kibi-runtime 2.8.0 → 2.9.0

package/dist/index.js

@@ -577,6 +577,10 @@ var init_contracts = __esm(() => {
       },
       existingGrounding: recordArray,
       replacementPlan: { type: ["object", "null"] },
+      bindingHints: {
+        ...recordArray,
+        description: "On provide_argument_bindings: one entry per unbound argument of the recommended candidate with its type, declared constants (allowedValues) when the vocabulary is closed, schema example values and the reason the current value was not accepted. Empty otherwise."
+      },
       warnings: stringArray
     }),
     kb_plan_bootstrap: objectData({
@@ -27400,6 +27404,7 @@ var init_candidate_helpers = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/requirement-claims.js
+import { createHash as createHash15 } from "node:crypto";
 function normalizeClaimStatement(statement) {
   return statement.replace(/^\s*(?:[-*+]|\d+[.)])\s+/, "").replace(/^\s*\[(?: |x)\]\s*/i, "").trim();
 }
@@ -27449,6 +27454,46 @@ function claimFor(statement, source, confidence, provenance) {
 function snakeSegment(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
+function fitsAspect(words) {
+  return words.length > 0 && words.length <= MAX_ASPECT_WORDS && words.join("_").length <= MAX_ASPECT_CHARS;
+}
+function trimStopWords(words) {
+  let start = 0;
+  let end = words.length;
+  while (start < end && ASPECT_STOP_WORDS.has(words[start] ?? ""))
+    start += 1;
+  while (end > start && ASPECT_STOP_WORDS.has(words[end - 1] ?? ""))
+    end -= 1;
+  return words.slice(start, end);
+}
+function shortenSubjectAspect(aspect) {
+  const words = aspect.split("_").filter(Boolean);
+  if (fitsAspect(words))
+    return aspect;
+  const boundary = words.findIndex((word, index) => index > 0 && ASPECT_BOUNDARY_WORDS.has(word) && trimStopWords(words.slice(0, index)).length > 0);
+  const head = trimStopWords(boundary < 0 ? words : words.slice(0, boundary));
+  if (fitsAspect(head))
+    return head.join("_");
+  const content = head.filter((word) => !ASPECT_STOP_WORDS.has(word) && !(word.length > 4 && word.endsWith("ly")));
+  if (fitsAspect(content))
+    return content.join("_");
+  const picked = Array.from(new Set([content[0], ...content.slice(-(MAX_ASPECT_WORDS - 2))])).filter((word) => typeof word === "string");
+  while (picked.length > 1 && picked.join("_").length > MAX_ASPECT_CHARS)
+    picked.splice(1, 1);
+  const short = picked.join("_");
+  return short.length > 0 ? short.slice(0, MAX_ASPECT_CHARS).replace(/_+$/, "") : (words[0] ?? aspect).slice(0, MAX_ASPECT_CHARS);
+}
+function withShortAspect(component, aspect) {
+  const full = `${component}.${aspect}`;
+  const short = shortenSubjectAspect(aspect);
+  const candidate = `${component}.${short}`;
+  if (!isConventionalSubjectKey(candidate))
+    return {
+      ok: false,
+      reason: `subject key "${candidate}" does not follow component.aspect[.sub]`
+    };
+  return short === aspect ? { ok: true, subjectKey: candidate } : { ok: true, subjectKey: candidate, shortenedFrom: full };
+}
 function resolveBootstrapSubjectKey(subject, propertyKey, component) {
   const stripped = subject.trim().replace(/^(?:the|a|an)\s+/i, "");
   let key;
@@ -27462,25 +27507,148 @@ function resolveBootstrapSubjectKey(subject, propertyKey, component) {
   const flat = key.replace(/\./g, "_");
   const comp = component === undefined ? "" : snakeSegment(component);
   const property = snakeSegment(propertyKey);
-  let candidate;
   if (comp) {
     const aspect = flat === comp ? property : flat.startsWith(`${comp}_`) ? flat.slice(comp.length + 1) : flat;
-    candidate = `${comp}.${aspect}`;
-  } else if (/^[a-z][a-z0-9]*$/.test(flat) && property) {
-    candidate = `${flat}.${property}`;
-  } else {
-    return {
-      ok: false,
-      reason: `subject key "${flat}" names no component, so it would violate component.aspect[.sub]`
-    };
+    return withShortAspect(comp, aspect);
   }
-  return isConventionalSubjectKey(candidate) ? { ok: true, subjectKey: candidate } : {
+  if (/^[a-z][a-z0-9]*$/.test(flat) && property)
+    return withShortAspect(flat, property);
+  return {
     ok: false,
-    reason: `subject key "${candidate}" does not follow component.aspect[.sub]`
+    reason: `subject key "${flat}" names no component, so it would violate component.aspect[.sub]`
+  };
+}
+
+class SubjectKeyRegistry {
+  owners = new Map;
+  assigned = new Map;
+  assign(resolution) {
+    const identity = resolution.shortenedFrom ?? resolution.subjectKey;
+    const known = this.assigned.get(identity);
+    if (known !== undefined)
+      return { subjectKey: known };
+    const owner = this.owners.get(resolution.subjectKey);
+    if (owner === undefined || owner === identity) {
+      this.owners.set(resolution.subjectKey, identity);
+      this.assigned.set(identity, resolution.subjectKey);
+      return { subjectKey: resolution.subjectKey };
+    }
+    const used = new Set(resolution.subjectKey.split(/[._]/));
+    const fullWords = identity.split(".").slice(1).join("_").split("_");
+    const qualifier = fullWords.find((word) => /^[a-z][a-z0-9]*$/.test(word) && !used.has(word) && !ASPECT_STOP_WORDS.has(word) && !ASPECT_BOUNDARY_WORDS.has(word) && !this.owners.has(`${resolution.subjectKey}.${word}`));
+    const subjectKey = `${resolution.subjectKey}.${qualifier ?? `k${digest(identity)}`}`;
+    this.owners.set(subjectKey, identity);
+    this.assigned.set(identity, subjectKey);
+    return { subjectKey, collidedWith: resolution.subjectKey };
+  }
+}
+function digest(value) {
+  return createHash15("sha256").update(value).digest("hex").slice(0, 6);
+}
+function planSubjectKey(subject, propertyKey, component, registry, location) {
+  const resolved = resolveBootstrapSubjectKey(subject, propertyKey, component);
+  if (!resolved.ok)
+    return { resolution: resolved, diagnostics: [] };
+  const diagnostics = [];
+  const assigned = registry?.assign(resolved) ?? {
+    subjectKey: resolved.subjectKey
+  };
+  if (resolved.shortenedFrom)
+    diagnostics.push(`subject-key-shortened: claim at ${location} would have the subject key ${resolved.shortenedFrom}; its aspect is longer than ${MAX_ASPECT_WORDS} words or ${MAX_ASPECT_CHARS} characters, so the plan uses ${assigned.subjectKey}. Rename the subject after apply if another noun phrase fits better.`);
+  if (assigned.collidedWith)
+    diagnostics.push(`subject-key-disambiguated: claim at ${location} names a different subject than an earlier claim keyed ${assigned.collidedWith}, so the plan uses ${assigned.subjectKey} instead of reusing that key.`);
+  return {
+    resolution: {
+      ok: true,
+      subjectKey: assigned.subjectKey,
+      ...resolved.shortenedFrom ? { shortenedFrom: resolved.shortenedFrom } : {}
+    },
+    diagnostics
   };
 }
+var MAX_ASPECT_WORDS = 4, MAX_ASPECT_CHARS = 40, ASPECT_BOUNDARY_WORDS, ASPECT_STOP_WORDS;
 var init_requirement_claims = __esm(() => {
   init_strict_modeling();
+  ASPECT_BOUNDARY_WORDS = new Set([
+    "when",
+    "whenever",
+    "while",
+    "if",
+    "unless",
+    "without",
+    "after",
+    "before",
+    "until",
+    "because",
+    "once",
+    "as",
+    "by",
+    "via",
+    "during",
+    "except",
+    "so",
+    "that",
+    "which",
+    "who",
+    "where",
+    "since",
+    "for",
+    "and",
+    "or"
+  ]);
+  ASPECT_STOP_WORDS = new Set([
+    "a",
+    "an",
+    "the",
+    "be",
+    "is",
+    "are",
+    "was",
+    "were",
+    "been",
+    "being",
+    "to",
+    "of",
+    "in",
+    "on",
+    "at",
+    "with",
+    "from",
+    "into",
+    "its",
+    "it",
+    "their",
+    "they",
+    "them",
+    "this",
+    "these",
+    "those",
+    "can",
+    "could",
+    "will",
+    "would",
+    "may",
+    "might",
+    "must",
+    "shall",
+    "should",
+    "do",
+    "does",
+    "has",
+    "have",
+    "had",
+    "any",
+    "all",
+    "each",
+    "every",
+    "some",
+    "only",
+    "also",
+    "then",
+    "than",
+    "not",
+    "no"
+  ]);
 });
 
