = path81.dirname(current);
   return parent === current ? undefined : parent;
 }
 function findUpwards(startDir, marker) {
-  let current = path80.resolve(startDir);
+  let current = path81.resolve(startDir);
   while (current !== undefined) {
-    if (fs11.existsSync(path80.join(current, marker))) {
+    if (fs11.existsSync(path81.join(current, marker))) {
       return current;
     }
     current = nextAncestorDirectory2(current);
@@ -78984,24 +79226,24 @@ function findUpwards(startDir, marker) {
 function resolveKibiWorkspaceRoot(startDir = process.cwd(), env = process.env) {
   const envRoot = readFirstEnv(env, WORKSPACE_ENV_KEYS);
   if (envRoot)
-    return path80.resolve(envRoot);
+    return path81.resolve(envRoot);
   const kbRoot = findUpwards(startDir, ".kb");
   if (kbRoot)
     return kbRoot;
   const gitRoot = findUpwards(startDir, ".git");
   if (gitRoot)
     return gitRoot;
-  return path80.resolve(startDir);
+  return path81.resolve(startDir);
 }
 function resolveEnvFilePath(envFileName, workspaceRoot) {
-  if (path80.isAbsolute(envFileName))
+  if (path81.isAbsolute(envFileName))
     return envFileName;
-  return path80.resolve(workspaceRoot, envFileName);
+  return path81.resolve(workspaceRoot, envFileName);
 }
 function resolveKibiUserEnvPath(options2 = {}) {
   const env = options2.env ?? process.env;
-  const xdg = options2.xdgConfigHome?.trim() || env.XDG_CONFIG_HOME?.trim() || path80.join(options2.homedir ?? os2.homedir(), ".config");
-  return path80.join(xdg, "kibi", "env");
+  const xdg = options2.xdgConfigHome?.trim() || env.XDG_CONFIG_HOME?.trim() || path81.join(options2.homedir ?? os2.homedir(), ".config");
+  return path81.join(xdg, "kibi", "env");
 }
 function resolveKibiProjectEnvPath(workspaceRoot, env = process.env) {
   const override = env.KIBI_ENV_FILE?.trim();