mikoshi-construct 0.4.0 → 0.5.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import path22 from "path";
+import path21 from "path";
 import process6 from "process";
 import { isTTY } from "@clack/prompts";
 import { defineCommand, runMain } from "citty";
@@ -209,37 +209,37 @@ function toEntry(raw) {
 }
 function readLedger(root) {
   const file = path2.join(root, LEDGER_FILE);
-  const reading = { entries: [], malformed: [] };
+  const reading2 = { entries: [], malformed: [] };
   if (!existsSync2(file))
-    return reading;
-  readFileSync2(file, "utf8").split("\n").forEach((text2, index) => {
+    return reading2;
+  readFileSync2(file, "utf8").split("\n").forEach((text3, index) => {
     const line = index + 1;
-    if (text2.trim() === "")
+    if (text3.trim() === "")
       return;
     let raw;
     try {
-      raw = JSON.parse(text2);
+      raw = JSON.parse(text3);
     } catch {
-      reading.malformed.push({ line, reason: "not JSON" });
+      reading2.malformed.push({ line, reason: "not JSON" });
       return;
     }
     const entry = toEntry(raw);
     if (typeof entry === "string")
-      reading.malformed.push({ line, reason: entry });
+      reading2.malformed.push({ line, reason: entry });
     else
-      reading.entries.push(entry);
+      reading2.entries.push(entry);
   });
-  return reading;
+  return reading2;
 }
-function summarizeLedger(reading) {
-  const anyTokenUnknown = reading.entries.some((entry) => entry.tokens === "unknown");
-  const counted = reading.entries.reduce((total, entry) => total + (entry.tokens === "unknown" ? 0 : entry.tokens), 0);
+function summarizeLedger(reading2) {
+  const anyTokenUnknown = reading2.entries.some((entry) => entry.tokens === "unknown");
+  const counted = reading2.entries.reduce((total, entry) => total + (entry.tokens === "unknown" ? 0 : entry.tokens), 0);
   return {
-    runs: reading.entries.length,
-    agents: reading.entries.reduce((total, entry) => total + entry.agents, 0),
-    failures: reading.entries.filter((entry) => entry.status !== "done").length,
+    runs: reading2.entries.length,
+    agents: reading2.entries.reduce((total, entry) => total + entry.agents, 0),
+    failures: reading2.entries.filter((entry) => entry.status !== "done").length,
     tokens: anyTokenUnknown ? "unknown" : counted,
-    malformed: reading.malformed
+    malformed: reading2.malformed
   };
 }
 function withoutTokenTotals(summary) {
@@ -541,8 +541,8 @@ function printCost(ui2, report, last) {
 // src/commands/cost/index.ts
 function costReport(cwd, options = {}) {
   const runtime = resolveRuntime(cwd, options.env ?? process2.env);
-  const reading = readLedger(cwd);
-  const ledger = summarizeLedger(reading);
+  const reading2 = readLedger(cwd);
+  const ledger = summarizeLedger(reading2);
   const reported = hasLedgerFindings(ledger);
   const source = runtime === "claude-code" ? new ClaudeCodeCostSource(options.projectsDir) : null;
   if (source == null || !source.readable())
@@ -553,19 +553,428 @@ function costReport(cwd, options = {}) {
     runtime,
     ...result,
     ...reported ? { ledger } : {},
-    ...joinable && (reported || result.runs.length > 0) ? { reconciliation: reconcile(reading.entries, result.runs) } : {}
+    ...joinable && (reported || result.runs.length > 0) ? { reconciliation: reconcile(reading2.entries, result.runs) } : {}
   };
 }
 