 // ../cli/dist/operations/bootstrap/markdown-candidates.js
@@ -27550,7 +27718,7 @@ function markdownComponentHint(relativePath) {
   }
   return;
 }
-function requirementCandidate(item, statement, line, heading, headingLine, existingIds, minConfidence) {
+function requirementCandidate(item, statement, line, heading, headingLine, existingIds, minConfidence, subjectKeys, diagnostics) {
   const relativePath = item.relativePath ?? item.label;
   const base = /\bshall\b/i.test(statement) ? 0.86 : /\bmust\b/i.test(statement) ? 0.84 : 0.78;
   const confidence = Math.min(0.95, base + (heading && /requirements?|constraints?|polic(?:y|ies)|rules?/i.test(heading) ? 0.08 : 0));
@@ -27559,7 +27727,8 @@ function requirementCandidate(item, statement, line, heading, headingLine, exist
   const claim = claimFor(statement, relativePath, confidence, `${relativePath}#L${line}`);
   if (!claim)
     return null;
-  const subjectKey = resolveBootstrapSubjectKey(claim.subjectKey, claim.propertyKey, markdownComponentHint(relativePath));
+  const planned = planSubjectKey(claim.subjectKey, claim.propertyKey, markdownComponentHint(relativePath), subjectKeys, `${relativePath}#L${line}`);
+  const subjectKey = planned.resolution;
   if (!subjectKey.ok)
     throw new Error(`${subjectKey.reason}; author it with kb_model and a component.aspect subjectKey`);
   const writeSet = buildStrictWriteSet({
@@ -27568,6 +27737,7 @@ function requirementCandidate(item, statement, line, heading, headingLine, exist
   });
   if (!writeSet.isStrict)
     return null;
+  diagnostics.push(...planned.diagnostics);
   return {
     candidateId: `norm:${writeSet.req.id.toLowerCase()}`,
     entityType: "req",
@@ -27588,7 +27758,7 @@ function requirementCandidate(item, statement, line, heading, headingLine, exist
     applyPlan: strictPlan(writeSet).map((step) => step.type === "req" ? withDocumentBody(step, provenanceRequirementBody(statement, bootstrapProvenance("generic markdown", `${relativePath} line ${line}${heading ? ` under the heading "${heading}"` : ""}`, confidence), `${relativePath}#L${line}`)) : step)
   };
 }
-function markdownCandidates(item, existingIds, minConfidence) {
+function markdownCandidates(item, existingIds, minConfidence, subjectKeys) {
   const candidates = [];
   const sourceOnlySignals = [];
   const diagnostics = [];
@@ -27617,7 +27787,7 @@ function markdownCandidates(item, existingIds, minConfidence) {
     if (!statement || !/\b(must|shall|should)\b/i.test(statement))
       continue;
     try {
-      const candidate = requirementCandidate(item, statement, index + 1, heading, headingLine, existingIds, minConfidence);
+      const candidate = requirementCandidate(item, statement, index + 1, heading, headingLine, existingIds, minConfidence, subjectKeys, diagnostics);
       if (candidate) {
         if (!candidate.applyPlan.some((payload) => payload.type === "req" && existingIds.has(String(payload.id))))
           candidates.push(candidate);
@@ -27748,7 +27918,7 @@ function providerCandidate(item, existingIds, minConfidence) {
     }
   ];
 }
-function buildBootstrapCandidates(evidence, existingIds, minConfidence, includeGenericMarkdown) {
+function buildBootstrapCandidates(evidence, existingIds, minConfidence, includeGenericMarkdown, subjectKeys) {
   const candidates = [];
   const sourceOnlySignals = [];
   const diagnostics = [];
@@ -27771,7 +27941,7 @@ function buildBootstrapCandidates(evidence, existingIds, minConfidence, includeG
       }
     }
     if (item.kind === "generic_markdown" && includeGenericMarkdown) {
-      const built = markdownCandidates(item, existingIds, minConfidence);
+      const built = markdownCandidates(item, existingIds, minConfidence, subjectKeys);
       candidates.push(...built.candidates);
       sourceOnlySignals.push(...built.sourceOnlySignals);
       diagnostics.push(...built.diagnostics);
@@ -28019,13 +28189,13 @@ var init_discovery_evidence = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/types.js
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 function bootstrapPlanHash(plan) {
   const { planHash: _ignored, ...body } = plan;
-  return createHash15("sha256").update(canonicalize(body)).digest("hex");
+  return createHash16("sha256").update(canonicalize(body)).digest("hex");
 }
 function bootstrapEmptyKbSnapshotId(input) {
-  return `empty-source-state-${createHash15("sha256").update(canonicalize({
+  return `empty-source-state-${createHash16("sha256").update(canonicalize({
     version: "kibi.empty-source-state.v1",
     branch: input.branch,
     workspaceSnapshot: input.workspaceSnapshot,
@@ -28162,7 +28332,7 @@ var init_discovery = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/intent-claims.js
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 function citation(source, claim) {
   return [
     `intent_claim:${source.id}:${claim.reference}`,
@@ -28171,8 +28341,8 @@ function citation(source, claim) {
     ...source.connector ? [`connector:${source.connector}`] : []
   ];
 }
-function digest(...parts) {
-  return createHash16("sha256").update(parts.join("\x00")).digest("hex").slice(0, 16).toUpperCase();
+function digest2(...parts) {
+  return createHash17("sha256").update(parts.join("\x00")).digest("hex").slice(0, 16).toUpperCase();
 }
 function claimBody(source, claim) {
   return renderRequirementBody({
@@ -28195,7 +28365,7 @@ function withRationale(step, rationale) {
   return { ...step, properties: { ...properties, rationale } };
 }
 function reviewClaimCandidate(source, claim, kind, confidence) {
-  const id = `FACT-BOOTSTRAP-${kind === "open_question" ? "QUESTION" : "OBSERVATION"}-${digest(source.id, claim.reference, claim.statement)}`;
+  const id = `FACT-BOOTSTRAP-${kind === "open_question" ? "QUESTION" : "OBSERVATION"}-${digest2(source.id, claim.reference, claim.statement)}`;
   const entity = {
     type: "fact",
     id,
@@ -28240,7 +28410,7 @@ function conflictCandidates(declared, sources, existingIds, minConfidence) {
       diagnostics.push(`Conflict "${conflict.note}" cites claim(s) not declared in intentClaims: ${undeclared.map((ref) => `${ref.sourceId}:${ref.reference}`).join(", ")}; declare them or correct the reference.`);
       continue;
     }
-    const id = `FACT-BOOTSTRAP-CONFLICT-${digest(...[...refs].sort(), conflict.note)}`;
+    const id = `FACT-BOOTSTRAP-CONFLICT-${digest2(...[...refs].sort(), conflict.note)}`;
     const candidateId = `conflict:${id.toLowerCase()}`;
     if (confidence < minConfidence) {
       suppressed.push({
@@ -28315,7 +28485,7 @@ ${evidenceLines.join(`
   }
   return { candidates, sourceOnlySignals: [], suppressed, diagnostics };
 }
-function buildIntentClaimCandidates(declared, existingIds, minConfidence) {
+function buildIntentClaimCandidates(declared, existingIds, minConfidence, subjectKeys) {
   const sources = new Map((declared.knowledgeSources ?? []).map((source) => [source.id, source]));
   const candidates = [];
   const sourceOnlySignals = [];
@@ -28371,7 +28541,9 @@ function buildIntentClaimCandidates(declared, existingIds, minConfidence) {
     let writeSet = null;
     try {
       const modeled = claimFor(claim.statement, `knowledge-source:${source.id}`, confidence, provenance);
-      const subjectKey = modeled ? resolveBootstrapSubjectKey(modeled.subjectKey, modeled.propertyKey, claim.component ?? source.component) : null;
+      const planned = modeled ? planSubjectKey(modeled.subjectKey, modeled.propertyKey, claim.component ?? source.component, subjectKeys, `${source.id}:${claim.reference}`) : null;
+      const subjectKey = planned?.resolution ?? null;
+      diagnostics.push(...planned?.diagnostics ?? []);
       writeSet = modeled && subjectKey?.ok ? buildStrictWriteSet({
         claim: { ...modeled, subjectKey: subjectKey.subjectKey },
         statement: claim.statement
@@ -30208,7 +30380,6 @@ var init_analysis_receipt = __esm(() => {
 // ../cli/dist/operations/semantic-advisor/observation-plan.js
 function observationPlan(payload, title, tags) {
   const factId = `FACT-OBS-${shortHash(`${stringValue2(payload.id)}.${title}.${statementOf(payload)}`)}`;
-  const target = tags.includes("review:ambiguity") ? "review:ambiguous-claim" : tags.includes("review:keyword-false-positive") ? "review:keyword-false-positive" : tags.includes("review:ontology-gap") ? "review:ontology-gap" : tags.includes("review:nonlogical") ? "review:nonlogical" : undefined;
   return [
     {
       type: "fact",
@@ -30221,7 +30392,13 @@ function observationPlan(payload, title, tags) {
         text_ref: statementOf(payload),
         tags
       },
-      relationships: target === undefined ? [] : [relationship(factId, target, "relates_to")]
+      document: {
+        body: `${title}. The semantic advisor suggested this review observation because the prose below is not safely grounded by a typed fact; it stays open until a reviewer models, rewords or dismisses the claim.
+
+> ${statementOf(payload).trim().replace(/\n/g, `
+> `)}`
+      },
+      relationships: []
     }
   ];
 }
@@ -31006,7 +31183,7 @@ var init_validation2 = __esm(() => {
 });
 