-// src/version.ts
-import { readFileSync as readFileSync4 } from "fs";
+// src/model/write.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
 import path5 from "path";
+
+// src/model/ownership.ts
+var authoredByOwner = (entry) => entry.authoredBy;
+
+// src/model/schema.ts
+var MODEL_FILE = "construct.model.json";
+var MODEL_VERSION = 1;
+var FACT_KINDS = ["file-exists", "file-contains"];
+var ENFORCEMENT_LEVELS = ["L0", "L1", "L2", "L3", "L4"];
+var ENTRY_AUTHORS = ["construct", "discovery", "unknown"];
+var FACT_PROPERTIES = ["id", "kind", "path", "authoredBy", "needle"];
+var ENFORCEMENT_PROPERTIES = ["mechanism", "level", "supportedBy"];
+var VERIFICATION_PROPERTIES = ["mechanism", "supportedBy"];
+var CLAIM_PROPERTIES = ["id", "statement", "authoredBy", "enforcement", "verification", "checkId"];
+var HYPOTHESIS_PROPERTIES = ["id", "statement", "authoredBy", "baseSha", "supportedBy"];
+var MODEL_PROPERTIES = ["modelVersion", "facts", "claims", "hypotheses"];
+var DanglingFactReference = class extends Error {
+  factId;
+  entry;
+  constructor(name, entry, factId) {
+    super(`${name}: ${entry} supportedBy refers to unknown fact "${factId}"`);
+    this.name = "DanglingFactReference";
+    this.factId = factId;
+    this.entry = entry;
+  }
+};
+function fail(name, message) {
+  throw new Error(`${name}: ${message}`);
+}
+function isRecord(value) {
+  return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function closed(name, record, allowed, where) {
+  for (const key of Object.keys(record)) {
+    if (!allowed.includes(key))
+      fail(name, `${where} carries an unexpected property "${key}": the schema is closed`);
+  }
+  return record;
+}
+function text(name, record, key, where) {
+  const value = record[key];
+  if (typeof value !== "string" || value.trim() === "")
+    fail(name, `${where} needs a non-empty "${key}"`);
+  return value;
+}
+function optionalText(name, record, key, where) {
+  if (record[key] === void 0)
+    return void 0;
+  return text(name, record, key, where);
+}
+function nullableText(name, record, key, where) {
+  const value = record[key];
+  if (value === null)
+    return null;
+  if (typeof value !== "string" || value.trim() === "")
+    fail(name, `${where} needs a non-empty "${key}" or null`);
+  return value;
+}
+function member(name, value, values, key, where) {
+  if (!values.includes(value))
+    fail(name, `${where} ${key} "${value}" is not one of ${values.join(", ")}`);
+  return value;
+}
+function list(name, record, key) {
+  const value = record[key];
+  if (!Array.isArray(value) || !value.every(isRecord))
+    fail(name, `"${key}" must be a list of objects`);
+  return value;
+}
+function uniqueIds(name, ids, where) {
+  const unique = new Set(ids);
+  if (unique.size !== ids.length)
+    fail(name, `${where} ids must be unique`);
+  return unique;
+}
+function nullableRecord(name, record, key, where) {
+  const value = record[key];
+  if (value === null)
+    return null;
+  if (!isRecord(value))
+    fail(name, `${where} needs an "${key}" object or null`);
+  return value;
+}
+function supportedBy(name, record, where, facts) {
+  const value = record.supportedBy;
+  if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && entry.trim() !== ""))
+    fail(name, `${where} needs a "supportedBy" list of fact ids`);
+  const ids = value;
+  for (const id of ids) {
+    if (!facts.has(id))
+      throw new DanglingFactReference(name, where, id);
+  }
+  return ids;
+}
+function parseFacts(name, raw) {
+  return list(name, raw, "facts").map((entry, index) => {
+    const where = `facts[${index}]`;
+    closed(name, entry, FACT_PROPERTIES, where);
+    const kind = member(name, text(name, entry, "kind", where), FACT_KINDS, "kind", where);
+    const fact = {
+      id: text(name, entry, "id", where),
+      kind,
+      path: text(name, entry, "path", where),
+      authoredBy: member(name, text(name, entry, "authoredBy", where), ENTRY_AUTHORS, "authoredBy", where)
+    };
+    const needle = optionalText(name, entry, "needle", where);
+    if (kind === "file-contains") {
+      if (needle === void 0)
+        fail(name, `${where} of kind "file-contains" needs a non-empty "needle"`);
+      fact.needle = needle;
+    } else if (needle !== void 0) {
+      fail(name, `${where} of kind "file-exists" must not carry a "needle"`);
+    }
+    return fact;
+  });
+}
+function parseClaims(name, raw, facts) {
+  return list(name, raw, "claims").map((entry, index) => {
+    const where = `claims[${index}]`;
+    closed(name, entry, CLAIM_PROPERTIES, where);
+    const enforcementEntry = nullableRecord(name, entry, "enforcement", where);
+    const verificationEntry = nullableRecord(name, entry, "verification", where);
+    const claim = {
+      id: text(name, entry, "id", where),
+      statement: text(name, entry, "statement", where),
+      authoredBy: member(name, text(name, entry, "authoredBy", where), ENTRY_AUTHORS, "authoredBy", where),
+      enforcement: enforcementEntry === null ? null : parseEnforcement(name, enforcementEntry, `${where}.enforcement`, facts),
+      verification: verificationEntry === null ? null : parseVerification(name, verificationEntry, `${where}.verification`, facts)
+    };
+    const checkId = optionalText(name, entry, "checkId", where);
+    if (checkId !== void 0)
+      claim.checkId = checkId;
+    return claim;
+  });
+}
+function parseEnforcement(name, entry, where, facts) {
+  closed(name, entry, ENFORCEMENT_PROPERTIES, where);
+  return {
+    mechanism: text(name, entry, "mechanism", where),
+    level: member(name, text(name, entry, "level", where), ENFORCEMENT_LEVELS, "level", where),
+    supportedBy: supportedBy(name, entry, where, facts)
+  };
+}
+function parseVerification(name, entry, where, facts) {
+  closed(name, entry, VERIFICATION_PROPERTIES, where);
+  return {
+    mechanism: text(name, entry, "mechanism", where),
+    supportedBy: supportedBy(name, entry, where, facts)
+  };
+}
+function parseHypotheses(name, raw, facts) {
+  return list(name, raw, "hypotheses").map((entry, index) => {
+    const where = `hypotheses[${index}]`;
+    closed(name, entry, HYPOTHESIS_PROPERTIES, where);
+    return {
+      id: text(name, entry, "id", where),
+      statement: text(name, entry, "statement", where),
+      authoredBy: member(name, text(name, entry, "authoredBy", where), ENTRY_AUTHORS, "authoredBy", where),
+      baseSha: nullableText(name, entry, "baseSha", where),
+      supportedBy: supportedBy(name, entry, where, facts)
+    };
+  });
+}
+function parseModel(source, name) {
+  let raw;
+  try {
+    raw = JSON.parse(source);
+  } catch (error) {
+    fail(name, `the document must be JSON: ${error.message}`);
+  }
+  if (!isRecord(raw))
+    fail(name, "the document must be an object");
+  closed(name, raw, MODEL_PROPERTIES, "the document");
+  if (raw.modelVersion !== MODEL_VERSION)
+    fail(name, `the document needs "modelVersion": ${MODEL_VERSION}`);
+  const facts = parseFacts(name, raw);
+  const factIds = uniqueIds(name, facts.map((fact) => fact.id), "fact");
+  const claims = parseClaims(name, raw, factIds);
+  uniqueIds(name, claims.map((claim) => claim.id), "claim");
+  const hypotheses = parseHypotheses(name, raw, factIds);
+  uniqueIds(name, hypotheses.map((hypothesis) => hypothesis.id), "hypothesis");
+  return { modelVersion: MODEL_VERSION, facts, claims, hypotheses };
+}
+
+// src/model/write.ts
+var SECURITY_WORKFLOW = ".github/workflows/security.yml";
+var CI_WORKFLOW = ".github/workflows/ci.yml";
+var CONTRACT_WORKFLOW = ".github/workflows/api-contract.yml";
+var MANIFEST = "package.json";
+var LINT_POLICY_TEST = "scripts/tests/lint/syntax-policy.test.ts";
+function baselineFacts(harnessCommand) {
+  return [
+    { id: "security-workflow", kind: "file-exists", path: SECURITY_WORKFLOW, authoredBy: "construct" },
+    { id: "security-workflow-runs-gitleaks", kind: "file-contains", path: SECURITY_WORKFLOW, authoredBy: "construct", needle: "gitleaks" },
+    { id: "gitleaks-config", kind: "file-exists", path: ".gitleaks.toml", authoredBy: "construct" },
+    { id: "security-workflow-audits-dependencies", kind: "file-contains", path: SECURITY_WORKFLOW, authoredBy: "construct", needle: "pnpm audit --audit-level=high" },
+    { id: "ci-workflow", kind: "file-exists", path: CI_WORKFLOW, authoredBy: "construct" },
+    { id: "ci-workflow-runs-the-harness", kind: "file-contains", path: CI_WORKFLOW, authoredBy: "construct", needle: harnessCommand },
+    { id: "eslint-config", kind: "file-exists", path: "eslint.config.mjs", authoredBy: "construct" },
+    { id: "security-invariants", kind: "file-exists", path: "architecture/security-invariants.md", authoredBy: "construct" },
+    { id: "harness-manifest", kind: "file-exists", path: MANIFEST, authoredBy: "construct" },
+    { id: "harness-script-runs-lint", kind: "file-contains", path: MANIFEST, authoredBy: "construct", needle: "pnpm lint" },
+    { id: "harness-script-runs-typecheck", kind: "file-contains", path: MANIFEST, authoredBy: "construct", needle: "pnpm typecheck" },
+    { id: "harness-script-runs-tests", kind: "file-contains", path: MANIFEST, authoredBy: "construct", needle: "pnpm test" }
+  ];
+}
+function listed(items) {
+  return items.length < 2 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
+function harnessStepsClaim(harnessCommand, contracts) {
+  const steps = [...contracts ? ["contracts:check"] : [], "lint", "typecheck", "tests"];
+  const spelled = [...contracts ? ["pnpm contracts:check"] : [], "pnpm lint", "pnpm typecheck", "pnpm test"];
+  return {
+    id: "harness-steps",
+    statement: `${harnessCommand} runs ${listed(steps)}, rather than merely existing as a script`,
+    authoredBy: "construct",
+    enforcement: {
+      mechanism: `${CI_WORKFLOW} runs ${harnessCommand} on every pull request, and ${MANIFEST} spells that command out as ${listed(spelled)}`,
+      level: "L3",
+      supportedBy: [
+        "ci-workflow-runs-the-harness",
+        ...contracts ? ["harness-script-runs-contracts-check"] : [],
+        "harness-script-runs-lint",
+        "harness-script-runs-typecheck",
+        "harness-script-runs-tests"
+      ]
+    },
+    verification: {
+      mechanism: `${MANIFEST} is the file that command resolves against, so a step dropped from it is visible there`,
+      supportedBy: ["harness-manifest"]
+    }
+  };
+}
+function baselineClaims(harnessCommand, contracts) {
+  return [
+    {
+      id: "no-committed-secret",
+      statement: "No secret, token or connection string is committed to this repository, including into gitignored files",
+      authoredBy: "construct",
+      enforcement: {
+        mechanism: `${SECURITY_WORKFLOW} runs gitleaks over the history on every push and pull request`,
+        level: "L3",
+        supportedBy: ["security-workflow", "security-workflow-runs-gitleaks"]
+      },
+      verification: {
+        mechanism: ".gitleaks.toml keeps the default ruleset live for that scan",
+        supportedBy: ["gitleaks-config"]
+      }
+    },
+    {
+      id: "vulnerable-dependencies-are-visible",
+      statement: "Dependencies with known high-severity vulnerabilities are visible",
+      authoredBy: "construct",
+      enforcement: {
+        mechanism: "security.yml runs pnpm audit weekly and on pull requests, reporting only",
+        level: "L3",
+        supportedBy: ["security-workflow", "security-workflow-audits-dependencies"]
+      },
+      verification: {
+        mechanism: "architecture/security-invariants.md names the mechanism behind each invariant",
+        supportedBy: ["security-invariants"]
+      }
+    },
+    {
+      id: "every-change-passes-the-harness",
+      statement: "Lint, typecheck and tests pass on every change, as one command",
+      authoredBy: "construct",
+      enforcement: {
+        mechanism: `${CI_WORKFLOW} runs ${harnessCommand} on every pull request and push to main`,
+        level: "L3",
+        supportedBy: ["ci-workflow", "ci-workflow-runs-the-harness"]
+      },
+      verification: {
+        mechanism: "eslint.config.mjs is the single source of style for that run",
+        supportedBy: ["eslint-config"]
+      },
+      checkId: "ci"
+    },
+    harnessStepsClaim(harnessCommand, contracts)
+  ];
+}
+function sampleFacts() {
+  return [
+    { id: "lint-policy-test", kind: "file-exists", path: LINT_POLICY_TEST, authoredBy: "construct" },
+    { id: "lint-policy-test-loads-eslint", kind: "file-contains", path: LINT_POLICY_TEST, authoredBy: "construct", needle: "import { ESLint } from 'eslint'" }
+  ];
+}
+function sampleClaims(harnessCommand) {
+  return [
+    {
+      id: "lint-policy",
+      statement: "The lint policy this repository declares is itself checked by a test, not only applied by the linter",
+      authoredBy: "construct",
+      enforcement: {
+        mechanism: `${LINT_POLICY_TEST} asserts the restrictions the lint policy declares, and ${CI_WORKFLOW} runs ${harnessCommand} over it on every pull request`,
+        level: "L3",
+        supportedBy: ["lint-policy-test", "ci-workflow-runs-the-harness"]
+      },
+      verification: {
+        mechanism: `${LINT_POLICY_TEST} resolves eslint.config.mjs through the ESLint API rather than reading its text`,
+        supportedBy: ["lint-policy-test-loads-eslint", "eslint-config"]
+      },
+      checkId: "lint-policy"
+    }
+  ];
+}
+function contractFacts(contractPath) {
+  return [
+    { id: "contract-workflow", kind: "file-exists", path: CONTRACT_WORKFLOW, authoredBy: "construct" },
+    { id: "contract-workflow-fails-on-a-breaking-change", kind: "file-contains", path: CONTRACT_WORKFLOW, authoredBy: "construct", needle: "fail-on: ERR" },
+    { id: "api-contract", kind: "file-exists", path: contractPath, authoredBy: "construct" },
+    { id: "harness-script-runs-contracts-check", kind: "file-contains", path: MANIFEST, authoredBy: "construct", needle: "pnpm contracts:check" }
+  ];
+}
+function contractClaims(contractPath) {
+  return [
+    {
+      id: "a-breaking-api-change-is-named-before-it-ships",
+      statement: "A change that breaks the HTTP API is identified on the pull request that makes it, never discovered afterwards",
+      authoredBy: "construct",
+      enforcement: {
+        mechanism: `${CONTRACT_WORKFLOW} runs oasdiff against the base branch and fails on a breaking change`,
+        level: "L3",
+        supportedBy: ["contract-workflow", "contract-workflow-fails-on-a-breaking-change"]
+      },
+      verification: {
+        mechanism: `${contractPath} is the contract that comparison reads`,
+        supportedBy: ["api-contract"]
+      }
+    }
+  ];
+}
+function buildModel(input) {
+  const { harnessCommand, contractPath } = input.vars;
+  return {
+    modelVersion: MODEL_VERSION,
+    facts: [...baselineFacts(harnessCommand), ...input.contracts ? contractFacts(contractPath) : [], ...input.sample ? sampleFacts() : []],
+    claims: [...baselineClaims(harnessCommand, input.contracts), ...input.contracts ? contractClaims(contractPath) : [], ...input.sample ? sampleClaims(harnessCommand) : []],
+    hypotheses: []
+  };
+}
+function readModel(root) {
+  const file = path5.join(root, MODEL_FILE);
+  if (!existsSync5(file))
+    return null;
+  try {
+    return parseModel(readFileSync4(file, "utf8"), MODEL_FILE);
+  } catch (error) {
+    if (error instanceof DanglingFactReference)
+      throw new Error(`${MODEL_FILE} stands on a fact that is not in it: ${error.entry} names "${error.factId}", which no fact declares. Nothing was written and ${MODEL_FILE} was not replaced: put the fact "${error.factId}" back, or drop it from ${error.entry}, and run this again.`);
+    throw error;
+  }
+}
+function mergeEntries(existing, fresh, keepDropped) {
+  const rebuilt = new Map(fresh.map((entry) => [entry.id, entry]));
+  const survivors = existing.flatMap((entry) => {
+    if (authoredByOwner(entry) !== "construct")
+      return [entry];
+    const replacement = rebuilt.get(entry.id);
+    if (replacement !== void 0)
+      return [replacement];
+    return keepDropped(entry) ? [entry] : [];
+  });
+  const present = new Set(survivors.map((entry) => entry.id));
+  return [...survivors, ...fresh.filter((entry) => !present.has(entry.id))];
+}
+function factsStoodOn(claims, hypotheses) {
+  const stoodOn = /* @__PURE__ */ new Map();
+  const record = (factId, entryId) => {
+    stoodOn.set(factId, [...stoodOn.get(factId) ?? [], entryId]);
+  };
+  for (const claim of claims) {
+    for (const factId of [...claim.enforcement?.supportedBy ?? [], ...claim.verification?.supportedBy ?? []])
+      record(factId, claim.id);
+  }
+  for (const hypothesis of hypotheses) {
+    for (const factId of hypothesis.supportedBy)
+      record(factId, hypothesis.id);
+  }
+  return stoodOn;
+}
+function mergeModel(existing, fresh) {
+  if (existing == null)
+    return { model: fresh, retained: [] };
+  const claims = mergeEntries(existing.claims, fresh.claims, () => false);
+  const hypotheses = mergeEntries(existing.hypotheses, fresh.hypotheses, () => false);
+  const stoodOn = factsStoodOn(claims, hypotheses);
+  const rebuilt = new Set(fresh.facts.map((fact) => fact.id));
+  const retained = existing.facts.filter((fact) => authoredByOwner(fact) === "construct" && !rebuilt.has(fact.id) && stoodOn.has(fact.id)).map((fact) => ({ id: fact.id, stoodOnBy: stoodOn.get(fact.id) ?? [] }));
+  return {
+    model: {
+      modelVersion: MODEL_VERSION,
+      facts: mergeEntries(existing.facts, fresh.facts, (fact) => stoodOn.has(fact.id)),
+      claims,
+      hypotheses
+    },
+    retained
+  };
+}
+function writeModel(root, model) {
+  const source = `${JSON.stringify(model, null, 2)}
+`;
+  parseModel(source, MODEL_FILE);
+  writeFileSync2(path5.join(root, MODEL_FILE), source);
+}
+
+// src/version.ts
+import { readFileSync as readFileSync5 } from "fs";
+import path6 from "path";
 import { fileURLToPath } from "url";
-var HERE = path5.dirname(fileURLToPath(import.meta.url));
+var HERE = path6.dirname(fileURLToPath(import.meta.url));
 function readVersion() {
   for (const candidate of ["../package.json", "../../package.json"]) {
     try {
-      const parsed = JSON.parse(readFileSync4(path5.resolve(HERE, candidate), "utf8"));
+      const parsed = JSON.parse(readFileSync5(path6.resolve(HERE, candidate), "utf8"));
       if (parsed.name === "mikoshi-construct" && parsed.version != null)
         return parsed.version;
     } catch {
@@ -576,219 +985,80 @@ function readVersion() {
 var VERSION = readVersion();
 