 // ../cli/dist/operations/bootstrap/generate.js
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import path31 from "node:path";
 function filterSourceOnlySignals(signals, entityTypes) {
   return entityTypes && entityTypes.length > 0 ? signals.filter((signal) => entityTypes.includes(signal.kind)) : signals;
@@ -31025,7 +31202,7 @@ function firstUpsertId(candidate) {
   return properties !== null && typeof properties === "object" && "id" in properties && typeof properties.id === "string" ? properties.id : "";
 }
 function sha2562(value) {
-  return createHash17("sha256").update(value).digest("hex");
+  return createHash18("sha256").update(value).digest("hex");
 }
 function selectBootstrapCandidates(input, existingIds, entityTypes, maximum) {
   const allowed = entityTypes?.length ? new Set(entityTypes) : null;
@@ -31240,13 +31417,14 @@ async function executePlanBootstrap(args, context) {
     })
   ]);
   const bound = await expectedSnapshots(context, discovery.evidence.map((evidence) => evidence.relativePath).filter((value) => Boolean(value)));
-  const built = discovery.activation.allowCandidateGeneration ? buildBootstrapCandidates(discovery.evidence, new Set, minConfidence, includeGenericMarkdown) : {
+  const subjectKeys = new SubjectKeyRegistry;
+  const built = discovery.activation.allowCandidateGeneration ? buildBootstrapCandidates(discovery.evidence, new Set, minConfidence, includeGenericMarkdown, subjectKeys) : {
     candidates: [],
     sourceOnlySignals: [],
     suppressed: [],
     diagnostics: []
   };
-  const claimed = discovery.activation.allowCandidateGeneration ? buildIntentClaimCandidates(declared, existingIds, minConfidence) : {
+  const claimed = discovery.activation.allowCandidateGeneration ? buildIntentClaimCandidates(declared, existingIds, minConfidence, subjectKeys) : {
     candidates: [],
     sourceOnlySignals: [],
     suppressed: [],
@@ -31298,6 +31476,7 @@ var init_generate = __esm(() => {
   init_discovery();
   init_intent_claims();
   init_presentation();
+  init_requirement_claims();
   init_validation2();
   init_types();
 });
@@ -31570,7 +31749,7 @@ var init_aggregated_checks = __esm(() => {
 });
 
 // ../cli/dist/traceability/impact-review.js
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 function canonicalJson2(value) {
   const active = new Set;
   const encode = (item) => {
@@ -31604,10 +31783,10 @@ function canonicalJson2(value) {
   return encode(value);
 }
 function fingerprint(value) {
-  return `sha256:${createHash18("sha256").update(canonicalJson2(value), "utf8").digest("hex")}`;
+  return `sha256:${createHash19("sha256").update(canonicalJson2(value), "utf8").digest("hex")}`;
 }
 function fingerprintBytes(value) {
-  return `sha256:${createHash18("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash19("sha256").update(value).digest("hex")}`;
 }
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -32237,7 +32416,7 @@ var init_source_classification = __esm(() => {
 });
 
 // ../cli/dist/plugins/source-analysis-service.js
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import * as path33 from "node:path";
 function detectSourceLanguage(filePath) {
   return extensionLanguage(filePath);
@@ -32245,7 +32424,7 @@ function detectSourceLanguage(filePath) {
 function createV2Request(filePath, content, explicitLanguageHint) {
   const classification = classifySource(filePath, content, explicitLanguageHint);
   const language = classification.language;
-  const inputFingerprint = createHash19("sha256").update(filePath).update("\x00").update(content).update("\x00").update(classification.kind).update("\x00").update(classification.language).update("\x00").update(explicitLanguageHint?.trim().toLowerCase() ?? "").digest("hex");
+  const inputFingerprint = createHash20("sha256").update(filePath).update("\x00").update(content).update("\x00").update(classification.kind).update("\x00").update(classification.language).update("\x00").update(explicitLanguageHint?.trim().toLowerCase() ?? "").digest("hex");
   return {
     classification,
     input: {
@@ -32407,7 +32586,7 @@ class SourceAnalysisService {
         providerId: entry.capability.id,
         stamp: entry.stamp,
         inputFingerprint: request.inputFingerprint,
-        providerFingerprint: this.options.providerFingerprints?.[entry.pluginId] ?? createHash19("sha256").update(`${entry.pluginId}\x00${entry.pluginVersion}\x00${entry.stamp.capability}`).digest("hex"),
+        providerFingerprint: this.options.providerFingerprints?.[entry.pluginId] ?? createHash20("sha256").update(`${entry.pluginId}\x00${entry.pluginVersion}\x00${entry.stamp.capability}`).digest("hex"),
         shadowComparisons: []
       };
     } catch (error) {
@@ -32527,7 +32706,7 @@ var init_source_analysis_service = __esm(() => {
 });
 
 // ../cli/dist/plugins/maintenance-source-analysis.js
-import { createHash as createHash20 } from "node:crypto";
+import { createHash as createHash21 } from "node:crypto";
 import { readFileSync as readFileSync16, realpathSync as realpathSync5 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 import { dirname as dirname7, isAbsolute as isAbsolute6, join as join13, relative as relative5, resolve as resolve7 } from "node:path";
@@ -32540,7 +32719,7 @@ function digestFile(root, file) {
   const actualRel = relative5(realpathSync5(root), actual);
   if (actualRel.startsWith("..") || isAbsolute6(actualRel))
     throw new Error(`Approved asset escapes its package: ${file}`);
-  return createHash20("sha256").update(readFileSync16(actual)).digest("hex");
+  return createHash21("sha256").update(readFileSync16(actual)).digest("hex");
 }
 function verifyFiles(root, files) {
   if (Object.keys(files).length === 0)
@@ -32609,7 +32788,7 @@ function verifyApprovedSourceAnalyzer(root, approval) {
     if (metadata.version !== dependency.version)
       throw new Error(`Unapproved source runtime version: ${dependency.packageName}`);
   }
-  return createHash20("sha256").update(JSON.stringify(approval)).digest("hex");
+  return createHash21("sha256").update(JSON.stringify(approval)).digest("hex");
 }
 function createMaintenanceSourceAnalysisService(workspaceRoot, projectConfig) {
   const config = projectConfig ?? readProjectKibiConfig(workspaceRoot);
@@ -40581,7 +40760,7 @@ async function enrichSymbolCoordinatesWithTsMorph(entries, workspaceRoot) {
 var init_symbols_ts = () => {};
 
 // ../cli/dist/traceability/symbol-extract.js
-import { createHash as createHash22 } from "node:crypto";
+import { createHash as createHash23 } from "node:crypto";
 function createManifestLookupSentinelKey(manifestPath) {
   return `${MANIFEST_SENTINEL_PREFIX}${manifestPath}`;
 }
@@ -40593,7 +40772,7 @@ function getCandidateManifestPaths(filePath) {
   return LOCAL_MANIFEST_NAMES.map((manifestName) => `${dir}/${manifestName}`);
 }
 function createHashFallbackId(filePath, name) {
-  const h = createHash22("sha256");
+  const h = createHash23("sha256");
   h.update(`${filePath}:${name}`);
   return h.digest("hex").slice(0, 16);
 }
@@ -40681,7 +40860,7 @@ function buildSymbolResult(stagedFile, name, kind, span, inlineReqLinks, manifes
   };
 }
 function computeContentSha(content) {
-  const h = createHash22("sha256");
+  const h = createHash23("sha256");
   h.update(content);
   return h.digest("hex");
 }
@@ -51991,7 +52170,7 @@ var require_out4 = __commonJS(function(exports2, module2) {
 
 // ../cli/dist/commands/sync/discovery.js
 import { execFile } from "node:child_process";
-import { createHash as createHash23 } from "node:crypto";
+import { createHash as createHash24 } from "node:crypto";
 import * as fs5 from "node:fs";
 import { existsSync as existsSync23, readFileSync as readFileSync24, readdirSync as readdirSync6, unlinkSync as unlinkSync4 } from "node:fs";
 import * as path47 from "node:path";
@@ -52026,13 +52205,13 @@ function pendingSourcePaths(cwd, recoverMissing) {
               receiptPath,
               path: relative,
               afterHash: receipt.afterHash,
-              rawHash: createHash23("sha256").update(raw).digest("hex")
+              rawHash: createHash24("sha256").update(raw).digest("hex")
             });
             continue;
           }
           throw new Error(`Pending source is missing: ${relative}. If the file was deleted on purpose, run 'kibi branch recover --apply' to rebuild the branch KB from the sources that remain.`);
         }
-        const actual = createHash23("sha256").update(readFileSync24(absolute)).digest("hex");
+        const actual = createHash24("sha256").update(readFileSync24(absolute)).digest("hex");
         if (actual !== receipt.afterHash) {
           throw new Error(`Pending source hash drift blocks sync for ${relative}; expected ${receipt.afterHash}, found ${actual}`);
         }
@@ -52080,7 +52259,7 @@ function clearRecoveredPendingSourceReceipts(cwd, receipts) {
     const raw = readTextOrEnoent(absolute);
     if (raw === null)
       continue;
-    const rawHash = createHash23("sha256").update(raw).digest("hex");
+    const rawHash = createHash24("sha256").update(raw).digest("hex");
     if (rawHash !== receipt.rawHash) {
       throw new Error(`Pending source receipt changed during recovery for ${receipt.path}; refusing to retire newer receipt`);
     }
@@ -53868,7 +54047,7 @@ function scoreExactPredicates3(schema, text) {
 }
 
 // ../cli/dist/operations/modeling/predicate-utils.js
-import { createHash as createHash24 } from "node:crypto";
+import { createHash as createHash25 } from "node:crypto";
 function normalizeText2(text) {
   const normalized = String(text ?? "").trim();
   if (!normalized) {
@@ -53892,7 +54071,7 @@ function slug2(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 function hashId(prefix, parts) {
-  const digest = createHash24("sha256").update(parts.join("\x00")).digest("hex").slice(0, 12).toUpperCase();
+  const digest = createHash25("sha256").update(parts.join("\x00")).digest("hex").slice(0, 12).toUpperCase();
   return `${prefix}-${digest}`;
 }
 function inferSubject(text, subjectHint) {
@@ -54556,11 +54735,43 @@ function isGenericPlaceholder(value) {
   const normalized = value.trim().toLowerCase();
   return PLACEHOLDER_VALUES.has(normalized) || normalized === "unknown" || normalized.startsWith("requirement.") || normalized.endsWith("_policy") && ["executable", "cwd", "environment", "stdio", "termination"].some((kind) => normalized.startsWith(kind));
 }
-function classifyBinding(value, text, explicit, canonical = false) {
+function bindingToken(value) {
+  return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function claimNames(text, token) {
+  if (!text || !token)
+    return false;
+  const words = token.split("_").filter(Boolean);
+  if (words.length === 0)
+    return false;
+  return new RegExp(`\\b${words.join("[\\s_-]+")}\\b`, "i").test(text);
+}
+function matchesConstant(value, context) {
+  const token = bindingToken(value);
+  return context.constants?.some((constant) => bindingToken(constant) === token) ?? false;
+}
+function nameOrStopWordReason(value, context = {}) {
+  const token = bindingToken(value);
+  if (token === "true" || token === "false")
+    return null;
+  if (matchesConstant(value, context))
+    return null;
+  if (STOP_WORD_BINDINGS.has(token))
+    return `"${token}" is a stop word`;
+  const own = context.argumentName ? bindingToken(context.argumentName) : "";
+  const repeatsName = own !== "" && token === own || (context.argumentNames ?? []).some((name) => bindingToken(name) === token);
+  if (repeatsName && !claimNames(context.text, token))
+    return `it repeats the argument name ${token} and the claim does not name it`;
+  return null;
+}
+function classifyBinding(value, text, explicit, canonical = false, context = {}) {
   const normalized = value.trim();
-  if (canonical && !isGenericPlaceholder(normalized))
+  if (nameOrStopWordReason(normalized, { ...context, text }) !== null)
+    return "placeholder";
+  const constant = matchesConstant(normalized, context);
+  if (canonical && (constant || !isGenericPlaceholder(normalized)))
     return "extracted";
-  if (explicit && (!isGenericPlaceholder(normalized) || ["true", "false"].includes(normalized.toLowerCase())))
+  if (explicit && (constant || !isGenericPlaceholder(normalized) || ["true", "false"].includes(normalized.toLowerCase())))
     return "explicit";
   if (!normalized || isGenericPlaceholder(normalized))
     return "placeholder";
@@ -54574,7 +54785,7 @@ function aggregateBindingProvenance(values) {
 function bindingCanBeApplied(value) {
   return value === "explicit" || value === "extracted";
 }
-var PLACEHOLDER_VALUES, DERIVED_CUE_ALIASES, PROVENANCE_ORDER;
+var PLACEHOLDER_VALUES, DERIVED_CUE_ALIASES, STOP_WORD_BINDINGS, PROVENANCE_ORDER;
 var init_predicate_bindings = __esm(() => {
   PLACEHOLDER_VALUES = new Set([
     "unknown",
@@ -54646,6 +54857,62 @@ var init_predicate_bindings = __esm(() => {
     actionable_error: ["actionable", "clear error", "report", "error"],
     exception: ["exception", "except", "package-manager", "package manager"]
   };
+  STOP_WORD_BINDINGS = new Set([
+    "a",
+    "an",
+    "the",
+    "be",
+    "is",
+    "are",
+    "was",
+    "were",
+    "been",
+    "being",
+    "am",
+    "do",
+    "does",
+    "did",
+    "done",
+    "have",
+    "has",
+    "had",
+    "it",
+    "its",
+    "this",
+    "that",
+    "these",
+    "those",
+    "they",
+    "them",
+    "there",
+    "thing",
+    "something",
+    "anything",
+    "some",
+    "any",
+    "of",
+    "to",
+    "in",
+    "at",
+    "by",
+    "for",
+    "with",
+    "and",
+    "or",
+    "not",
+    "null",
+    "nil",
+    "n_a",
+    "na",
+    "tbd",
+    "todo",
+    "x",
+    "xxx",
+    "foo",
+    "bar",
+    "example",
+    "placeholder"
+  ]);
   PROVENANCE_ORDER = [
     "explicit",
     "extracted",
@@ -55362,7 +55629,11 @@ function buildSuggestion(schema, text, subject, score, argumentBindings = {}, po
   const undeclaredArguments = new Set(conformance.undeclared.map((value) => value.argumentName));
   const bindingProvenanceByArgument = Object.fromEntries(schema.argument_names.map((name, index) => [
     name,
-    classifyBinding(predicateArgs[index] ?? "unknown", text, typeof argumentBindings[name] === "string" && argumentBindings[name].trim().length > 0 || diagnostics?.explicitSubject === true && index === 0, canonicalLauncherArgs?.[index] === predicateArgs[index] && !(index === 0 && predicateArgs[index] === "launcher" && diagnostics?.explicitSubject !== true && typeof argumentBindings[name] !== "string"))
+    classifyBinding(predicateArgs[index] ?? "unknown", text, typeof argumentBindings[name] === "string" && argumentBindings[name].trim().length > 0 || diagnostics?.explicitSubject === true && index === 0, canonicalLauncherArgs?.[index] === predicateArgs[index] && !(index === 0 && predicateArgs[index] === "launcher" && diagnostics?.explicitSubject !== true && typeof argumentBindings[name] !== "string"), index === 0 && diagnostics?.explicitSubject === true && typeof argumentBindings[name] !== "string" ? { constants: schema.argument_constants?.[name] } : {
+      argumentName: name,
+      argumentNames: schema.argument_names,
+      constants: schema.argument_constants?.[name]
+    })
   ]));
   const bindingProvenance = aggregateBindingProvenance(Object.values(bindingProvenanceByArgument));
   const unboundArguments = schema.argument_names.filter((name) => undeclaredArguments.has(name) || !bindingCanBeApplied(bindingProvenanceByArgument[name] ?? "placeholder"));
@@ -55452,8 +55723,21 @@ function buildRelationshipPlan(factId, requirementId, claimText, existingLogicCl
     instructions: `Apply the predicate fact ${factId} first, update the requirement with the returned merged logicClaims manifest, then attach this relationship without overwriting other requirement metadata. The relationship target is the planned fact id ${factId}, never a candidates[].id (SUGGEST-...).`
   };
 }
+function gapObservationBody(text, args) {
+  const origin = [
+    args.requirementId ? `requirement ${args.requirementId}` : null,
+    args.source ? `source ${args.source}` : null
+  ].filter((value) => value !== null);
+  return [
+    "No available predicate schema fits this claim, so kb_model mode predicates recorded it as an open ontology gap. The observation does not ground the claim; it stays visible for review until a reviewed predicate_schema covers this kind of statement.",
+    ...origin.length > 0 ? [`Claim from ${origin.join(", ")}:`] : ["Claim:"],
+    `> ${text.trim().replace(/\n/g, `
+> `)}`
+  ].join(`
+
+`);
+}
 function buildGapApplyPlan(text, args) {
-  const claimKey = semanticClaimKey(text);
   const factId = hashId("FACT-ONTOLOGY-GAP", [
     args.requirementId ?? "",
     args.source ?? "",
@@ -55467,20 +55751,14 @@ function buildGapApplyPlan(text, args) {
         title: "Ontology gap: predicate schema needed",
         status: "active",
         source: args.source ?? "mcp://kibi/suggest-predicates",
-        text_ref: args.source,
+        ...args.source ? { text_ref: args.source } : {},
         tags: ["review:ontology-gap", "needs_schema_extension"],
         fact_kind: "observation",
         value_string: text,
-        claim_key: claimKey,
         claim_text: text
       },
-      relationships: [
-        {
-          type: "relates_to",
-          from: factId,
-          to: "review:ontology-gap"
-        }
-      ]
+      document: { body: gapObservationBody(text, args) },
+      relationships: []
     }
   ];
 }
@@ -55543,6 +55821,84 @@ var init_predicate_applyplan = __esm(() => {
   init_predicate_utils();
 });
 