 // src/commands/doctor/baseline.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import path6 from "path";
-function baselineVerdict(root, manifest) {
-  const missingFiles = [];
-  const modifiedFiles = [];
-  for (const [file, hash] of Object.entries(manifest.files)) {
-    const absolute = path6.join(root, file);
-    if (!existsSync5(absolute))
-      missingFiles.push(file);
-    else if (sha256(readFileSync5(absolute, "utf8")) !== hash)
-      modifiedFiles.push(file);
-  }
-  return { missingFiles, modifiedFiles };
-}
-
-// src/commands/doctor/enforcement.ts
-function harnessReach(evidence) {
-  const command = `"${evidence.harness.command}"`;
-  if (evidence.workflows.harnessWorkflow != null)
-    return { level: "L3", evidence: `${evidence.workflows.harnessWorkflow} runs ${command}` };
-  if (evidence.hooks.runsHarness && evidence.hooks.manager != null)
-    return { level: "L2", evidence: `${evidence.hooks.manager} runs ${command}, and a local hook is bypassable with --no-verify` };
-  return { level: "L0", evidence: `no workflow and no hook configuration runs ${command}` };
-}
-function reached(id, state, evidence, detail) {
-  const reach = harnessReach(evidence);
-  return { id, level: reach.level, state, evidence: `${detail}; ${reach.evidence}` };
-}
-function absent(id, detail) {
-  return { id, level: "L0", state: "absent", evidence: detail };
-}
-
-// src/commands/doctor/checks/ci.ts
-var ID = "ci";
-var SCOPE = "branch protection and organisation rulesets live in the GitHub API, not in the repository, so doctor cannot see whether this blocks a merge";
-function ciCheck(evidence) {
-  const workflows = evidence.workflows;
-  const reach = harnessReach(evidence);
-  if (workflows.harnessWorkflow != null)
-    return { id: ID, level: reach.level, state: "present", evidence: `${reach.evidence}; ${SCOPE}` };
-  const seen = workflows.files.length === 0 ? `${workflows.directory} holds no workflow file` : `none of ${workflows.files.map((file) => `${workflows.directory}/${file}`).join(", ")} runs "${evidence.harness.command}"`;
-  return { id: ID, level: reach.level, state: "unknown", evidence: `${seen}; ${SCOPE}` };
-}
+import { existsSync as existsSync7 } from "fs";
+import path8 from "path";
 
-// src/commands/doctor/runner.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+// src/commands/doctor/readings.ts
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
 import path7 from "path";
-var RUNNER_CONFIG_FILES = [
-  "vitest.config.ts",
-  "vitest.config.mts",
-  "vitest.config.js",
-  "vitest.config.mjs",
-  "vite.config.ts",
-  "vite.config.mts",
-  "vite.config.js",
-  "vite.config.mjs"
-];
-var STRING_LITERAL = /^(['"])(.*)\1$/;
-function literalEntries(body) {
-  const trimmed = body.trim();
-  if (trimmed === "")
-    return [];
-  const entries = trimmed.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
-  const values = entries.map((entry) => STRING_LITERAL.exec(entry)?.[2]);
-  return values.every((value) => value != null) ? values : null;
-}
-function includeGlobs(source) {
-  const found = [];
-  let literal = false;
-  for (const match of source.matchAll(/include\s*:\s*/g)) {
-    const rest = source.slice(match.index + match[0].length);
-    if (!rest.startsWith("["))
+function cause(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var FileReadings = class {
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  causes = /* @__PURE__ */ new Map();
+  read(file) {
+    const target = path7.join(this.root, file);
+    if (!existsSync6(target))
       return null;
-    const close = rest.indexOf("]");
-    if (close === -1)
-      return null;
-    const entries = literalEntries(rest.slice(1, close));
-    if (entries == null)
+    try {
+      return readFileSync6(target, "utf8");
+    } catch (error) {
+      this.causes.set(file, cause(error));
       return null;
-    literal = true;
-    found.push(...entries);
-  }
-  return literal ? found : null;
-}
-function escapeLiteral(character) {
-  return /[.+^${}()|[\]\\]/.test(character) ? `\\${character}` : character;
-}
-function globToRegExp(glob) {
-  let pattern = "";
-  let braces = 0;
-  for (let index = 0; index < glob.length; index += 1) {
-    const character = glob[index];
-    if (character === "*" && glob[index + 1] === "*" && glob[index + 2] === "/") {
-      pattern += "(?:[^/]+/)*";
-      index += 2;
-      continue;
     }
-    if (character === "*" && glob[index + 1] === "*") {
-      pattern += ".*";
-      index += 1;
-      continue;
-    }
-    if (character === "*") {
-      pattern += "[^/]*";
-      continue;
-    }
-    if (character === "?") {
-      pattern += "[^/]";
-      continue;
-    }
-    if (character === "{") {
-      braces += 1;
-      pattern += "(?:";
-      continue;
-    }
-    if (character === "}" && braces > 0) {
-      braces -= 1;
-      pattern += ")";
-      continue;
+  }
+  readJson(file) {
+    const source = this.read(file);
+    if (source == null)
+      return null;
+    try {
+      return JSON.parse(source);
+    } catch (error) {
+      this.causes.set(file, cause(error));
+      return null;
     }
-    if (character === "," && braces > 0) {
-      pattern += "|";
-      continue;
+  }
+  entries(directory) {
+    const target = path7.join(this.root, directory);
+    if (!existsSync6(target))
+      return null;
+    try {
+      return readdirSync3(target);
+    } catch (error) {
+      this.causes.set(directory, cause(error));
+      return null;
     }
-    pattern += escapeLiteral(character);
   }
-  return new RegExp(`^${pattern}$`);
-}
-function matchesAnyGlob(file, globs) {
-  const normalized = file.replace(/^\.\//, "");
-  return globs.some((glob) => globToRegExp(glob.replace(/^\.\//, "")).test(normalized));
-}
-function readRunnerFacts(root, harnessText) {
-  const invokedByHarness = harnessText.includes("vitest");
-  const file = RUNNER_CONFIG_FILES.find((candidate) => existsSync6(path7.join(root, candidate))) ?? null;
-  if (file == null) {
-    return {
-      file: null,
-      globs: null,
-      note: `no runner config file (${RUNNER_CONFIG_FILES[0]} or a sibling) exists, so the include list cannot be read`,
-      invokedByHarness
-    };
+  unreadable(file) {
+    return this.causes.has(file);
   }
-  let source;
-  try {
-    source = readFileSync6(path7.join(root, file), "utf8");
-  } catch {
-    return { file, globs: null, note: `${file} cannot be read, so the include list is unknown`, invokedByHarness };
+  get files() {
+    return [...this.causes.keys()].sort().map((file) => `${file} (${this.causes.get(file) ?? ""})`);
   }
-  const globs = includeGlobs(source);
-  if (globs == null)
-    return { file, globs: null, note: `the include in ${file} is not a literal list of strings, so doctor cannot say what the runner collects`, invokedByHarness };
-  return { file, globs, note: `${file} includes ${globs.map((glob) => `"${glob}"`).join(", ")}`, invokedByHarness };
-}
-
-// src/commands/doctor/checks/construct-tests.ts
-var ID2 = "construct-tests";
-function constructTestsCheck(evidence) {
-  const recorded = evidence.recordedTests;
-  if (recorded.length === 0)
-    return absent(ID2, "construct.json records no test file; weakest link: there are no construct tests to run");
-  const runner = evidence.runner;
-  if (runner.globs == null)
-    return reached(ID2, "unknown", evidence, `construct.json records ${recorded.length} test files, but ${runner.note}`);
-  const orphan = recorded.find((file) => !matchesAnyGlob(file, runner.globs ?? []));
-  if (orphan != null)
-    return absent(ID2, `${orphan} is recorded in construct.json, but ${runner.note}, so the runner never collects it; weakest link: a construct test that nothing runs`);
-  if (!runner.invokedByHarness)
-    return absent(ID2, `construct.json records ${recorded.length} test files and ${runner.note}, but "${evidence.harness.script}" does not run the test runner; weakest link: the harness command never reaches them`);
-  return reached(ID2, "present", evidence, `all ${recorded.length} test files recorded in construct.json match the include in ${runner.file}, and "${evidence.harness.script}" runs the test runner`);
-}
-
-// src/commands/doctor/checks/hook.ts
-var ID3 = "hook";
-function hookCheck(evidence) {
-  const hooks = evidence.hooks;
-  if (hooks.manager != null) {
-    const runs = hooks.runsHarness ? `runs "${evidence.harness.command}"` : `does not run "${evidence.harness.command}"`;
-    return { id: ID3, level: "L2", state: "present", evidence: `${hooks.manager} installs a git hook and ${runs}; a local hook is bypassable with --no-verify` };
-  }
-  if (hooks.script != null)
-    return { id: ID3, level: "L0", state: "present", evidence: `package.json script "${hooks.script}" is claimed as a guard, but no .husky, lefthook, simple-git-hooks or core.hooksPath configuration installs it; weakest link: nobody is obliged to run it` };
-  return { id: ID3, level: "L0", state: "absent", evidence: "no .husky, lefthook, simple-git-hooks or core.hooksPath configuration and no pre-commit script in package.json" };
-}
-
-// src/commands/doctor/checks/lint-policy.ts
-var ID4 = "lint-policy";
-function lintPolicyCheck(evidence) {
-  const policy = evidence.policyTests[0];
-  if (policy == null) {
-    if (evidence.unreadable.length > 0)
-      return reached(ID4, "unknown", evidence, `${evidence.unreadable[0]} cannot be read, so doctor cannot say whether a lint policy check exists`);
-    return absent(ID4, "no file recorded in construct.json runs ESLint over the lint policy this repository declares; weakest link: the repository has no policy check to run");
-  }
-  const runner = evidence.runner;
-  if (runner.globs == null)
-    return reached(ID4, "unknown", evidence, `${policy} runs ESLint over the lint policy this repository declares, but ${runner.note}`);
-  if (!matchesAnyGlob(policy, runner.globs))
-    return absent(ID4, `${policy} runs ESLint over the lint policy this repository declares, but ${runner.note}; weakest link: the runner never collects the policy check`);
-  if (!runner.invokedByHarness)
-    return absent(ID4, `${policy} runs ESLint over the lint policy this repository declares and ${runner.note}, but "${evidence.harness.script}" does not run the test runner; weakest link: the harness command never reaches the policy check`);
-  return reached(ID4, "present", evidence, `${policy} runs ESLint over the lint policy this repository declares, ${runner.note}, and "${evidence.harness.script}" runs the test runner`);
-}
-
-// src/commands/doctor/checks/red-gate.ts
-var ID5 = "red-gate";
-function redGateCheck(evidence) {
-  return reached(ID5, "unknown", evidence, `doctor executes nothing from the repository it inspects, so whether "${evidence.harness.command}" passes on a clean checkout is unproven here; CI is where that is proven`);
+};
+
+// src/commands/doctor/baseline.ts
+function baselineVerdict(root, manifest, readings = new FileReadings(root)) {
+  const missingFiles = [];
+  const modifiedFiles = [];
+  for (const [file, hash] of Object.entries(manifest.files)) {
+    if (!existsSync7(path8.join(root, file))) {
+      missingFiles.push(file);
+      continue;
+    }
+    const content = readings.read(file);
+    if (content != null && sha256(content) !== hash)
+      modifiedFiles.push(file);
+  }
+  return { missingFiles, modifiedFiles };
 }
 
 // src/commands/doctor/discovery.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
-import path8 from "path";
+import path9 from "path";
 