+// ../cli/dist/operations/modeling/predicate-binding-hints.js
+function exampleArguments(example) {
+  const open = example.indexOf("(");
+  const close = example.lastIndexOf(")");
+  if (open < 0 || close <= open)
+    return [];
+  const inner = example.slice(open + 1, close);
+  const args = [];
+  let depth = 0;
+  let current = "";
+  for (const char of inner) {
+    if (char === "(" || char === "[")
+      depth += 1;
+    if (char === ")" || char === "]")
+      depth -= 1;
+    if (char === "," && depth === 0) {
+      args.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  args.push(current.trim());
+  return args.filter(Boolean);
+}
+function unboundReason(candidate, name, value, text) {
+  const schema = candidate.schema;
+  const provenance = candidate.binding_provenance_by_argument[name];
+  const nameReason = nameOrStopWordReason(value, {
+    argumentName: name,
+    argumentNames: schema.argument_names,
+    constants: schema.argument_constants?.[name],
+    text
+  });
+  if (nameReason !== null)
+    return `The value "${value}" is not a binding: ${nameReason}.`;
+  if (!value.trim() || isGenericPlaceholder(value))
+    return "The claim text names no value for this argument.";
+  if (provenance === "inferred")
+    return `The value "${value}" was inferred and does not appear in the claim text; confirm it or pass the exact value.`;
+  if (schema.argument_constants?.[name])
+    return `The value "${value}" is not one of this argument's declared constants.`;
+  return `The value "${value}" needs review.`;
+}
+function buildBindingHints(candidate, text) {
+  const schema = candidate.schema;
+  const parsedExamples = schema.examples.map(exampleArguments);
+  return candidate.unbound_arguments.map((name) => {
+    const position = schema.argument_names.indexOf(name);
+    const constants = schema.argument_constants?.[name];
+    const exampleValues = parsedExamples.map((args) => args[position]).filter((value) => typeof value === "string");
+    const examples = Array.from(new Set([...constants ?? [], ...exampleValues])).slice(0, MAX_EXAMPLES);
+    const current = candidate.predicate_args[position] ?? "";
+    const description = schema.argument_descriptions?.[position];
+    return {
+      argument: name,
+      position,
+      type: schema.argument_types[position] ?? "unknown",
+      ...description ? { description } : {},
+      ...constants ? { allowedValues: [...constants] } : {},
+      examples,
+      currentValue: current,
+      provenance: candidate.binding_provenance_by_argument[name] ?? "placeholder",
+      reason: unboundReason(candidate, name, current, text)
+    };
+  });
+}
+function describeBindingHints(hints) {
+  return hints.map((hint) => {
+    const values = hint.allowedValues ? `one of ${hint.allowedValues.join(", ")}` : hint.examples.length > 0 ? `e.g. ${hint.examples.join(", ")}` : "no example in the schema";
+    return `${hint.argument} (${hint.type}, ${values})`;
+  }).join("; ");
+}
+var MAX_EXAMPLES = 5;
+var init_predicate_binding_hints = __esm(() => {
+  init_predicate_bindings();
+});
+
 // ../cli/dist/operations/modeling/suggest-predicates.js
 function analyzeInputPropositions(text) {
   return analyzeSemanticAdvisorInput({
@@ -55769,15 +56125,16 @@ async function handleKbSuggestPredicates(prolog, args, context) {
   const applyPlan = completeCandidate ? alreadyGrounded ? [] : predicatePlan : !recommendedCandidate && !unavailableSchema ? buildGapApplyPlan(text, args) : [];
   const plannedFactId = typeof predicatePlan[0]?.id === "string" ? predicatePlan[0].id : null;
   const relationshipPlan = completeCandidate && !alreadyGrounded ? buildRelationshipPlan(plannedFactId ?? "", args.requirementId, text, args.existingLogicClaims) : null;
-  const replacementPlan = alreadyGrounded && plannedFactId !== null && args.requirementId ? buildGroundingReplacementPlan(args.requirementId, plannedFactId, predicatePlan, existingGrounding) : null;
+  const replacementPlan = alreadyGrounded && plannedFactId !== null && args.requirementId ? buildGroundingReplacementPlan(args.requirementId, plannedFactId, predicatePlan, existingGrounding, await storedRequirementProperties(prolog, args.requirementId, warnings)) : null;
   const relationshipTarget = relationshipPlan !== null || replacementPlan !== null ? plannedFactId : null;
   const groundingSummary = existingGrounding.map((row) => `${row.relationship.type} -> ${row.factId}`).join(", ");
   if (alreadyGrounded) {
     warnings.push(`${args.requirementId} already grounds this claim (${claimKey}) through ${groundingSummary}. A modeled claim takes exactly one logical grounding relationship, so adding requires_predicate beside it fails the proposition-complete rule. ${replacementPlan ? "Keep the existing grounding, or follow replacementPlan to swap it for the predicate." : "Keep the existing grounding; no predicate replacement is available yet."}`);
   }
+  const bindingHints = recommendedAction === "provide_argument_bindings" && recommendedCandidate ? buildBindingHints(recommendedCandidate, text) : [];
   const recommendedPredicateSchema = !recommendedCandidate && !unavailableSchema ? buildPredicateSchemaDraft(text, subject) : null;
   const groundedPrefix = alreadyGrounded ? `${args.requirementId} already grounds this claim through ${groundingSummary}. ` : "";
-  const textSummary = groundedPrefix + (replacementPlan ? `To use ${completeCandidate?.predicate_name} instead, follow replacementPlan and link requires_predicate to ${plannedFactId}; otherwise keep the existing grounding.` : completeCandidate ? `Suggested ${candidates.length} predicate candidate(s). Top applicable match: ${completeCandidate.predicate_name}. Apply the predicate fact ${plannedFactId}, then link requires_predicate to that fact id (not a candidate id).` : recommendedCandidate ? `Matched ${recommendedCandidate.predicate_name}, but exact reviewed values are still required for: ${recommendedCandidate.unbound_arguments.join(", ")}. No apply plan was generated.` : unavailableSchema ? `Requested predicate schema ${args.schemaId} is unavailable or semantically inapplicable. No apply plan was generated.` : alreadyGrounded ? "No predicate candidate passed the semantic applicability gate; keep the existing grounding and record the ontology-gap observation in applyPlan so the missing schema stays visible." : "No predicate candidate passed the semantic applicability gate; record an ontology gap and review the generated schema draft instead of silently writing prose.");
+  const textSummary = groundedPrefix + (replacementPlan ? `To use ${completeCandidate?.predicate_name} instead, follow replacementPlan and link requires_predicate to ${plannedFactId}; otherwise keep the existing grounding.` : completeCandidate ? `Suggested ${candidates.length} predicate candidate(s). Top applicable match: ${completeCandidate.predicate_name}. Apply the predicate fact ${plannedFactId}, then link requires_predicate to that fact id (not a candidate id).` : recommendedCandidate ? `Matched ${recommendedCandidate.predicate_name}, but exact reviewed values are still required for: ${recommendedCandidate.unbound_arguments.join(", ")}. Bind them from the claim text: ${describeBindingHints(bindingHints)}. A value that repeats an argument name or a stop word stays unbound. No apply plan was generated.` : unavailableSchema ? `Requested predicate schema ${args.schemaId} is unavailable or semantically inapplicable. No apply plan was generated.` : alreadyGrounded ? "No predicate candidate passed the semantic applicability gate; keep the existing grounding and record the ontology-gap observation in applyPlan so the missing schema stays visible." : "No predicate candidate passed the semantic applicability gate; record an ontology gap and review the generated schema draft instead of silently writing prose.");
   const logicClaims = Array.from(new Set([...args.existingLogicClaims ?? [], claimKey]));
   return {
     content: [{ type: "text", text: textSummary }],
@@ -55796,12 +56153,40 @@ async function handleKbSuggestPredicates(prolog, args, context) {
       relationshipTarget,
       existingGrounding,
       replacementPlan,
+      bindingHints,
       warnings
     },
     applyPlan
   };
 }
-function buildGroundingReplacementPlan(requirementId, factId, predicatePlan, existing) {
+async function storedRequirementProperties(prolog, requirementId, warnings) {
+  if (prolog === null)
+    return null;
+  try {
+    const [stored] = await loadEntities(prolog, {
+      id: requirementId,
+      type: "req"
+    });
+    if (stored === undefined)
+      return null;
+    const restated = {};
+    for (const field of RESTATED_REQUIREMENT_FIELDS)
+      if (stored[field] !== undefined && stored[field] !== null)
+        restated[field] = stored[field];
+    return typeof restated.title === "string" && typeof restated.status === "string" ? restated : null;
+  } catch (error) {
+    warnings.push(`Requirement ${requirementId} could not be read (${error instanceof Error ? error.message : String(error)}); add its stored title and status to the last replacementPlan step before applying it.`);
+    return null;
+  }
+}
+function buildGroundingReplacementPlan(requirementId, factId, predicatePlan, existing, stored) {
+  const requirementUpsert = (relationships) => ({
+    type: "req",
+    id: requirementId,
+    ...stored === null ? {} : { properties: stored },
+    relationships
+  });
+  const restate = stored === null ? `add the requirement's stored title and status as properties (they could not be read), keep this relationship only` : "the properties restate the stored title, status and metadata; kb_upsert keeps the stored proposition ledger";
   return {
     relationshipTarget: factId,
     steps: [
@@ -55819,30 +56204,33 @@ function buildGroundingReplacementPlan(requirementId, factId, predicatePlan, exi
       },
       {
         operation: "kb_upsert",
-        input: {
-          type: "req",
-          id: requirementId,
-          relationships: [
-            { type: "requires_predicate", from: requirementId, to: factId }
-          ]
-        },
-        reason: `Link requires_predicate to ${factId}; upsert the requirement with its stored title and status and this relationship only.`
+        input: requirementUpsert([
+          { type: "requires_predicate", from: requirementId, to: factId }
+        ]),
+        reason: `Link requires_predicate to ${factId}; ${restate}.`
       }
     ],
-    instructions: `Only replace the grounding when the predicate states the claim at least as precisely as ${existing.map((row) => row.factId).join(", ")}. Run kb_check after the last step.`
+    rollback: {
+      operation: "kb_upsert",
+      input: requirementUpsert(existing.map((row) => row.relationship)),
+      reason: "Only if the last step fails: restore the retracted grounding link so the claim is grounded again."
+    },
+    instructions: `Only replace the grounding when the predicate states the claim at least as precisely as ${existing.map((row) => row.factId).join(", ")}. Apply the steps unchanged, in order and back to back: linking requires_predicate before the retraction is rejected because the claim would have two groundings, and between the retraction and the link the claim is ungrounded, so kb_check reports logic-coverage for ${requirementId} until the last step lands. If the last step fails, apply rollback. Run kb_check after the last step.`
   };
 }
 async function executeSuggestPredicates(args, context) {
   return handleKbSuggestPredicates(context.prolog ?? null, args, context);
 }
-var DEFAULT_MAX_CANDIDATES = 5, DEFAULT_MIN_SCORE2 = 0.35, NON_ASSERTIVE_PROPOSITION_ROLES, GROUNDING_RELATIONSHIP_TYPES;
+var DEFAULT_MAX_CANDIDATES = 5, DEFAULT_MIN_SCORE2 = 0.35, NON_ASSERTIVE_PROPOSITION_ROLES, GROUNDING_RELATIONSHIP_TYPES, RESTATED_REQUIREMENT_FIELDS;
 var init_suggest_predicates = __esm(() => {
+  init_discovery_entities();
   init_serialization();
   init_analyze_prose();
   init_clauses();
   init_plugin_orchestration();
   init_predicate_applicability();
   init_predicate_applyplan();
+  init_predicate_binding_hints();
   init_predicate_catalog();
   init_predicate_inference();
   init_predicate_loader();
@@ -55858,6 +56246,13 @@ var init_suggest_predicates = __esm(() => {
     "requires_predicate",
     "requires_rule"
   ];
+  RESTATED_REQUIREMENT_FIELDS = [
+    "title",
+    "status",
+    "priority",
+    "owner",
+    "tags"
+  ];
 });
 