 // src/detect/facts.ts
 function factsTheRepositoryEstablishes(root) {
@@ -812,22 +1082,20 @@ function blockBody(document, marker) {
   const body = document.slice(start + markerOpen(marker).length, stop).trim();
   return body === "" || body === DISCOVERY_PLACEHOLDER ? null : body;
 }
-function compositionBody(directory) {
-  if (!existsSync7(directory))
-    return null;
-  const models = readdirSync3(directory).filter((file) => file.endsWith(".yaml")).sort();
-  if (models.length === 0)
-    return null;
-  return models.map((model) => `${model}
-${readFileSync7(path8.join(directory, model), "utf8")}`).join("\n");
+function compositionBody(directory, readings) {
+  const models = (readings.entries(directory) ?? []).filter((file) => file.endsWith(".yaml")).sort();
+  const bodies = models.flatMap((model) => {
+    const source = readings.read(path9.posix.join(directory, model));
+    return source == null ? [] : [`${model}
+${source}`];
+  });
+  return bodies.length === 0 ? null : bodies.join("\n");
 }
-function markerBody(root, marker, file) {
-  const location = path8.join(root, file);
+function markerBody(root, marker, file, readings = new FileReadings(root)) {
   if (marker === "composition")
-    return compositionBody(location);
-  if (!existsSync7(location))
-    return null;
-  return blockBody(readFileSync7(location, "utf8"), marker);
+    return compositionBody(file, readings);
+  const source = readings.read(file);
+  return source == null ? null : blockBody(source, marker);
 }
 function markerFileFor(root, manifest, marker) {
   const recordedFile = manifest.discovery.markers[marker].file;
@@ -838,18 +1106,18 @@ function markerFileFor(root, manifest, marker) {
     return decided;
   return factsTheRepositoryEstablishes(root).compositionDir ?? recordedFile;
 }
-function missingDiscovery(root, manifest) {
-  return DISCOVERY_MARKERS.filter((marker) => markerBody(root, marker, markerFileFor(root, manifest, marker)) == null);
+function missingDiscovery(root, manifest, readings = new FileReadings(root)) {
+  return DISCOVERY_MARKERS.filter((marker) => markerBody(root, marker, markerFileFor(root, manifest, marker), readings) == null);
 }
 
-// src/commands/doctor/evidence.ts
-import { readFileSync as readFileSync11 } from "fs";
-import path12 from "path";
+// src/commands/doctor/families.ts
+function isIntact(evidence) {
+  return evidence.missingFiles.length === 0 && evidence.harnessProblems.length === 0 && evidence.unreadableFiles.length === 0;
+}
 
 // src/commands/doctor/harness.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import path9 from "path";
-var REQUIRED_QUALITY_STEPS = ["lint", "typecheck", "test"];
+import { existsSync as existsSync8 } from "fs";
+import path10 from "path";
 var SCRIPT_REFERENCE = /(?:^|&&|\|\||;)\s*(?:pnpm|npm|yarn|bun)\s+(?:run\s+)?([\w:.-]+)/g;
 function harnessScriptName(command) {
   return command.replace(/^(pnpm|npm|yarn|bun)\s+(run\s+)?/, "");
@@ -864,163 +1132,142 @@ function expandScript(scripts, name, seen) {
   const referenced = [...body.matchAll(SCRIPT_REFERENCE)].map((match) => match[1]);
   return [body, ...referenced.map((reference) => expandScript(scripts, reference, seen))].join(" && ");
 }
-function readHarnessFacts(root, command) {
+var HARNESS_MANIFEST = "package.json";
+function readHarnessFacts(root, command, readings = new FileReadings(root)) {
   const script = harnessScriptName(command);
-  const manifestPath = path9.join(root, "package.json");
-  const packageJson = existsSync8(manifestPath) ? JSON.parse(readFileSync8(manifestPath, "utf8")) : null;
+  const packageJson = readings.readJson(HARNESS_MANIFEST);
   const scripts = packageJson?.scripts ?? {};
   const body = scripts[script] ?? null;
   return {
     command,
     script,
-    scripts,
     body,
     resolved: expandScript(scripts, script, /* @__PURE__ */ new Set()),
-    commandForms: [command, `pnpm run ${script}`, `pnpm ${script}`, `npm run ${script}`, `yarn ${script}`],
     packageJson
   };
 }
-function runsHarnessCommand(text2, forms) {
-  return forms.some((form) => text2.includes(form));
-}
-function contractProblems(root, contracts, script, body) {
+function missingContractFiles(root, contracts) {
   if (contracts == null)
     return [];
-  const problems = [contracts.path, contracts.types].filter((file) => !existsSync8(path9.join(root, file))).map((file) => `${file} is missing (construct.json \u2192 contracts)`);
-  if (!body.includes("contracts:check"))
-    problems.push(`"${script}" does not run contracts:check`);
-  return problems;
+  return [contracts.path, contracts.types].filter((file) => !existsSync8(path10.join(root, file))).map((file) => `${file} is missing (construct.json \u2192 contracts)`);
 }
-function harnessProblems(root, manifest, facts) {
+function harnessProblems(root, manifest, facts, readings = new FileReadings(root)) {
   if (facts.packageJson == null)
-    return ["package.json is missing"];
-  const body = facts.body;
-  if (body == null)
+    return readings.unreadable(HARNESS_MANIFEST) ? [] : [`${HARNESS_MANIFEST} is missing`];
+  if (facts.body == null)
     return [`package.json has no "${facts.script}" script (harness command is "${facts.command}")`];
-  return [
-    ...REQUIRED_QUALITY_STEPS.filter((step) => !body.includes(step)).map((step) => `"${facts.script}" does not run ${step}`),
-    ...contractProblems(root, manifest.contracts, facts.script, body)
-  ];
+  return missingContractFiles(root, manifest.contracts);
 }
 
-// src/commands/doctor/hooks.ts
-import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
-import path10 from "path";
-var LEFTHOOK_FILES = ["lefthook.yml", "lefthook.yaml", "lefthook.toml", "lefthook.json", ".lefthook.yml", ".lefthook.yaml"];
-var SIMPLE_GIT_HOOKS_FILES = [".simple-git-hooks.js", ".simple-git-hooks.cjs", ".simple-git-hooks.mjs", ".simple-git-hooks.json", "simple-git-hooks.json"];
-var HUSKY_DIR = ".husky";
-var GIT_CONFIG = ".git/config";
-var HOOK_SCRIPTS = ["precommit", "pre-commit", "prepush", "pre-push"];
-function read(root, file) {
-  try {
-    return readFileSync9(path10.join(root, file), "utf8");
-  } catch {
-    return null;
+// src/model/path.ts
+var CHAIN_STAGES = ["enforcement", "verification"];
+function firstStop(claimId, stages) {
+  for (const stage of CHAIN_STAGES) {
+    const finding = stages[stage];
+    if (finding.state !== "held")
+      return { claimId, stage, ...finding };
   }
+  return null;
 }
-function huskyHooks(root) {
-  const directory = path10.join(root, HUSKY_DIR);
-  if (!existsSync9(directory) || !statSync2(directory).isDirectory())
-    return [];
-  return readdirSync4(directory).filter((entry) => !entry.startsWith("_") && !entry.startsWith(".")).sort().map((entry) => `${HUSKY_DIR}/${entry}`);
-}
-function managerFiles(root, packageJson) {
-  const files = [...huskyHooks(root)];
-  files.push(...[...LEFTHOOK_FILES, ...SIMPLE_GIT_HOOKS_FILES].filter((file) => existsSync9(path10.join(root, file))));
-  if (packageJson != null && "simple-git-hooks" in packageJson)
-    files.push("package.json (simple-git-hooks)");
-  const gitConfig = read(root, GIT_CONFIG);
-  if (gitConfig != null && gitConfig.includes("hooksPath"))
-    files.push(`${GIT_CONFIG} (core.hooksPath)`);
-  return files;
-}
-function readHookFacts(root, packageJson, scripts, commandForms) {
-  const files = managerFiles(root, packageJson);
-  const script = HOOK_SCRIPTS.find((name) => scripts[name] != null) ?? null;
-  const sources = files.map((file) => {
-    if (file.startsWith("package.json"))
-      return JSON.stringify(packageJson?.["simple-git-hooks"] ?? "");
-    return read(root, file.split(" ")[0]) ?? "";
-  });
-  const manager = files[0] ?? null;
-  const scriptRunsHarness = script != null && runsHarnessCommand(scripts[script] ?? "", commandForms);
-  const installed = sources.some((source) => runsHarnessCommand(source, commandForms) || scriptRunsHarness && script != null && source.includes(script));
-  return { manager, script, runsHarness: manager != null && installed };
-}
-
-// src/commands/doctor/workflows.ts
-import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync10 } from "fs";
-import path11 from "path";
-var WORKFLOWS_DIR = ".github/workflows";
-var RUN_STEP = /(?:^|\s)run:[ \t]*(\S.*)$/;
-function runStepTexts(source) {
-  const lines = source.split("\n");
-  const steps = [];
-  for (let index = 0; index < lines.length; index += 1) {
-    const inline = RUN_STEP.exec(lines[index])?.[1];
-    if (inline == null)
+function selectPath(model, derived) {
+  let selected = null;
+  let selectedDepth = CHAIN_STAGES.length;
+  for (const claim of model.claims) {
+    const stages = derived.claims[claim.id];
+    if (stages === void 0)
       continue;
-    if (!inline.startsWith("|") && !inline.startsWith(">")) {
-      steps.push(inline.trim());
+    const stop = firstStop(claim.id, stages);
+    if (stop === null)
       continue;
+    const depth = CHAIN_STAGES.indexOf(stop.stage);
+    if (depth < selectedDepth) {
+      selected = stop;
+      selectedDepth = depth;
     }
-    const indent = lines[index].length - lines[index].trimStart().length;
-    const block = [];
-    for (let next = index + 1; next < lines.length; next += 1) {
-      const line = lines[next];
-      if (line.trim() !== "" && line.length - line.trimStart().length <= indent)
-        break;
-      block.push(line.trim());
-    }
-    steps.push(block.join("\n"));
-  }
-  return steps;
-}
-function readWorkflowFacts(root, commandForms) {
-  const directory = path11.join(root, WORKFLOWS_DIR);
-  if (!existsSync10(directory))
-    return { directory: WORKFLOWS_DIR, files: [], harnessWorkflow: null, unreadable: [] };
-  const files = readdirSync5(directory).filter((file) => file.endsWith(".yml") || file.endsWith(".yaml")).sort();
-  const unreadable = [];
-  let harnessWorkflow = null;
-  for (const file of files) {
-    let source;
-    try {
-      source = readFileSync10(path11.join(directory, file), "utf8");
-    } catch {
-      unreadable.push(`${WORKFLOWS_DIR}/${file}`);
-      continue;
-    }
-    if (harnessWorkflow == null && runStepTexts(source).some((step) => runsHarnessCommand(step, commandForms)))
-      harnessWorkflow = `${WORKFLOWS_DIR}/${file}`;
   }
-  return { directory: WORKFLOWS_DIR, files, harnessWorkflow, unreadable };
+  return selected;
 }
 
-// src/commands/doctor/evidence.ts
-var TEST_FILE = /\.test\.[cm]?[jt]s$/;
-var LINT_POLICY_MARKERS = ["calculateConfigForFile", "lintText", "lintFiles"];
-function recordedTestFiles(manifest) {
-  return Object.keys(manifest.files).filter((file) => TEST_FILE.test(file)).sort();
-}
-function gatherEvidence(root, manifest) {
-  const harness = readHarnessFacts(root, manifest.harness.command);
-  const runner = readRunnerFacts(root, harness.resolved);
-  const workflows = readWorkflowFacts(root, harness.commandForms);
-  const hooks = readHookFacts(root, harness.packageJson, harness.scripts, harness.commandForms);
-  const recordedTests = recordedTestFiles(manifest);
-  const policyTests = [];
-  const unreadable = [...workflows.unreadable];
-  for (const file of recordedTests) {
-    try {
-      const source = readFileSync11(path12.join(root, file), "utf8");
-      if (LINT_POLICY_MARKERS.some((marker) => source.includes(marker)))
-        policyTests.push(file);
-    } catch {
-      unreadable.push(file);
-    }
-  }
-  return { harness, runner, workflows, hooks, recordedTests, policyTests, unreadable };
+// src/model/state.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import path11 from "path";
+function evaluateFact(fact, root) {
+  const target = path11.join(root, fact.path);
+  try {
+    if (!existsSync9(target))
+      return "does-not-hold";
+    if (fact.kind === "file-exists")
+      return "holds";
+    return readFileSync7(target, "utf8").includes(fact.needle ?? "") ? "holds" : "does-not-hold";
+  } catch {
+    return "unevaluable";
+  }
+}
+function evaluateFacts(model, root) {
+  return Object.fromEntries(model.facts.map((fact) => [fact.id, evaluateFact(fact, root)]));
+}
+function pathsOf(outcomes, evaluation) {
+  return [...new Set(outcomes.filter((fact) => fact.evaluation === evaluation).map((fact) => fact.path))];
+}
+function resolveFinding(facts, supportedBy2, evaluations) {
+  if (supportedBy2.length === 0)
+    return { state: "unknown", reason: "no-fact-named" };
+  const outcomes = factOutcomes(facts, supportedBy2, evaluations);
+  const [firstUnevaluable, ...restUnevaluable] = pathsOf(outcomes, "unevaluable");
+  if (firstUnevaluable !== void 0)
+    return { state: "unknown", reason: "unevaluable", unevaluable: [firstUnevaluable, ...restUnevaluable] };
+  const [firstDoesNotHold, ...restDoesNotHold] = pathsOf(outcomes, "does-not-hold");
+  if (firstDoesNotHold === void 0)
+    return { state: "held" };
+  return { state: "unsupported", doesNotHold: [firstDoesNotHold, ...restDoesNotHold] };
+}
+function resolveState(supportedBy2, evaluations) {
+  return resolveFinding([], supportedBy2, evaluations).state;
+}
+function factOutcomes(facts, supportedBy2, evaluations) {
+  return supportedBy2.flatMap((id) => {
+    const evaluation = evaluations[id] ?? "unevaluable";
+    if (evaluation === "holds")
+      return [];
+    return [{ path: facts.find((fact) => fact.id === id)?.path ?? id, evaluation }];
+  });
+}
+function deriveModelState(model, root) {
+  const facts = evaluateFacts(model, root);
+  return {
+    facts,
+    hypotheses: Object.fromEntries(model.hypotheses.map((hypothesis) => [hypothesis.id, resolveState(hypothesis.supportedBy, facts)])),
+    claims: Object.fromEntries(model.claims.map((claim) => [claim.id, {
+      enforcement: resolveFinding(model.facts, claim.enforcement?.supportedBy ?? [], facts),
+      verification: resolveFinding(model.facts, claim.verification?.supportedBy ?? [], facts)
+    }]))
+  };
+}
+
+// src/commands/doctor/projection.ts
+function verdict(claim, finding, owner) {
+  return {
+    id: claim.checkId ?? claim.id,
+    claimId: claim.id,
+    level: claim.enforcement?.level ?? "L0",
+    authoredBy: owner(claim),
+    mechanism: claim.enforcement?.mechanism ?? claim.statement,
+    ...finding
+  };
+}
+var NOTHING_NAMED = { state: "unknown", reason: "no-fact-named" };
+function placeClaim(model, derived) {
+  if (model.claims.length === 0)
+    return { at: "no-claim" };
+  const stop = selectPath(model, derived);
+  return stop == null ? { at: "no-stop" } : { at: "stop", stop };
+}
+function projectKnowledge(model, root, owner = authoredByOwner) {
+  if (model == null)
+    return { checks: [], youAreHere: { at: "no-model" } };
+  const derived = deriveModelState(model, root);
+  const checks = model.claims.map((claim) => verdict(claim, derived.claims[claim.id]?.enforcement ?? NOTHING_NAMED, owner));
+  return { checks, youAreHere: placeClaim(model, derived) };
 }
 
 // src/commands/doctor/provenance.ts
@@ -1029,18 +1276,18 @@ function markerAuthorship(recorded, body) {
     return "unknown";
   return sha256(body) === recorded.sha ? "construct" : "owner";
 }
-function discoveryProvenance(root, manifest) {
+function discoveryProvenance(root, manifest, readings = new FileReadings(root)) {
   return DISCOVERY_MARKERS.map((marker) => {
     const recorded = manifest.discovery.markers[marker];
     return {
       marker,
       file: recorded.file,
-      authorship: markerAuthorship(recorded, markerBody(root, marker, markerFileFor(root, manifest, marker)))
+      authorship: markerAuthorship(recorded, markerBody(root, marker, markerFileFor(root, manifest, marker), readings))
     };
   });
 }
-function constructAuthored(readings) {
-  return readings.filter((reading) => reading.authorship === "construct");
+function constructAuthored(markers) {
+  return markers.filter((reading2) => reading2.authorship === "construct");
 }
 
 // src/commands/doctor/typecheck.ts
@@ -1050,33 +1297,123 @@ var CAVEATS = {
     text: "node-frontend: `tsc --noEmit` does not see `.vue` or `.svelte` single-file components, so a Vite app that adds them needs the framework's own checker (vue-tsc, svelte-check) in the harness"
   }
 };
-function typecheckWarnings(preset, evidence) {
+function typecheckWarnings(preset, harness) {
   const caveat = CAVEATS[preset];
-  if (caveat == null || caveat.checkers.some((checker) => evidence.harness.resolved.includes(checker)))
+  if (caveat == null || caveat.checkers.some((checker) => harness.resolved.includes(checker)))
     return [];
   return [caveat.text];
 }
 
-// src/commands/doctor/verdict.ts
-var CHECK_IDS = ["lint-policy", "construct-tests", "ci", "hook", "red-gate"];
-var LEVELS = ["L0", "L1", "L2", "L3", "L4"];
-function weakestLink(checks) {
-  const claimed = checks.filter((check) => check.state === "present");
-  if (claimed.length === 0)
-    return null;
-  const ordered = [...claimed].sort((left, right) => CHECK_IDS.indexOf(left.id) - CHECK_IDS.indexOf(right.id));
-  const weakest = ordered.reduce((current, check) => LEVELS.indexOf(check.level) < LEVELS.indexOf(current.level) ? check : current);
-  return { id: weakest.id, level: weakest.level };
+// src/commands/doctor/runner.ts
+var RUNNER_CONFIG_FILES = [
+  "vitest.config.ts",
+  "vitest.config.mts",
+  "vitest.config.js",
+  "vitest.config.mjs",
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.js",
+  "vite.config.mjs"
+];
+var STRING_LITERAL = /^(['"])(.*)\1$/;
+function literalEntries(body) {
+  const trimmed = body.trim();
+  if (trimmed === "")
+    return [];
+  const entries = trimmed.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+  const values = entries.map((entry) => STRING_LITERAL.exec(entry)?.[2]);
+  return values.every((value) => value != null) ? values : null;
+}
+function includeGlobs(source) {
+  const found = [];
+  let literal = false;
+  for (const match of source.matchAll(/include\s*:\s*/g)) {
+    const rest = source.slice(match.index + match[0].length);
+    if (!rest.startsWith("["))
+      return null;
+    const close = rest.indexOf("]");
+    if (close === -1)
+      return null;
+    const entries = literalEntries(rest.slice(1, close));
+    if (entries == null)
+      return null;
+    literal = true;
+    found.push(...entries);
+  }
+  return literal ? found : null;
+}
+function escapeLiteral(character) {
+  return /[.+^${}()|[\]\\]/.test(character) ? `\\${character}` : character;
+}
+function globToRegExp(glob) {
+  let pattern = "";
+  let braces = 0;
+  for (let index = 0; index < glob.length; index += 1) {
+    const character = glob[index];
+    if (character === "*" && glob[index + 1] === "*" && glob[index + 2] === "/") {
+      pattern += "(?:[^/]+/)*";
+      index += 2;
+      continue;
+    }
+    if (character === "*" && glob[index + 1] === "*") {
+      pattern += ".*";
+      index += 1;
+      continue;
+    }
+    if (character === "*") {
+      pattern += "[^/]*";
+      continue;
+    }
+    if (character === "?") {
+      pattern += "[^/]";
+      continue;
+    }
+    if (character === "{") {
+      braces += 1;
+      pattern += "(?:";
+      continue;
+    }
+    if (character === "}" && braces > 0) {
+      braces -= 1;
+      pattern += ")";
+      continue;
+    }
+    if (character === "," && braces > 0) {
+      pattern += "|";
+      continue;
+    }
+    pattern += escapeLiteral(character);
+  }
+  return new RegExp(`^${pattern}$`);
+}
+function matchesAnyGlob(file, globs) {
+  const normalized = file.replace(/^\.\//, "");
+  return globs.some((glob) => globToRegExp(glob.replace(/^\.\//, "")).test(normalized));
+}
+
+// src/commands/doctor/uncollected-tests.ts
+var TEST_FILE = /\.test\.[cm]?[jt]s$/;
+function uncollectedTests(root, manifest, readings = new FileReadings(root)) {
+  const config = RUNNER_CONFIG_FILES.find((candidate) => manifest.files[candidate] != null);
+  if (config == null)
+    return [];
+  const source = readings.read(config);
+  if (source == null)
+    return [];
+  const globs = includeGlobs(source);
+  if (globs == null)
+    return [];
+  return Object.keys(manifest.files).filter((file) => TEST_FILE.test(file) && !matchesAnyGlob(file, globs)).sort();
 }
 
 // src/sync/replay.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
 import { tmpdir } from "os";
-import path15 from "path";
+import path14 from "path";
 
 // src/materialize/plan.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
-import path14 from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import path13 from "path";
 
 // src/materialize/rules.ts
 var CLAUDE_RULES_DIR = ".claude/rules/";
@@ -1255,43 +1592,43 @@ ${end}
 }
 