 // ../cli/dist/public/operations/specs/modeling.js
@@ -59870,7 +60265,7 @@ var init_skills = __esm(() => {
 });
 
 // ../cli/dist/public/operations/specs/skills.js
-import { createHash as createHash25 } from "node:crypto";
+import { createHash as createHash26 } from "node:crypto";
 function assertNonEmptyString(value, field) {
   if (typeof value !== "string" || value.trim() === "") {
     throw new Error(`${field} must be a non-empty string`);
@@ -59891,7 +60286,7 @@ async function executeSkillsLoad(input, _context) {
   assertNonEmptyString(id, "id");
   const bundle = loadBundledSkill(id);
   const resources = bundle.manifest.resources ?? [];
-  const contentHash = createHash25("sha256").update(bundle.body, "utf8").digest("hex");
+  const contentHash = createHash26("sha256").update(bundle.body, "utf8").digest("hex");
   const resourceList = resources.length === 0 ? "none" : resources.join(", ");
   return {
     content: [
@@ -61648,16 +62043,16 @@ var init_audit = __esm(() => {
 });
 
 // ../cli/dist/operations/mutation/source-authoring.js
-import { createHash as createHash26 } from "node:crypto";
+import { createHash as createHash27 } from "node:crypto";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs6 from "node:fs";
 import path50 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
-function digest2(value) {
-  return createHash26("sha256").update(value).digest("hex");
+function digest3(value) {
+  return createHash27("sha256").update(value).digest("hex");
 }
 function pendingReceiptPath(workspaceRoot, relativePath) {
-  return path50.join(workspaceRoot, ".kb", "recovery", "pending-sources", `${digest2(relativePath)}.json`);
+  return path50.join(workspaceRoot, ".kb", "recovery", "pending-sources", `${digest3(relativePath)}.json`);
 }
 function writePendingSourceReceipt(workspaceRoot, relativePath, afterHash) {
   const receiptPath = pendingReceiptPath(workspaceRoot, relativePath);
@@ -62164,8 +62559,8 @@ async function writeSourceForUpsert(input, entity, existing, context, sourceDocu
   const receipt = {
     path: relative,
     mode: "write",
-    beforeHash: before === undefined ? null : digest2(before),
-    afterHash: digest2(after),
+    beforeHash: before === undefined ? null : digest3(before),
+    afterHash: digest3(after),
     created: before === undefined
   };
   const rollback = async () => {
@@ -62178,7 +62573,7 @@ async function writeSourceForUpsert(input, entity, existing, context, sourceDocu
     } catch {
       current = undefined;
     }
-    if (current !== undefined && digest2(current) !== digest2(after)) {
+    if (current !== undefined && digest3(current) !== digest3(after)) {
       writePendingSourceReceipt(context.workspaceRoot, relative, receipt.afterHash);
       console.warn(`Skipped source rollback for ${relative}: file changed after the Kibi write; kept concurrent content and recorded recovery metadata.`);
       return;
@@ -62248,7 +62643,7 @@ var init_source_authoring = __esm(() => {
 });
 
 // ../cli/dist/operations/mutation/plan-apply-journal.js
-import { createHash as createHash27, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash28, randomUUID as randomUUID3 } from "node:crypto";
 import { closeSync as closeSync3, existsSync as existsSync26, fsyncSync as fsyncSync2, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync27, readdirSync as readdirSync8, renameSync as renameSync5, statSync as statSync10, unlinkSync as unlinkSync5, writeSync as writeSync2 } from "node:fs";
 import path51 from "node:path";
 function planApplyJournalId(planHash) {
@@ -62258,7 +62653,7 @@ function isPlanApplyJournalId(value) {
   return JOURNAL_ID_PATTERN.test(value);
 }
 function contentHash(value) {
-  return createHash27("sha256").update(value).digest("hex");
+  return createHash28("sha256").update(value).digest("hex");
 }
 function errorText(error) {
   return error instanceof Error ? error.message : String(error);
@@ -63035,7 +63430,7 @@ var init_workspace_mutation_lock = __esm(() => {
 });
 