 // src/materialize/templates.ts
-import { existsSync as existsSync11, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
-import path13 from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import path12 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-var HERE2 = path13.dirname(fileURLToPath2(import.meta.url));
+var HERE2 = path12.dirname(fileURLToPath2(import.meta.url));
 function templatesRoot() {
-  const candidates = [path13.resolve(HERE2, "../templates"), path13.resolve(HERE2, "../../templates")];
-  const found = candidates.find((candidate) => existsSync11(candidate));
+  const candidates = [path12.resolve(HERE2, "../templates"), path12.resolve(HERE2, "../../templates")];
+  const found = candidates.find((candidate) => existsSync10(candidate));
   if (found == null)
     throw new Error(`templates directory not found next to ${HERE2}`);
   return found;
 }
 var EXISTING_SUFFIX = ".existing.eta";
 function toTargetPath(relative) {
-  const segments = relative.split(path13.sep).map((segment) => segment.startsWith("_") ? `.${segment.slice(1)}` : segment);
+  const segments = relative.split(path12.sep).map((segment) => segment.startsWith("_") ? `.${segment.slice(1)}` : segment);
   const joined = segments.join("/");
   if (joined.endsWith(EXISTING_SUFFIX))
     return { target: joined.slice(0, -EXISTING_SUFFIX.length), rendered: true, variant: "existing" };
   return joined.endsWith(".eta") ? { target: joined.slice(0, -".eta".length), rendered: true, variant: "default" } : { target: joined, rendered: false, variant: "default" };
 }
 function walk(root, current, files) {
-  for (const entry of readdirSync6(current).sort()) {
-    const absolute = path13.join(current, entry);
-    if (statSync3(absolute).isDirectory())
+  for (const entry of readdirSync4(current).sort()) {
+    const absolute = path12.join(current, entry);
+    if (statSync2(absolute).isDirectory())
       walk(root, absolute, files);
     else if (entry !== ".DS_Store")
-      files.push(path13.relative(root, absolute));
+      files.push(path12.relative(root, absolute));
   }
 }
 function listTemplateFiles(group) {
-  const root = path13.join(templatesRoot(), group);
-  if (!existsSync11(root))
+  const root = path12.join(templatesRoot(), group);
+  if (!existsSync10(root))
     throw new Error(`template group "${group}" does not exist`);
   const files = [];
   walk(root, root, files);
   return files.map((relative) => {
     const { target, rendered, variant } = toTargetPath(relative);
-    return { group, source: path13.join(root, relative), target, rendered, variant };
+    return { group, source: path12.join(root, relative), target, rendered, variant };
   });
 }
 var BLOCK = /^[ \t]*\{\{#(if|unless) (\w+)\}\}[ \t]*\n([\s\S]*?)^[ \t]*\{\{\/\1\}\}[ \t]*\n/gm;
@@ -1318,7 +1655,7 @@ function mountTarget(mount, target) {
   return mount.into == null || mount.into === "." ? target : `${mount.into.replace(/\/$/, "")}/${target}`;
 }
 function readTemplate(source, rendered, vars) {
-  const raw = readFileSync12(source, "utf8");
+  const raw = readFileSync8(source, "utf8");
   return rendered ? render(raw, vars) : raw;
 }
 var SORTED_SECTIONS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
@@ -1376,13 +1713,13 @@ function layerJson(earlier, later) {
 var NOT_ADDED_TO_EXISTING_MANIFEST = ["version"];
 function planOne(root, target, content, conflicts, existingVariant) {
   const strategy = strategyFor(target);
-  const absolute = path14.join(root, target);
-  const exists = existsSync12(absolute);
+  const absolute = path13.join(root, target);
+  const exists = existsSync11(absolute);
   if (!exists) {
     return strategy === "append-block" ? { target, strategy, action: "create", content: appendBlock("", content, target), variant: "default" } : { target, strategy, action: "create", content };
   }
   if (strategy === "merge-json") {
-    const existing = JSON.parse(readFileSync12(absolute, "utf8"));
+    const existing = JSON.parse(readFileSync8(absolute, "utf8"));
     const incoming = JSON.parse(content);
     for (const key of NOT_ADDED_TO_EXISTING_MANIFEST)
       delete incoming[key];
@@ -1393,7 +1730,7 @@ function planOne(root, target, content, conflicts, existingVariant) {
 ` };
   }
   if (strategy === "append-block") {
-    const existing = readFileSync12(absolute, "utf8");
+    const existing = readFileSync8(absolute, "utf8");
     return {
       target,
       strategy,
@@ -1552,6 +1889,9 @@ function isPresetId(value) {
 function getPreset(id) {
   return PRESETS[id];
 }
+function sampleGroups(preset) {
+  return preset.groups.map((group) => typeof group === "string" ? group : group.group).filter((group) => group.endsWith("/sample"));
+}
 function aiGroups(target) {
   return target === "both" ? ["ai/shared", "ai/claude", "ai/cursor"] : ["ai/shared", `ai/${target}`];
 }
@@ -1734,7 +2074,7 @@ function establishVariant(input) {
 }
 
 // src/sync/replay.ts
-var NO_TREE_TO_PLAN_AGAINST = path15.join(tmpdir(), "mikoshi-construct-replay-renders-against-no-tree");
+var NO_TREE_TO_PLAN_AGAINST = path14.join(tmpdir(), "mikoshi-construct-replay-renders-against-no-tree");
 function replayedGroups(manifest) {
   const preset = getPreset(manifest.preset);
   return [...preset.groups, ...aiGroups(manifest.ai), ...reviewGroups(manifest.review?.provider ?? "none")];
@@ -1807,9 +2147,9 @@ function producedInTheVariantThatWroteIt(templates, variants) {
 function presentInTree(root, targets) {
   const present = {};
   for (const target of new Set(targets)) {
-    const absolute = path15.join(root, target);
-    if (existsSync13(absolute))
-      present[target] = readFileSync13(absolute, "utf8");
+    const absolute = path14.join(root, target);
+    if (existsSync12(absolute))
+      present[target] = readFileSync9(absolute, "utf8");
   }
   return present;
 }
@@ -1884,14 +2224,39 @@ function versionGap(root, manifest, version) {
 }
 
 // src/commands/doctor/report.ts
-function checkLine(ui2, check) {
-  return `  ${check.id.padEnd(16)} ${check.level}  ${check.state.padEnd(8)} ${ui2.theme.dim(check.evidence)}`;
+function reading(ui2, check) {
+  switch (check.state) {
+    case "held":
+      return ui2.lore.verdictHeld(check.mechanism);
+    case "unsupported":
+      return ui2.lore.verdictUnsupported(check.mechanism, check.doesNotHold);
+    case "unknown":
+      return check.reason === "unevaluable" ? ui2.lore.verdictUnevaluable(check.mechanism, check.unevaluable) : ui2.lore.verdictNothingNamed(check.mechanism);
+  }
+}
+function checkLine(ui2, check, width) {
+  return `  ${check.id.padEnd(width)} ${check.level}  ${check.state.padEnd(12)} ${ui2.theme.dim(reading(ui2, check))}`;
+}
+function claimsRead(ui2, placement) {
+  switch (placement.at) {
+    case "no-model":
+      return ui2.lore.enforcementNoModel;
+    case "no-claim":
+      return ui2.lore.enforcementNoClaim;
+    default:
+      return null;
+  }
 }
-function printChecks(ui2, checks) {
+function printChecks(ui2, checks, placement) {
+  const width = Math.max(16, ...checks.map((check) => check.id.length));
   ui2.line();
   ui2.line(ui2.theme.accent(ui2.lore.enforcement));
+  const read = claimsRead(ui2, placement);
+  if (read != null)
+    ui2.line(ui2.theme.dim(`  ${read}`));
   for (const check of checks)
-    ui2.line(checkLine(ui2, check));
+    ui2.line(checkLine(ui2, check, width));
+  ui2.line(ui2.theme.dim(`  ${ui2.lore.executesNothing}`));
 }
 function printProvenance(ui2, provenance) {
   const authored = constructAuthored(provenance);
@@ -1899,8 +2264,8 @@ function printProvenance(ui2, provenance) {
     return;
   ui2.line();
   ui2.line(ui2.theme.accent(ui2.lore.provenance));
-  for (const reading of authored)
-    ui2.line(`  ${reading.marker.padEnd(20)} ${ui2.theme.dim(reading.file)}`);
+  for (const reading2 of authored)
+    ui2.line(`  ${reading2.marker.padEnd(20)} ${ui2.theme.dim(reading2.file)}`);
   ui2.line(ui2.theme.dim(`  ${ui2.lore.stillConstructAuthored(authored.length)}`));
 }
 function gapReading(ui2, gap) {
@@ -1912,14 +2277,29 @@ function printVersionGap(ui2, gap) {
   ui2.line(ui2.theme.dim(`  ${ui2.lore.syncVersionGap(gap.materializedBy, gap.readBy)}`));
   ui2.line(ui2.theme.dim(`  ${gapReading(ui2, gap)}`));
 }
-function printWeakestLink(ui2, weakest) {
-  ui2.line();
-  if (weakest == null) {
-    ui2.line(ui2.theme.bold(ui2.lore.weakestLinkNone));
-    return;
+function stoppedLine(ui2, stop) {
+  switch (stop.state) {
+    case "unsupported":
+      return ui2.lore.youAreHereUnsupported(stop.claimId, stop.stage, stop.doesNotHold);
+    case "unknown":
+      return stop.reason === "unevaluable" ? ui2.lore.youAreHereUnevaluable(stop.claimId, stop.stage, stop.unevaluable) : ui2.lore.youAreHereNothingNamed(stop.claimId, stop.stage);
+  }
+}
+function placementLine(ui2, placement) {
+  switch (placement.at) {
+    case "stop":
+      return stoppedLine(ui2, placement.stop);
+    case "no-stop":
+      return ui2.lore.youAreHereNone;
+    case "no-claim":
+      return ui2.lore.youAreHereNoClaim;
+    case "no-model":
+      return ui2.lore.youAreHereNoModel;
   }
-  const lift = ui2.lore.levelLift[weakest.level];
-  ui2.line(`${ui2.theme.bold(ui2.lore.weakestLink(weakest.id, weakest.level))}${lift == null ? "" : ui2.theme.dim(` \u2014 ${lift}`)}`);
+}
+function printYouAreHere(ui2, placement) {
+  ui2.line();
+  ui2.line(ui2.theme.bold(placementLine(ui2, placement)));
 }
 function printDoctor(ui2, result) {
   if (result == null) {
@@ -1928,6 +2308,10 @@ function printDoctor(ui2, result) {
   }
   if (result.harnessProblems.length > 0)
     ui2.glitch("Harness is broken.", result.harnessProblems);
+  if (result.uncollectedTests.length > 0)
+    ui2.glitch(ui2.lore.uncollectedTests, result.uncollectedTests);
+  if (result.unreadableFiles.length > 0)
+    ui2.glitch(ui2.lore.unreadableFiles, result.unreadableFiles);
   if (result.missingFiles.length > 0)
     ui2.glitch("Baseline files are missing.", result.missingFiles);
   if (result.missingDiscovery.length > 0)
@@ -1940,8 +2324,8 @@ function printDoctor(ui2, result) {
   if (result.ok)
     ui2.ok(ui2.lore.stable);
   printProvenance(ui2, result.provenance);
-  printChecks(ui2, result.checks);
-  printWeakestLink(ui2, result.weakestLink);
+  printChecks(ui2, result.checks, result.youAreHere);
+  printYouAreHere(ui2, result.youAreHere);
   return result.ok ? 0 : 1;
 }
 
@@ -1950,54 +2334,66 @@ function runDoctor(root, version = VERSION) {
   const manifest = readManifest(root);
   if (manifest == null)
     return null;
-  const evidence = gatherEvidence(root, manifest);
-  const baseline = baselineVerdict(root, manifest);
-  const problems = harnessProblems(root, manifest, evidence.harness);
-  const checks = [
-    lintPolicyCheck(evidence),
-    constructTestsCheck(evidence),
-    ciCheck(evidence),
-    hookCheck(evidence),
-    redGateCheck(evidence)
-  ];
+  const readings = new FileReadings(root);
+  const harness = readHarnessFacts(root, manifest.harness.command, readings);
+  const baseline = baselineVerdict(root, manifest, readings);
+  const problems = harnessProblems(root, manifest, harness, readings);
+  const markers = missingDiscovery(root, manifest, readings);
+  const provenance = discoveryProvenance(root, manifest, readings);
+  const uncollected = uncollectedTests(root, manifest, readings);
+  const knowledge = projectKnowledge(readModel(root), root);
+  const unreadableFiles = readings.files;
+  const intact = {
+    missingFiles: baseline.missingFiles,
+    modifiedFiles: baseline.modifiedFiles,
+    unreadableFiles,
+    missingDiscovery: markers,
+    provenance,
+    harnessProblems: problems,
+    uncollectedTests: uncollected,
+    warnings: typecheckWarnings(manifest.preset, harness),
+    versionGap: versionGap(root, manifest, version)
+  };
   return {
-    ok: baseline.missingFiles.length === 0 && problems.length === 0,
+    ok: isIntact(intact),
     missingFiles: baseline.missingFiles,
     modifiedFiles: baseline.modifiedFiles,
-    missingDiscovery: missingDiscovery(root, manifest),
-    provenance: discoveryProvenance(root, manifest),
+    unreadableFiles,
+    missingDiscovery: markers,
+    provenance,
     harnessProblems: problems,
-    warnings: typecheckWarnings(manifest.preset, evidence),
-    checks,
-    weakestLink: weakestLink(checks),
+    uncollectedTests: uncollected,
+    warnings: typecheckWarnings(manifest.preset, harness),
+    checks: knowledge.checks,
+    youAreHere: knowledge.youAreHere,
     versionGap: versionGap(root, manifest, version)
   };
 }
 