 // ../cli/dist/operations/mutation/delete.js
-import { createHash as createHash28, randomUUID as randomUUID4 } from "node:crypto";
+import { createHash as createHash29, randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync27, readFileSync as readFileSync29, writeFileSync as writeFileSync9 } from "node:fs";
 import path53 from "node:path";
 function requireProlog3(context) {
@@ -63073,7 +63468,7 @@ function sourceIsAuthored(source) {
 function fileHash(pathname) {
   if (!existsSync27(pathname))
     return null;
-  return createHash28("sha256").update(readFileSync29(pathname)).digest("hex");
+  return createHash29("sha256").update(readFileSync29(pathname)).digest("hex");
 }
 async function executeRelationshipDeleteUnlocked(selectors, context, onCommitted = () => {
   return;
@@ -63267,8 +63662,8 @@ async function executeRelationshipDeleteUnlocked(selectors, context, onCommitted
     ];
   });
   sourceWrites.push(...Array.from(sourcePatches, ([relative, patch]) => {
-    const beforeHash = createHash28("sha256").update(patch.before).digest("hex");
-    const afterHash = createHash28("sha256").update(patch.after).digest("hex");
+    const beforeHash = createHash29("sha256").update(patch.before).digest("hex");
+    const afterHash = createHash29("sha256").update(patch.after).digest("hex");
     writePendingSourceReceipt(context.workspaceRoot, relative, afterHash);
     return {
       path: relative,
@@ -63400,8 +63795,8 @@ async function executeDelete(input, context) {
             }
             const deletion = renderSourceDeletion(relativeSource, id, String(entity.type), contents);
             evolvingSourceBodies.set(relativeSource, deletion.mode === "write" ? deletion.body : undefined);
-            const beforeHash = createHash28("sha256").update(original).digest("hex");
-            const afterHash = deletion.body === undefined ? null : createHash28("sha256").update(deletion.body).digest("hex");
+            const beforeHash = createHash29("sha256").update(original).digest("hex");
+            const afterHash = deletion.body === undefined ? null : createHash29("sha256").update(deletion.body).digest("hex");
             sourceHashes[relativeSource] = beforeHash;
             sourcePlansByPath.set(relativeSource, {
               path: relativeSource,
@@ -63427,13 +63822,13 @@ async function executeDelete(input, context) {
           const relativeShard = path53.relative(context.workspaceRoot, shardPath).replaceAll("\\", "/");
           const original = readFileSync29(shardPath, "utf8");
           const body = renderShardWithout(original, selectors, shardPath);
-          const beforeHash = createHash28("sha256").update(original).digest("hex");
+          const beforeHash = createHash29("sha256").update(original).digest("hex");
           sourceHashes[relativeShard] = beforeHash;
           sourcePlansByPath.set(relativeShard, {
             path: relativeShard,
             mode: "write",
             beforeHash,
-            afterHash: createHash28("sha256").update(body).digest("hex"),
+            afterHash: createHash29("sha256").update(body).digest("hex"),
             body
           });
         }
@@ -63447,7 +63842,7 @@ async function executeDelete(input, context) {
         sourceWrites: sourcePlans,
         supersessionRequired
       };
-      const planHash = createHash28("sha256").update(JSON.stringify(planBody)).digest("hex");
+      const planHash = createHash29("sha256").update(JSON.stringify(planBody)).digest("hex");
       const payload = {
         deleted: 0,
         skipped: authoredIds.length,
@@ -64381,7 +64776,7 @@ var init_symbols_coordinator2 = __esm(() => {
 });
 
 // ../cli/dist/operations/mutation/symbol-refresh.js
-import { createHash as createHash29, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash30, randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync29, readFileSync as readFileSync33, renameSync as renameSync7, unlinkSync as unlinkSync8, writeFileSync as writeFileSync11 } from "node:fs";
 import * as path58 from "node:path";
 function record2(value) {
@@ -64408,7 +64803,7 @@ function sourceTextFor(sourceFile, workspaceRoot) {
   }
 }
 function contentHash2(content) {
-  return createHash29("sha256").update(content).digest("hex");
+  return createHash30("sha256").update(content).digest("hex");
 }
 function restoreOrUnlinkCoordinateArtifact(targetPath, before) {
   if (before === null) {
@@ -64608,7 +65003,7 @@ async function scenarioCoverageWarnings(prolog, relationships, entityType, entit
 var init_warnings = () => {};
 
 // ../cli/dist/operations/mutation/upsert.js
-import { createHash as createHash30 } from "node:crypto";
+import { createHash as createHash31 } from "node:crypto";
 import { existsSync as existsSync30, readFileSync as readFileSync34, unlinkSync as unlinkSync9, writeFileSync as writeFileSync12 } from "node:fs";
 import path59 from "node:path";
 function requireProlog4(context) {
@@ -64629,10 +65024,10 @@ function parseChangeKind(value) {
 function fileHash2(pathname) {
   if (!existsSync30(pathname))
     return null;
-  return createHash30("sha256").update(readFileSync34(pathname)).digest("hex");
+  return createHash31("sha256").update(readFileSync34(pathname)).digest("hex");
 }
 function textHash(value) {
-  return createHash30("sha256").update(value).digest("hex");
+  return createHash31("sha256").update(value).digest("hex");
 }
 function assertRelationshipShardContained(workspaceRoot, shardPath) {
   const root = path59.resolve(workspaceRoot);
@@ -66926,7 +67321,7 @@ var init_staging = __esm(() => {
 
 // ../cli/dist/commands/sync.js
 import { execSync as execSync4 } from "node:child_process";
-import { createHash as createHash31 } from "node:crypto";
+import { createHash as createHash32 } from "node:crypto";
 import { existsSync as existsSync34, mkdirSync as mkdirSync12, readFileSync as readFileSync37, readdirSync as readdirSync9, renameSync as renameSync10, writeFileSync as writeFileSync15 } from "node:fs";
 import * as path64 from "node:path";
 function relationshipKey2(relationship) {
@@ -66999,14 +67394,14 @@ function trackedRelationshipFiles(workspaceRoot, relationshipsDir, recoverMissin
               receiptPath,
               path: relative,
               afterHash: receipt.afterHash,
-              rawHash: createHash31("sha256").update(readFileSync37(receiptPath)).digest("hex")
+              rawHash: createHash32("sha256").update(readFileSync37(receiptPath)).digest("hex")
             });
           }
           continue;
         }
         throw new SyncError(`Pending source is missing: ${relative}.${PENDING_SOURCE_RECOVERY_HINT}`);
       }
-      const actual = createHash31("sha256").update(readFileSync37(absolute)).digest("hex");
+      const actual = createHash32("sha256").update(readFileSync37(absolute)).digest("hex");
       if (actual !== receipt.afterHash) {
         throw new SyncError(`Pending source hash drift blocks sync for ${relative}`);
       }
@@ -67867,14 +68262,14 @@ var init_sync = __esm(() => {
 });
 
 // ../cli/dist/commands/branch.js
-import { createHash as createHash32 } from "node:crypto";
+import { createHash as createHash33 } from "node:crypto";
 import * as fs8 from "node:fs";
 import * as path65 from "node:path";
 function isSupportedLegacyBranchMigration(from, to) {
   return from === to;
 }
 function hashLegacyStore(sourcePath) {
-  const hash = createHash32("sha256");
+  const hash = createHash33("sha256");
   const visit = (directory, relative = "") => {
     for (const entry of fs8.readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
       const absolute = path65.join(directory, entry.name);
@@ -67894,7 +68289,7 @@ function hashLegacyStore(sourcePath) {
 }
 function branchMigrationApprovalHash(from, to, sourcePath, targetPath) {
   const sourceHash = hashLegacyStore(sourcePath);
-  return createHash32("sha256").update(JSON.stringify({
+  return createHash33("sha256").update(JSON.stringify({
     version: 2,
     from,
     to,
@@ -68187,7 +68582,7 @@ var init_branch = __esm(() => {
 });
 
 // ../cli/dist/operations/migration/inventory-rederive.js
-import { createHash as createHash33 } from "node:crypto";
+import { createHash as createHash34 } from "node:crypto";
 import path66 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 function isRecord17(value) {
@@ -68404,7 +68799,7 @@ function planOne(workspaceRoot, relativePath, entity, extracted, shards, facts)
     summary: summarize2(changes, inventory),
     changes,
     contract,
-    contractHash: createHash33("sha256").update(canonicalJson3(contract)).digest("hex")
+    contractHash: createHash34("sha256").update(canonicalJson3(contract)).digest("hex")
   };
 }
 function readShardRelationships(workspaceRoot) {
@@ -68977,7 +69372,7 @@ ${KIBI_BIN_RESOLVER}
 });
 