 // src/commands/init.ts
 import { mkdirSync as mkdirSync2 } from "fs";
-import path21 from "path";
+import path20 from "path";
 
 // src/detect/index.ts
-import { existsSync as existsSync17 } from "fs";
-import path19 from "path";
+import { existsSync as existsSync16 } from "fs";
+import path18 from "path";
 import process3 from "process";
 
 // src/detect/layout.ts
-import { existsSync as existsSync15, readdirSync as readdirSync7, readFileSync as readFileSync15, statSync as statSync4 } from "fs";
-import path17 from "path";
+import { existsSync as existsSync14, readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
+import path16 from "path";
 
 // src/detect/workspaces.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
-import path16 from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
+import path15 from "path";
 var TOP_LEVEL_PACKAGES_KEY = /^packages:(.*)$/m;
 var EMPTY_FLOW_SEQUENCE = /^\[\s*\]$/;
 var BLOCK_SEQUENCE_ENTRY = /^[ \t]+-[ \t]*\S/;
 function readIfPresent(file) {
-  if (!existsSync14(file))
+  if (!existsSync13(file))
     return null;
   try {
-    return readFileSync14(file, "utf8");
+    return readFileSync10(file, "utf8");
   } catch {
     return null;
   }
@@ -2011,7 +2407,7 @@ function startsBlockSequence(rest) {
   return false;
 }
 function declaresPnpmPackages(dir) {
-  const content = readIfPresent(path16.join(dir, "pnpm-workspace.yaml"));
+  const content = readIfPresent(path15.join(dir, "pnpm-workspace.yaml"));
   if (content == null)
     return false;
   const match = TOP_LEVEL_PACKAGES_KEY.exec(content);
@@ -2025,7 +2421,7 @@ function declaresPnpmPackages(dir) {
   return startsBlockSequence(content.slice(match.index + match[0].length));
 }
 function declaresNpmWorkspaces(dir) {
-  const content = readIfPresent(path16.join(dir, "package.json"));
+  const content = readIfPresent(path15.join(dir, "package.json"));
   if (content == null)
     return false;
   let workspaces;
@@ -2043,9 +2439,9 @@ function declaresNpmWorkspaces(dir) {
 // src/detect/layout.ts
 var IGNORED_ENTRIES = /* @__PURE__ */ new Set([".git", ".DS_Store", ".gitignore", ".gitattributes", "LICENSE", "README.md", ".idea", ".vscode"]);
 function isEmptyDir(dir) {
-  if (!existsSync15(dir))
+  if (!existsSync14(dir))
     return true;
-  return readdirSync7(dir).every((entry) => IGNORED_ENTRIES.has(entry));
+  return readdirSync5(dir).every((entry) => IGNORED_ENTRIES.has(entry));
 }
 function detectMonorepoTools(dir) {
   const tools = [];
@@ -2053,40 +2449,40 @@ function detectMonorepoTools(dir) {
     tools.push("pnpm-workspace");
   if (declaresNpmWorkspaces(dir))
     tools.push("npm-workspaces");
-  if (existsSync15(path17.join(dir, "turbo.json")))
+  if (existsSync14(path16.join(dir, "turbo.json")))
     tools.push("turbo");
-  if (existsSync15(path17.join(dir, "nx.json")))
+  if (existsSync14(path16.join(dir, "nx.json")))
     tools.push("nx");
   return tools;
 }
 function detectWorkspaceDirs(dir) {
-  return ["apps", "packages", "libs", "services"].filter((name) => existsSync15(path17.join(dir, name)) && statSync4(path17.join(dir, name)).isDirectory());
+  return ["apps", "packages", "libs", "services"].filter((name) => existsSync14(path16.join(dir, name)) && statSync3(path16.join(dir, name)).isDirectory());
 }
 function packageName(dir) {
   try {
-    const parsed = JSON.parse(readFileSync15(path17.join(dir, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync11(path16.join(dir, "package.json"), "utf8"));
     return typeof parsed.name === "string" && parsed.name !== "" ? parsed.name : null;
   } catch {
     return null;
   }
 }
 function detectWorkspacePackages(root, workspaceDirs) {
-  return workspaceDirs.flatMap((parent) => readdirSync7(path17.join(root, parent)).sort().map((entry) => `${parent}/${entry}`).filter((dir) => existsSync15(path17.join(root, dir, "package.json"))).map((dir) => ({ dir, name: packageName(path17.join(root, dir)) ?? dir.split("/").at(-1) ?? dir })));
+  return workspaceDirs.flatMap((parent) => readdirSync5(path16.join(root, parent)).sort().map((entry) => `${parent}/${entry}`).filter((dir) => existsSync14(path16.join(root, dir, "package.json"))).map((dir) => ({ dir, name: packageName(path16.join(root, dir)) ?? dir.split("/").at(-1) ?? dir })));
 }
 function detectLayout(dir, monorepoTools, workspaceDirs, hasSrc) {
   if (isEmptyDir(dir))
     return "empty";
   if (monorepoTools.length > 0 || workspaceDirs.length > 0)
     return "monorepo";
-  if (hasSrc || existsSync15(path17.join(dir, "package.json")))
+  if (hasSrc || existsSync14(path16.join(dir, "package.json")))
     return "single";
   return "unknown";
 }
 
 // src/detect/package-manager.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync16 } from "fs";
-import path18 from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
+import path17 from "path";
 var LOCKFILES = [
   ["pnpm-lock.yaml", "pnpm"],
   ["bun.lockb", "bun"],
@@ -2095,11 +2491,11 @@ var LOCKFILES = [
   ["package-lock.json", "npm"]
 ];
 function fromPackageManagerField(dir) {
-  const manifest = path18.join(dir, "package.json");
-  if (!existsSync16(manifest))
+  const manifest = path17.join(dir, "package.json");
+  if (!existsSync15(manifest))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync16(manifest, "utf8"));
+    const parsed = JSON.parse(readFileSync12(manifest, "utf8"));
     const name = parsed.packageManager?.split("@")[0];
     return name === "pnpm" || name === "npm" || name === "yarn" || name === "bun" ? name : null;
   } catch {
@@ -2111,10 +2507,10 @@ function detectPackageManager(dir) {
   if (declared != null)
     return declared;
   for (const [lockfile, manager] of LOCKFILES) {
-    if (existsSync16(path18.join(dir, lockfile)))
+    if (existsSync15(path17.join(dir, lockfile)))
       return manager;
   }
-  return existsSync16(path18.join(dir, "package.json")) ? "npm" : "none";
+  return existsSync15(path17.join(dir, "package.json")) ? "npm" : "none";
 }
 var pnpmVersionCache;
 function detectPnpmVersion() {
@@ -2130,10 +2526,10 @@ function detectPnpmVersion() {
 
 // src/detect/index.ts
 function detect(dir) {
-  const root = path19.resolve(dir);
+  const root = path18.resolve(dir);
   const monorepoTools = detectMonorepoTools(root);
   const workspaceDirs = detectWorkspaceDirs(root);
-  const hasSrc = existsSync17(path19.join(root, "src"));
+  const hasSrc = existsSync16(path18.join(root, "src"));
   return {
     dir: root,
     packageManager: detectPackageManager(root),
@@ -2149,23 +2545,23 @@ function detect(dir) {
 }
 
 // src/materialize/apply.ts
-import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
-import path20 from "path";
+import { mkdirSync, writeFileSync as writeFileSync3 } from "fs";
+import path19 from "path";
 function applyPlan(root, ops) {
   const written = [];
   for (const op of ops) {
     if (op.action === "skip")
       continue;
-    const absolute = path20.join(root, op.target);
-    mkdirSync(path20.dirname(absolute), { recursive: true });
-    writeFileSync2(absolute, op.content);
+    const absolute = path19.join(root, op.target);
+    mkdirSync(path19.dirname(absolute), { recursive: true });
+    writeFileSync3(absolute, op.content);
     written.push(op);
   }
   return written;
 }
 