 // ../cli/dist/commands/legacy-storage-migration.js
-import { createHash as createHash34 } from "node:crypto";
+import { createHash as createHash35 } from "node:crypto";
 import { existsSync as existsSync37, mkdirSync as mkdirSync15, readFileSync as readFileSync40, readdirSync as readdirSync11, renameSync as renameSync12, rmSync as rmSync5, statSync as statSync12, writeFileSync as writeFileSync18 } from "node:fs";
 import * as path70 from "node:path";
 function stripGlobToRoot(pattern) {
@@ -69163,7 +69558,7 @@ function rewritePendingSourceReceiptPaths(cwd, moves) {
       const absolute = path70.resolve(cwd, destination);
       if (!existsSync37(absolute))
         continue;
-      const afterHash = typeof receipt.afterHash === "string" && /^[a-f0-9]{64}$/i.test(receipt.afterHash) ? receipt.afterHash : createHash34("sha256").update(readFileSync40(absolute)).digest("hex");
+      const afterHash = typeof receipt.afterHash === "string" && /^[a-f0-9]{64}$/i.test(receipt.afterHash) ? receipt.afterHash : createHash35("sha256").update(readFileSync40(absolute)).digest("hex");
       writeFileSync18(receiptPath, `${JSON.stringify({ ...receipt, path: destination, afterHash }, null, 2)}
 `, "utf8");
       rewritten += 1;
@@ -69900,7 +70295,7 @@ var init_ignore_policy = __esm(() => {
 
 // ../cli/dist/public/operations/node-ports.js
 import { execFile as execFile2, execFileSync as execFileSync8 } from "node:child_process";
-import { createHash as createHash35 } from "node:crypto";
+import { createHash as createHash36 } from "node:crypto";
 import * as fsSync from "node:fs";
 import * as fs9 from "node:fs/promises";
 import path72 from "node:path";
@@ -69930,7 +70325,7 @@ async function workspaceSnapshot(workspaceRoot) {
     "-z"
   ], { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 });
   const paths = listed.toString("utf8").split("\x00").filter(Boolean).filter(includedSnapshotPath).map((raw) => ({ raw, key: raw.normalize("NFC") })).sort((left, right) => left.key < right.key ? -1 : left.key > right.key ? 1 : 0);
-  const digest = createHash35("sha256");
+  const digest = createHash36("sha256");
   digest.update("kibi.workspace-snapshot.v2\x00");
   for (const { raw, key: relativePath } of paths) {
     digest.update(relativePath);
@@ -70321,7 +70716,7 @@ var init_cli_runtime = __esm(() => {
 });
 
 // ../cli/dist/public/operations/legacy-migration-plan.js
-import { createHash as createHash36 } from "node:crypto";
+import { createHash as createHash37 } from "node:crypto";
 function isRecord20(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -70356,7 +70751,7 @@ function stableStringify(value) {
   return JSON.stringify(stableValue3(value));
 }
 function hash(value) {
-  return createHash36("sha256").update(stableStringify(value)).digest("hex");
+  return createHash37("sha256").update(stableStringify(value)).digest("hex");
 }
 function migrationRepairBatches(plan) {
   const seen = new Set;
@@ -70678,7 +71073,7 @@ var init_legacy_migration_plan = __esm(() => {
 });
 
 // ../cli/dist/public/operations/repair-plan.js
-import { createHash as createHash37 } from "node:crypto";
+import { createHash as createHash38 } from "node:crypto";
 function isRecord21(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -70821,7 +71216,7 @@ function buildRepairPlan(payload, input, codeSnapshot) {
     },
     batches
   };
-  const planId = `repair-plan-${createHash37("sha256").update(stableStringify2(planCore)).digest("hex").slice(0, 24)}`;
+  const planId = `repair-plan-${createHash38("sha256").update(stableStringify2(planCore)).digest("hex").slice(0, 24)}`;
   return {
     version: REPAIR_PLAN_VERSION,
     planId,
@@ -73923,7 +74318,7 @@ var init_migrate = __esm(() => {
 });
 
 // ../cli/dist/operations/planning/compile-intent.js
-import { createHash as createHash38 } from "node:crypto";
+import { createHash as createHash39 } from "node:crypto";
 import path77 from "node:path";
 function compilePlanHash(plan) {
   const { planHash: _ignored, ...body } = plan;
@@ -73933,7 +74328,7 @@ function text7(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function hash2(value) {
-  return createHash38("sha256").update(canonicalize(value)).digest("hex");
+  return createHash39("sha256").update(canonicalize(value)).digest("hex");
 }
 function shortHash2(value, length = 8) {
   return hash2(value).slice(0, length);
@@ -74080,7 +74475,7 @@ async function sourceHashes(context, locations) {
   for (const relative of sourceFilesFor(locations)) {
     try {
       const contents = context.fs ? await context.fs.readFile(path77.join(context.workspaceRoot, relative)) : null;
-      hashes[relative] = contents === null ? null : createHash38("sha256").update(contents).digest("hex");
+      hashes[relative] = contents === null ? null : createHash39("sha256").update(contents).digest("hex");
     } catch {
       hashes[relative] = null;
     }
@@ -74665,7 +75060,7 @@ var init_compile_intent = __esm(() => {
 });
 
 // ../cli/dist/operations/planning/apply-plan.js
-import { createHash as createHash39, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash40, randomUUID as randomUUID6 } from "node:crypto";
 import path78 from "node:path";
 function text8(value) {
   return typeof value === "string" ? value.trim() : "";
@@ -74673,8 +75068,8 @@ function text8(value) {
 function isRecord23(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function digest3(value) {
-  return createHash39("sha256").update(value).digest("hex");
+function digest4(value) {
+  return createHash40("sha256").update(value).digest("hex");
 }
 function relationships(step) {
   if (!Array.isArray(step.relationships))
@@ -74838,7 +75233,7 @@ function validateEntityDeletionPlan(args) {
     throw new Error("Entity deletion apply failed: approvedPlanHash does not match planHash");
   }
   const { planHash: _ignored, ...body } = args.plan;
-  if (createHash39("sha256").update(JSON.stringify(body)).digest("hex") !== args.plan.planHash) {
+  if (createHash40("sha256").update(JSON.stringify(body)).digest("hex") !== args.plan.planHash) {
     throw new Error("Entity deletion apply failed: planHash does not match the canonical plan body");
   }
   if (!Array.isArray(args.plan.entityIds) || args.plan.entityIds.length === 0) {
@@ -74917,7 +75312,7 @@ async function validateSources(context, sourceHashes) {
       throw new Error("Apply plan failed: source hashes require a filesystem-capable runtime");
     let actual;
     try {
-      actual = digest3(await context.fs.readFile(path78.join(context.workspaceRoot, relative)));
+      actual = digest4(await context.fs.readFile(path78.join(context.workspaceRoot, relative)));
     } catch {
       actual = null;
     }
@@ -74946,12 +75341,12 @@ async function resolveSourceWriteTarget(workspaceRoot, fsPort, write) {
   const existing = await fsPort.readFile(absolute).catch(() => {
     return;
   });
-  const beforeHash = existing === undefined ? null : digest3(existing);
+  const beforeHash = existing === undefined ? null : digest4(existing);
   if (beforeHash !== write.beforeHash) {
     throw new Error(`Apply plan failed: source hash changed for ${write.path}`);
   }
   const mode = write.mode ?? "write";
-  if (mode === "write" && (write.body === undefined || write.afterHash === null || digest3(write.body) !== write.afterHash)) {
+  if (mode === "write" && (write.body === undefined || write.afterHash === null || digest4(write.body) !== write.afterHash)) {
     throw new Error(`Apply plan failed: afterHash does not match staged body for ${write.path}`);
   }
   if (mode === "delete" && write.afterHash !== null) {
@@ -74995,7 +75390,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
     for (const entry of prior.entries) {
       try {
         const current = await context.fs.readFile(path78.resolve(context.workspaceRoot, entry.path));
-        if (entry.afterHash === null || digest3(current) !== entry.afterHash) {
+        if (entry.afterHash === null || digest4(current) !== entry.afterHash) {
           allAfter = false;
         }
       } catch {
@@ -75023,7 +75418,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
       } catch {
         current = undefined;
       }
-      const currentHash = current === undefined ? null : digest3(current);
+      const currentHash = current === undefined ? null : digest4(current);
       if (currentHash !== entry.beforeHash && currentHash !== entry.afterHash) {
         throw new Error(`Apply plan recovery refused: ${entry.path} changed outside its journal`);
       }
@@ -77915,7 +78310,7 @@ init_generate();
 init_presentation();
 init_ir();
 // src/skill-operations.ts
-import { createHash as createHash40 } from "node:crypto";
+import { createHash as createHash41 } from "node:crypto";
 
 // src/skill-system/loader.ts
 import { existsSync as existsSync44, readFileSync as readFileSync47, readdirSync as readdirSync13, realpathSync as realpathSync10 } from "node:fs";
@@ -78187,7 +78582,7 @@ async function executeSkillsLoad2(input, _context) {
   assertNonEmptyString2(id, "id");
   const bundle = loadBundledSkill2(id);
   const resources = bundle.manifest.resources ?? [];
-  const contentHash = createHash40("sha256").update(bundle.body, "utf8").digest("hex");
+  const contentHash = createHash41("sha256").update(bundle.body, "utf8").digest("hex");
   const resourceList = resources.length === 0 ? "none" : resources.join(", ");
   return {
     content: [