 // src/ui/prompts.ts
-import { cancel, confirm, isCancel, multiselect, select, text } from "@clack/prompts";
+import { cancel, confirm, isCancel, multiselect, select, text as text2 } from "@clack/prompts";
 var PROJECT_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 function isValidProjectName(value) {
   return PROJECT_NAME_PATTERN.test(value);
@@ -2216,7 +2612,7 @@ function createClackPrompter(lore, streams = {}) {
       return selected == null ? void 0 : toAiTarget(selected);
     },
     async projectName(initial) {
-      const answer = await text({
+      const answer = await text2({
         ...streams,
         message: lore.askName,
         initialValue: initial,
@@ -2331,7 +2727,7 @@ async function askChoices(ui2, options, report, root, prompter) {
   return { presetId, ai, projectName, review };
 }
 async function runInit(ui2, options, prompter) {
-  const root = path21.resolve(options.dir);
+  const root = path20.resolve(options.dir);
   mkdirSync2(root, { recursive: true });
   if (!options.yes && prompter == null) {
     ui2.glitch(ui2.lore.needsTerminal);
@@ -2407,10 +2803,19 @@ async function runInit(ui2, options, prompter) {
   }
   if (interactive != null && await interactive.confirm(ui2.lore.confirm) !== true)
     return aborted(skipped, plan.conflicts);
+  const existingModel = readModel(root);
   const written = applyPlan(root, plan.ops);
   const previous = readManifest(root);
   const manifest = buildManifest({ version: VERSION, preset: presetId, ai, review, vars, written, contracts: preset.contracts, previous });
   writeManifest(root, manifest);
+  const samples = sampleGroups(preset);
+  const sample = samples.length > 0 && samples.every((group) => !plan.omittedGroups.includes(group));
+  const merged = mergeModel(existingModel, buildModel({ vars, contracts: preset.contracts, sample }));
+  writeModel(root, merged.model);
+  if (merged.retained.length > 0) {
+    const standingOn = [...new Set(merged.retained.flatMap((fact) => fact.stoodOnBy))];
+    ui2.line(ui2.theme.dim(`  ${ui2.lore.recordFactsRetained(merged.retained.map((fact) => fact.id), standingOn)}`));
+  }
   if (previous != null) {
     const carriedOver = Object.keys(previous.files).filter((target) => !written.some((op) => op.target === target)).length;
     const added = written.filter((op) => previous.files[op.target] == null).length;
@@ -2501,8 +2906,8 @@ function printPaths(ui2, report) {
   }
 }
 function printMergedNote(ui2, report) {
-  const listed = report.classifications.filter((entry) => LISTED_CLASSES.includes(entry.class));
-  if (!listed.some((entry) => entry.strategy === "merge-json"))
+  const listed2 = report.classifications.filter((entry) => LISTED_CLASSES.includes(entry.class));
+  if (!listed2.some((entry) => entry.strategy === "merge-json"))
     return;
   ui2.line();
   ui2.line(ui2.theme.dim(ui2.lore.syncMergedNotWritten));
@@ -2631,6 +3036,9 @@ var BANNER = String.raw`
   ██║╚██╔╝██║██║██╔═██╗ ██║   ██║╚════██║██╔══██║██║
   ██║ ╚═╝ ██║██║██║  ██╗╚██████╔╝███████║██║  ██║██║
   ╚═╝     ╚═╝╚═╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝`;
+function andMore(rest) {
+  return rest.length === 0 ? "" : `, and ${rest.length} more ${rest.length === 1 ? "fact" : "facts"}`;
+}
 var LORE = {
   subtitle: (version) => `--- CONSTRUCT ENGINE v${version} // ARASAKA SUB-NET ---`,
   johnnyWakeUp: "Wake up, Netrunner. We have a repository to build.",
@@ -2666,15 +3074,21 @@ var LORE = {
   baselineGapUnknown: "What a sync would add or update cannot be established from this manifest: run `construct sync`.",
   enforcement: "ENFORCEMENT TRACE",
   typecheckCaveat: "Typecheck cannot carry this stack alone.",
-  weakestLink: (id, level) => `WEAKEST LINK: ${id} at ${level}`,
-  levelLift: {
-    L0: "wire it to a hook or a workflow step and it climbs",
-    L1: "only a reviewer stands behind it; a hook or a workflow step raises it",
-    L2: "a hook is bypassable with --no-verify; running it in CI too raises it",
-    L3: "L3 is the ceiling doctor can read: branch protection is what makes it blocking, and that lives in the API",
-    L4: "nothing above this"
-  },
-  weakestLinkNone: "WEAKEST LINK: nothing is claimed",
+  uncollectedTests: "TESTS THE RECORD CARRIES AND THE RUNNER NEVER COLLECTS.",
+  unreadableFiles: "FILES THE RECORD NAMES AND THIS PROBE COULD NOT OPEN: they are neither missing nor modified, and nothing is said about them.",
+  executesNothing: "NOTHING HERE IS EXECUTED: doctor reads files and runs nothing from the repository it inspects, so it does not speak about whether the harness passes.",
+  verdictHeld: (mechanism) => mechanism,
+  verdictUnsupported: (mechanism, doesNotHold) => `EXPECTS ${mechanism} \u2014 no longer matching: ${doesNotHold.join(", ")}`,
+  verdictUnevaluable: (mechanism, unevaluable) => `EXPECTS ${mechanism} \u2014 could not be read here, so nothing is said about it: ${unevaluable.join(", ")}`,
+  verdictNothingNamed: (mechanism) => `EXPECTS ${mechanism} \u2014 no fact is named under it, so nothing was read`,
+  enforcementNoModel: "THERE IS NO construct.model.json HERE: nothing was read, so nothing is known about what this repository claims \u2014 which is not a reading that nothing is enforced.",
+  enforcementNoClaim: "construct.model.json NAMES NO CLAIM: it was read and it asserts nothing about this repository \u2014 which is not a reading that nothing is enforced.",
+  youAreHereUnsupported: (claimId, stage, [first, ...rest]) => `YOU ARE HERE: ${claimId} \u2014 ${stage} unsupported: ${first} no longer matches${andMore(rest)}`,
+  youAreHereUnevaluable: (claimId, stage, [first, ...rest]) => `YOU ARE HERE: ${claimId} \u2014 ${stage} unknown: ${first} could not be read${andMore(rest)}, so nothing is said about it`,
+  youAreHereNothingNamed: (claimId, stage) => `YOU ARE HERE: ${claimId} \u2014 ${stage} unknown: no fact is named under it, so nothing was read`,
+  youAreHereNone: "YOU ARE HERE: no claim stops before the end of its chain",
+  youAreHereNoClaim: "YOU ARE HERE: construct.model.json carries no claim, so there is none to place",
+  youAreHereNoModel: "YOU ARE HERE: nowhere to place you \u2014 there is no construct.model.json, so nothing is known about claims",
   wireHarness: "Existing configs were kept, so the harness is not wired in yet. /construct-discover does this first; by hand:",
   wireHarnessSteps: [
     "eslint: ignore scripts/construct/*.workflow.mjs (the ladder script uses top-level return)",
@@ -2720,7 +3134,8 @@ var LORE = {
   syncVersionGap: (from, to) => `ENGRAM CUT BY v${from} // REPLAYED BY v${to}`,
   syncNoManifest: "No construct.json here. Run `construct init` first.",
   recordCarriedOver: (carried, added) => `ENGRAM EXTENDED: ${carried} record${carried === 1 ? "" : "s"} carried over from the construct.json already here, ${added} added.`,
-  recordVarsChanged: (changed) => `ENGRAM REWRITTEN: this run changed ${changed.map((entry) => `${entry.name} (${entry.from} \u2192 ${entry.to})`).join(", ")} in the record; the recorded hashes were taken with the old value${changed.length === 1 ? "" : "s"}.`
+  recordVarsChanged: (changed) => `ENGRAM REWRITTEN: this run changed ${changed.map((entry) => `${entry.name} (${entry.from} \u2192 ${entry.to})`).join(", ")} in the record; the recorded hashes were taken with the old value${changed.length === 1 ? "" : "s"}.`,
+  recordFactsRetained: (facts, entries) => `ENGRAM HELD: ${facts.length} construct-authored fact${facts.length === 1 ? "" : "s"} this preset no longer makes ${facts.length === 1 ? "was" : "were"} kept, because ${entries.join(", ")} still ${entries.length === 1 ? "stands" : "stand"} on ${facts.length === 1 ? "it" : "them"}.`
 };
 var PLAIN_LORE = {
   subtitle: (version) => `mikoshi-construct v${version}`,
@@ -2757,15 +3172,21 @@ var PLAIN_LORE = {
   baselineGapUnknown: "What a sync would add or update cannot be established from this manifest: run `construct sync`.",
   enforcement: "Enforcement",
   typecheckCaveat: "Typecheck cannot carry this stack alone.",
-  weakestLink: (id, level) => `Weakest link: ${id} at ${level}`,
-  levelLift: {
-    L0: "wire it to a hook or a workflow step and it climbs",
-    L1: "only a reviewer stands behind it; a hook or a workflow step raises it",
-    L2: "a hook is bypassable with --no-verify; running it in CI too raises it",
-    L3: "L3 is the ceiling doctor can read: branch protection is what makes it blocking, and that lives in the API",
-    L4: "nothing above this"
-  },
-  weakestLinkNone: "Weakest link: nothing is claimed",
+  uncollectedTests: "Tests the record carries and the runner does not collect.",
+  unreadableFiles: "Files the record names that could not be read: they are neither missing nor modified, and nothing is said about them.",
+  executesNothing: "doctor executes nothing from the repository it inspects, so it does not speak about whether the harness passes.",
+  verdictHeld: (mechanism) => mechanism,
+  verdictUnsupported: (mechanism, doesNotHold) => `expects ${mechanism} \u2014 no longer matching: ${doesNotHold.join(", ")}`,
+  verdictUnevaluable: (mechanism, unevaluable) => `expects ${mechanism} \u2014 could not be read here, so nothing is said about it: ${unevaluable.join(", ")}`,
+  verdictNothingNamed: (mechanism) => `expects ${mechanism} \u2014 no fact is named under it, so nothing was read`,
+  enforcementNoModel: "There is no construct.model.json here: nothing was read, so nothing is known about what this repository claims \u2014 which is not a reading that nothing is enforced.",
+  enforcementNoClaim: "construct.model.json names no claim: it was read and it asserts nothing about this repository \u2014 which is not a reading that nothing is enforced.",
+  youAreHereUnsupported: (claimId, stage, [first, ...rest]) => `You are here: ${claimId} \u2014 ${stage} unsupported: ${first} no longer matches${andMore(rest)}`,
+  youAreHereUnevaluable: (claimId, stage, [first, ...rest]) => `You are here: ${claimId} \u2014 ${stage} unknown: ${first} could not be read${andMore(rest)}, so nothing is said about it`,
+  youAreHereNothingNamed: (claimId, stage) => `You are here: ${claimId} \u2014 ${stage} unknown: no fact is named under it, so nothing was read`,
+  youAreHereNone: "You are here: no claim stops before the end of its chain",
+  youAreHereNoClaim: "You are here: construct.model.json carries no claim, so there is none to place",
+  youAreHereNoModel: "You are here: nowhere to place you \u2014 there is no construct.model.json, so nothing is known about claims",
   wireHarness: "Existing configs were kept, so the harness is not wired in yet. /construct-discover does this first; by hand:",
   wireHarnessSteps: [
     "eslint: ignore scripts/construct/*.workflow.mjs (the ladder script uses top-level return)",
@@ -2811,18 +3232,19 @@ var PLAIN_LORE = {
   syncVersionGap: (from, to) => `Materialized by construct ${from}, read by ${to}.`,
   syncNoManifest: "No construct.json here. Run `construct init` first.",
   recordCarriedOver: (carried, added) => `Carried over ${carried} record${carried === 1 ? "" : "s"} from the construct.json already here; added ${added}.`,
-  recordVarsChanged: (changed) => `This run changed ${changed.map((entry) => `${entry.name} (${entry.from} -> ${entry.to})`).join(", ")} in the record; the recorded hashes were taken with the old value${changed.length === 1 ? "" : "s"}.`
+  recordVarsChanged: (changed) => `This run changed ${changed.map((entry) => `${entry.name} (${entry.from} -> ${entry.to})`).join(", ")} in the record; the recorded hashes were taken with the old value${changed.length === 1 ? "" : "s"}.`,
+  recordFactsRetained: (facts, entries) => `Kept ${facts.length} construct-authored fact${facts.length === 1 ? "" : "s"} this preset no longer makes, because ${entries.join(", ")} still ${entries.length === 1 ? "stands" : "stand"} on ${facts.length === 1 ? "it" : "them"}.`
 };
 
 // src/ui/console.ts
-var stdoutWriter = (text2) => {
-  process4.stdout.write(text2);
+var stdoutWriter = (text3) => {
+  process4.stdout.write(text3);
 };
 function createUi(theme, write = stdoutWriter) {
   const plain = theme.name === "plain";
   const lore = plain ? PLAIN_LORE : LORE;
-  const out = (text2 = "") => {
-    write(`${text2}
+  const out = (text3 = "") => {
+    write(`${text3}
 `);
   };
   const icon = (glyph, fallback) => plain ? fallback : glyph;
@@ -2860,16 +3282,16 @@ function createUi(theme, write = stdoutWriter) {
       });
     },
     line: out,
-    ok(text2) {
-      out(`${icon("\u2705", "[ok]")} ${theme.ok(theme.bold(text2))}`);
+    ok(text3) {
+      out(`${icon("\u2705", "[ok]")} ${theme.ok(theme.bold(text3))}`);
     },
-    glitch(text2, details = []) {
-      out(`${icon("\u26A0", "[warn]")} ${theme.warn(`${lore.glitch}:`)} ${text2}`);
+    glitch(text3, details = []) {
+      out(`${icon("\u26A0", "[warn]")} ${theme.warn(`${lore.glitch}:`)} ${text3}`);
       for (const detail of details)
         out(`    ${theme.dim(detail)}`);
     },
-    flatline(text2) {
-      out(`${icon("\u2620", "[error]")} ${theme.fail(`${lore.flatlined}:`)} ${text2}`);
+    flatline(text3) {
+      out(`${icon("\u2620", "[error]")} ${theme.fail(`${lore.flatlined}:`)} ${text3}`);
     }
   };
 }
@@ -2878,9 +3300,9 @@ function createUi(theme, write = stdoutWriter) {
 import process5 from "process";
 import pc from "picocolors";
 function rgb(r, g, b) {
-  return (text2) => `\x1B[38;2;${r};${g};${b}m${text2}\x1B[39m`;
+  return (text3) => `\x1B[38;2;${r};${g};${b}m${text3}\x1B[39m`;
 }
-var identity = (text2) => text2;
+var identity = (text3) => text3;
 function supportsColor() {
   if (process5.env.NO_COLOR != null && process5.env.NO_COLOR !== "")
     return false;
@@ -2913,7 +3335,7 @@ function arasaka() {
     dim: pc.dim,
     ok: tc ? rgb(0, 255, 159) : pc.green,
     warn: pc.yellow,
-    fail: (text2) => pc.bold(pc.red(text2)),
+    fail: (text3) => pc.bold(pc.red(text3)),
     bold: pc.bold
   };
 }
@@ -3013,7 +3435,7 @@ var cost = defineCommand({
     json: { type: "boolean", description: "Machine-readable report", default: false }
   },
   run({ args }) {
-    const report = costReport(path22.resolve(args.dir));
+    const report = costReport(path21.resolve(args.dir));
     if (args.json) {
       process6.stdout.write(`${JSON.stringify(costJson(report, args.last), null, 2)}
 `);